rea-agents 6.2.0 → 6.4.0

package/dist/domain/javascript/javascriptAstFingerprint.js

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
 import * as t from "@babel/types";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
-import { propertyName } from "./javascriptAstValues.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
+import { propertyName, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
 import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
 /** Derive a rename-resistant syntax fingerprint without code execution. */
 export const fingerprintJavaScriptAst = (node) => {
@@ -28,7 +28,7 @@ export const collectJavaScriptExports = (node) => {
         },
     });
     return {
-        values: [...exports].sort(compareCodePoints),
+        values: [...exports].sort(compareUnicodeCodePoints),
     };
 };
 const semanticTokens = (node) => {
@@ -59,40 +59,71 @@ const semanticTokens = (node) => {
 };
 const collectAssignmentExports = (left, right, output) => {
     const path = memberPath(left);
-    if (path === "exports" || path === "module.exports") {
+    if (path === null)
+        return;
+    // Rebinding the CommonJS alias does not replace module.exports.
+    if (path.length === 1 && path[0] === "exports")
+        return;
+    const exportOffset = path[0] === "exports"
+        ? 1
+        : path[0] === "module" && path[1] === "exports"
+            ? 2
+            : null;
+    if (exportOffset === null)
+        return;
+    if (path.length === exportOffset) {
         if (t.isObjectExpression(right))
             collectObjectKeys(right, output);
         else
             addExport(output, "default");
         return;
     }
-    if (path.startsWith("exports."))
-        addExport(output, path.slice("exports.".length));
-    if (path.startsWith("module.exports."))
-        addExport(output, path.slice("module.exports.".length));
+    // A CommonJS export assignment exposes the first property below the
+    // exports object. Deeper writes mutate that exported value, rather than
+    // creating an export whose name is the dotted member path.
+    addExport(output, path[exportOffset]);
 };
 const collectCallExports = (call, output) => {
     const callee = memberPath(call.callee);
-    if (callee === "Object.defineProperty") {
-        const target = memberPath(call.arguments[0]);
+    if (callee === null)
+        return;
+    const definePropertyCall = callee.length === 2 &&
+        callee[0] === "Object" &&
+        callee[1] === "defineProperty";
+    const declarationCall = callee.length >= 2 && callee.at(-1) === "d";
+    if (!definePropertyCall && !declarationCall)
+        return;
+    const target = memberPath(call.arguments[0]);
+    const exportTarget = target !== null &&
+        ((target.length === 1 && target[0] === "exports") ||
+            (target.length === 2 &&
+                target[0] === "module" &&
+                target[1] === "exports"));
+    if (!exportTarget)
+        return;
+    if (definePropertyCall) {
         const name = stringValue(call.arguments[1]);
-        if ((target === "exports" || target === "module.exports") && name)
+        if (name !== undefined)
             addExport(output, name);
-    }
-    if (!callee.endsWith(".d"))
         return;
-    const target = memberPath(call.arguments[0]);
+    }
     const declarations = call.arguments[1];
-    if ((target === "exports" || target === "module.exports") &&
-        t.isObjectExpression(declarations))
+    if (t.isObjectExpression(declarations))
         collectObjectKeys(declarations, output);
 };
 const collectObjectKeys = (object, output) => {
     for (const property of object.properties) {
         if (!t.isObjectProperty(property) && !t.isObjectMethod(property))
             continue;
-        const name = propertyName(property.key);
-        if (name !== "")
+        const name = semanticStaticPropertyKey(property.key, property.computed);
+        // In an object literal, a non-computed `__proto__: value` sets the
+        // prototype instead of creating an own property. Shorthand, computed,
+        // and method forms do create own properties.
+        if (name !== null &&
+            !(t.isObjectProperty(property) &&
+                !property.computed &&
+                !property.shorthand &&
+                name === "__proto__"))
             addExport(output, name);
     }
 };
@@ -105,22 +136,18 @@ const memberPath = (node) => {
     while (current !== undefined &&
         current !== null &&
         (t.isMemberExpression(current) || t.isOptionalMemberExpression(current))) {
-        properties.push(propertyName(current.property));
-        current = t.isNode(current.object) ? current.object : undefined;
+        const property = semanticStaticPropertyKey(current.property, current.computed);
+        if (property === null)
+            return null;
+        properties.push(property);
+        current = current.object;
     }
-    const root = current !== undefined && t.isIdentifier(current)
+    if (current === undefined || current === null)
+        return null;
+    const root = t.isIdentifier(current)
         ? current.name
-        : current !== undefined && t.isThisExpression(current)
+        : t.isThisExpression(current)
             ? "this"
-            : "";
-    if (properties.length === 0)
-        return root;
-    properties.reverse();
-    const path = root === "" ? [] : [root];
-    for (const property of properties) {
-        if (path.length === 0 && property === "")
-            continue;
-        path.push(property);
-    }
-    return path.join(".");
+            : null;
+    return root === null ? null : [root, ...properties.reverse()];
 };

