fix(javascript): preserve CommonJS lookup and analysis provenance (#2306)

* fix(javascript): preserve CommonJS directory and ancestor lookup

* test(apple): bound cold archive fixture compilation

* test(release): scope preflight schema to selected jobs

* fix(javascript): retain requested analysis limits in Evidence

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

src/application/javascript/JavaScriptArtifactPathResolution.ts

@@ -457,9 +457,8 @@ const bareModuleCandidate = (
     dependencyDirectory = posix.dirname(confined);
   }
   const source = input.files.get(input.sourcePath);
-  let directory = posix.dirname(input.sourcePath);
   let nearestNotFound: CandidateResolution | null = null;
-  while (true) {
+  for (const directory of packageLookupDirectories(input)) {
     const candidate = posix.join(directory, dependencyDirectory);
     const metadata = readPackageMetadata(input, candidate);
     const continueCommonJsLookup =
@@ -487,8 +486,6 @@ const bareModuleCandidate = (
         nearestNotFound ??= packageResolution;
       } else return packageResolution;
     }
-    if (directory === "." || directory === "") break;
-    directory = posix.dirname(directory);
   }
   if (nearestNotFound !== null) return nearestNotFound;
   return unresolvedCandidate("external", [
@@ -496,6 +493,21 @@ const bareModuleCandidate = (
   ]);
 };
 
+function* packageLookupDirectories(
+  input: ResolveArtifactPathInput,
+): Generator<string> {
+  let directory = posix.dirname(input.sourcePath);
+  while (true) {
+    if (
+      input.moduleKind !== "require" ||
+      posix.basename(directory) !== "node_modules"
+    )
+      yield directory;
+    if (directory === "." || directory === "") return;
+    directory = posix.dirname(directory);
+  }
+}
+
 /**
  * Nearest same-container package.json, stopping at a `node_modules` directory
  * so a nested package cannot inherit an ancestor's map.
@@ -960,15 +972,29 @@ const resolveCandidate = (
   candidate: string,
   packageChain: ReadonlySet<string>,
   emittedSourceCandidates: readonly TypeScriptEmittedSourceCandidate[] = [],
-): CandidateResolution =>
-  resolveFileCandidates(input, fileCandidates(candidate, input.moduleKind)) ??
-  resolveRuntimeSourceCandidates(input, candidate, emittedSourceCandidates) ??
-  resolveDirectory(
+): CandidateResolution => {
+  if (!commonJsDirectoryRequest(input)) {
+    const file =
+      resolveFileCandidates(
+        input,
+        fileCandidates(candidate, input.moduleKind),
+      ) ??
+      resolveRuntimeSourceCandidates(input, candidate, emittedSourceCandidates);
+    if (file !== null) return file;
+  }
+  return resolveDirectory(
     input,
     candidate,
     readPackageMetadata(input, candidate),
     packageChain,
   );
+};
+
+const commonJsDirectoryRequest = (input: ResolveArtifactPathInput): boolean =>
+  input.context === "module-specifier" &&
+  input.moduleKind === "require" &&
+  (input.declaredPath.endsWith("/") ||
+    /(?:^|\/)\.{1,2}$/u.test(input.declaredPath));
 
 const resolveDirectory = (
   input: ResolveArtifactPathInput,