rea-agents 4.1.0 → 6.0.0

package/dist/domain/{javascriptRuntimeReconciliationMatching.js → javascript/javascriptRuntimeReconciliationMatching.js}

@@ -1,6 +1,6 @@
 import { createJavaScriptApplicationEdge, } from "./javascriptApplicationGraph.js";
-import { canonicalDigest } from "./comparisonSemantics.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { canonicalDigest } from "../comparisonSemantics.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { mappedRuntimePaths, } from "./javascriptRuntimeStaticCandidates.js";
 /** Match runtime entities conservatively and emit only inferred observed_as edges. */
 export const reconcileRuntimeEntities = (input) => {

package/dist/domain/{javascriptRuntimeReconciliationParsing.js → javascript/javascriptRuntimeReconciliationParsing.js}

@@ -1,11 +1,11 @@
 import { z } from "zod";
-import { browserAllowedOriginsSchema, browserEndpointSchema, webPageInspectionSchema, } from "./browserObservation.js";
-import { classifyBrowserCompleteness, } from "./browserCompleteness.js";
+import { browserAllowedOriginsSchema, browserEndpointSchema, webPageInspectionSchema, } from "../browserObservation.js";
+import { classifyBrowserCompleteness, } from "../browserCompleteness.js";
 import { electronPageInspectionSchema, } from "./electronObservation.js";
 import { javascriptRuntimeObservationSchema, javascriptRuntimeKindSchema, } from "./javascriptRuntimeObservation.js";
-import { canonicalDigest } from "./comparisonSemantics.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
-import { parseEvidence } from "./evidence.js";
+import { canonicalDigest } from "../comparisonSemantics.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { parseEvidence } from "../evidence.js";
 import { javascriptApplicationAnalysisResultSchema, } from "./javascriptApplicationAnalysis.js";
 import {} from "./javascriptApplicationGraph.js";
 import { parseActiveElectronCapture } from "./javascriptRuntimeReconciliationActive.js";

package/dist/domain/{javascriptRuntimeReconciliationResult.js → javascript/javascriptRuntimeReconciliationResult.js}

@@ -1,6 +1,6 @@
 import {} from "./javascriptApplicationGraph.js";
-import { canonicalDigest } from "./comparisonSemantics.js";
-import { uniqueSorted } from "./canonicalOrdering.js";
+import { canonicalDigest } from "../comparisonSemantics.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
 import { javascriptRuntimeReconciliationResultSchema, } from "./javascriptRuntimeReconciliationSchemas.js";
 /** Build and verify the deterministic caller-visible reconciliation result. */
 export const createJavaScriptRuntimeReconciliationResult = (input) => {

package/dist/domain/{javascriptRuntimeReconciliationSchemas.js → javascript/javascriptRuntimeReconciliationSchemas.js}

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { compareCodePoints } from "./canonicalOrdering.js";
-import { evidenceSchema } from "./evidence.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { evidenceSchema } from "../evidence.js";
 import { javascriptRuntimeUnresolvedLocationSchema } from "./javascriptRuntimeObservation.js";
 import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const nodeIdSchema = prefixedDigestSchema("jag_node");
 const boundedTextSchema = z.string().min(1);

package/dist/domain/{javascriptRuntimeStaticCandidates.js → javascript/javascriptRuntimeStaticCandidates.js}

@@ -1,6 +1,6 @@
 import { posix, relative, win32 } from "node:path";
 import {} from "./javascriptApplicationGraph.js";
-import { compareCodePoints, uniqueSorted } from "./canonicalOrdering.js";
+import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
 /** Index statically reconstructed entities that can receive runtime matches. */
 export const collectStaticRuntimeCandidates = (layers) => layers
     .flatMap((layer) => candidatesForLayer(layer))

package/dist/domain/{javascriptSemanticAnalysis.js → javascript/javascriptSemanticAnalysis.js}

