@ecoma-io/archkeep 0.21.0 → 0.22.1

package/src/analysis/source-util.mjs

@@ -351,6 +351,119 @@ export const refuseUnreadTree = (reader, failures) => {
  */
 export const isWholeFileFailure = (failure) => failure.line === null;
 
+/**
+ * Whether a positioned failure is the declared dynamic limit rather than an
+ * unresolvable specifier.
+ *
+ * Both are permanent blind spots — a site the run saw and could not judge —
+ * and both are disclosed identically (`coverage.blindSpots`, the report's
+ * blind-spot section). They part ways at the verdict: an unresolvable LITERAL
+ * specifier is a concrete question the resolver was asked and could not answer
+ * (#595 — a missing workspace edge at site granularity, an uninstalled
+ * dependency), so it withholds the run's verdict; a non-literal
+ * `import()`/`require()` argument is the language itself declaring the target
+ * computed at runtime, which static analysis cannot answer in principle —
+ * every config loader that opens a consumer-named file contains one — so it
+ * is a declared limit the run states and moves past. Measured on this
+ * repository's own tree: ten such sites in config loaders, unfixable without
+ * giving up the feature that makes them config loaders.
+ *
+ * The field is set only by the TypeScript/Vue analyzer, the one analyzer whose
+ * language has the construct; every other analyzer's positioned failures are
+ * literal specifiers by construction and never set it.
+ *
+ * @param {{ line: number|null, dynamic?: true }} failure
+ * @returns {boolean}
+ */
+export const isDynamicSiteFailure = (failure) => failure.dynamic === true;
+
+/**
+ * Whether a positioned failure is an unresolvable literal pointing at the
+ * EXTERNAL dependency universe — the bare-package class that neither withholds
+ * the verdict nor may.
+ *
+ * A bare specifier (`vitest`, `zod`, a scoped package) resolves against an
+ * installed dependency tree, and a workspace without that tree — a fresh
+ * clone, a trimmed install, the native self-check's `git archive` copy, which
+ * by design carries no `node_modules` — is a normal state. Withholding the
+ * verdict over it would make the tree permanently un-green over dependencies
+ * nobody crossed: measured, that is exactly what this repository's own
+ * required boundary gate did under the unqualified flip, 284 such rows on the
+ * native face alone. The marker rides the row (the TypeScript/Vue analyzer
+ * sets it; `isExternalUnresolvable` holds the class line there — path-like,
+ * `#` subpath and `paths`-alias specifiers never get it, so a workspace-edge
+ * question can never masquerade as external), and every verdict lane counts
+ * by its absence, the same mechanism the `dynamic` marker uses.
+ *
+ * Every analyzer sets the field, and each holds the same class line as the
+ * TypeScript/Vue one: only a bare coordinate that genuinely names the
+ * language's dependency universe gets it (a Go module path outside the
+ * workspace modules, a Rust crate outside the workspace crates, a Python
+ * third-party top-level import outside the unmodelled gate, a JVM/C# dotted
+ * name no tracked package or namespace claims), and a specifier naming a
+ * declared workspace project never does — a workspace-edge question must not
+ * masquerade as external. What still withholds is everything that is NOT this
+ * class: a workspace-surface specifier, a Rust brace group, a Python relative
+ * import past the top-level package, an unmodelled layout, a split package
+ * (#603's per-language pins hold both directions).
+ *
+ * @param {{ line: number|null, external?: true }} failure
+ * @returns {boolean}
+ */
+export const isExternalSiteFailure = (failure) => failure.external === true;
+
+/**
+ * The count of positioned failures that WITHHOLD the run's verdict —
+ * unresolvable literal specifiers that reference the workspace's own surface,
+ * dynamic declared limits and external bare-package sites excluded.
+ *
+ * The one number every verdict lane and refusal guard reads (#595, narrowed):
+ * `check`'s `coverage.complete` and no-verdict lane, the refusal every
+ * descriptive and refuse-class command raises over an unjudged site, and the
+ * envelope builder's completeness law all read this class and nothing else.
+ * Centralized here so the class line cannot drift between the fifteen call
+ * sites the way a repeated inline filter would.
+ *
+ * @param {{ line: number|null, dynamic?: true, external?: true }[]} failures
+ * @returns {number}
+ */
+export const unresolvableLiteralCount = (failures) =>
+  failures.filter(
+    (failure) =>
+      !isWholeFileFailure(failure) &&
+      !isDynamicSiteFailure(failure) &&
+      !isExternalSiteFailure(failure),
+  ).length;
+
+/**
+ * The `coverage.blindSpots` rows every command's coverage block carries: one
+ * row per positioned failure, ALL permanent classes, the run's disclosure of
+ * every site it saw and did not judge.
+ *
+ * Disclosure is deliberately wider than the verdict's withholding: a dynamic
+ * or external site never flips an exit, but it is still named here — the
+ * fields that separate the classes ride the row, which is what lets the
+ * envelope builder's completeness law (`report/json.mjs`) tell a declared
+ * limit and an external bare package from unjudged work without a second
+ * classification.
+ *
+ * @param {{ sourceFile: string, line: number|null, column: number|null,
+ *   reason: string, dynamic?: true, external?: true }[]} failures
+ * @returns {{ file: string, line: number, column: number, reason: string,
+ *   dynamic?: true, external?: true }[]}
+ */
+export const blindSpotRows = (failures) =>
+  failures
+    .filter((failure) => !isWholeFileFailure(failure))
+    .map(({ sourceFile, line, column, reason, dynamic, external }) => ({
+      file: sourceFile,
+      line,
+      column,
+      reason,
+      ...(dynamic ? { dynamic: true } : {}),
+      ...(external ? { external: true } : {}),
+    }));
+
 /**
  * One whole-file failure per source file, first reason kept.
  *

