rea-agents 6.2.0 → 6.4.0

package/dist/domain/javascript/javascriptApplicationGraph.js

@@ -1,7 +1,11 @@
 import { z } from "zod";
-import { canonicalDigest, canonicalJson } from "../comparisonSemantics.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
-import { freezeOwnedJsonSnapshotSteps } from "../immutableJson.js";
+import { arrayContainerSchema, parseElementSteps, } from "../zodCollectionSteps.js";
+import { canonicalJsonDigestSteps } from "../canonicalJsonDigestSteps.js";
+import { canonicalJson } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
+import { freezeJsonSnapshot, freezeOwnedJsonSnapshotSteps, } from "../immutableJson.js";
 import { applicationEdgeInputSchema, applicationEdgeSchema, applicationNodeInputSchema, applicationNodeObservationSchema, applicationNodeSchema, javascriptApplicationGraphInputSchema, javascriptApplicationGraphRecordSchema, } from "./javascriptApplicationGraphSchemas.js";
 const OBSERVATION_IDENTIFIER_STRATEGY = {
     strategy: "semantic-content-sha256",
@@ -12,7 +16,7 @@ const EDGE_IDENTIFIER_STRATEGY = {
     stability: "relationship-exact",
 };
 const limitKey = (limit) => canonicalJson(limit, "JavaScript Application Graph");
-const normalizeLimits = (limits) => [...new Map(limits.map((limit) => [limitKey(limit), limit])).values()].sort((left, right) => compareCodePoints(limitKey(left), limitKey(right)));
+const normalizeLimits = (limits) => [...new Map(limits.map((limit) => [limitKey(limit), limit])).values()].sort((left, right) => compareUnicodeCodePoints(limitKey(left), limitKey(right)));
 const normalizeEvidence = (evidence) => ({
     ...evidence,
     coverage: {
@@ -29,13 +33,13 @@ const nodeSemantic = (node) => ({
     kind: node.kind,
     identity: node.identity,
 });
-const nodeId = (node) => `jag_node_${canonicalDigest(nodeSemantic(node), "JavaScript Application Graph")}`;
+const nodeId = (node) => `jag_node_${digestCanonicalValue(nodeSemantic(node), "JavaScript Application Graph")}`;
 const observationSemantic = (nodeIdentifier, observation) => ({ node_id: nodeIdentifier, ...observation });
-const observationId = (nodeIdentifier, observation) => `jag_observation_${canonicalDigest(observationSemantic(nodeIdentifier, observation))}`;
-const edgeId = (edge) => `jag_edge_${canonicalDigest(edge, "JavaScript Application Graph")}`;
+const observationId = (nodeIdentifier, observation) => `jag_observation_${digestCanonicalValue(observationSemantic(nodeIdentifier, observation))}`;
+const edgeId = (edge) => `jag_edge_${digestCanonicalValue(edge, "JavaScript Application Graph")}`;
 const sortedUniqueIssue = (values, path, label, context) => {
     for (let index = 1; index < values.length; index += 1) {
-        if (compareCodePoints(values[index - 1] ?? "", values[index] ?? "") < 0)
+        if (compareUnicodeCodePoints(values[index - 1] ?? "", values[index] ?? "") < 0)
             continue;
         context.addIssue({
             code: "custom",
@@ -158,7 +162,12 @@ const checkNode = (node, index, context) => {
             path: ["nodes", index, "identity"],
         });
 };
-const checkGraphInvariants = (graph, context) => {
+const checkGraphContent = (graph, context) => {
+    const steps = checkGraphContentSteps(graph, context);
+    while (steps.next().done !== true)
+        ;
+};
+function* checkGraphContentSteps(graph, context) {
     sortedUniqueIssue(graph.root_node_ids, ["root_node_ids"], "Root nodes", context);
     sortedUniqueIssue(graph.nodes.map(({ node_id: id }) => id), ["nodes"], "Nodes", context);
     sortedUniqueIssue(graph.edges.map(({ edge_id: id }) => id), ["edges"], "Edges", context);
@@ -178,9 +187,14 @@ const checkGraphInvariants = (graph, context) => {
                 message: "Root identifier must name a graph node",
                 path: ["root_node_ids"],
             });
-    for (const [index, node] of graph.nodes.entries())
+    for (const [index, node] of graph.nodes.entries()) {
+        if (index % 64 === 0)
+            yield;
         checkNode(node, index, context);
+    }
     for (const [index, edge] of graph.edges.entries()) {
+        if (index % 64 === 0)
+            yield;
         const { edge_id: identifier, ...semantic } = edge;
         if (identifier !== edgeId(semantic))
             context.addIssue({
@@ -211,9 +225,12 @@ const checkGraphInvariants = (graph, context) => {
             });
         checkEvidenceNormalization(edge.evidence, ["edges", index, "evidence"], context);
     }
+}
+const checkGraphInvariants = (graph, context) => {
+    checkGraphContent(graph, context);
     const { graph_id: identifier, ...semantic } = graph;
     if (identifier !==
-        `jag_${canonicalDigest(semantic, "JavaScript Application Graph")}`)
