rea-agents 6.3.0 → 6.4.0

package/dist/domain/javascript/electronStaticAnalysisNative.js

@@ -3,7 +3,7 @@ import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrde
 import { stripQueryAndFragment } from "../artifactPathSyntax.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
-import { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
+import { propertyName, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
 /** Inspect JavaScript-side imports and re-exports of native .node addons. */
 export const inspectElectronNativeNode = (node, context) => {
     if (t.isImportDeclaration(node))
@@ -20,12 +20,12 @@ export const inspectElectronNativeNode = (node, context) => {
 const inspectImport = (node, context) => {
     if (!isNativeSpecifier(node.source.value, "import"))
         return;
-    const members = node.specifiers.map((specifier) => {
+    const members = node.specifiers.flatMap((specifier) => {
         if (t.isImportDefaultSpecifier(specifier))
-            return "default";
+            return ["default"];
         if (t.isImportNamespaceSpecifier(specifier))
-            return "*";
-        return propertyName(specifier.imported) || "[dynamic-import]";
+            return [];
+        return [propertyName(specifier.imported)];
     });
     addBinding({
         context,
@@ -34,6 +34,8 @@ const inspectImport = (node, context) => {
         kind: "import",
         moduleKind: "import",
         members,
+        namespaceAccess: node.specifiers.some((value) => t.isImportNamespaceSpecifier(value)),
+        dynamicMemberAccess: false,
     });
 };
 const inspectNamedExport = (node, context) => {
@@ -41,10 +43,12 @@ const inspectNamedExport = (node, context) => {
         node.source === undefined ||
         !isNativeSpecifier(node.source.value, "import"))
         return;
-    const members = node.specifiers.map((specifier) => {
+    const members = node.specifiers.flatMap((specifier) => {
         if (t.isExportSpecifier(specifier))
-            return propertyName(specifier.local);
-        return "*";
+            return [propertyName(specifier.local)];
+        if (t.isExportDefaultSpecifier(specifier))
+            return ["default"];
+        return [];
     });
     addBinding({
         context,
@@ -53,6 +57,8 @@ const inspectNamedExport = (node, context) => {
         kind: "re-export",
         moduleKind: "import",
         members,
+        namespaceAccess: node.specifiers.some((value) => t.isExportNamespaceSpecifier(value)),
+        dynamicMemberAccess: false,
     });
 };
 const inspectExportAll = (node, context) => {
@@ -65,7 +71,9 @@ const inspectExportAll = (node, context) => {
         specifier: node.source.value,
         kind: "re-export",
         moduleKind: "import",
-        members: ["*"],
+        members: [],
+        namespaceAccess: true,
+        dynamicMemberAccess: false,
     });
 };
 const inspectRequireBinding = (node, context) => {
@@ -78,7 +86,7 @@ const inspectRequireBinding = (node, context) => {
         specifier: required.specifier,
         kind: "require",
         moduleKind: "require",
-        members: required.member === null ? bindingMembers(node.id) : [required.member],
+        ...(required.hasMemberAccess ? required.access : bindingMembers(node.id)),
     });
 };
 const inspectReExport = (node, context) => {
@@ -91,26 +99,32 @@ const inspectReExport = (node, context) => {
         specifier: required.specifier,
         kind: "re-export",
         moduleKind: "require",
-        members: [required.member ?? exportedMember(node.left) ?? "*"],
+        ...required.access,
     });
 };
 const addBinding = (input) => {
     const { context, node, specifier, kind } = input;
-    const unique = [
-        ...new Set(input.members.filter((member) => member !== "")),
-    ].sort(compareUnicodeCodePoints);
-    const members = unique.length === 0 ? ["*"] : unique;
+    const members = [...new Set(input.members)].sort(compareUnicodeCodePoints);
     addLocatedFinding(context, {
         collection: context.accumulator.nativeAddonBindings,
