fix(javascript): align module lookup and source evidence

Preserve CommonJS literal paths and confined ESM URL semantics, including package main fallback, directory intent, Unicode identity, and present opaque modules. Parse extraction inputs at their AST/source owner, retain skipped HTML and source-map coverage, and distinguish endpoint candidates from proven receiver facts. Version structural fingerprints with computed literal contents and propagate them through worker contracts.

Reviewed fixes include #1810, #1840, #2642, #2700, #2702, #2714, #2803, #2960, #2968, #2986, #3035, and #3036.

Validation: 158 resolver tests passed; public CLI/MCP module lookup controls, package-main/Unicode workflows, and six builtin workflows passed in the current compiled lane. Worker schema/fingerprint regressions passed. Large public pdf.js completion and real Electron analysis remain unverified.

src/application/javascript/JavaScriptArtifactGraphContext.ts

@@ -4,11 +4,17 @@ import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
 import {
   completeApplicationCoverage,
   partialApplicationCoverage,
+  truncatedApplicationCoverage,
   type ApplicationGraphEvidence,
 } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import type { ApplicationNode } from "../../domain/javascript/javascriptApplicationGraphSchemas.js";
 import type { JavaScriptSourceRange } from "../../domain/javascript/javascriptStaticAnalysisTypes.js";
-import type { JavaScriptModuleArtifactAnalysis } from "./JavaScriptArtifactAnalysisTypes.js";
+import type {
+  JavaScriptHtmlInlineScriptsObservation,
+  JavaScriptModuleArtifactAnalysis,
+} from "./JavaScriptArtifactAnalysisTypes.js";
+import type { JavaScriptUnanalyzedArtifactLookup } from "../../domain/javascript/javascriptArtifactFiles.js";
+import { HTML_INLINE_SCRIPT_LOCATION_LIMIT } from "../../domain/javascript/htmlArtifactReferences.js";
 import type {
   JavaScriptArtifactFile,
   JavaScriptArtifactFileSet,
@@ -33,8 +39,11 @@ export interface JavaScriptArtifactGraphContext {
   readonly snapshot: ArtifactInventorySnapshot;
   readonly fileSet: JavaScriptArtifactFileSet;
   readonly analysis: JavaScriptModuleArtifactAnalysis;
+  readonly directoryPaths: ReadonlySet<string>;
   readonly root: ApplicationNode;
   readonly filesByPath: ReadonlyMap<string, JavaScriptArtifactFile>;
+  /** Borrowed inventory lookup for present files outside the source projection. */
+  readonly unanalyzedFiles: JavaScriptUnanalyzedArtifactLookup | undefined;
   readonly fileNodes: Map<string, ApplicationNode>;
   readonly assetNodes: Map<string, ApplicationNode>;
   readonly sourceModuleNodes: Map<string, ApplicationNode>;
@@ -104,8 +113,29 @@ export interface UnavailableParseInput {
   readonly limitation: string;
   readonly failure?: JsonValue;
   readonly limits?: JavaScriptArtifactGraphCoverage["limits"];
+  /** Items a named limit dropped from this gap's own record, when known. */
+  readonly omittedCount?: number;
+  /** Structured details of the gap, such as the exact omitted locations. */
+  readonly details?: Readonly<Record<string, JsonValue>>;
 }
 
+/** The per-file bound on retained inline HTML script locations. */
+export const HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT = {
+  name: "html_inline_script_locations_per_file",
+  value: HTML_INLINE_SCRIPT_LOCATION_LIMIT,
+  unit: "items",
+} as const;
+
+/** Count inline HTML script locations dropped by the per-file bound. */
+export const omittedHtmlInlineScriptLocations = (
+  files: readonly JavaScriptHtmlInlineScriptsObservation[],
+): number =>
+  files.reduce(
+    (omitted, { script_count, scripts }) =>
+      omitted + script_count - scripts.length,
+    0,
+  );
+
 /** Add a direct artifact-containment edge. */
 export const addArtifactContainsEdge = (
   context: JavaScriptArtifactGraphContext,
@@ -187,6 +217,8 @@ export const addUnavailableStaticParseScope = (
       {
         label: `${input.file.path} parse scope`,
         properties: {
+          // Details come first so they cannot replace the gap's own fields.
+          ...input.details,
           path: input.file.path,
           operation: input.operation,
           limitation: input.limitation,
@@ -198,7 +230,13 @@ export const addUnavailableStaticParseScope = (
           sha256: input.file.sha256,
           path: input.file.path,
           operation: input.operation,
-          coverage: partialApplicationCoverage(input.limits ?? [], null),
+          coverage:
+            input.omittedCount !== undefined && input.omittedCount > 0
+              ? truncatedApplicationCoverage(
+                  input.limits ?? [],
+                  input.omittedCount,
+                )
+              : partialApplicationCoverage(input.limits ?? [], null),
           limitation: input.limitation,
         }),
       },
@@ -269,12 +307,12 @@ export const createElectronRoleNode = (
       {
         label: input.resolution.resolved_path ?? input.resolution.declared_path,
         properties: {
+          ...artifactPathResolutionProperties(input.resolution),
           declared_path: input.resolution.declared_path,
           resolution_context: input.resolution.resolution_context,
           resolved_path: input.resolution.resolved_path,
           resolution_status: input.resolution.resolution_status,
           limitations: input.resolution.limitations,
-          ...artifactPathResolutionProperties(input.resolution),
           mechanism: input.mechanism,
         },
         evidence: staticInferenceEvidence({
@@ -354,12 +392,14 @@ export const resolveArtifactPath = (
   sourcePath: string,
   files: ReadonlyMap<string, JavaScriptArtifactFile>,
   moduleKind?: "import" | "require" | "compiler-dependent",
+  directoryPaths?: ReadonlySet<string>,
 ): string | null =>
   resolveArtifactPathByContext({
     declaredPath: specifier,
     sourcePath,
     context: "module-specifier",
     files,
+    ...(directoryPaths === undefined ? {} : { directoryPaths }),
     ...(moduleKind === undefined ? {} : { moduleKind }),
   }).resolved_path;