+        `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`)
         context.addIssue({
             code: "custom",
             message: "Graph identifier does not match its semantic content",
@@ -222,9 +239,14 @@ const checkGraphInvariants = (graph, context) => {
 };
 /** Strict JavaScript Application Graph with verified commitments. */
 export const javascriptApplicationGraphSchema = javascriptApplicationGraphRecordSchema.superRefine(checkGraphInvariants);
+const javascriptApplicationGraphContentSchema = javascriptApplicationGraphInputSchema.superRefine(checkGraphContent);
 /** Build one normalized application entity and derive all semantic IDs. */
 export const createJavaScriptApplicationNode = (input) => {
     const parsed = applicationNodeInputSchema.parse(input);
+    // These properties are newly parsed and exclusively owned. Authenticate
+    // them before the observation/node schemas and final graph validate again.
+    for (const observation of parsed.observations)
+        freezeJsonSnapshot(observation.properties);
     const identity = normalizeIdentity(parsed.identity);
     const identifier = nodeId({ kind: parsed.kind, identity });
     const observations = parsed.observations
@@ -239,7 +261,7 @@ export const createJavaScriptApplicationNode = (input) => {
             observation_id: observationId(identifier, semantic),
         });
     })
-        .sort((left, right) => compareCodePoints(left.observation_id, right.observation_id));
+        .sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
     return applicationNodeSchema.parse({
         node_id: identifier,
         kind: parsed.kind,
@@ -250,6 +272,7 @@ export const createJavaScriptApplicationNode = (input) => {
 /** Build one normalized directed relationship and derive its semantic ID. */
 export const createJavaScriptApplicationEdge = (input) => {
     const parsed = applicationEdgeInputSchema.parse(input);
+    freezeJsonSnapshot(parsed.properties);
     const semantic = {
         ...parsed,
         evidence: normalizeEvidence(parsed.evidence),
@@ -262,26 +285,66 @@ export const createJavaScriptApplicationEdge = (input) => {
 };
 /** Normalize a complete graph and derive its top-level semantic ID. */
 export const createJavaScriptApplicationGraph = (input) => {
-    const parsed = javascriptApplicationGraphInputSchema.parse(input);
-    const semantic = {
-        ...parsed,
-        root_node_ids: uniqueSorted(parsed.root_node_ids),
-        nodes: [...parsed.nodes].sort((left, right) => compareCodePoints(left.node_id, right.node_id)),
-        edges: [...parsed.edges].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id)),
-        coverage: {
-            ...parsed.coverage,
-            limits: normalizeLimits(parsed.coverage.limits),
-        },
-        limitations: uniqueSorted(parsed.limitations),
+    const semantic = normalizeGraphInput(javascriptApplicationGraphInputSchema.parse(input));
+    const content = javascriptApplicationGraphContentSchema.parse(semantic);
+    return {
+        ...content,
+        graph_id: `jag_${digestCanonicalValue(content, "JavaScript Application Graph")}`,
     };
-    return javascriptApplicationGraphSchema.parse({
-        ...semantic,
-        graph_id: `jag_${canonicalDigest(semantic, "JavaScript Application Graph")}`,
-    });
 };
+const normalizeGraphInput = (parsed) => ({
+    ...parsed,
+    root_node_ids: uniqueSorted(parsed.root_node_ids),
+    nodes: [...parsed.nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id)),
+    edges: [...parsed.edges].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id)),
+    coverage: {
+        ...parsed.coverage,
+        limits: normalizeLimits(parsed.coverage.limits),
+    },
+    limitations: uniqueSorted(parsed.limitations),
+});
 const validatedImmutableApplicationGraphs = new WeakSet();
 /** Clone and validate synchronously, then return steps to seal the owned graph. */
 export const createImmutableJavaScriptApplicationGraphSteps = (input) => sealValidatedApplicationGraphSteps(createJavaScriptApplicationGraph(input));
+const applicationGraphShape = javascriptApplicationGraphInputSchema.shape;
+const applicationGraphContainerSchema = javascriptApplicationGraphInputSchema.extend({
+    nodes: arrayContainerSchema(applicationGraphShape.nodes),
+    edges: arrayContainerSchema(applicationGraphShape.edges),
+});
+/**
+ * Seal a graph whose input the caller transfers: the caller neither retains nor
+ * mutates any part of it afterwards. Only the graph's own fields are validated
+ * synchronously; nodes and edges are validated, checked, hashed and frozen in
+ * steps, because doing so at once held the event loop for large applications.
