fix(javascript): preserve runtime path bytes and Electron ownership (#4941)

* fix(javascript): preserve literal percent runtime paths

* fix(javascript): ignore resolve prefixes before the final anchor

* fix(electron): retain application roots for loadFile declarations

* fix(electron): resolve loadFile from enclosing application package

* fix(electron): retain outer application root across package scopes

* fix(electron): derive application ownership from inventoried packages

* fix(electron): retain resolved package entrypoint ownership

* fix(electron): preserve competing application ownership

* fix(electron): retain invalid and omitted runtime ownership

* fix(electron): preserve omitted module ownership and runtime paths

* fix(electron): preserve proven roots before confining page paths

* fix(electron): retain possible owners behind missing imports

* fix(electron): distinguish absent imports and owned page candidates

* fix(electron): keep unavailable JSON out of owner gaps

* fix(electron): retain exact loader formats and default entry status

* fix(electron): retain unavailable entrypoint ownership candidates

* test(ghidra): preserve Windows Node probe prerequisites

* test(ghidra): assert cancellation during profile shutdown

* fix(electron): separate examined imports from frontend ownership

* fix(electron): retain unavailable directory entrypoint owners

* test(jeb): retain Linux ownership prerequisite in isolation

* fix(javascript): retain unchecked loader ownership and literal main paths

* fix(javascript): preserve runtime paths and call-site module aliases

* fix(javascript): bound module alias traversal and preserve projections

* fix(javascript): retain host module and nested artifact path boundaries

* fix(javascript): preserve ESM and archive module loader provenance

* test(javascript): distinguish unmapped containers from missing exports

* fix: retain default module aliases and Electron builtin imports

* fix: preserve host file URL and inward ASAR ownership

* fix: preserve CommonJS file URL classification in CI fixtures

* fix: retain bound module loaders and Windows entrypoint uncertainty

* fix: retain ASAR uncertainty and invalidate changed Electron app roots

* fix(javascript): retain ownership uncertainty across loader boundaries

* fix(javascript): preserve loader sources and bound alias queries

* fix(javascript): retain destructured loader sources

* fix(javascript): preserve loader uncertainty at resolution boundaries

* fix(javascript): preserve callable and package launch ownership

* fix(javascript): preserve captured values across member reads

* test(process): assert tagged filesystem cancellation failures

* fix(javascript): preserve inventory bases and invocation read timing

* fix(javascript): preserve ownership across indirect and unread loads

* test(javascript): order fixture directory creation on Windows

* test(javascript): share ordered filesystem fixture writer

* fix(javascript): unify loader provenance and package validation

* fix(javascript): preserve captured Node require loader values

* fix(javascript): preserve loader invocation authority

* fix(javascript): verify generic loader invocation authority

* fix(javascript): preserve conditional loader method alternatives

* fix(javascript): require proven factories for source association

* fix(javascript): honor replaced Electron app path setters

* fix(javascript): prove path and assignment source ownership

* fix(javascript): retain native delegate eligibility through shared writes

* fix(process): settle stale baseline errors after confirmed absence

* fix(javascript): preserve assignment and path boundary evidence

* fix(javascript): prove source-directory resolve anchors

* fix: preserve application path provenance and portable schemas

* fix(javascript): retain CommonJS exported setter effects

* fix: isolate Linux identity observations and retain native module exports

* fix(javascript): preserve published app and helper provenance

* fix(javascript): normalize typed stores and native path fixtures

src/application/javascript/JavaScriptArtifactGraphStructure.ts

@@ -1,4 +1,5 @@
 import type { ArtifactInventorySnapshot } from "../../domain/artifactInventorySnapshot.js";
+import { isJsonModuleTarget } from "../../domain/javascript/javascriptModuleResolutionMode.js";
 import type { ApplicationNode } from "../../domain/javascript/javascriptApplicationGraphSchemas.js";
 import { htmlInlineScriptLimitation } from "./JavaScriptArtifactAnalysis.js";
 import {
@@ -18,6 +19,10 @@ import type { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGra
 import { isSkippedJavaScriptAnalysis } from "./JavaScriptArtifactAnalysisTypes.js";
 import {
   addArtifactContainsEdge,
+  applicationManifestPath,
+  applicationContainerIdentity,
+  addApplicationRootCandidate,
+  dependencyManifest,
   addUnavailableStaticParseScope,
   artifactFileNodeKind,
   artifactLocalIdentity,
@@ -36,8 +41,8 @@ import {
 import {
   artifactPathResolutionProperties,
   resolveArtifactPathByContext,
+  type ArtifactPathResolution,
 } from "./JavaScriptArtifactPathResolution.js";
-import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 
 interface PackageRoleInput {
   readonly packageNode: ApplicationNode;
@@ -480,6 +485,7 @@ export const addJavaScriptPackageNodes = (
             name: packageValue.name,
             version: packageValue.version,
             main: packageValue.main,
+            main_status: packageValue.main_status,
             renderer: packageValue.renderer,
             parse_status: packageValue.status,
           },
@@ -516,6 +522,24 @@ export const addJavaScriptPackageNodes = (
         operation: "inventory-package",
       });
     if (dependencyManifest(file.path)) continue;
+    if (
+      packageValue.status === "included" &&
+      packageValue.main_entrypoint === ""
+    ) {
+      registerPackageResolutionOwner(
+        context,
+        file,
+        resolveArtifactPathByContext({
+          declaredPath: packageValue.main_entrypoint,
+          sourcePath: file.path,
+          context: "package-entrypoint",
+          runtimePathKind: "node-entrypoint",
+          files: context.filesByPath,
+          directoryPaths: context.directoryPaths,
+          unanalyzedFiles: context.unanalyzedFiles,
+        }),
+      );
+    }
     addPackageRole(context, {
       packageNode: node,
       packageFile: file,
@@ -532,24 +556,6 @@ export const addJavaScriptPackageNodes = (
   return roots;
 };
 