package/src/analysis/typescript.mjs

@@ -373,6 +373,57 @@ function namesDeclaredProject(specifier, workspace) {
   return workspace.projects.some((project) => project.name === name || project.name === specifier);
 }
 
+/**
+ * Whether an unresolvable LITERAL specifier points at the external dependency
+ * universe rather than at the workspace's own governed surface — the row class
+ * that the loud-coverage contract (#595, narrowed) discloses without
+ * withholding the verdict, marked `external: true` on the failure.
+ *
+ * Three shapes always reference the workspace surface and never get the
+ * marker, so a run cannot go quiet over an edge the graph should carry:
+ *
+ * - a path-like specifier (`./`, `../`, `/`): it names a file in the
+ *   workspace's own namespace, and failing to resolve it means that path
+ *   cannot be proven to exist — a broken import, which is loud on purpose;
+ * - a `#` subpath import: package-internal by definition, never an external
+ *   dependency. This is #595's own reported shape
+ *   (`#canary-review/index.mjs`): `packageNameOf` keeps the `#` prefix, so
+ *   the whole-file lane's name test cannot catch it, and without this branch
+ *   the subpath would silently read as external;
+ * - a `paths` alias: the mapping declares the prefix workspace-internal, so
+ *   a specifier under a failed alias is an unproven workspace edge. A `paths`
+ *   key with `*` matches by its prefix (`@app/*` catches `@app/x/y`); an
+ *   exact key matches exactly. (`baseUrl` alone is not consulted — its bare
+ *   results are npm-shaped and read as external.)
+ *
+ * Everything else — `vitest`, `zod`, a scoped package no `paths` row claims —
+ * resolves against an installed dependency tree, and a workspace without that
+ * tree installed (a fresh clone, a trimmed install, the native self-check's
+ * `git archive` copy, which by design carries no `node_modules`) is a normal
+ * state. Those are the rows the native self-check's 284 blind spots are made
+ * of, and treating them as verdict-withholding would make that required CI
+ * step permanently exit 3 over dependencies nobody crossed.
+ *
+ * @param {string} specifier The raw specifier as written.
+ * @param {ts.CompilerOptions} options The resolution options in force.
+ * @returns {boolean}
+ */
+function isExternalUnresolvable(specifier, options) {
+  if (
+    specifier.startsWith("./") ||
+    specifier.startsWith("../") ||
+    specifier.startsWith("/") ||
+    specifier.startsWith("#")
+  ) {
+    return false;
+  }
+  for (const key of Object.keys(options.paths ?? {})) {
+    const star = key.indexOf("*");
+    if (star === -1 ? key === specifier : specifier.startsWith(key.slice(0, star))) return false;
+  }
+  return true;
+}
+
 /** The dialect to parse `sourceFile` as; `lang` wins when the caller knows it. */
 function scriptKindFor(sourceFile, lang) {
   if (lang) return SCRIPT_KIND_BY_LANG[lang] ?? ts.ScriptKind.TS;
@@ -784,7 +835,7 @@ function parseFailures(sourceFile, workspaceRelativePath) {
  * nested `node_modules/`, which every package that declares its own
  * `dependencies` has; the branch below says why, with the measurement.
  *
- * @returns {{ resolved: object|null, reason: string|null }}
+ * @returns {{ resolved: object|null, reason: string|null, external?: boolean }}
  */
 function resolveSpecifier(specifier, sourceFile, workspace) {
   const context = contextFor(workspace);