+ */
+export const sealTransferredJavaScriptApplicationGraphSteps = (input) => parseAndSealApplicationGraphSteps(applicationGraphContainerSchema.parse(input));
+function* parseAndSealApplicationGraphSteps(container) {
+    const issues = [];
+    const parsed = {
+        ...container,
+        nodes: yield* parseElementSteps(applicationGraphShape.nodes.element, container.nodes, ["nodes"], issues),
+        edges: yield* parseElementSteps(applicationGraphShape.edges.element, container.edges, ["edges"], issues),
+    };
+    if (issues.length > 0)
+        throw new z.ZodError(issues);
+    const content = normalizeGraphInput(parsed);
+    let invalid = false;
+    yield* checkGraphContentSteps(content, {
+        addIssue: () => {
+            invalid = true;
+        },
+    });
+    // An invalid owned graph is a construction defect; report it with the exact
+    // issues the content schema produces.
+    if (invalid) {
+        javascriptApplicationGraphContentSchema.parse(content);
+        throw new TypeError("Application graph checks disagree with its schema");
+    }
+    return yield* sealValidatedApplicationGraphSteps({
+        ...content,
+        graph_id: `jag_${yield* canonicalJsonDigestSteps(content)}`,
+    });
+}
 function* sealValidatedApplicationGraphSteps(graph) {
     yield* freezeOwnedJsonSnapshotSteps(graph);
     validatedImmutableApplicationGraphs.add(graph);
@@ -294,6 +357,6 @@ export const isValidatedImmutableJavaScriptApplicationGraph = (value) => typeof
 /** Parse a stored graph and reject stale IDs. */
 export const parseJavaScriptApplicationGraph = (input) => javascriptApplicationGraphSchema.parse(input);
 /** Compute the byte-stable SHA-256 commitment of a verified graph. */
-export const computeJavaScriptApplicationGraphSha256 = (input) => canonicalDigest(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
+export const computeJavaScriptApplicationGraphSha256 = (input) => digestCanonicalValue(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
 /** Serialize a verified graph as RFC 8785 canonical JSON. */
 export const serializeJavaScriptApplicationGraph = (input) => canonicalJson(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");

package/dist/domain/javascript/javascriptApplicationProjectionResources.js

@@ -0,0 +1,35 @@
+/** Forecast static-fact expansion into observations, nodes and relationships. */
+export const estimateJavaScriptStaticApplicationProjection = (facts, checkpointBytes, sourcePath) => {
+    // A finding can produce a node, a separate observation and several edges.
+    // Allow for identifiers, locations, authority, coverage and schema copies,
+    // independently of the producer's compact checkpoint representation.
+    const findings = facts.references.length +
+        facts.endpoints.length +
+        facts.storage.length +
+        facts.role_paths.length +
+        facts.source_map_urls.length +
+        facts.electron.browser_windows.length +
+        facts.electron.context_bridge_apis.length +
+        facts.electron.ipc.length +
+        facts.electron.sender_validations.length +
+        facts.electron.utility_processes.length +
+        facts.electron.native_addon_bindings.length;
+    let records = findings * 8;
+    let repeatedBytes = 0;
+    for (const registration of facts.bundler_registrations) {
+        records +=
+            3 +
+                registration.modules.length * 3 +
+                registration.entry_module_keys.length * 3 +
+                registration.async_chunk_keys.length * 3;
+        // Every module observation and containment edge repeats its chunk keys.