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
 import { failedJavaScriptSemanticIr, } from "./javascriptSemanticIr.js";
-import { collectSemanticModuleLink, collectSemanticCallable, collectSemanticReferences, immutableSemanticBindings, immutableSemanticScopes, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
+import { collectSemanticModuleLink, collectSemanticCallable, collectSemanticReferences, immutableSemanticBindings, immutableSemanticScopes, semanticStaticPropertyKey, } from "./javascriptSemanticProjection.js";
 import { currentSemanticScope, resolveSemanticBindingFromScope, semanticScopeId, semanticVariableScope, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
+import { collectSemanticMemberMutations } from "./javascriptSemanticMemberMutations.js";
 import { collectSemanticReturns, resolveSemanticModuleCallables, } from "./javascriptSemanticReturns.js";
 import { collectJavaScriptDerivedSemantics } from "./javascriptSemanticDerivedAnalysis.js";
 import { propertyName, range } from "./javascriptStaticAnalysisHelpers.js";
@@ -15,10 +16,17 @@ export const analyzeJavaScriptSemantics = (source) => {
         ? failedJavaScriptSemanticIr()
         : analyzeParsedJavaScriptSemantics(file);
 };
+/** Recover lexical references, optionally for one name, without evaluating values or provenance. */
+export const analyzeParsedJavaScriptReferences = (file, name) => {
+    const state = createState(file.program);
+    collectDefinitions(file.program, state);
+    return collectSemanticReferences(file.program, state, name);
+};
 /** Recover semantics from an already parsed JavaScript artifact. */
 export const analyzeParsedJavaScriptSemantics = (file) => {
     const state = createState(file.program);
     collectDefinitions(file.program, state);
+    collectSemanticMemberMutations(file.program, state);
     traverseJavaScriptAst(file.program, {
         enter: (node) => collectSemanticModuleLink(node, state),
     });
@@ -226,7 +234,8 @@ const nestedScope = (node, parent, parentScope, state) => {
         return undefined;
     const scope = {
         scopeId: semanticScopeId(kind, switchOwner ?? node),
-        parentScopeId: parentScope.scopeId,
+        parentScopeId: functionNameScope(node, parentScope, state)?.scopeId ??
+            parentScope.scopeId,
         kind,
         location: range(switchOwner ?? node),
         bindingsComplete: true,
@@ -236,6 +245,32 @@ const nestedScope = (node, parent, parentScope, state) => {
     state.scopesById.set(scope.scopeId, scope);
     return scope;
 };
+const functionNameScope = (node, parentScope, state) => {
+    if (!t.isFunctionExpression(node) || !t.isIdentifier(node.id))
+        return undefined;
+    // A named expression has a private name environment outside its parameters
+    // and body. Parameters and local declarations may shadow that name.
+    const scope = {
+        scopeId: `${semanticScopeId("block", node)}:function-name`,
+        parentScopeId: parentScope.scopeId,
+        kind: "block",
+        location: range(node),
+        bindingsComplete: true,
+        bindings: new Map(),
+    };
+    state.scopes.push(scope);
+    state.scopesById.set(scope.scopeId, scope);
+    addBinding({
+        state,
+        scope,
+        name: node.id.name,
+        kind: "function",
+        mutable: false,
+        definitionNode: node.id,
+        initializer: node,
+    });
+    return scope;
+};
 const scopeKind = (node, parent) => {
     if (t.isFunction(node))
         return "function";
@@ -280,16 +315,6 @@ const bindImports = (node, scope, state) => {
     }
 };
 const bindFunctionLocals = (node, scope, state) => {
-    if (t.isFunctionExpression(node) && t.isIdentifier(node.id))
-        addBinding({
-            state,
-            scope,
-            name: node.id.name,
-            kind: "function",
-            mutable: false,
-            definitionNode: node.id,
-            initializer: node,
-        });
     for (const parameter of node.params)
         bindPattern({
             pattern: t.isTSParameterProperty(parameter)
@@ -351,11 +376,11 @@ const bindPattern = (input) => {
                     projection: [],
                 });
             else {
-                const name = semanticStaticPropertyName(property.key, property.computed);
+                const name = semanticStaticPropertyKey(property.key, property.computed);
                 bindPattern({
                     ...input,
                     pattern: property.value,
-                    projection: [...projection, name === "" ? null : name],
+                    projection: [...projection, name],
                 });
             }
         }
@@ -392,6 +417,7 @@ const createBinding = (scope, name, kind, mutable) => ({
     name,
     kind,
     mutable,
+    mutatedPaths: [],
     definitions: [],
     initializers: [],
     directOrigins: [],

package/dist/domain/{javascriptSemanticAsyncEffects.js → javascript/javascriptSemanticAsyncEffects.js}