package/dist/domain/javascript/javascriptAstValues.js

@@ -1,6 +1,27 @@
 import * as t from "@babel/types";
+/**
+ * Remove wrappers that affect TypeScript or Flow checking but not runtime
+ * expression identity. The returned depth lets bounded evaluators account for
+ * syntax that normalization would otherwise skip.
+ */
+export const unwrapJavaScriptExpression = (node) => {
+    let current = node;
+    let depth = 0;
+    while (t.isParenthesizedExpression(current) ||
+        t.isTSAsExpression(current) ||
+        t.isTSTypeAssertion(current) ||
+        t.isTSNonNullExpression(current) ||
+        t.isTSSatisfiesExpression(current) ||
+        t.isTSInstantiationExpression(current) ||
+        t.isTypeCastExpression(current)) {
+        current = current.expression;
+        depth += 1;
+    }
+    return { node: current, depth };
+};
 /** Read one syntax-level primitive only when its value is exact. */
 export const readExactJavaScriptLiteral = (node) => {
+    node = unwrapJavaScriptExpression(node).node;
     if (t.isStringLiteral(node))
         return { found: true, value: node.value };
     if (t.isNumericLiteral(node) && Number.isFinite(node.value))
@@ -31,10 +52,43 @@ export const propertyName = (node) => {
 export const semanticStaticPropertyName = (property, computed) => semanticStaticPropertyKey(property, computed) ?? "";
 /** Read an exact property key, preserving the legal empty-string key. */
 export const semanticStaticPropertyKey = (property, computed) => {
+    property = unwrapJavaScriptExpression(property).node;
     if (t.isStringLiteral(property) || t.isNumericLiteral(property))
         return String(property.value);
     return !computed && t.isIdentifier(property) ? property.name : null;
 };
+/** Read exact consumed object-pattern keys, leaving dynamic keys unknown. */
+export const semanticObjectPatternKeys = (pattern) => pattern.properties.flatMap((property) => {
+    if (t.isRestElement(property))
+        return [];
+    const key = semanticStaticPropertyKey(property.key, property.computed);
+    return key === null ? [] : [key];
+});
+/** Visit member write targets in direct and destructuring assignment forms. */
+export function* semanticMemberWriteTargets(root) {
+    const pending = [root];
+    while (pending.length > 0) {
+        const next = pending.pop();
+        if (next === undefined)
+            break;
+        const node = unwrapJavaScriptExpression(next).node;
+        if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node))
+            yield node;
+        else if (t.isRestElement(node))
+            pending.push(node.argument);
+        else if (t.isAssignmentPattern(node))
+            pending.push(node.left);
+        else if (t.isArrayPattern(node)) {
+            for (const element of node.elements.toReversed())
+                if (element !== null)
+                    pending.push(element);
+        }
+        else if (t.isObjectPattern(node)) {
+            for (const property of node.properties.toReversed())
+                pending.push(t.isRestElement(property) ? property.argument : property.value);
+        }
+    }
+}
 /**
  * Display an exact JavaScript string as nonempty label text. Graph labels and
  * artifact-local keys are nonempty, so the legal empty value is shown as `""`;