+        repeatedBytes +=
+            Buffer.byteLength(JSON.stringify(registration.chunk_keys)) *
+                registration.modules.length *
+                2;
+    }
+    for (const binding of facts.electron.native_addon_bindings)
+        records += binding.members.length * 3;
+    const metadataBytes = 2048 + Buffer.byteLength(sourcePath) * 4;
+    return (checkpointBytes * 4 + repeatedBytes + records * metadataBytes) * 8;
+};

package/dist/domain/javascript/javascriptApplicationVersionComparison.js

@@ -1,7 +1,7 @@
-import { canonicalDigest } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { buildJavaScriptApplicationChangeGraph } from "./javascriptApplicationChangeGraph.js";
-import { applicationVersionComparisonResultSchema, } from "./javascriptApplicationVersionComparisonSchemas.js";
+import { ownedApplicationVersionComparisonResultSchema, } from "./javascriptApplicationVersionComparisonSchemas.js";
 import { classifyJavaScriptApplicationVersions } from "./javascriptApplicationVersionItems.js";
 import { matchJavaScriptApplicationVersions } from "./javascriptApplicationVersionKeys.js";
 /** Compare application entities with ordered unique-only identity tiers. */
@@ -47,9 +47,9 @@ export const compareJavaScriptApplicationVersions = (input) => {
         evidence_links: evidenceLinks,
         limitations: comparisonLimitations(input),
     };
-    return applicationVersionComparisonResultSchema.parse({
+    return ownedApplicationVersionComparisonResultSchema.parse({
         ...semantic,
-        comparison_id: `javc_${canonicalDigest(semantic, "Application version comparison")}`,
+        comparison_id: `javc_${digestCanonicalValue(semantic, "Application version comparison")}`,
     });
 };
 const summary = (items) => ({

package/dist/domain/javascript/javascriptApplicationVersionComparisonSchemas.js

@@ -1,21 +1,14 @@
 import { z } from "zod";
 import { emptyArraySchema } from "../emptyArraySchema.js";
 import { evidenceSchema } from "../evidence.js";
-import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
+import { isValidatedImmutableJavaScriptApplicationGraph, javascriptApplicationGraphSchema, } from "./javascriptApplicationGraph.js";
 import { JAVASCRIPT_APPLICATION_NODE_KINDS } from "./javascriptApplicationGraphSchemas.js";
 import { prefixedDigestSchema } from "../digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const nodeIdSchema = prefixedDigestSchema("jag_node");
 const textSchema = z.string().min(1);
-/** Two authenticated application versions and their native observations. */
-export const compareApplicationVersionsInputSchema = z
-    .strictObject({
-    left: evidenceSchema,
-    right: evidenceSchema,
-    left_native_observations: z.array(evidenceSchema).default([]),
-    right_native_observations: z.array(evidenceSchema).default([]),
-})
-    .superRefine((input, context) => {
+/** Check paired version identities and per-side native identity uniqueness. */
+const validateApplicationVersionIdentities = (input, context) => {
     if (input.left.evidence_id === input.right.evidence_id)
         context.addIssue({
             code: "custom",
@@ -34,8 +27,26 @@ export const compareApplicationVersionsInputSchema = z
                 message: "Native observations must be unique on each side",
             });
     }
-});
-const emptyCandidateNodesSchema = emptyArraySchema;
+};
+const evidenceIdentitySchema = z.object({ evidence_id: evidenceIdSchema });
+/** Validate paired version identities without capturing whole analysis graphs. */
+export const applicationVersionIdentitiesSchema = z
+    .object({
+    left: evidenceIdentitySchema,
+    right: evidenceIdentitySchema,
+    left_native_observations: z.array(evidenceIdentitySchema),
+    right_native_observations: z.array(evidenceIdentitySchema),
+})
+    .superRefine(validateApplicationVersionIdentities);
+/** Two authenticated application versions and their native observations. */
+export const compareApplicationVersionsInputSchema = z
+    .strictObject({
+    left: evidenceSchema,
+    right: evidenceSchema,
+    left_native_observations: z.array(evidenceSchema).default([]),
+    right_native_observations: z.array(evidenceSchema).default([]),
+})
+    .superRefine(validateApplicationVersionIdentities);
 const candidateNodesSchema = z.tuple([nodeIdSchema]).rest(nodeIdSchema);
 const exactMatchSchema = z.strictObject({
     status: z.literal("matched"),