@@ -905,6 +956,12 @@ function resolveSpecifier(specifier, sourceFile, workspace) {
     if (sibling === null) {
       return {
         resolved: null,
+        // A failed literal is classified here, where the resolution options
+        // are in scope: `external: true` marks the bare-package class the
+        // contract discloses without withholding (`isExternalUnresolvable`
+        // holds the class line). The failure-push site forwards the flag to
+        // the row, and every verdict lane counts withholds from its absence.
+        external: isExternalUnresolvable(specifier, context.options),
         reason: `TypeScript cannot resolve '${specifier}' from '${sourceFile}'`,
       };
     }
@@ -992,7 +1049,7 @@ export function analyzeTypeScript({ sourceFile, text, workspace, lang }) {
       // a grammar error there — and `import x = require(y)` is the form that
       // makes `require` the right word for it.
       const callee = site.callee ?? (site.kind === "dynamic" ? "import" : "require");
-      const { resolved, reason } = site.literal
+      const { resolved, reason, external } = site.literal
         ? resolveSpecifier(site.specifier, sourceFile, workspace)
         : {
             resolved: null,
@@ -1023,13 +1080,37 @@ export function analyzeTypeScript({ sourceFile, text, workspace, lang }) {
       // site failures — the "blind spot" the contract documents as legitimately
       // permanent (`report/text.mjs`'s `formatFailures` is where the report
       // explains the two, and `cli.mjs` counts `unchecked` by
-      // `failure.line === null`). A NON-LITERAL argument keeps its line/column
-      // for the same reason: it is genuinely not statically knowable.
+      // `failure.line === null`).
+      //
+      // The positioned rows then part ways by class, and the markers on the
+      // row are what every verdict lane counts by:
+      //
+      // - a positioned literal that still references the workspace's own
+      //   surface — path-like, `#` subpath, or a `paths` alias — carries NO
+      //   marker and withholds the run's verdict (#595, narrowed): a `#`
+      //   subpath naming a declared project is exactly the shape #595
+      //   reported, and `packageNameOf` keeps the `#`, so the whole-file
+      //   lane's name test above cannot catch it;
+      // - a positioned literal pointing at the bare-package universe carries
+      //   `external: true` (`isExternalUnresolvable` holds the class line)
+      //   and discloses without withholding — the native self-check's 284
+      //   bare rows are this class, and withholding them would make that
+      //   required CI step permanently exit 3;
+      // - a NON-LITERAL argument keeps its line/column for the same reason:
+      //   it is genuinely not statically knowable, and carries
+      //   `dynamic: true` (contract.md).
       if (reason) {
         result.failures.push(
           site.literal && namesDeclaredProject(site.specifier, workspace)
             ? fileFailure(sourceFile, reason)
-            : { sourceFile, line: line + 1, column: character + 1, reason },
+            : {
+                sourceFile,
+                line: line + 1,
+                column: character + 1,
+                reason,
+                ...(site.literal ? {} : { dynamic: true }),
+                ...(site.literal && external ? { external: true } : {}),
+              },
         );
       }
     }

