rea-agents 6.2.0 → 6.3.0

package/dist/domain/javascript/electronStaticAnalysisBrowser.js

@@ -1,6 +1,6 @@
 import * as t from "@babel/types";
 import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
@@ -98,7 +98,7 @@ const collectWebPreferences = (source, object) => {
             unknown += 1;
         preferences.push({ name, value });
     }
-    preferences.sort((left, right) => compareCodePoints(left.name, right.name));
+    preferences.sort((left, right) => compareUnicodeCodePoints(left.name, right.name));
     return {
         status: "object-literal",
         preferences,

package/dist/domain/javascript/electronStaticAnalysisIpc.js

@@ -3,6 +3,7 @@ import { boundedExpression, electronStaticValue, handlerKind, } from "./electron
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { compositeKey } from "../unicodeCodePointOrder.js";
 /** Inspect Electron IPC operations and validation candidates. */
 export const inspectElectronIpcNode = (node, context) => {
     if (t.isCallExpression(node)) {
@@ -116,7 +117,14 @@ const addValidation = (context, node, input) => {
     };
     addLocatedFinding(context, {
         collection: context.accumulator.senderValidations,
-        key: `electron-validation\0${input.subject}\0${input.mechanism}\0${input.expected.status === "literal" ? String(input.expected.value) : input.expected.expression}`,
+        key: compositeKey([
+            "electron-validation",
+            input.subject,
+            input.mechanism,
+            input.expected.status === "literal"
+                ? String(input.expected.value)
+                : input.expected.expression,
+        ]),
         node,
         value: finding,
     });

package/dist/domain/javascript/electronStaticAnalysisNative.js

@@ -1,5 +1,5 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrder.js";
 import { stripQueryAndFragment } from "../artifactPathSyntax.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
@@ -98,11 +98,13 @@ const addBinding = (input) => {
     const { context, node, specifier, kind } = input;
     const unique = [
         ...new Set(input.members.filter((member) => member !== "")),
-    ].sort(compareCodePoints);
+    ].sort(compareUnicodeCodePoints);
     const members = unique.length === 0 ? ["*"] : unique;
     addLocatedFinding(context, {
         collection: context.accumulator.nativeAddonBindings,
-        key: `native-addon-binding\0${kind}\0${specifier}\0${members.join("\0")}`,
+        // Members are a variable-length source-derived list: compositeKey keeps
+        // ["a\0b"] distinct from ["a", "b"] instead of collapsing one binding.
+        key: compositeKey(["native-addon-binding", kind, specifier, members]),
         node,
         value: {
             specifier,

package/dist/domain/javascript/electronStaticAnalysisValues.js

@@ -1,5 +1,5 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { readExactJavaScriptLiteral, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 import { sourceSlice } from "./javascriptStaticAnalysisHelpers.js";
 /** Preserve one literal value or the exact inert expression. */
@@ -72,7 +72,7 @@ export const collectContextBridgeMembers = (node) => {
         unknown: 0,
     };
     collectMembersAt(node, "", 0, state);
-    const members = [...new Set(state.members)].sort(compareCodePoints);
+    const members = [...new Set(state.members)].sort(compareUnicodeCodePoints);
     return {
         status: "object-literal",
         members,
@@ -107,7 +107,11 @@ const literalValue = (node) => {
     if (literal.found)
         return literal;
     if (t.isUnaryExpression(node, { operator: "-" }) &&
-        t.isNumericLiteral(node.argument))
-        return { found: true, value: -node.argument.value };
+        t.isNumericLiteral(node.argument)) {
+        const value = -node.argument.value;
+        return Number.isFinite(value) && !Object.is(value, -0)
+            ? { found: true, value }
+            : { found: false };
+    }
     return { found: false };
 };