-/** Dependency-only artifacts retain their inventory root. */
-const applicationManifestPath = (
-  context: JavaScriptArtifactGraphContext,
-): string | undefined =>
-  context.analysis.packages
-    .map(({ path }) => path)
-    .filter(
-      (path) => context.filesByPath.has(path) && !dependencyManifest(path),
-    )
-    .sort(
-      (left, right) =>
-        left.split("/").length - right.split("/").length ||
-        compareUnicodeCodePoints(left, right),
-    )[0];
-
-const dependencyManifest = (path: string): boolean =>
-  path.split("/").slice(0, -1).includes("node_modules");
-
 const createFileTarget = (
   context: JavaScriptArtifactGraphContext,
   file: JavaScriptArtifactFile,
@@ -645,10 +651,17 @@ const addPackageRole = (
     declaredPath: input.declaredPath,
     sourcePath: input.packageFile.path,
     context: "package-entrypoint",
+    // Launch main uses Node's filesystem lookup, independently of renderer
+    // metadata. Literal percent bytes are filename bytes at this boundary.
+    ...(input.kind === "electron-main"
+      ? { runtimePathKind: "node-entrypoint" as const }
+      : {}),
     files: context.filesByPath,
     directoryPaths: context.directoryPaths,
     unanalyzedFiles: context.unanalyzedFiles,
   });
+  if (input.kind === "electron-main")
+    registerPackageResolutionOwner(context, input.packageFile, resolution);
   const role = createElectronRoleNode(context, {
     kind: input.kind,
     anchor: input.packageFile,
@@ -685,6 +698,61 @@ const addPackageRole = (
   });
 };
 
+const registerPackageResolutionOwner = (
+  context: JavaScriptArtifactGraphContext,
+  packageFile: JavaScriptArtifactFile,
+  resolution: ArtifactPathResolution,
+): void => {
+  if (resolution.resolution_status === "resolved")
+    registerPackageEntrypointOwner(
+      context,
+      packageFile,
+      resolution.resolved_path,
+    );
+  else if (
+    resolution.resolution_status === "unavailable" &&
+    !(
+      resolution.candidate_path !== undefined &&
+      isJsonModuleTarget(
+        resolution.candidate_path,
+        context.unanalyzedFiles?.get(resolution.candidate_path)?.kind,
+      )
+    )
+  )
+    registerPossiblePackageOwner(context, packageFile);
+};
+
+const registerPackageEntrypointOwner = (
+  context: JavaScriptArtifactGraphContext,
+  packageFile: JavaScriptArtifactFile,
+  sourcePath: string,
+): void => {
+  const roots =
+    context.applicationRootsBySource.get(sourcePath) ?? new Set<string>();
+  addApplicationRootCandidate(roots, packageRoot(packageFile));
+  context.applicationRootsBySource.set(sourcePath, roots);
+  if (
+    !context.applicationModuleReferencesRetained.has(sourcePath) &&
+    !isJsonModuleTarget(sourcePath, context.filesByPath.get(sourcePath)?.kind)
+  )
+    registerPossiblePackageOwner(context, packageFile);
+};
+
+const packageRoot = (file: JavaScriptArtifactFile): string =>
+  file.path.slice(0, -"package.json".length).replace(/\/$/u, "");
+
+const registerPossiblePackageOwner = (
+  context: JavaScriptArtifactGraphContext,
+  file: JavaScriptArtifactFile,
+): void => {
+  const container = applicationContainerIdentity(context.fileSet, file);
+  const roots =
+    context.applicationPossibleRootsByContainer.get(container) ??
+    new Set<string>();
+  addApplicationRootCandidate(roots, packageRoot(file));
+  context.applicationPossibleRootsByContainer.set(container, roots);
+};
+
 const containerProperties = (container: JavaScriptArtifactContainer) => ({
   path: container.path,
   format: "asar",