package/src/canonical.mjs

@@ -11,11 +11,50 @@
  * correct.
  *
  * Used by `computePolicyFingerprint` (`../commands/graph.mjs`), the intent
- * fingerprint (`./intent-fingerprint.mjs`), and anything else a fingerprint
- * is computed over — one canonicalizer, in one place, so two serializations
- * cannot drift.
+ * fingerprint (`./intent-fingerprint.mjs`), the evidence-snapshot serializer
+ * (`./commands/delta-snapshot.mjs`, through the exported replacer below), and
+ * anything else a fingerprint or a byte-deterministic file is produced from —
+ * one canonicalizer, in one place, so two serializations cannot drift.
  */
 
+/**
+ * The `JSON.stringify` replacer that sorts plain-object keys at every depth.
+ *
+ * Exported beside `canonicalizeJson` so a serializer that needs a different
+ * `JSON.stringify` spacing can run the SAME rule rather than grow a second
+ * copy of it: `canonicalizeJson` passes this replacer at compact spacing, and
+ * `./commands/delta-snapshot.mjs`'s `serializeEvidenceSnapshot` passes it at
+ * two-space spacing, so both spellings sort identically by construction.
+ *
+ * @param {string} _key The key being visited; `JSON.stringify` calls the
+ *   replacer once per key and once for the root with `""`.
+ * @param {*} current The value at that key.
+ * @returns {*} The value to serialize in its place — a key-sorted copy when
+ *   `current` is a plain object, `current` itself otherwise.
+ */
+export function canonicalJsonReplacer(_key, current) {
+  if (current !== null && typeof current === "object" && !Array.isArray(current)) {
+    // A null-prototype accumulator, not `{}`: `JSON.parse('{"__proto__":…}')`
+    // produces an OWN key literally named "__proto__" (JSON has no notion of
+    // prototypes), and `sorted[keyName] = …` on an ordinary object treats
+    // that one key specially — it sets the object's prototype instead of
+    // creating an own property, so the key silently vanishes from
+    // `JSON.stringify`'s output. Two documents that disagree only in a
+    // `__proto__` field would then canonicalize identically, a silent
+    // fingerprint collision (`../../../AGENTS.md`, "An empty result is a claim,
+    // not a shrug" — this is the same failure shape: two different inputs
+    // must never produce one indistinguishable output). `Object.create(null)`
+    // has no `__proto__` accessor to intercept the assignment, so every key
+    // — "__proto__" included — always becomes a real own property.
+    const sorted = Object.create(null);
+    for (const keyName of Object.keys(current).sort()) {
+      sorted[keyName] = current[keyName];
+    }
+    return sorted;
+  }
+  return current;
+}
+
 /**
  * Serialize `value` with keys sorted at every object level.
  *
@@ -23,26 +62,5 @@
  * @returns {string} The canonical serialization.
  */
 export function canonicalizeJson(value) {
-  return JSON.stringify(value, (key, current) => {
-    if (current !== null && typeof current === "object" && !Array.isArray(current)) {
-      // A null-prototype accumulator, not `{}`: `JSON.parse('{"__proto__":…}')`
-      // produces an OWN key literally named "__proto__" (JSON has no notion of
-      // prototypes), and `sorted[keyName] = …` on an ordinary object treats
-      // that one key specially — it sets the object's prototype instead of
-      // creating an own property, so the key silently vanishes from
-      // `JSON.stringify`'s output. Two documents that disagree only in a
-      // `__proto__` field would then canonicalize identically, a silent
-      // fingerprint collision (`../../../AGENTS.md`, "An empty result is a claim,
-      // not a shrug" — this is the same failure shape: two different inputs
-      // must never produce one indistinguishable output). `Object.create(null)`
-      // has no `__proto__` accessor to intercept the assignment, so every key
-      // — "__proto__" included — always becomes a real own property.
-      const sorted = Object.create(null);
-      for (const keyName of Object.keys(current).sort()) {
-        sorted[keyName] = current[keyName];
-      }
-      return sorted;
-    }
-    return current;
-  });
+  return JSON.stringify(value, canonicalJsonReplacer);
 }