package/dist/domain/javascript/javascriptApplicationAnalysis.js

@@ -3,12 +3,14 @@ import { javascriptApplicationGraphSchema, isValidatedImmutableJavaScriptApplica
 import { javaScriptSemanticGraphSchema, isValidatedImmutableJavaScriptSemanticGraph, } from "./javascriptSemanticGraph.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { integrityContradictionSchema } from "../artifactGraph.js";
 import { localPathStringSchema } from "../localPath.js";
 const countSchema = z.number().int().min(0);
 /** Public target-free request for static JavaScript application analysis. */
 export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
     input_path: localPathStringSchema,
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
 });
 /** Compact counts for the high-level Electron architecture/security surface. */
 const electronBoundarySummarySchema = z.strictObject({
@@ -44,7 +46,6 @@ const reconstructionStatisticsSchema = z.strictObject({
     findings: countSchema,
     modules: countSchema,
     parse_failures: countSchema,
-    truncated_scopes: countSchema,
 });
 const applicationAnalysisResultShape = z.strictObject({
     input_path: z.string().min(1),
@@ -52,6 +53,7 @@ const applicationAnalysisResultShape = z.strictObject({
     root_artifact_sha256: digestSchema,
     inventory_manifest_id: prefixedDigestSchema("agm"),
     inventory_graph_sha256: digestSchema,
+    integrity_contradictions: z.array(integrityContradictionSchema),
     graph: javascriptApplicationGraphSchema,
     summary: electronBoundarySummarySchema,
     statistics: reconstructionStatisticsSchema,

package/dist/domain/javascript/javascriptApplicationChangeGraph.js

@@ -1,5 +1,6 @@
-import { createJavaScriptApplicationEdge, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { createJavaScriptApplicationEdge, createImmutableJavaScriptApplicationGraphSteps, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Merge compared nodes and add inferred right-to-left changed_from edges. */
 export const buildJavaScriptApplicationChangeGraph = (input) => {
     const allNodes = nodeCandidates(input);
@@ -24,7 +25,7 @@ export const buildJavaScriptApplicationChangeGraph = (input) => {
     const candidateEdges = uniqueEdges([...sourceEdges, ...comparisonEdges]);
     const rootNodeIds = preferredRoots.filter((nodeId) => retained.has(nodeId));
     const fallbackRoot = mergedNodes[0]?.node_id;
-    const graph = createJavaScriptApplicationGraph({
+    const steps = createImmutableJavaScriptApplicationGraphSteps({
         schema: "JavaScriptApplicationGraph",
         root_node_ids: rootNodeIds.length > 0
             ? rootNodeIds
@@ -41,7 +42,10 @@ export const buildJavaScriptApplicationChangeGraph = (input) => {
             "The change graph contains compared entities and their retained relationships; it is not an executable application.",
         ]),
     });
-    return { graph };
+    let next = steps.next();
+    while (!next.done)
+        next = steps.next();
+    return { graph: next.value };
 };
 const nodeCandidates = (input) => {
     const required = new Set([
@@ -145,7 +149,7 @@ const changeGraphCoverage = (input) => {
 };
 const sourceCoverageLimits = (input) => [
     ...new Map([...input.left.coverage.limits, ...input.right.coverage.limits].map((limit) => [`${limit.name}\0${limit.value}\0${limit.unit}`, limit])).values(),
-].sort((left, right) => compareCodePoints(left.name, right.name));
+].sort((left, right) => compareUnicodeCodePoints(left.name, right.name));
 const combineOmittedCounts = (left, right) => left === null || right === null ? null : left + right;
 const mergeNodes = (nodes) => {
     const groups = new Map();
@@ -159,13 +163,13 @@ const mergeNodes = (nodes) => {
             ...new Map(group
                 .flatMap(({ observations: values }) => values)
                 .map((observation) => [observation.observation_id, observation])).values(),
-        ].sort((left, right) => compareCodePoints(left.observation_id, right.observation_id));
+        ].sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
         return createJavaScriptApplicationNode({
             kind: first.kind,
             identity: first.identity,
             observations: observations.map(({ observation_id: _id, identifier_strategy: _strategy, ...value }) => value),
         });
     });
-    return merged.sort((left, right) => compareCodePoints(left.node_id, right.node_id));
+    return merged.sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));
 };
-const uniqueEdges = (edges) => [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id));
+const uniqueEdges = (edges) => [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id));

package/dist/domain/javascript/javascriptApplicationEvidenceSchemas.js

@@ -232,6 +232,10 @@ const applicationGraphEvidenceBaseSchema = z.strictObject({
     limitations: z.array(boundedTextSchema),
     evidence_ids: z.array(prefixedDigestSchema("ev")),
 });
+/** Shared provenance fields apart from the fact-specific evidence location. */
+export const applicationGraphEvidenceContextSchema = applicationGraphEvidenceBaseSchema.omit({ location: true });
+/** Exact coordinates retained on each graph fact. */
+export const applicationGraphEvidenceLocationSchema = applicationLocationReferenceSchema;
 const checkAuthorityState = (evidence, context) => {
     if (evidence.authority === "static-relationship-inference" &&
         evidence.state !== "inferred")