@@ -1,4 +1,5 @@
 import * as t from "@babel/types";
+import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js";
 import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
@@ -230,7 +231,7 @@ const timerMethodFromBinding = (binding) => {
     }
     return null;
 };
-const timerNamespaceBinding = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => timerModule(specifier) && importedPath.length === 0) ?? false;
+const timerNamespaceBinding = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => timerModule(specifier) && semanticBuiltinNamespacePath(importedPath)) ?? false;
 const timerModule = (specifier) => specifier === "timers" || specifier === "node:timers";
 const bindingId = (node, state) => t.isIdentifier(node)
     ? (resolveSemanticBindingState(state, node, node.name)?.bindingId ?? null)

package/dist/domain/{javascriptSemanticCallResolution.js → javascript/javascriptSemanticCallResolution.js}

@@ -1,5 +1,5 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
 import { range } from "./javascriptStaticAnalysisHelpers.js";
@@ -102,14 +102,19 @@ export const parameterBindings = (callable, index, state) => {
     return [...scope.bindings.values()]
         .filter((binding) => binding.kind === "parameter" &&
         binding.definitions.some(({ kind, location }) => kind === "parameter" &&
-            parameterIndex(callable, location, state) === index))
+            parameterAcceptsArgument(callable, location, index, state)))
         .sort((left, right) => compareCodePoints(left.bindingId, right.bindingId));
 };
-const parameterIndex = (callable, location, state) => {
+const parameterAcceptsArgument = (callable, location, argumentIndex, state) => {
     const node = state.callableNodesById.get(callable.callableId);
     if (!t.isFunction(node))
-        return -1;
-    return node.params.findIndex((parameter) => rangeContains(range(parameter), location));
+        return false;
+    const parameterIndex = node.params.findIndex((parameter) => rangeContains(range(parameter), location));
+    if (parameterIndex === argumentIndex)
+        return true;
+    return (parameterIndex >= 0 &&
+        parameterIndex < argumentIndex &&
+        t.isRestElement(node.params[parameterIndex]));
 };
 const rangeContains = (outer, inner) => (outer.start.line < inner.start.line ||
     (outer.start.line === inner.start.line &&

package/dist/domain/{javascriptSemanticCalls.js → javascript/javascriptSemanticCalls.js}

@@ -1,5 +1,5 @@
 import * as t from "@babel/types";
-import { semanticCallableIdForNode, semanticReferenceRole, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
+import { semanticCallableIdForNode, semanticReferenceRole, semanticStaticPropertyKey, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, isUnshadowedGlobal, } from "./javascriptSemanticState.js";
 import { parameterBindings, resolveLocalCallables, } from "./javascriptSemanticCallResolution.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
@@ -98,7 +98,7 @@ const collectCallSite = (node, parent, owner, context) => {
 };
 const collectCallResultFlow = (site, node, context) => {
     for (const assigned of assignedSemanticResultBindings(node, context.ancestors, context.state).filter(({ projectionPath }) => projectionPath.length === 0)) {
-        const binding = [...context.state.bindingsById.values()].find(({ bindingId }) => bindingId === assigned.bindingId);
+        const binding = context.state.bindingsById.get(assigned.bindingId);
         if (binding === undefined)
             continue;
         const identifierRange = range(assigned.identifier);
@@ -118,6 +118,9 @@ const collectCallResultFlow = (site, node, context) => {
 const retainedArguments = (nodes) => {
     const retained = [];
     for (const [index, node] of nodes.entries()) {
+        // Babel recovery can leave null slots; retain the other argument positions.
+        if (node === null)
+            continue;
         retained.push({
             index,
             location: range(node),
@@ -204,7 +207,7 @@ const collectCapture = (node, parent, owner, context) => {
 };
 const collectDynamicProperty = (node, owner, state, output) => {
     if ((t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) &&
-        semanticStaticPropertyName(node.property, node.computed) === "")
+        semanticStaticPropertyKey(node.property, node.computed) === null)
         addFrontier({
             kind: "dynamic-property",
             callableId: owner?.callableId ?? null,
@@ -213,7 +216,7 @@ const collectDynamicProperty = (node, owner, state, output) => {
         }, state, output);
     else if ((t.isObjectProperty(node) || t.isObjectMethod(node)) &&
         node.computed &&
-        semanticStaticPropertyName(node.key, true) === "")
+        semanticStaticPropertyKey(node.key, true) === null)
         addFrontier({
             kind: "dynamic-property",
             callableId: owner?.callableId ?? null,