package/dist/domain/javascript/javascriptElectronMemberWrites.js

@@ -0,0 +1,50 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyKey, semanticMemberWriteTargets, unwrapJavaScriptExpression, } from "./javascriptAstValues.js";
+import { SemanticPropertyPathCoverage } from "./javascriptSemanticPropertyPaths.js";
+import { traverseJavaScriptAstSteps } from "./javascriptSemanticTraversal.js";
+/** Match Electron's supported module entry points. */
+export const ELECTRON_MODULE = /^electron(?:\/(?:common|main|renderer|utility))?$/u;
+/**
+ * Electron's CommonJS exports define no `default` member, so a leading
+ * `default` segment can only denote the module object itself, as an ES module
+ * default import (`import electron from "electron"`) binds it.
+ */
+export const electronExportPath = (importedPath) => importedPath[0] === "default" ? importedPath.slice(1) : importedPath;
+/** Static identity recovery cannot establish the absence of Electron usage. */
+export const ELECTRON_IDENTITY_LIMITATION = "Electron API identity follows proven lexical module aliases. Reassigned bindings, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.";
+/** Preserve exact property segments instead of flattening literal dotted keys. */
+export const electronMemberPath = (node) => {
+    let root = unwrapJavaScriptExpression(node).node;
+    const members = [];
+    while (t.isMemberExpression(root) || t.isOptionalMemberExpression(root)) {
+        members.push(semanticStaticPropertyKey(root.property, root.computed));
+        root = unwrapJavaScriptExpression(root.object).node;
+    }
+    return { root, members: members.toReversed() };
+};
+/** Index visible writes through proven Electron aliases, without executing them. */
+export function* collectElectronMemberWritesSteps(program, origin) {
+    const writes = new SemanticPropertyPathCoverage();
+    yield* traverseJavaScriptAstSteps(program, {
+        enter: (node) => {
+            const target = t.isAssignmentExpression(node)
+                ? node.left
+                : t.isUpdateExpression(node)
+                    ? node.argument
+                    : t.isUnaryExpression(node, { operator: "delete" })
+                        ? node.argument
+                        : t.isForOfStatement(node) || t.isForInStatement(node)
+                            ? node.left
+                            : undefined;
+            if (target === undefined)
+                return;
+            for (const member of semanticMemberWriteTargets(target)) {
+                const { root, members } = electronMemberPath(member);
+                const exported = origin(root);
+                if (exported !== undefined)
+                    writes.retain([...exported, ...members]);
+            }
+        },
+    });
+    return writes;
+}

package/dist/domain/javascript/javascriptExportShapeComparison.js

@@ -1,4 +1,5 @@
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { canonicalExportShapeValue, digestExportShapeValue, } from "./javascriptExportShapeComparisonIdentity.js";
 import { javaScriptExportShapeComparisonResultSchema, } from "./javascriptExportShapeComparisonSchemas.js";
 import { retainJavaScriptExportShapes, selectJavaScriptExport, } from "./javascriptExportShapeSelection.js";
@@ -65,7 +66,7 @@ const sortChanges = (changes) => changes
         change_id: change.change_id,
     }),
 }))
-    .sort((left, right) => compareCodePoints(left.sortKey, right.sortKey) ||
+    .sort((left, right) => compareUnicodeCodePoints(left.sortKey, right.sortKey) ||
     left.index - right.index)
     .map(({ change }) => change);
 const comparisonCoverage = (context) => {