package/dist/domain/javascript/javascriptApplicationGraph.js

@@ -1,6 +1,8 @@
 import { z } from "zod";
-import { canonicalDigest, canonicalJson } from "../comparisonSemantics.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { canonicalJson } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { freezeOwnedJsonSnapshotSteps } from "../immutableJson.js";
 import { applicationEdgeInputSchema, applicationEdgeSchema, applicationNodeInputSchema, applicationNodeObservationSchema, applicationNodeSchema, javascriptApplicationGraphInputSchema, javascriptApplicationGraphRecordSchema, } from "./javascriptApplicationGraphSchemas.js";
 const OBSERVATION_IDENTIFIER_STRATEGY = {
@@ -12,7 +14,7 @@ const EDGE_IDENTIFIER_STRATEGY = {
     stability: "relationship-exact",
 };
 const limitKey = (limit) => canonicalJson(limit, "JavaScript Application Graph");
-const normalizeLimits = (limits) => [...new Map(limits.map((limit) => [limitKey(limit), limit])).values()].sort((left, right) => compareCodePoints(limitKey(left), limitKey(right)));
+const normalizeLimits = (limits) => [...new Map(limits.map((limit) => [limitKey(limit), limit])).values()].sort((left, right) => compareUnicodeCodePoints(limitKey(left), limitKey(right)));
 const normalizeEvidence = (evidence) => ({
     ...evidence,
     coverage: {
@@ -29,13 +31,13 @@ const nodeSemantic = (node) => ({
     kind: node.kind,
     identity: node.identity,
 });
-const nodeId = (node) => `jag_node_${canonicalDigest(nodeSemantic(node), "JavaScript Application Graph")}`;
+const nodeId = (node) => `jag_node_${digestCanonicalValue(nodeSemantic(node), "JavaScript Application Graph")}`;
 const observationSemantic = (nodeIdentifier, observation) => ({ node_id: nodeIdentifier, ...observation });
-const observationId = (nodeIdentifier, observation) => `jag_observation_${canonicalDigest(observationSemantic(nodeIdentifier, observation))}`;
-const edgeId = (edge) => `jag_edge_${canonicalDigest(edge, "JavaScript Application Graph")}`;
+const observationId = (nodeIdentifier, observation) => `jag_observation_${digestCanonicalValue(observationSemantic(nodeIdentifier, observation))}`;
+const edgeId = (edge) => `jag_edge_${digestCanonicalValue(edge, "JavaScript Application Graph")}`;
 const sortedUniqueIssue = (values, path, label, context) => {
     for (let index = 1; index < values.length; index += 1) {
-        if (compareCodePoints(values[index - 1] ?? "", values[index] ?? "") < 0)
+        if (compareUnicodeCodePoints(values[index - 1] ?? "", values[index] ?? "") < 0)
             continue;
         context.addIssue({
             code: "custom",
@@ -213,7 +215,7 @@ const checkGraphInvariants = (graph, context) => {
     }
     const { graph_id: identifier, ...semantic } = graph;
     if (identifier !==
-        `jag_${canonicalDigest(semantic, "JavaScript Application Graph")}`)
+        `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`)
         context.addIssue({
             code: "custom",
             message: "Graph identifier does not match its semantic content",
@@ -239,7 +241,7 @@ export const createJavaScriptApplicationNode = (input) => {
             observation_id: observationId(identifier, semantic),
         });
     })
-        .sort((left, right) => compareCodePoints(left.observation_id, right.observation_id));
+        .sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
     return applicationNodeSchema.parse({
         node_id: identifier,
         kind: parsed.kind,
@@ -266,8 +268,8 @@ export const createJavaScriptApplicationGraph = (input) => {
     const semantic = {
         ...parsed,
         root_node_ids: uniqueSorted(parsed.root_node_ids),
-        nodes: [...parsed.nodes].sort((left, right) => compareCodePoints(left.node_id, right.node_id)),
-        edges: [...parsed.edges].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id)),
+        nodes: [...parsed.nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id)),
+        edges: [...parsed.edges].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id)),
         coverage: {
             ...parsed.coverage,
             limits: normalizeLimits(parsed.coverage.limits),
@@ -276,7 +278,7 @@ export const createJavaScriptApplicationGraph = (input) => {
     };
     return javascriptApplicationGraphSchema.parse({
         ...semantic,
-        graph_id: `jag_${canonicalDigest(semantic, "JavaScript Application Graph")}`,
+        graph_id: `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`,
     });
 };
 const validatedImmutableApplicationGraphs = new WeakSet();
@@ -294,6 +296,6 @@ export const isValidatedImmutableJavaScriptApplicationGraph = (value) => typeof
 /** Parse a stored graph and reject stale IDs. */
 export const parseJavaScriptApplicationGraph = (input) => javascriptApplicationGraphSchema.parse(input);
 /** Compute the byte-stable SHA-256 commitment of a verified graph. */
-export const computeJavaScriptApplicationGraphSha256 = (input) => canonicalDigest(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
+export const computeJavaScriptApplicationGraphSha256 = (input) => digestCanonicalValue(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
 /** Serialize a verified graph as RFC 8785 canonical JSON. */
 export const serializeJavaScriptApplicationGraph = (input) => canonicalJson(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");