@@ -45,22 +56,22 @@ const exactMatchSchema = z.strictObject({
         "exact-module-source-digest",
     ]),
     confidence: z.literal("exact"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const sourceMapMatchSchema = z.strictObject({
     status: z.literal("matched"),
     basis: z.literal("source-map-identity"),
     confidence: z.literal("high"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const inferredMatchSchema = z.strictObject({
     status: z.literal("matched"),
     basis: z.enum(["structural-fingerprint", "semantic-key"]),
     confidence: z.literal("medium"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const matchedItemMatchSchema = z.union([
     exactMatchSchema,
@@ -71,14 +82,14 @@ const unmatchedItemMatchSchema = z.strictObject({
     status: z.literal("unmatched"),
     basis: z.literal("none"),
     confidence: z.literal("unknown"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const leftAmbiguousMatchSchema = z.strictObject({
     status: z.literal("ambiguous"),
     basis: z.literal("none"),
     confidence: z.literal("unknown"),
-    candidate_left_node_ids: emptyCandidateNodesSchema,
+    candidate_left_node_ids: emptyArraySchema,
     candidate_right_node_ids: candidateNodesSchema,
 });
 const rightAmbiguousMatchSchema = z.strictObject({
@@ -86,7 +97,7 @@ const rightAmbiguousMatchSchema = z.strictObject({
     basis: z.literal("none"),
     confidence: z.literal("unknown"),
     candidate_left_node_ids: candidateNodesSchema,
-    candidate_right_node_ids: emptyCandidateNodesSchema,
+    candidate_right_node_ids: emptyArraySchema,
 });
 const comparisonItemContextShape = {
     item_id: prefixedDigestSchema("javc_item"),
@@ -194,3 +205,7 @@ export const applicationVersionComparisonResultSchema = z
             message: "Comparison coverage must match source graph completeness",
         });
 });
+/** Reuse the exact owned change graph while validating the rest of the result. */
+export const ownedApplicationVersionComparisonResultSchema = applicationVersionComparisonResultSchema.safeExtend({
+    graph: z.custom(isValidatedImmutableJavaScriptApplicationGraph),
+});

package/dist/domain/javascript/javascriptApplicationVersionItems.js

@@ -1,5 +1,6 @@
-import { absenceClaimable, canonicalDigest, canonicalJson, } from "../comparisonSemantics.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { absenceClaimable, canonicalJson } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Classify matched, unmatched, and ambiguous nodes without inventing absence. */
 export const classifyJavaScriptApplicationVersions = (matching, context) => {
     const pairByLeft = new Map(matching.pairs.map(({ left, right }) => [
@@ -10,7 +11,18 @@ export const classifyJavaScriptApplicationVersions = (matching, context) => {
         right.node_id,
         `pair:${left.node_id}:${right.node_id}`,
     ]));
-    const fullContext = { ...context, pairByLeft, pairByRight };
+    const fullContext = {
+        leftGraph: context.leftGraph,
+        rightGraph: context.rightGraph,
+        leftEvidenceId: context.leftEvidenceId,
+        rightEvidenceId: context.rightEvidenceId,
+        leftNativeEvidenceByDigest: indexNativeEvidence(context.leftNativeEvidence),
+        rightNativeEvidenceByDigest: indexNativeEvidence(context.rightNativeEvidence),
+        pairByLeft,
+        pairByRight,
+        leftRelationships: indexRelationships(context.leftGraph),
+        rightRelationships: indexRelationships(context.rightGraph),
+    };
     const leftItems = matching.unmatchedLeft.map((node) => {
         const candidates = matching.candidatesForLeft.get(node.node_id) ?? [];
         return unmatchedItem({
@@ -30,7 +42,7 @@ export const classifyJavaScriptApplicationVersions = (matching, context) => {
             ...matching.pairs.map((pair) => matchedItem(pair, fullContext)),
             ...leftItems,
             ...rightItems,
-        ].sort((left, right) => compareCodePoints(left.item_id, right.item_id)),
+        ].sort((left, right) => compareUnicodeCodePoints(left.item_id, right.item_id)),
     };
 };
 const matchedItem = (pair, context) => {
@@ -201,42 +213,46 @@ const contentIdentity = (node) => {
 };
 const locations = (node) => node.observations
     .map(({ evidence }) => evidence.location.available ? evidence.location.value : evidence.location)
-    .sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right)));