package/src/commands/README.md

@@ -22,15 +22,18 @@ the resolution order.
   drift, a failing fitness gate, and a failing custom rule
   (`./custom-rules.mjs`). Exits 1 on any of them, and it is the only
   command holding all four exit codes
-  ([which verbs carry exit 1 is settled in `docs/concepts/architecture.md`](../../../../docs/concepts/architecture.md)
-  — `fitness` and `delta` are the other two).
+  ([which verbs carry exit 1 is settled in `docs/reference/exit-codes.md`](../../../../docs/reference/exit-codes.md)
+  — `fitness`, `delta`, `change` and `rules verify` are the other four).
 
 - **`graph`** (`./graph.mjs`'s `graphCommand`) — the project graph as a
   deterministic, serialisable snapshot: projects (with `targets` and `tags`) and
   dependencies, each as a flat sorted array. Strips internal fields
   (`mfeRemote`, `entryPoints`, `declaredPackages`). Includes
-  `workspaceLayout`/`workspaceLayoutSource`. Refuses an Nx workspace with
-  polyglot manifests but no plugin registration. Descriptive: never exits 1.
+  `workspaceLayout`/`workspaceLayoutSource`. Completeness comes from
+  `./coverage-verdict.mjs`'s shared constructor — a whole-file failure, an
+  unjudged site, or a run that analyzed no file at all (#612) is the
+  no-verdict lane. Refuses an Nx workspace with polyglot manifests but no
+  plugin registration. Descriptive: never exits 1.
 
 - **`diff`** (`./diff.mjs`'s `diffCommand`) — two graph snapshots compared edge
   by edge. Takes a baseline file (not a git ref). When a boundary config is
@@ -56,8 +59,9 @@ the resolution order.
   incomplete head coverage, and an Nx workspace with polyglot manifests but no
   plugin registration; a policy-fingerprint change is a loud coverage note, not
   a refusal. A verdict, not a description: a non-waived introduced violation is
-  a finding (exit 1 — then the third verb beside `check` and `fitness`; `change`
-  and its declared-intent question arrived later as the fourth), an
+  a finding (exit 1 — one of the five verdict verbs
+  [`docs/reference/exit-codes.md`](../../../../docs/reference/exit-codes.md)
+  pins), an
   unclassifiable item is a no-verdict (exit 3), and a waived-introduced entry
   is reported without gating. Capture stays descriptive: never exits 1.
 