package/dist/domain/javascript/javascriptApplicationVersionComparison.js

@@ -1,7 +1,7 @@
-import { canonicalDigest } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { buildJavaScriptApplicationChangeGraph } from "./javascriptApplicationChangeGraph.js";
-import { applicationVersionComparisonResultSchema, } from "./javascriptApplicationVersionComparisonSchemas.js";
+import { ownedApplicationVersionComparisonResultSchema, } from "./javascriptApplicationVersionComparisonSchemas.js";
 import { classifyJavaScriptApplicationVersions } from "./javascriptApplicationVersionItems.js";
 import { matchJavaScriptApplicationVersions } from "./javascriptApplicationVersionKeys.js";
 /** Compare application entities with ordered unique-only identity tiers. */
@@ -47,9 +47,9 @@ export const compareJavaScriptApplicationVersions = (input) => {
         evidence_links: evidenceLinks,
         limitations: comparisonLimitations(input),
     };
-    return applicationVersionComparisonResultSchema.parse({
+    return ownedApplicationVersionComparisonResultSchema.parse({
         ...semantic,
-        comparison_id: `javc_${canonicalDigest(semantic, "Application version comparison")}`,
+        comparison_id: `javc_${digestCanonicalValue(semantic, "Application version comparison")}`,
     });
 };
 const summary = (items) => ({