package/dist/domain/{javascriptSemanticChildProcesses.js → javascript/javascriptSemanticChildProcesses.js}

@@ -1,7 +1,8 @@
 import * as t from "@babel/types";
+import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js";
 import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { range } from "./javascriptStaticAnalysisHelpers.js";
 import { dataEffectLiteralString, dataEffectMemberCallee, assignedSemanticResultBindings, scalarAssignedResultBinding, semanticProjectedBindingFacts, } from "./javascriptSemanticDataEffectHelpers.js";
@@ -174,7 +175,8 @@ const methodFromBinding = (binding) => {
     return null;
 };
 const admittedChildMethod = (value) => CHILD_PROCESS_METHODS.find((candidate) => candidate === value) ?? null;
-const childProcessNamespace = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => childProcessModule(specifier) && importedPath.length === 0) ?? false;
+const childProcessNamespace = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => childProcessModule(specifier) &&
+    semanticBuiltinNamespacePath(importedPath)) ?? false;
 const childProcessModule = (specifier) => specifier === "child_process" || specifier === "node:child_process";
 const resolveChildCandidates = (node, binding, spawnByNode, spawnsByBinding) => {
     const direct = spawnByNode.get(node);

package/dist/domain/{javascriptSemanticDataEffectHelpers.js → javascript/javascriptSemanticDataEffectHelpers.js}

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
+import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js";
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { semanticStaticPropertyKey, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Resolve bindings written by the nearest variable or assignment owner. */
 export const assignedSemanticResultBindings = (node, ancestors, state) => {
     for (let index = ancestors.length - 1; index >= 0; index -= 1) {
@@ -69,11 +70,10 @@ const projectedPatternBindings = (pattern, state) => {
                 else
                     visit(property.value, [
                         ...path,
-                        semanticStaticPropertyName(property.key, property.computed) ||
-                            null,
+                        semanticStaticPropertyKey(property.key, property.computed),
                     ], partial ||
-                        semanticStaticPropertyName(property.key, property.computed) ===
-                            "");
+                        semanticStaticPropertyKey(property.key, property.computed) ===
+                            null);
             }
         }
         else if (t.isArrayPattern(current)) {
@@ -102,7 +102,8 @@ export const builtinDataEffectMethod = (callee, state, specifiers) => {
     if (!t.isIdentifier(callee.object))
         return null;
     const binding = resolveSemanticBindingState(state, callee.object, callee.object.name);
-    const namespace = binding?.directOrigins.some(({ specifier, importedPath }) => specifiers.includes(specifier) && importedPath.length === 0);
+    const namespace = binding?.directOrigins.some(({ specifier, importedPath }) => specifiers.includes(specifier) &&
+        semanticBuiltinNamespacePath(importedPath));
     return namespace
         ? semanticStaticPropertyName(callee.property, callee.computed)
         : null;

package/dist/domain/{javascriptSemanticDataEffects.js → javascript/javascriptSemanticDataEffects.js}