package/dist/domain/javascript/javascriptExportShapeComparisonSchemas.js

@@ -5,7 +5,6 @@ const evidenceIdSchema = prefixedDigestSchema("ev");
 const graphIdSchema = prefixedDigestSchema("jag");
 const nodeIdSchema = prefixedDigestSchema("jag_node");
 const textSchema = z.string().min(1);
-const selectorTextSchema = textSchema;
 const semanticPrimitiveSchema = z.union([
     z.string(),
     z.number().finite(),
@@ -49,24 +48,34 @@ const sourceRangeSchema = z
             message: "Source range end must not precede its start",
         });
 });
-/** Two authenticated application graphs and exact export selectors. */
-export const compareJavaScriptExportShapesInputSchema = z
-    .strictObject({
-    left: evidenceSchema,
-    right: evidenceSchema,
-    left_module_path: selectorTextSchema,
-    left_export_name: selectorTextSchema,
-    right_module_path: selectorTextSchema,
-    right_export_name: selectorTextSchema,
-})
-    .superRefine((input, context) => {
+/** Check that export-shape comparisons bind distinct source Evidence. */
+const validateJavaScriptExportShapeIdentities = (input, context) => {
     if (input.left.evidence_id === input.right.evidence_id)
         context.addIssue({
             code: "custom",
             path: ["right"],
             message: "JavaScript export shape Evidence must be distinct",
         });
-});
+};
+const evidenceIdentitySchema = z.object({ evidence_id: evidenceIdSchema });
+/** Validate export-shape identities without capturing complete source graphs. */
+export const javaScriptExportShapeIdentitiesSchema = z
+    .object({
+    left: evidenceIdentitySchema,
+    right: evidenceIdentitySchema,
+})
+    .superRefine(validateJavaScriptExportShapeIdentities);
+/** Two authenticated application graphs and exact export selectors. */
+export const compareJavaScriptExportShapesInputSchema = z
+    .strictObject({
+    left: evidenceSchema,
+    right: evidenceSchema,
+    left_module_path: textSchema,
+    left_export_name: textSchema,
+    right_module_path: textSchema,
+    right_export_name: textSchema,
+})
+    .superRefine(validateJavaScriptExportShapeIdentities);
 const projectedReturnFieldShape = {
     path: jsonPointerSchema,
     presence: z.enum(["present", "absent", "unknown-coverage"]),
@@ -138,8 +147,8 @@ const projectedReturnShapeSchema = z
 export const projectedExportReturnShapesSchema = z
     .strictObject({
     semantic_role: z.literal("export-return-shapes"),
-    module_path: selectorTextSchema,
-    exported_name: selectorTextSchema,
+    module_path: textSchema,
+    exported_name: textSchema,
     callable_id: textSchema,
     callable_kind: z.enum(["function", "class", "method"]),
     static_return_shapes: z.array(projectedReturnShapeSchema),
@@ -163,16 +172,16 @@ export const projectedExportReturnShapesSchema = z
 });
 const exportCandidateSchema = z.strictObject({
     node_id: nodeIdSchema,
-    module_path: selectorTextSchema,
-    export_name: selectorTextSchema,
+    module_path: textSchema,
+    export_name: textSchema,
     matches_requested_module: z.boolean(),
     matches_requested_export: z.boolean(),
 });
 const selectorResultShape = {
     evidence_id: evidenceIdSchema,
     graph_id: graphIdSchema,
-    requested_module_path: selectorTextSchema,
-    requested_export_name: selectorTextSchema,
+    requested_module_path: textSchema,
+    requested_export_name: textSchema,
     candidates: z.array(exportCandidateSchema),
     omitted_candidates: z.number().int().min(0),
 };
@@ -217,7 +226,8 @@ const propertyPresenceSchema = z.enum([
     "absent",
     "unknown-coverage",
 ]);
-const comparisonChangeSchema = z.strictObject({
+/** One change row; presence is required even when values stay unknown. */
+export const javaScriptExportShapeComparisonChangeSchema = z.strictObject({
     change_id: prefixedDigestSchema("jesc_change"),
     status: z.enum(["added", "removed", "changed", "unknown"]),
     path: jsonPointerSchema,
@@ -233,8 +243,6 @@ const comparisonChangeSchema = z.strictObject({
     evidence_links: z.array(evidenceIdSchema).length(2),
     limitations: z.array(textSchema),
 });
-/** One change row; presence is required even when values stay unknown. */
-export const javaScriptExportShapeComparisonChangeSchema = comparisonChangeSchema;
 const inventoryPropertyCoverageSchema = z.strictObject({
     path: jsonPointerSchema,
     status: z.enum(["complete", "partial"]),
@@ -260,7 +268,7 @@ export const javaScriptExportShapeComparisonResultSchema = z.strictObject({
         changed: z.number().int().min(0),
         unknown: z.number().int().min(0),
     }),
-    changes: z.array(comparisonChangeSchema),
+    changes: z.array(javaScriptExportShapeComparisonChangeSchema),
     coverage: z.strictObject({
         status: z.enum(["complete-within-inputs", "partial", "truncated"]),
         left_graph_status: z.enum([