         // Members are a variable-length source-derived list: compositeKey keeps
         // ["a\0b"] distinct from ["a", "b"] instead of collapsing one binding.
-        key: compositeKey(["native-addon-binding", kind, specifier, members]),
+        key: compositeKey([
+            "native-addon-binding",
+            kind,
+            specifier,
+            members,
+            input.namespaceAccess,
+            input.dynamicMemberAccess,
+        ]),
         node,
         value: {
             specifier,
             binding_kind: kind,
             module_kind: input.moduleKind,
             members,
+            namespace_access: input.namespaceAccess,
+            dynamic_member_access: input.dynamicMemberAccess,
             module_key: null,
             location: range(node),
         },
@@ -118,12 +132,14 @@ const addBinding = (input) => {
 };
 const nativeRequire = (node) => {
     let member = null;
+    let hasMemberAccess = false;
     while (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
         if (!t.isNode(node.object))
             return undefined;
-        const property = semanticStaticPropertyName(node.property, node.computed);
-        if (member === null && property !== "")
-            member = property;
+        const property = semanticStaticPropertyKey(node.property, node.computed);
+        // Walking inward leaves the first member consumed from the addon itself.
+        member = property;
+        hasMemberAccess = true;
         node = node.object;
     }
     if (!t.isCallExpression(node))
@@ -135,33 +151,47 @@ const nativeRequire = (node) => {
         return undefined;
     const specifier = stringValue(argumentNode(node.arguments[0]));
     return specifier !== undefined && isNativeSpecifier(specifier, "require")
-        ? { specifier, member }
+        ? {
+            specifier,
+            hasMemberAccess,
+            access: {
+                members: member === null ? [] : [member],
+                namespaceAccess: !hasMemberAccess,
+                dynamicMemberAccess: hasMemberAccess && member === null,
+            },
+        }
         : undefined;
 };
 const bindingMembers = (pattern) => {
-    if (t.isIdentifier(pattern))
-        return ["*"];
     if (!t.isObjectPattern(pattern))
-        return ["*"];
-    return pattern.properties.map((property) => {
-        if (t.isRestElement(property))
-            return "*";
-        return propertyName(property.key) || "[dynamic-import]";
-    });
+        return { members: [], namespaceAccess: true, dynamicMemberAccess: false };
+    const members = [];
+    let namespaceAccess = false;
+    let dynamicMemberAccess = false;
+    for (const property of pattern.properties) {
+        if (t.isRestElement(property)) {
+            namespaceAccess = true;
+            continue;
+        }
+        const key = semanticStaticPropertyKey(property.key, property.computed);
+        if (key === null)
+            dynamicMemberAccess = true;
+        else
+            members.push(key);
+    }
+    return { members, namespaceAccess, dynamicMemberAccess };
 };
 const isModuleExport = (node) => {
-    const name = calleeName(node);
-    return (name === "module.exports" ||
-        name.startsWith("module.exports.") ||
-        name.startsWith("exports."));
-};
-const exportedMember = (node) => {
-    const name = calleeName(node);
-    if (name.startsWith("module.exports."))
-        return name.slice("module.exports.".length);
-    if (name.startsWith("exports."))
-        return name.slice("exports.".length);
-    return undefined;
+    const keys = [];
+    while (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        keys.unshift(semanticStaticPropertyKey(node.property, node.computed));
+        node = node.object;
+    }
+    if (!t.isIdentifier(node))
+        return false;
+    return node.name === "exports"
+        ? keys.length > 0
+        : node.name === "module" && keys[0] === "exports";
 };
 const isNativeSpecifier = (specifier, moduleKind) => {
     const path = moduleKind === "require" ? specifier : stripQueryAndFragment(specifier);