@@ -1,6 +1,7 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "./canonicalOrdering.js";
-import { semanticStaticPropertyName } from "./javascriptSemanticProjection.js";
+import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { semanticStaticPropertyKey, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { builtinDataEffectMethod as builtinMethod, containsSemanticNode as containsNode, dataEffectArgumentBindingId as argumentBindingId, dataEffectLiteralString as literalString, dataEffectMemberCallee as memberCallee, dataEffectMemberObject as memberObject, dataEffectPrimitive as primitiveValue, isSemanticProcessObject as isProcessObject, outerDataEffectBinding as outerAssignedBinding, assignedSemanticResultBindings, semanticProjectedBindingFacts, traverseDataEffects as traverseWithContext, } from "./javascriptSemanticDataEffectHelpers.js";
 import { range } from "./javascriptStaticAnalysisHelpers.js";
@@ -77,7 +78,8 @@ const processConfigurationMember = (node, state) => {
     const family = semanticStaticPropertyName(object.property, object.computed);
     if (family !== "env" && family !== "argv")
         return null;
-    const key = semanticStaticPropertyName(node.property, node.computed) || null;
+    // `process.env[""]` names an exact (empty) key; only a dynamic key is unknown.
+    const key = semanticStaticPropertyKey(node.property, node.computed);
     return {
         kind: family === "env" ? "environment" : "argv",
         key,
@@ -252,7 +254,7 @@ const requestMethod = (node, state) => {
         return null;
     const binding = resolveSemanticBindingState(state, member.object, member.object.name);
     return binding?.directOrigins.some(({ specifier, importedPath }) => ["http", "https", "node:http", "node:https"].includes(specifier) &&
-        importedPath.length === 0)
+        semanticBuiltinNamespacePath(importedPath))
         ? method
         : null;
 };
@@ -269,8 +271,8 @@ const requestFields = (node, method, state) => {
             return [];
         // `{[key]: 1}` sends no knowable field name; reporting `key` would invent
         // a request field that may not exist.
-        const name = semanticStaticPropertyName(property.key, property.computed);
-        if (name.length === 0)
+        const name = semanticStaticPropertyKey(property.key, property.computed);
+        if (name === null)
             return [];
         return [
             {

package/dist/domain/{javascriptSemanticFingerprints.js → javascript/javascriptSemanticFingerprints.js}