package/dist/domain/javascript/javascriptExportShapeSelection.js

@@ -1,5 +1,5 @@
 import { projectedExportReturnShapesSchema, } from "./javascriptExportShapeComparisonSchemas.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Select one exact trusted export and its exact static return-shape observation. */
 export const selectJavaScriptExport = (side) => {
     const candidates = exportCandidates(side.graph);
@@ -90,7 +90,7 @@ const exportCandidates = (graph) => {
             });
         }
     }
-    return [...candidates.values()].sort((left, right) => compareCodePoints(candidateKey(left), candidateKey(right)));
+    return [...candidates.values()].sort((left, right) => compareUnicodeCodePoints(candidateKey(left), candidateKey(right)));
 };
 const candidateKey = (candidate) => `${candidate.modulePath}\0${candidate.exportName}\0${candidate.node.node_id}`;
 const returnShapeFor = (node, side) => {

package/dist/domain/javascript/javascriptExportShapeVariants.js

@@ -1,5 +1,6 @@
 import { canonicalExportShapeValue, digestExportShapeValue, } from "./javascriptExportShapeComparisonIdentity.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 const UNKNOWN_COVERAGE_PRESENCE = {
     left: "unknown-coverage",
     right: "unknown-coverage",
@@ -139,7 +140,7 @@ const addTarget = (map, source, target) => {
     map.set(source, values);
 };
 const indexesNotIn = (shapes, paired) => shapes.map((_, index) => index).filter((index) => !paired.has(index));
-const compareDiscriminants = (left, right) => compareCodePoints(canonicalExportShapeValue(left), canonicalExportShapeValue(right));
+const compareDiscriminants = (left, right) => compareUnicodeCodePoints(canonicalExportShapeValue(left), canonicalExportShapeValue(right));
 const selectionUnknownChange = (input) => changeWithId({
     status: "unknown",
     path: "",

package/dist/domain/javascript/javascriptFeatureSeed.js

@@ -1,9 +1,9 @@
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { featureSeedMatchMode, } from "./javascriptFeatureTraceSchemas.js";
 /** Locate every graph node matching a typed literal seed without regex execution. */
 export const findApplicationFeatureSeeds = (nodes, seed) => nodes
     .flatMap((node) => seedMatch(node, seed))
-    .sort((left, right) => compareCodePoints(`${left.node_id}\0${left.basis}\0${left.field}`, `${right.node_id}\0${right.basis}\0${right.field}`));
+    .sort((left, right) => compareUnicodeCodePoints(`${left.node_id}\0${left.basis}\0${left.field}`, `${right.node_id}\0${right.basis}\0${right.field}`));
 const seedMatch = (node, seed) => {
     if (seed.kind === "node-id")
         return node.node_id === seed.value
@@ -171,7 +171,9 @@ const propertyFields = (value, prefix) => {
             continue;
         }
         if (current !== null && typeof current === "object") {
-            for (const key of Object.keys(current).sort(compareCodePoints).reverse())
+            for (const key of Object.keys(current)
+                .sort(compareUnicodeCodePoints)
+                .reverse())
                 pending.push({
                     current: current[key] ?? null,
                     path: `${path}.${key}`,