package/dist/domain/javascript/electronStaticAnalysisValues.js

@@ -2,6 +2,22 @@ import * as t from "@babel/types";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { readExactJavaScriptLiteral, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 import { sourceSlice } from "./javascriptStaticAnalysisHelpers.js";
+/** Resolve a callee only when its root has a proven Electron module identity. */
+export const electronCalleePath = (callee, context) => {
+    const members = [];
+    let root = callee;
+    while (t.isMemberExpression(root) || t.isOptionalMemberExpression(root)) {
+        const member = semanticStaticPropertyName(root.property, root.computed);
+        if (member === "" || !t.isNode(root.object))
+            return undefined;
+        members.push(member);
+        root = root.object;
+    }
+    const exported = context.electronBindings?.get(root.start ?? -1);
+    return exported === undefined
+        ? undefined
+        : [...exported, ...members.toReversed()];
+};
 /** Preserve one literal value or the exact inert expression. */
 export const electronStaticValue = (source, node) => {
     const literal = literalValue(node);

package/dist/domain/javascript/javascriptAnalysisResourceControls.js

@@ -0,0 +1,45 @@
+import { z } from "zod";
+/** Shared operational defaults for the isolated source-analysis boundary. */
+export const JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS = {
+    heapMb: 1024,
+    timeoutMs: 300_000,
+};
+/** Project observed execution limits without inventing unmeasured values. */
+export const javaScriptAnalysisCoverageLimits = (limits) => {
+    const result = [];
+    for (const key of [
+        "worker_heap_limit_bytes",
+        "worker_timeout_ms",
+        "parent_result_budget_bytes",
+        "semantic_result_budget_bytes",
+        "transfer_record_bytes",
+        "transfer_file_bytes",
+    ]) {
+        const value = limits?.[key];
+        if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+            continue;
+        result.push({
+            name: `javascript_analysis_${key}`,
+            value,
+            unit: key.endsWith("_ms") ? "milliseconds" : "bytes",
+        });
+    }
+    return result;
+};
+/** Optional operational choices; omission keeps them out of Evidence parameters. */
+export const javaScriptAnalysisResourceControlsSchema = z.strictObject({
+    max_heap_mb: z
+        .number()
+        .int()
+        .min(128)
+        .max(16_384)
+        .optional()
+        .describe("Maximum V8 old-space heap in MiB for the isolated JavaScript source analyzer; defaults to 1024. This does not change the CLI/MCP process heap."),
+    analysis_timeout_ms: z
+        .number()
+        .int()
+        .min(1)
+        .max(2_147_483_647)
+        .optional()
+        .describe("Maximum startup, analysis and transfer time per JavaScript source, in milliseconds; defaults to 300000. On timeout, return collected partial Evidence and stop the analysis."),
+});

package/dist/domain/javascript/javascriptApplicationAnalysis.js

@@ -4,13 +4,16 @@ import { javaScriptSemanticGraphSchema, isValidatedImmutableJavaScriptSemanticGr
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
 import { integrityContradictionSchema } from "../artifactGraph.js";
+import { artifactIntegrityPolicySchema } from "../artifactIntegrityPolicy.js";
 import { localPathStringSchema } from "../localPath.js";
+import { javaScriptAnalysisResourceControlsSchema } from "./javascriptAnalysisResourceControls.js";
 const countSchema = z.number().int().min(0);
 /** Public target-free request for static JavaScript application analysis. */
 export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
     input_path: localPathStringSchema,
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
-    integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
+    integrity_policy: artifactIntegrityPolicySchema,
+    ...javaScriptAnalysisResourceControlsSchema.shape,
 });
 /** Compact counts for the high-level Electron architecture/security surface. */
 const electronBoundarySummarySchema = z.strictObject({

package/dist/domain/javascript/javascriptApplicationChangeGraph.js

@@ -21,7 +21,9 @@ export const buildJavaScriptApplicationChangeGraph = (input) => {
         ...input.left.edges,
         ...input.right.edges,
     ]).filter(({ source_node_id: source, target_node_id: target }) => retained.has(source) && retained.has(target));
-    const comparisonEdges = input.items.flatMap((item) => changedFromEdge(item, input, retained));
+    const leftById = new Map(input.left.nodes.map((node) => [node.node_id, node]));
+    const rightById = new Map(input.right.nodes.map((node) => [node.node_id, node]));
+    const comparisonEdges = input.items.flatMap((item) => changedFromEdge(item, input, retained, leftById, rightById));
     const candidateEdges = uniqueEdges([...sourceEdges, ...comparisonEdges]);
     const rootNodeIds = preferredRoots.filter((nodeId) => retained.has(nodeId));
     const fallbackRoot = mergedNodes[0]?.node_id;
@@ -62,7 +64,7 @@ const nodeCandidates = (input) => {
             output.set(node.node_id, [...(output.get(node.node_id) ?? []), node]);
     return output;
 };
-const changedFromEdge = (item, input, retained) => {
+const changedFromEdge = (item, input, retained, leftById, rightById) => {
     const left = item.left_node_id;
     const right = item.right_node_id;
     if (item.match.status !== "matched" ||
@@ -73,7 +75,7 @@ const changedFromEdge = (item, input, retained) => {
         !retained.has(left) ||
         !retained.has(right))
         return [];
-    const evidence = comparisonEvidence(item, input);
+    const evidence = comparisonEvidence(item, input, leftById.get(left), rightById.get(right));
     return [
         createJavaScriptApplicationEdge({
             source_node_id: right,
@@ -90,9 +92,7 @@ const changedFromEdge = (item, input, retained) => {
         }),
     ];
 };
-const comparisonEvidence = (item, input) => {
-    const right = input.right.nodes.find(({ node_id: id }) => id === item.right_node_id);
-    const left = input.left.nodes.find(({ node_id: id }) => id === item.left_node_id);
+const comparisonEvidence = (item, input, left, right) => {
     const source = right?.observations[0]?.evidence ?? left?.observations[0]?.evidence;
     const complete = input.left.coverage.status === "complete" &&
         input.right.coverage.status === "complete";