package/dist/domain/javascript/javascriptApplicationVersionComparisonSchemas.js

@@ -1,21 +1,14 @@
 import { z } from "zod";
 import { emptyArraySchema } from "../emptyArraySchema.js";
 import { evidenceSchema } from "../evidence.js";
-import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
+import { isValidatedImmutableJavaScriptApplicationGraph, javascriptApplicationGraphSchema, } from "./javascriptApplicationGraph.js";
 import { JAVASCRIPT_APPLICATION_NODE_KINDS } from "./javascriptApplicationGraphSchemas.js";
 import { prefixedDigestSchema } from "../digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const nodeIdSchema = prefixedDigestSchema("jag_node");
 const textSchema = z.string().min(1);
-/** Two authenticated application versions and their native observations. */
-export const compareApplicationVersionsInputSchema = z
-    .strictObject({
-    left: evidenceSchema,
-    right: evidenceSchema,
-    left_native_observations: z.array(evidenceSchema).default([]),
-    right_native_observations: z.array(evidenceSchema).default([]),
-})
-    .superRefine((input, context) => {
+/** Check paired version identities and per-side native identity uniqueness. */
+const validateApplicationVersionIdentities = (input, context) => {
     if (input.left.evidence_id === input.right.evidence_id)
         context.addIssue({
             code: "custom",
@@ -34,8 +27,26 @@ export const compareApplicationVersionsInputSchema = z
                 message: "Native observations must be unique on each side",
             });
     }
-});
-const emptyCandidateNodesSchema = emptyArraySchema;
+};
+const evidenceIdentitySchema = z.object({ evidence_id: evidenceIdSchema });
+/** Validate paired version identities without capturing whole analysis graphs. */
+export const applicationVersionIdentitiesSchema = z
+    .object({
+    left: evidenceIdentitySchema,
+    right: evidenceIdentitySchema,
+    left_native_observations: z.array(evidenceIdentitySchema),
+    right_native_observations: z.array(evidenceIdentitySchema),
+})
+    .superRefine(validateApplicationVersionIdentities);
+/** Two authenticated application versions and their native observations. */
+export const compareApplicationVersionsInputSchema = z
+    .strictObject({
+    left: evidenceSchema,
+    right: evidenceSchema,
+    left_native_observations: z.array(evidenceSchema).default([]),
+    right_native_observations: z.array(evidenceSchema).default([]),
+})
+    .superRefine(validateApplicationVersionIdentities);
 const candidateNodesSchema = z.tuple([nodeIdSchema]).rest(nodeIdSchema);
 const exactMatchSchema = z.strictObject({
     status: z.literal("matched"),
@@ -45,22 +56,22 @@ const exactMatchSchema = z.strictObject({
         "exact-module-source-digest",
     ]),
     confidence: z.literal("exact"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const sourceMapMatchSchema = z.strictObject({
     status: z.literal("matched"),
     basis: z.literal("source-map-identity"),
     confidence: z.literal("high"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const inferredMatchSchema = z.strictObject({
     status: z.literal("matched"),
     basis: z.enum(["structural-fingerprint", "semantic-key"]),
     confidence: z.literal("medium"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const matchedItemMatchSchema = z.union([
     exactMatchSchema,
@@ -71,14 +82,14 @@ const unmatchedItemMatchSchema = z.strictObject({
     status: z.literal("unmatched"),
     basis: z.literal("none"),
     confidence: z.literal("unknown"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const leftAmbiguousMatchSchema = z.strictObject({
     status: z.literal("ambiguous"),
     basis: z.literal("none"),
     confidence: z.literal("unknown"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
     candidate_right_node_ids: candidateNodesSchema,
 });
 const rightAmbiguousMatchSchema = z.strictObject({
@@ -86,7 +97,7 @@ const rightAmbiguousMatchSchema = z.strictObject({
     basis: z.literal("none"),
     confidence: z.literal("unknown"),
     candidate_left_node_ids: candidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const comparisonItemContextShape = {
     item_id: prefixedDigestSchema("javc_item"),
@@ -194,3 +205,7 @@ export const applicationVersionComparisonResultSchema = z
             message: "Comparison coverage must match source graph completeness",
         });
 });
+/** Reuse the exact owned change graph while validating the rest of the result. */
+export const ownedApplicationVersionComparisonResultSchema = applicationVersionComparisonResultSchema.safeExtend({
+    graph: z.custom(isValidatedImmutableJavaScriptApplicationGraph),
+});