package/dist/domain/javascript/javascriptFeatureTrace.js

@@ -1,5 +1,6 @@
-import { canonicalDigest } from "../comparisonSemantics.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { createJavaScriptApplicationGraph, } from "./javascriptApplicationGraph.js";
 import { applicationFeatureTraceResultSchema, } from "./javascriptFeatureTraceSchemas.js";
 import { findApplicationFeatureSeeds, } from "./javascriptFeatureSeed.js";
@@ -46,7 +47,7 @@ export const traceApplicationFeature = (input) => {
     };
     return applicationFeatureTraceResultSchema.parse({
         ...semantic,
-        trace_id: `jatr_${canonicalDigest(semantic, "Feature trace")}`,
+        trace_id: `jatr_${digestCanonicalValue(semantic, "Feature trace")}`,
     });
 };
 const noMatchResult = (input) => {
@@ -83,7 +84,7 @@ const noMatchResult = (input) => {
     };
     return applicationFeatureTraceResultSchema.parse({
         ...semantic,
-        trace_id: `jatr_${canonicalDigest(semantic, "Feature trace")}`,
+        trace_id: `jatr_${digestCanonicalValue(semantic, "Feature trace")}`,
     });
 };
 const traceGraph = (input, seedMatches, traversal) => {
@@ -112,7 +113,7 @@ const terminalPaths = (traversal, seeds) => {
         (!seedIds.has(node.node_id) || traversal.nodes.length === 1))
         .map((node) => pathTo(node, traversal.predecessors, edgeById))
         .filter((path) => path !== null)
-        .sort((left, right) => compareCodePoints(left.path_id, right.path_id));
+        .sort((left, right) => compareUnicodeCodePoints(left.path_id, right.path_id));
 };
 const pathTo = (node, predecessors, edgeById) => {
     const nodeIds = [node.node_id];
@@ -144,7 +145,7 @@ const pathTo = (node, predecessors, edgeById) => {
     };
     return {
         ...semantic,
-        path_id: `jatp_${canonicalDigest(semantic, "Feature trace")}`,
+        path_id: `jatp_${digestCanonicalValue(semantic, "Feature trace")}`,
     };
 };
 const isTerminal = (node) => ["endpoint", "storage", "native-addon", "native-export", "unknown"].includes(node.kind);

package/dist/domain/javascript/javascriptFeatureTraceSchemas.js

@@ -36,6 +36,22 @@ const applicationFeatureSeedSchema = z.union([
         case_sensitive: z.boolean().default(false),
     }),
 ]);
+/** Check unique native identities before projecting an application trace. */
+const validateApplicationTraceIdentities = (input, context) => {
+    const ids = input.native_observations.map(({ evidence_id: id }) => id);
+    if (new Set(ids).size !== ids.length)
+        context.addIssue({
+            code: "custom",
+            path: ["native_observations"],
+            message: "Native observations must be unique",
+        });
+};
+/** Validate native trace identities without capturing their complete Evidence. */
+export const applicationTraceIdentitiesSchema = z
+    .object({
+    native_observations: z.array(z.object({ evidence_id: evidenceIdSchema })),
+})
+    .superRefine(validateApplicationTraceIdentities);
 /** Evidence-backed application graph and feature seed. */
 export const traceApplicationFeatureInputSchema = z
     .strictObject({
@@ -44,15 +60,7 @@ export const traceApplicationFeatureInputSchema = z
     seed: applicationFeatureSeedSchema,
     direction: z.enum(["outgoing", "incoming", "both"]).default("both"),
 })
-    .superRefine((input, context) => {
-    const ids = input.native_observations.map(({ evidence_id: id }) => id);
-    if (new Set(ids).size !== ids.length)
-        context.addIssue({
-            code: "custom",
-            path: ["native_observations"],
-            message: "Native observations must be unique",
-        });
-});
+    .superRefine(validateApplicationTraceIdentities);
 const seedMatchSchema = z.strictObject({
     node_id: nodeIdSchema,
     kind: z.string().min(1),

package/dist/domain/javascript/javascriptFeatureTraversal.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Traverse a JAG without treating edge inference as observed reachability. */
 export const traverseApplicationFeature = (graph, seedNodeIds, direction) => {
     const nodeById = new Map(graph.nodes.map((node) => [node.node_id, node]));
@@ -29,8 +29,8 @@ export const traverseApplicationFeature = (graph, seedNodeIds, direction) => {
         nodes: [...visited]
             .map((nodeId) => nodeById.get(nodeId))
             .filter((node) => node !== undefined)
-            .sort((left, right) => compareCodePoints(left.node_id, right.node_id)),
-        edges: [...retainedEdges.values()].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id)),
+            .sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id)),
+        edges: [...retainedEdges.values()].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id)),
         predecessors,
     };
 };
@@ -49,7 +49,7 @@ const buildAdjacency = (edges, direction) => {
             });
     }
     for (const entries of adjacency.values())
-        entries.sort((left, right) => compareCodePoints(`${left.edge.edge_id}\0${left.nextNodeId}`, `${right.edge.edge_id}\0${right.nextNodeId}`));
+        entries.sort((left, right) => compareUnicodeCodePoints(`${left.edge.edge_id}\0${left.nextNodeId}`, `${right.edge.edge_id}\0${right.nextNodeId}`));
     return adjacency;
 };
 const addAdjacency = (adjacency, nodeId, entry) => {