@@ -1,11 +1,19 @@
 import { createHash } from "node:crypto";
 import * as t from "@babel/types";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 /** Build bounded rename- and formatting-resistant components per callable. */
 export const collectJavaScriptSemanticFingerprints = (input) => {
     const { state, callables, calls, promises, events, timers, childProcessSpawns, childProcessInteractions, requestOperations, resourceOperations, parserPartial, } = input;
+    const callSitesByCaller = groupByOwner(calls.callSites, ({ callerCallableId }) => callerCallableId);
+    const captureCountByCallable = countByOwner(calls.closureCaptures, ({ callableId }) => callableId);
+    const promiseEffectsByOwner = groupByOwner(promises, ownerId);
+    const eventEffectsByOwner = groupByOwner(events, ownerId);
+    const timerEffectsByOwner = groupByOwner(timers, ownerId);
+    const childProcessEffectsByOwner = groupByOwner([...childProcessSpawns, ...childProcessInteractions], ownerId);
+    const networkEffectsByOwner = groupByOwner(requestOperations, ownerId);
+    const resourceEffectsByOwner = groupByOwner(resourceOperations, ownerId);
     return callables.flatMap((callable) => {
         if (callable.kind === "class")
             return [];
@@ -13,15 +21,12 @@ export const collectJavaScriptSemanticFingerprints = (input) => {
         if (node === undefined)
             return [];
         const syntax = fingerprintSyntax(node, callable.callableId);
-        const promiseEffects = promises.filter(({ ownerCallableId }) => ownerCallableId === callable.callableId);
-        const eventEffects = events.filter(({ ownerCallableId }) => ownerCallableId === callable.callableId);
-        const timerEffects = timers.filter(({ ownerCallableId }) => ownerCallableId === callable.callableId);
-        const childProcessEffects = [
-            ...childProcessSpawns,
-            ...childProcessInteractions,
-        ].filter(({ ownerCallableId }) => ownerCallableId === callable.callableId);
-        const networkEffects = requestOperations.filter(({ ownerCallableId }) => ownerCallableId === callable.callableId);
-        const resourceEffects = resourceOperations.filter(({ ownerCallableId }) => ownerCallableId === callable.callableId);
+        const promiseEffects = promiseEffectsByOwner.get(callable.callableId) ?? [];
+        const eventEffects = eventEffectsByOwner.get(callable.callableId) ?? [];
+        const timerEffects = timerEffectsByOwner.get(callable.callableId) ?? [];
+        const childProcessEffects = childProcessEffectsByOwner.get(callable.callableId) ?? [];
+        const networkEffects = networkEffectsByOwner.get(callable.callableId) ?? [];
+        const resourceEffects = resourceEffectsByOwner.get(callable.callableId) ?? [];
         return [
             {
                 callableId: callable.callableId,
@@ -32,7 +37,7 @@ export const collectJavaScriptSemanticFingerprints = (input) => {
                     parameterArity: callableParameterArity(node),
                     normalizedAstSha256: digest(syntax.normalizedTokens),
                     controlFlowSha256: digest(syntax.controlFlowTokens),
-                    relationShapeSha256: digest(relationShape(callable, calls, promiseEffects)),
+                    relationShapeSha256: digest(relationShape(callable, callSitesByCaller.get(callable.callableId) ?? [], captureCountByCallable.get(callable.callableId) ?? 0, promiseEffects)),
                     literalSetSha256: digest([...new Set(syntax.literals)].sort(compareCodePoints)),
                     effects: [
                         ...(isAsyncCallable(node) ? ["async"] : []),
@@ -56,6 +61,27 @@ export const collectJavaScriptSemanticFingerprints = (input) => {
         ];
     });
 };
+const ownerId = (value) => value.ownerCallableId;
+const groupByOwner = (values, getOwner) => {
+    const grouped = new Map();
+    for (const value of values) {
+        const owner = getOwner(value);
+        const ownedValues = grouped.get(owner);
+        if (ownedValues === undefined)
+            grouped.set(owner, [value]);
+        else
+            ownedValues.push(value);
+    }
+    return grouped;
+};
+const countByOwner = (values, getOwner) => {
+    const counts = new Map();
+    for (const value of values) {
+        const owner = getOwner(value);
+        counts.set(owner, (counts.get(owner) ?? 0) + 1);
+    }
+    return counts;
+};
 const fingerprintSyntax = (root, targetCallableId) => {
     const normalizedTokens = [];
     const controlFlowTokens = [];
@@ -159,12 +185,10 @@ const semanticLiteral = (node) => {
         return `template:${node.value.cooked ?? node.value.raw}`;
     return null;
 };
-const relationShape = (callable, calls, promises) => [
+const relationShape = (callable, callSites, captureCount, promises) => [
     `returns:${String(callable.returnSites.length)}:${callable.returnCoverage.status}`,
-    ...calls.callSites
-        .filter(({ callerCallableId }) => callerCallableId === callable.callableId)
-        .map(({ kind, resolution, arguments: args, calleeCallableIds }) => `call:${kind}:${resolution}:${String(args.length)}:${String(calleeCallableIds.length)}`),
-    `captures:${String(calls.closureCaptures.filter(({ callableId }) => callableId === callable.callableId).length)}`,
+    ...callSites.map(({ kind, resolution, arguments: args, calleeCallableIds }) => `call:${kind}:${resolution}:${String(args.length)}:${String(calleeCallableIds.length)}`),
+    `captures:${String(captureCount)}`,
     ...promises.map(({ kind, method, ownership, sourceResolution }) => `promise:${kind}:${method}:${ownership}:${sourceResolution}`),
 ];
 const callableParameterArity = (node) => t.isFunction(node) ? node.params.length : 0;

package/dist/domain/{javascriptSemanticGraph.js → javascript/javascriptSemanticGraph.js}