package/dist/domain/javascript/javascriptApplicationVersionItems.js

@@ -1,5 +1,6 @@
-import { absenceClaimable, canonicalDigest, canonicalJson, } from "../comparisonSemantics.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { absenceClaimable, canonicalJson } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Classify matched, unmatched, and ambiguous nodes without inventing absence. */
 export const classifyJavaScriptApplicationVersions = (matching, context) => {
     const pairByLeft = new Map(matching.pairs.map(({ left, right }) => [
@@ -10,7 +11,13 @@ export const classifyJavaScriptApplicationVersions = (matching, context) => {
         right.node_id,
         `pair:${left.node_id}:${right.node_id}`,
     ]));
-    const fullContext = { ...context, pairByLeft, pairByRight };
+    const fullContext = {
+        ...context,
+        pairByLeft,
+        pairByRight,
+        leftRelationships: indexRelationships(context.leftGraph),
+        rightRelationships: indexRelationships(context.rightGraph),
+    };
     const leftItems = matching.unmatchedLeft.map((node) => {
         const candidates = matching.candidatesForLeft.get(node.node_id) ?? [];
         return unmatchedItem({
@@ -30,7 +37,7 @@ export const classifyJavaScriptApplicationVersions = (matching, context) => {
             ...matching.pairs.map((pair) => matchedItem(pair, fullContext)),
             ...leftItems,
             ...rightItems,
-        ].sort((left, right) => compareCodePoints(left.item_id, right.item_id)),
+        ].sort((left, right) => compareUnicodeCodePoints(left.item_id, right.item_id)),
     };
 };
 const matchedItem = (pair, context) => {
@@ -201,42 +208,46 @@ const contentIdentity = (node) => {
 };
 const locations = (node) => node.observations
     .map(({ evidence }) => evidence.location.available ? evidence.location.value : evidence.location)
-    .sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right)));
+    .sort((left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right)));
 const properties = (node) => node.observations
     .map(({ label, properties: values, source_map_reference }) => ({
     label,
     properties: values,
     source_map_reference,
 }))
-    .sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right)));
+    .sort((left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right)));
+const indexRelationships = (graph) => {
+    const adjacency = new Map();
+    const add = (nodeId, relationship) => {
+        const existing = adjacency.get(nodeId);
+        if (existing === undefined)
+            adjacency.set(nodeId, [relationship]);
+        else
+            existing.push(relationship);
+    };
+    for (const edge of graph.edges) {
+        add(edge.source_node_id, {
+            direction: "out",
+            relation: edge.relation,
+            neighborId: edge.target_node_id,
+        });
+        if (edge.target_node_id !== edge.source_node_id)
+            add(edge.target_node_id, {
+                direction: "in",
+                relation: edge.relation,
+                neighborId: edge.source_node_id,
+            });
+    }
+    return {
+        nodeById: new Map(graph.nodes.map((value) => [value.node_id, value])),
+        adjacency,
+    };
+};
 const relationshipSignature = (node, side, context) => {
-    const graph = side === "left" ? context.leftGraph : context.rightGraph;
+    const { nodeById, adjacency } = side === "left" ? context.leftRelationships : context.rightRelationships;
     const paired = side === "left" ? context.pairByLeft : context.pairByRight;
-    const nodeById = new Map(graph.nodes.map((value) => [value.node_id, value]));
-    const signatures = graph.edges.flatMap((edge) => {
-        if (edge.source_node_id === node.node_id)
-            return [
-                edgeSignature({
-                    direction: "out",
-                    relation: edge.relation,
-                    neighborId: edge.target_node_id,
-                    paired,
-                    nodeById,
-                }),
-            ];
-        if (edge.target_node_id === node.node_id)
-            return [
-                edgeSignature({
-                    direction: "in",
-                    relation: edge.relation,
-                    neighborId: edge.source_node_id,
-                    paired,
-                    nodeById,
-                }),
-            ];
-        return [];
-    });
-    return canonicalJson(signatures.sort(compareCodePoints));
+    const signatures = (adjacency.get(node.node_id) ?? []).map((relationship) => edgeSignature({ ...relationship, paired, nodeById }));
+    return canonicalJson(signatures.sort(compareUnicodeCodePoints));
 };
 const edgeSignature = (context) => {
     const mapped = context.paired.get(context.neighborId);
@@ -250,7 +261,7 @@ const itemEvidenceLinks = (left, right, context) => [
         ...nativeLinks(left, context.leftNativeEvidence),
         ...nativeLinks(right, context.rightNativeEvidence),
     ]),
-].sort(compareCodePoints);
+].sort(compareUnicodeCodePoints);
 const nativeLinks = (node, evidence) => {
     const digest = node === undefined
         ? null
@@ -283,7 +294,7 @@ const pairLimitations = (pair, status) => [
 ];
 const itemWithId = (semantic) => ({
     ...semantic,
-    item_id: `javc_item_${canonicalDigest(semantic, "Application version item")}`,
+    item_id: `javc_item_${digestCanonicalValue(semantic, "Application version item")}`,
 });
 const stringProperty = (node, key) => {
     const values = [