package/dist/domain/javascript/javascriptModuleSemanticIr.js

@@ -0,0 +1,15 @@
+/** Retain facts consumed by source-module and export-return composition. */
+export const projectJavaScriptModuleSemantics = (ir) => {
+    const scopes = ir.scopes.filter(({ kind }) => kind === "program");
+    const programScopeId = scopes[0]?.scopeId;
+    const localNames = new Set(ir.moduleLinks.map(({ localName }) => localName));
+    const callableIds = new Set(ir.moduleLinks.map(({ callableId }) => callableId));
+    return {
+        scopes,
+        bindings: ir.bindings.filter(({ name, scopeId }) => scopeId === programScopeId && localNames.has(name)),
+        callables: ir.callables.filter(({ callableId }) => callableIds.has(callableId)),
+        moduleLinks: ir.moduleLinks,
+        coverage: ir.coverage,
+        limitations: ir.limitations,
+    };
+};

package/dist/domain/javascript/javascriptNativeHandoff.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import {} from "./javascriptApplicationGraphSchemas.js";
 /** Build provider-neutral addon targets and link exact-subject native Evidence. */
 export const buildJavaScriptNativeHandoffs = (nodes, edges, nativeEvidence) => {
@@ -24,7 +24,7 @@ export const buildJavaScriptNativeHandoffs = (nodes, edges, nativeEvidence) => {
                 providers: uniqueProviders(linked),
                 evidence_ids: linked
                     .map(({ evidence_id: id }) => id)
-                    .sort(compareCodePoints),
+                    .sort(compareUnicodeCodePoints),
                 recommended_tools: [
                     "open_binary",
                     "binary_overview",
@@ -35,7 +35,7 @@ export const buildJavaScriptNativeHandoffs = (nodes, edges, nativeEvidence) => {
             },
         ];
     })
-        .sort((left, right) => compareCodePoints(left.native_node_id, right.native_node_id));
+        .sort((left, right) => compareUnicodeCodePoints(left.native_node_id, right.native_node_id));
 };
 const artifactDigest = (node) => {
     if (node.identity.strategy === "content-digest")
@@ -65,15 +65,20 @@ const nativeExportNodes = (addon, edges, nodeById) => {
     return [...new Set(ids)]
         .map((id) => nodeById.get(id))
         .filter((node) => node?.kind === "native-export")
-        .sort((left, right) => compareCodePoints(left.node_id, right.node_id));
+        .sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));
 };
 const requestedExports = (nodes) => {
     const values = nodes.flatMap((node) => node.observations.flatMap((observation) => [
-        ...(observation.label === null ? [] : [observation.label]),
+        // Display labels can summarize several names or namespace access.
+        // Only legacy observations without structured member facts need them.
+        ...(observation.label === null ||
+            Array.isArray(observation.properties.requested_members)
+            ? []
+            : [observation.label]),
         ...stringArray(observation.properties.requested_members),
         ...stringArray(observation.properties.members),
     ]));
-    return [...new Set(values)].sort(compareCodePoints);
+    return [...new Set(values)].sort(compareUnicodeCodePoints);
 };
 const stringArray = (value) => Array.isArray(value)
     ? value.filter((item) => typeof item === "string")
@@ -83,4 +88,4 @@ const uniqueProviders = (evidence) => [
         `${provider.id}\0${provider.name}\0${provider.version ?? ""}`,
         provider,
     ])).values(),
-].sort((left, right) => compareCodePoints(`${left.id}\0${left.name}\0${left.version ?? ""}`, `${right.id}\0${right.name}\0${right.version ?? ""}`));
+].sort((left, right) => compareUnicodeCodePoints(`${left.id}\0${left.name}\0${left.version ?? ""}`, `${right.id}\0${right.name}\0${right.version ?? ""}`));