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
-import { compareCodePoints, uniqueSorted } from "./canonicalOrdering.js";
+import { canonicalDigest, canonicalJson } from "../comparisonSemantics.js";
+import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES, JAVASCRIPT_SEMANTIC_RELATION_FAMILY, javaScriptSemanticFingerprintInputSchema, javaScriptSemanticFingerprintSchema, javaScriptSemanticGraphInputSchema, javaScriptSemanticGraphRecordSchema, javaScriptSemanticNodeInputSchema, javaScriptSemanticNodeSchema, javaScriptSemanticRelationInputSchema, javaScriptSemanticRelationSchema, javaScriptSemanticUnknownInputSchema, javaScriptSemanticUnknownSchema, } from "./javascriptSemanticGraphSchemas.js";
 const normalizeEvidence = (evidence) => ({
     ...evidence,
@@ -11,7 +11,8 @@ const normalizeEvidence = (evidence) => ({
     limitations: uniqueSorted(evidence.limitations),
     evidence_ids: uniqueSorted(evidence.evidence_ids),
 });
-const nodeId = (node) => `jsrg_node_${canonicalDigest({ kind: node.kind, identity: node.identity }, "JavaScript semantic graph")}`;
+/** Derive a semantic node ID from its kind and exact artifact identity. */
+export const javaScriptSemanticNodeId = (node) => `jsrg_node_${canonicalDigest({ kind: node.kind, identity: node.identity }, "JavaScript semantic graph")}`;
 /** Normalize one semantic entity and derive its artifact-version identifier. */
 export const createJavaScriptSemanticGraphNode = (input) => {
     const parsed = javaScriptSemanticNodeInputSchema.parse(input);
@@ -26,7 +27,7 @@ export const createJavaScriptSemanticGraphNode = (input) => {
     };
     return javaScriptSemanticNodeSchema.parse({
         ...semantic,
-        node_id: nodeId(semantic),
+        node_id: javaScriptSemanticNodeId(semantic),
     });
 };
 /** Normalize one semantic relationship and derive its exact identifier. */
@@ -157,7 +158,7 @@ const checkCanonicalOrder = (graph, context) => {
 };
 const checkNodes = (graph, nodes, context) => {
     for (const [index, node] of graph.nodes.entries()) {
-        if (node.node_id !== nodeId(node))
+        if (node.node_id !== javaScriptSemanticNodeId(node))
             context.addIssue({
                 code: "custom",
                 path: ["nodes", index, "node_id"],
@@ -295,7 +296,7 @@ const checkFingerprints = (graph, nodes, context) => {
             });
     }
 };
-const checkGraph = (graph, context) => {
+const checkGraphContent = (graph, context) => {
     checkCanonicalOrder(graph, context);
     const nodes = new Map(graph.nodes.map((node) => [node.node_id, node]));
     checkNodes(graph, nodes, context);
@@ -311,6 +312,9 @@ const checkGraph = (graph, context) => {
             path: ["limitations"],
             message: "Non-complete graph coverage requires a limitation",
         });
+};
+const checkGraph = (graph, context) => {
+    checkGraphContent(graph, context);
     const { graph_id: identifier, ...semantic } = graph;
     if (identifier !==
         "jsrg_" + canonicalDigest(semantic, "JavaScript semantic graph"))
@@ -344,8 +348,20 @@ export const createJavaScriptSemanticGraph = (input) => {
         },
         limitations: uniqueSorted(parsed.limitations),
     };
-    return javaScriptSemanticGraphSchema.parse({
+    // The input schema already cloned and validated every field. Validate the
+    // normalized relationships in place, then derive the only added field. The
+    // public schema still verifies arbitrary records and their commitments.
+    const record = {
         ...semantic,
         graph_id: `jsrg_${canonicalDigest(semantic, "JavaScript semantic graph")}`,
+    };
+    const issues = [];
+    checkGraphContent(record, {
+        addIssue: (issue) => {
+            issues.push(issue);
+        },
     });
+    if (issues.length > 0)
+        throw new z.ZodError(issues);
+    return record;
 };

package/dist/domain/{javascriptSemanticGraphSchemas.js → javascript/javascriptSemanticGraphSchemas.js}

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import { applicationGraphEvidenceSchema } from "./javascriptApplicationEvidenceSchemas.js";
-import { jsonValueSchema } from "./jsonValue.js";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { jsonValueSchema } from "../jsonValue.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
 const boundedTextSchema = z.string().min(1);
 const semanticNodeIdSchema = prefixedDigestSchema("jsrg_node");
 const semanticRelationIdSchema = z