package/dist/domain/javascript/javascriptApplicationGraph.js

@@ -1,9 +1,11 @@
 import { z } from "zod";
+import { arrayContainerSchema, parseElementSteps, } from "../zodCollectionSteps.js";
+import { canonicalJsonDigestSteps } from "../canonicalJsonDigestSteps.js";
 import { canonicalJson } from "../comparisonSemantics.js";
 import { digestCanonicalValue } from "../canonicalDigest.js";
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
-import { freezeOwnedJsonSnapshotSteps } from "../immutableJson.js";
+import { freezeJsonSnapshot, freezeOwnedJsonSnapshotSteps, } from "../immutableJson.js";
 import { applicationEdgeInputSchema, applicationEdgeSchema, applicationNodeInputSchema, applicationNodeObservationSchema, applicationNodeSchema, javascriptApplicationGraphInputSchema, javascriptApplicationGraphRecordSchema, } from "./javascriptApplicationGraphSchemas.js";
 const OBSERVATION_IDENTIFIER_STRATEGY = {
     strategy: "semantic-content-sha256",
@@ -160,7 +162,12 @@ const checkNode = (node, index, context) => {
             path: ["nodes", index, "identity"],
         });
 };
-const checkGraphInvariants = (graph, context) => {
+const checkGraphContent = (graph, context) => {
+    const steps = checkGraphContentSteps(graph, context);
+    while (steps.next().done !== true)
+        ;
+};
+function* checkGraphContentSteps(graph, context) {
     sortedUniqueIssue(graph.root_node_ids, ["root_node_ids"], "Root nodes", context);
     sortedUniqueIssue(graph.nodes.map(({ node_id: id }) => id), ["nodes"], "Nodes", context);
     sortedUniqueIssue(graph.edges.map(({ edge_id: id }) => id), ["edges"], "Edges", context);
@@ -180,9 +187,14 @@ const checkGraphInvariants = (graph, context) => {
                 message: "Root identifier must name a graph node",
                 path: ["root_node_ids"],
             });
-    for (const [index, node] of graph.nodes.entries())
+    for (const [index, node] of graph.nodes.entries()) {
+        if (index % 64 === 0)
+            yield;
         checkNode(node, index, context);
+    }
     for (const [index, edge] of graph.edges.entries()) {
+        if (index % 64 === 0)
+            yield;
         const { edge_id: identifier, ...semantic } = edge;
         if (identifier !== edgeId(semantic))
             context.addIssue({
@@ -213,6 +225,9 @@ const checkGraphInvariants = (graph, context) => {
             });
         checkEvidenceNormalization(edge.evidence, ["edges", index, "evidence"], context);
     }
+}
+const checkGraphInvariants = (graph, context) => {
+    checkGraphContent(graph, context);
     const { graph_id: identifier, ...semantic } = graph;
     if (identifier !==
         `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`)
@@ -224,9 +239,14 @@ const checkGraphInvariants = (graph, context) => {
 };
 /** Strict JavaScript Application Graph with verified commitments. */
 export const javascriptApplicationGraphSchema = javascriptApplicationGraphRecordSchema.superRefine(checkGraphInvariants);
+const javascriptApplicationGraphContentSchema = javascriptApplicationGraphInputSchema.superRefine(checkGraphContent);
 /** Build one normalized application entity and derive all semantic IDs. */
 export const createJavaScriptApplicationNode = (input) => {
     const parsed = applicationNodeInputSchema.parse(input);
+    // These properties are newly parsed and exclusively owned. Authenticate
+    // them before the observation/node schemas and final graph validate again.
+    for (const observation of parsed.observations)
+        freezeJsonSnapshot(observation.properties);
     const identity = normalizeIdentity(parsed.identity);
     const identifier = nodeId({ kind: parsed.kind, identity });
     const observations = parsed.observations
@@ -252,6 +272,7 @@ export const createJavaScriptApplicationNode = (input) => {
 /** Build one normalized directed relationship and derive its semantic ID. */
 export const createJavaScriptApplicationEdge = (input) => {
     const parsed = applicationEdgeInputSchema.parse(input);
+    freezeJsonSnapshot(parsed.properties);
     const semantic = {