package/dist/domain/javascript/javascriptApplicationVersionKeys.js

@@ -1,5 +1,5 @@
 import { canonicalJson } from "../comparisonSemantics.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrder.js";
 const matchTiers = () => [
     {
         match: { basis: "exact-content-digest", confidence: "exact" },
@@ -40,7 +40,7 @@ export const matchJavaScriptApplicationVersions = (leftNodes, rightNodes) => {
     const leftIds = new Set(remainingLeft.map(({ node_id: id }) => id));
     const rightIds = new Set(remainingRight.map(({ node_id: id }) => id));
     return {
-        pairs: pairs.sort((a, b) => compareCodePoints(`${a.left.node_id}\0${a.right.node_id}`, `${b.left.node_id}\0${b.right.node_id}`)),
+        pairs: pairs.sort((a, b) => compareUnicodeCodePoints(`${a.left.node_id}\0${a.right.node_id}`, `${b.left.node_id}\0${b.right.node_id}`)),
         unmatchedLeft: remainingLeft,
         unmatchedRight: remainingRight,
         candidatesForLeft: filteredCandidates(leftCandidates, rightIds),
@@ -50,7 +50,7 @@ export const matchJavaScriptApplicationVersions = (leftNodes, rightNodes) => {
 const applyTier = (context) => {
     const leftByKey = nodesByKey(context.left.values(), context.tier.key);
     const rightByKey = nodesByKey(context.right.values(), context.tier.key);
-    for (const key of [...leftByKey.keys()].sort(compareCodePoints)) {
+    for (const key of [...leftByKey.keys()].sort(compareUnicodeCodePoints)) {
         const leftGroup = leftByKey.get(key) ?? [];
         const rightGroup = rightByKey.get(key) ?? [];
         if (rightGroup.length === 0)
@@ -98,7 +98,7 @@ const recordCandidates = (left, right, leftCandidates, rightCandidates) => {
 const filteredCandidates = (candidates, retained) => new Map([...candidates.entries()].flatMap(([nodeId, values]) => {
     const filtered = [...values]
         .filter((value) => retained.has(value))
-        .sort(compareCodePoints);
+        .sort(compareUnicodeCodePoints);
     return filtered.length === 0 ? [] : [[nodeId, filtered]];
 }));
 const nodeIdentityKey = (node) => `node\0${node.kind}\0${node.node_id}`;
@@ -178,7 +178,7 @@ const uniqueStringProperty = (node, name) => {
 };
 const joined = (...values) => {
     const strings = values.map(nonEmptyString);
-    return strings.some((value) => value === null) ? null : strings.join("\0");
+    return strings.some((value) => value === null) ? null : compositeKey(strings);
 };
 const nonEmptyString = (value) => typeof value === "string" && value !== "" ? value : null;
 /** A literal value such as `ipcMain.handle("")` keeps its exact empty text. */
@@ -186,6 +186,6 @@ const exactString = (value) => typeof value === "string" ? value : null;
 const stringList = (value) => Array.isArray(value)
     ? value
         .filter((item) => typeof item === "string")
-        .sort(compareCodePoints)
+        .sort(compareUnicodeCodePoints)
     : [];
-const sortedNodes = (nodes) => [...nodes].sort((left, right) => compareCodePoints(left.node_id, right.node_id));
+const sortedNodes = (nodes) => [...nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));

package/dist/domain/javascript/javascriptAstFingerprint.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import * as t from "@babel/types";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { propertyName } from "./javascriptAstValues.js";
 import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
 /** Derive a rename-resistant syntax fingerprint without code execution. */
@@ -28,7 +28,7 @@ export const collectJavaScriptExports = (node) => {
         },
     });
     return {
-        values: [...exports].sort(compareCodePoints),
+        values: [...exports].sort(compareUnicodeCodePoints),
     };
 };
 const semanticTokens = (node) => {

package/dist/domain/javascript/javascriptAstValues.js

@@ -1,6 +1,27 @@
 import * as t from "@babel/types";
+/**
+ * Remove wrappers that affect TypeScript or Flow checking but not runtime
+ * expression identity. The returned depth lets bounded evaluators account for
+ * syntax that normalization would otherwise skip.
+ */
+export const unwrapJavaScriptExpression = (node) => {
+    let current = node;
+    let depth = 0;
+    while (t.isParenthesizedExpression(current) ||
+        t.isTSAsExpression(current) ||
+        t.isTSTypeAssertion(current) ||
+        t.isTSNonNullExpression(current) ||
+        t.isTSSatisfiesExpression(current) ||
+        t.isTSInstantiationExpression(current) ||
+        t.isTypeCastExpression(current)) {
+        current = current.expression;
+        depth += 1;
+    }
+    return { node: current, depth };
+};
 /** Read one syntax-level primitive only when its value is exact. */
 export const readExactJavaScriptLiteral = (node) => {
+    node = unwrapJavaScriptExpression(node).node;
     if (t.isStringLiteral(node))
         return { found: true, value: node.value };
     if (t.isNumericLiteral(node) && Number.isFinite(node.value))
@@ -31,6 +52,7 @@ export const propertyName = (node) => {
 export const semanticStaticPropertyName = (property, computed) => semanticStaticPropertyKey(property, computed) ?? "";
 /** Read an exact property key, preserving the legal empty-string key. */
 export const semanticStaticPropertyKey = (property, computed) => {
+    property = unwrapJavaScriptExpression(property).node;
     if (t.isStringLiteral(property) || t.isNumericLiteral(property))
         return String(property.value);
     return !computed && t.isIdentifier(property) ? property.name : null;