+    .sort((left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right)));
 const properties = (node) => node.observations
     .map(({ label, properties: values, source_map_reference }) => ({
     label,
     properties: values,
     source_map_reference,
 }))
-    .sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right)));
+    .sort((left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right)));
+const indexRelationships = (graph) => {
+    const adjacency = new Map();
+    const add = (nodeId, relationship) => {
+        const existing = adjacency.get(nodeId);
+        if (existing === undefined)
+            adjacency.set(nodeId, [relationship]);
+        else
+            existing.push(relationship);
+    };
+    for (const edge of graph.edges) {
+        add(edge.source_node_id, {
+            direction: "out",
+            relation: edge.relation,
+            neighborId: edge.target_node_id,
+        });
+        if (edge.target_node_id !== edge.source_node_id)
+            add(edge.target_node_id, {
+                direction: "in",
+                relation: edge.relation,
+                neighborId: edge.source_node_id,
+            });
+    }
+    return {
+        nodeById: new Map(graph.nodes.map((value) => [value.node_id, value])),
+        adjacency,
+    };
+};
 const relationshipSignature = (node, side, context) => {
-    const graph = side === "left" ? context.leftGraph : context.rightGraph;
+    const { nodeById, adjacency } = side === "left" ? context.leftRelationships : context.rightRelationships;
     const paired = side === "left" ? context.pairByLeft : context.pairByRight;
-    const nodeById = new Map(graph.nodes.map((value) => [value.node_id, value]));
-    const signatures = graph.edges.flatMap((edge) => {
-        if (edge.source_node_id === node.node_id)
-            return [
-                edgeSignature({
-                    direction: "out",
-                    relation: edge.relation,
-                    neighborId: edge.target_node_id,
-                    paired,
-                    nodeById,
-                }),
-            ];
-        if (edge.target_node_id === node.node_id)
-            return [
-                edgeSignature({
-                    direction: "in",
-                    relation: edge.relation,
-                    neighborId: edge.source_node_id,
-                    paired,
-                    nodeById,
-                }),
-            ];
-        return [];
-    });
-    return canonicalJson(signatures.sort(compareCodePoints));
+    const signatures = (adjacency.get(node.node_id) ?? []).map((relationship) => edgeSignature({ ...relationship, paired, nodeById }));
+    return canonicalJson(signatures.sort(compareUnicodeCodePoints));
 };
 const edgeSignature = (context) => {
     const mapped = context.paired.get(context.neighborId);
@@ -247,19 +263,30 @@ const itemEvidenceLinks = (left, right, context) => [
     ...new Set([
         context.leftEvidenceId,
         context.rightEvidenceId,
-        ...nativeLinks(left, context.leftNativeEvidence),
-        ...nativeLinks(right, context.rightNativeEvidence),
+        ...nativeLinks(left, context.leftNativeEvidenceByDigest),
+        ...nativeLinks(right, context.rightNativeEvidenceByDigest),
     ]),
-].sort(compareCodePoints);
-const nativeLinks = (node, evidence) => {
-    const digest = node === undefined
-        ? null
-        : contentIdentity(node)?.replace(/^content:/u, "");
-    return digest === null
-        ? []
-        : evidence
-            .filter(({ subject }) => subject?.digest.sha256 === digest)
-            .map(({ evidence_id: id }) => id);
+].sort(compareUnicodeCodePoints);
+const nativeLinks = (node, evidenceByDigest) => {
+    const identity = node === undefined ? null : contentIdentity(node);
+    if (identity === null)
+        return [];
+    const digest = identity.replace(/^content:/u, "");
+    return evidenceByDigest.get(digest) ?? [];
+};
+const indexNativeEvidence = (evidence) => {
+    const evidenceByDigest = new Map();
+    for (const { evidence_id: id, subject } of evidence) {
+        const digest = subject?.digest.sha256;
+        if (digest === undefined)
+            continue;
+        const ids = evidenceByDigest.get(digest);
+        if (ids === undefined)
+            evidenceByDigest.set(digest, [id]);
+        else
+            ids.push(id);
+    }