         ...parsed,
         evidence: normalizeEvidence(parsed.evidence),
@@ -264,26 +285,66 @@ export const createJavaScriptApplicationEdge = (input) => {
 };
 /** Normalize a complete graph and derive its top-level semantic ID. */
 export const createJavaScriptApplicationGraph = (input) => {
-    const parsed = javascriptApplicationGraphInputSchema.parse(input);
-    const semantic = {
-        ...parsed,
-        root_node_ids: uniqueSorted(parsed.root_node_ids),
-        nodes: [...parsed.nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id)),
-        edges: [...parsed.edges].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id)),
-        coverage: {
-            ...parsed.coverage,
-            limits: normalizeLimits(parsed.coverage.limits),
-        },
-        limitations: uniqueSorted(parsed.limitations),
+    const semantic = normalizeGraphInput(javascriptApplicationGraphInputSchema.parse(input));
+    const content = javascriptApplicationGraphContentSchema.parse(semantic);
+    return {
+        ...content,
+        graph_id: `jag_${digestCanonicalValue(content, "JavaScript Application Graph")}`,
     };
-    return javascriptApplicationGraphSchema.parse({
-        ...semantic,
-        graph_id: `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`,
-    });
 };
+const normalizeGraphInput = (parsed) => ({
+    ...parsed,
+    root_node_ids: uniqueSorted(parsed.root_node_ids),
+    nodes: [...parsed.nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id)),
+    edges: [...parsed.edges].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id)),
+    coverage: {
+        ...parsed.coverage,
+        limits: normalizeLimits(parsed.coverage.limits),
+    },
+    limitations: uniqueSorted(parsed.limitations),
+});
 const validatedImmutableApplicationGraphs = new WeakSet();
 /** Clone and validate synchronously, then return steps to seal the owned graph. */
 export const createImmutableJavaScriptApplicationGraphSteps = (input) => sealValidatedApplicationGraphSteps(createJavaScriptApplicationGraph(input));
+const applicationGraphShape = javascriptApplicationGraphInputSchema.shape;
+const applicationGraphContainerSchema = javascriptApplicationGraphInputSchema.extend({
+    nodes: arrayContainerSchema(applicationGraphShape.nodes),
+    edges: arrayContainerSchema(applicationGraphShape.edges),
+});
+/**
+ * Seal a graph whose input the caller transfers: the caller neither retains nor
+ * mutates any part of it afterwards. Only the graph's own fields are validated
+ * synchronously; nodes and edges are validated, checked, hashed and frozen in
+ * steps, because doing so at once held the event loop for large applications.
+ */
+export const sealTransferredJavaScriptApplicationGraphSteps = (input) => parseAndSealApplicationGraphSteps(applicationGraphContainerSchema.parse(input));
+function* parseAndSealApplicationGraphSteps(container) {
+    const issues = [];
+    const parsed = {
+        ...container,
+        nodes: yield* parseElementSteps(applicationGraphShape.nodes.element, container.nodes, ["nodes"], issues),
+        edges: yield* parseElementSteps(applicationGraphShape.edges.element, container.edges, ["edges"], issues),
+    };
+    if (issues.length > 0)
+        throw new z.ZodError(issues);
+    const content = normalizeGraphInput(parsed);
+    let invalid = false;
+    yield* checkGraphContentSteps(content, {
+        addIssue: () => {
+            invalid = true;
+        },
+    });
+    // An invalid owned graph is a construction defect; report it with the exact
+    // issues the content schema produces.
+    if (invalid) {
+        javascriptApplicationGraphContentSchema.parse(content);
+        throw new TypeError("Application graph checks disagree with its schema");
+    }
+    return yield* sealValidatedApplicationGraphSteps({
+        ...content,
+        graph_id: `jag_${yield* canonicalJsonDigestSteps(content)}`,
+    });
+}
 function* sealValidatedApplicationGraphSteps(graph) {
     yield* freezeOwnedJsonSnapshotSteps(graph);
     validatedImmutableApplicationGraphs.add(graph);