+    return evidenceByDigest;
 };
 const pairLimitations = (pair, status) => [
     ...(pair.basis === "structural-fingerprint"
@@ -283,7 +310,7 @@ const pairLimitations = (pair, status) => [
 ];
 const itemWithId = (semantic) => ({
     ...semantic,
-    item_id: `javc_item_${canonicalDigest(semantic, "Application version item")}`,
+    item_id: `javc_item_${digestCanonicalValue(semantic, "Application version item")}`,
 });
 const stringProperty = (node, key) => {
     const values = [

package/dist/domain/javascript/javascriptApplicationVersionKeys.js

@@ -1,5 +1,5 @@
 import { canonicalJson } from "../comparisonSemantics.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrder.js";
 const matchTiers = () => [
     {
         match: { basis: "exact-content-digest", confidence: "exact" },
@@ -40,7 +40,7 @@ export const matchJavaScriptApplicationVersions = (leftNodes, rightNodes) => {
     const leftIds = new Set(remainingLeft.map(({ node_id: id }) => id));
     const rightIds = new Set(remainingRight.map(({ node_id: id }) => id));
     return {
-        pairs: pairs.sort((a, b) => compareCodePoints(`${a.left.node_id}\0${a.right.node_id}`, `${b.left.node_id}\0${b.right.node_id}`)),
+        pairs: pairs.sort((a, b) => compareUnicodeCodePoints(`${a.left.node_id}\0${a.right.node_id}`, `${b.left.node_id}\0${b.right.node_id}`)),
         unmatchedLeft: remainingLeft,
         unmatchedRight: remainingRight,
         candidatesForLeft: filteredCandidates(leftCandidates, rightIds),
@@ -50,7 +50,7 @@ export const matchJavaScriptApplicationVersions = (leftNodes, rightNodes) => {
 const applyTier = (context) => {
     const leftByKey = nodesByKey(context.left.values(), context.tier.key);
     const rightByKey = nodesByKey(context.right.values(), context.tier.key);
-    for (const key of [...leftByKey.keys()].sort(compareCodePoints)) {
+    for (const key of [...leftByKey.keys()].sort(compareUnicodeCodePoints)) {
         const leftGroup = leftByKey.get(key) ?? [];
         const rightGroup = rightByKey.get(key) ?? [];
         if (rightGroup.length === 0)
@@ -98,7 +98,7 @@ const recordCandidates = (left, right, leftCandidates, rightCandidates) => {
 const filteredCandidates = (candidates, retained) => new Map([...candidates.entries()].flatMap(([nodeId, values]) => {
     const filtered = [...values]
         .filter((value) => retained.has(value))
-        .sort(compareCodePoints);
+        .sort(compareUnicodeCodePoints);
     return filtered.length === 0 ? [] : [[nodeId, filtered]];
 }));
 const nodeIdentityKey = (node) => `node\0${node.kind}\0${node.node_id}`;
@@ -153,7 +153,15 @@ const semanticValue = (node, properties) => {
             exactString(properties.api_key) ??
             nonEmptyString(properties.api_name));
     if (node.kind === "native-export")
-        return (joined(properties.specifier, stringList(properties.requested_members).join(",")) ?? firstLabel(node));
+        return (joined(properties.specifier, compositeKey([
+            stringList(properties.requested_members),
+            typeof properties.namespace_access === "boolean"
+                ? properties.namespace_access
+                : null,
+            typeof properties.dynamic_member_access === "boolean"
+                ? properties.dynamic_member_access
+                : null,
+        ])) ?? firstLabel(node));
     if ([
         "electron-main",
         "electron-preload",
@@ -178,7 +186,7 @@ const uniqueStringProperty = (node, name) => {
 };
 const joined = (...values) => {
     const strings = values.map(nonEmptyString);
-    return strings.some((value) => value === null) ? null : strings.join("\0");
+    return strings.some((value) => value === null) ? null : compositeKey(strings);
 };
 const nonEmptyString = (value) => typeof value === "string" && value !== "" ? value : null;
 /** A literal value such as `ipcMain.handle("")` keeps its exact empty text. */
@@ -186,6 +194,6 @@ const exactString = (value) => typeof value === "string" ? value : null;
 const stringList = (value) => Array.isArray(value)
     ? value
         .filter((item) => typeof item === "string")
-        .sort(compareCodePoints)
+        .sort(compareUnicodeCodePoints)
     : [];
-const sortedNodes = (nodes) => [...nodes].sort((left, right) => compareCodePoints(left.node_id, right.node_id));
+const sortedNodes = (nodes) => [...nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));