package/dist/domain/javascript/javascriptApplicationProjectionResources.js

@@ -0,0 +1,35 @@
+/** Forecast static-fact expansion into observations, nodes and relationships. */
+export const estimateJavaScriptStaticApplicationProjection = (facts, checkpointBytes, sourcePath) => {
+    // A finding can produce a node, a separate observation and several edges.
+    // Allow for identifiers, locations, authority, coverage and schema copies,
+    // independently of the producer's compact checkpoint representation.
+    const findings = facts.references.length +
+        facts.endpoints.length +
+        facts.storage.length +
+        facts.role_paths.length +
+        facts.source_map_urls.length +
+        facts.electron.browser_windows.length +
+        facts.electron.context_bridge_apis.length +
+        facts.electron.ipc.length +
+        facts.electron.sender_validations.length +
+        facts.electron.utility_processes.length +
+        facts.electron.native_addon_bindings.length;
+    let records = findings * 8;
+    let repeatedBytes = 0;
+    for (const registration of facts.bundler_registrations) {
+        records +=
+            3 +
+                registration.modules.length * 3 +
+                registration.entry_module_keys.length * 3 +
+                registration.async_chunk_keys.length * 3;
+        // Every module observation and containment edge repeats its chunk keys.
+        repeatedBytes +=
+            Buffer.byteLength(JSON.stringify(registration.chunk_keys)) *
+                registration.modules.length *
+                2;
+    }
+    for (const binding of facts.electron.native_addon_bindings)
+        records += binding.members.length * 3;
+    const metadataBytes = 2048 + Buffer.byteLength(sourcePath) * 4;
+    return (checkpointBytes * 4 + repeatedBytes + records * metadataBytes) * 8;
+};

package/dist/domain/javascript/javascriptApplicationVersionItems.js

@@ -12,7 +12,12 @@ export const classifyJavaScriptApplicationVersions = (matching, context) => {
         `pair:${left.node_id}:${right.node_id}`,
     ]));
     const fullContext = {
-        ...context,
+        leftGraph: context.leftGraph,
+        rightGraph: context.rightGraph,
+        leftEvidenceId: context.leftEvidenceId,
+        rightEvidenceId: context.rightEvidenceId,
+        leftNativeEvidenceByDigest: indexNativeEvidence(context.leftNativeEvidence),
+        rightNativeEvidenceByDigest: indexNativeEvidence(context.rightNativeEvidence),
         pairByLeft,
         pairByRight,
         leftRelationships: indexRelationships(context.leftGraph),
@@ -258,19 +263,30 @@ const itemEvidenceLinks = (left, right, context) => [
     ...new Set([
         context.leftEvidenceId,
         context.rightEvidenceId,
-        ...nativeLinks(left, context.leftNativeEvidence),
-        ...nativeLinks(right, context.rightNativeEvidence),
+        ...nativeLinks(left, context.leftNativeEvidenceByDigest),
+        ...nativeLinks(right, context.rightNativeEvidenceByDigest),
     ]),
 ].sort(compareUnicodeCodePoints);
-const nativeLinks = (node, evidence) => {
-    const digest = node === undefined
-        ? null
-        : contentIdentity(node)?.replace(/^content:/u, "");
-    return digest === null
-        ? []
-        : evidence
-            .filter(({ subject }) => subject?.digest.sha256 === digest)
-            .map(({ evidence_id: id }) => id);
+const nativeLinks = (node, evidenceByDigest) => {
+    const identity = node === undefined ? null : contentIdentity(node);
+    if (identity === null)
+        return [];
+    const digest = identity.replace(/^content:/u, "");
+    return evidenceByDigest.get(digest) ?? [];
+};
+const indexNativeEvidence = (evidence) => {
+    const evidenceByDigest = new Map();
+    for (const { evidence_id: id, subject } of evidence) {
+        const digest = subject?.digest.sha256;
+        if (digest === undefined)
+            continue;
+        const ids = evidenceByDigest.get(digest);
+        if (ids === undefined)
+            evidenceByDigest.set(digest, [id]);
+        else
+            ids.push(id);
+    }
+    return evidenceByDigest;
 };
 const pairLimitations = (pair, status) => [
     ...(pair.basis === "structural-fingerprint"

package/dist/domain/javascript/javascriptApplicationVersionKeys.js

@@ -153,7 +153,15 @@ const semanticValue = (node, properties) => {
             exactString(properties.api_key) ??
             nonEmptyString(properties.api_name));
     if (node.kind === "native-export")
-        return (joined(properties.specifier, stringList(properties.requested_members).join(",")) ?? firstLabel(node));
+        return (joined(properties.specifier, compositeKey([
+            stringList(properties.requested_members),
+            typeof properties.namespace_access === "boolean"
+                ? properties.namespace_access
+                : null,
+            typeof properties.dynamic_member_access === "boolean"
+                ? properties.dynamic_member_access
+                : null,
+        ])) ?? firstLabel(node));
     if ([
         "electron-main",
         "electron-preload",