@@ -75,8 +79,9 @@ the resolution order.
   verdict, and the workspace-law axis it reports is informational — computed,
   labeled as evidence, never folded into the exit code, because `check`
   remains the authority on the law. Undeclared, unfulfilled, or a failed
-  declared constraint is a finding (exit 1 — the fourth verb beside `check`,
-  `fitness`, `delta`); an unproven base identity or an undeterminable
+  declared constraint is a finding (exit 1 — one of the five verdict verbs
+  [`docs/reference/exit-codes.md`](../../../../docs/reference/exit-codes.md)
+  pins); an unproven base identity or an undeterminable
   constraint is exit 3, and constraints are left unevaluated over a base the
   run cannot vouch for. Refuses a manifest that fails shape or reference
   validation, an unreadable/malformed/incomplete baseline, a provider
@@ -198,10 +203,13 @@ the resolution order.
   `../../src/governance/discovery-proposal.mjs`'s pure evaluator over it.
   Proposal-only: every candidate carries `proposed: true` and
   `notAuthoritative: true`, and the command never writes
-  `architecture-intent.json`. Returns `status: "no-verdict"` (exit 3) over
-  incomplete coverage and refuses `--propose` over it; refuses an Nx workspace
-  with polyglot manifests but no plugin registration; a zero-project workspace
-  is the empty `unknown` proposal, not a refusal. Descriptive: never exits 1.
+  `architecture-intent.json`. Completeness comes from
+  `./coverage-verdict.mjs`'s shared constructor — a whole-file failure, an
+  unjudged site, or a run that analyzed no file at all (#619) is the
+  no-verdict lane. Returns `status: "no-verdict"` (exit 3) over incomplete
+  coverage and refuses `--propose` over it; refuses an Nx workspace with
+  polyglot manifests but no plugin registration; a zero-project workspace is
+  the empty `unknown` proposal, not a refusal. Descriptive: never exits 1.
 
 - **`drift`** (`./drift.mjs`'s `driftCommand`) — the observed architecture
   compared against the declared intended one. The intended side is the one
@@ -307,6 +315,49 @@ the resolution order.
   declaration carries is listed `unknown` — named, never hidden. Descriptive:
   never exits 1.
 
+- **`scenario`** (`./scenario.mjs`'s `scenarioCommand`, with the scenario
+  grammar in `./scenario-evaluation.mjs`'s `parseScenarioInput`/`evaluateScenario`)
+  — a hypothetical change evaluated against the current workspace and compared
+  with its present impact. Virtual and read-only by construction: it never
+  mutates the workspace, never writes canonical history, never emits an
+  `EvolutionEvent`, and every output field carries `virtual: true` /
+  `notAuthoritative` — a what-if projection, never an authoritative verdict.
+  Refuses an Nx workspace with polyglot manifests but no plugin registration;
+  incomplete coverage withholds the evaluation as the structured
+  incomplete-coverage refusal (exit 3, no `result`). Descriptive: never exits 1.
+
+- **`decisions`** (`./decisions.mjs`'s `decisionsCommand`) — the deterministic
+  chain behind one recorded decision: the decision, the governed rows that
+  stand on it (intent, constraint and fitness), the projects they govern, the
+  current evidence and findings, and the decision's verification level. It
+  composes the governance modules without owning any of them —
+  `../governance/decision-graph.mjs`'s `forwardDecision` walk,
+  `../governance/decision-fitness.mjs`'s verification level, and the row walk
+  `./provenance-command.mjs` exports, so it never holds a second copy of which
+  rows exist. A binding naming a declared fitness gate is judged against the
+  same snapshot the `fitness` command builds; one naming no declared gate
+  renders `unverifiable` — the registry alone asserts nothing, never a clean
+  pass. Refuses an unreadable registry; an unresolvable reference — the
+  positional `<id>` or any hop of the walk — is rendered as an unresolved block
+  (exit 3), never as a clean chain. Descriptive: never exits 1.
+
+- **`rules`** (`./rules.mjs`'s `rulesListCommand`, `rulesInfoCommand`,
+  `rulesVerifyCommand` and `rulesAddCommand`) — the CLI face of the official
+  rules catalog (`@ecoma-io/archkeep-rules`): `list`, `info`, `verify` and
+  `add`. The catalog is read from the filesystem at a user-resolvable path
+  (explicit `--catalog`, then
+  `node_modules/@ecoma-io/archkeep-rules/catalog.json`), never by import, and
+  artifact integrity is validated through the engine's real host
+  (`../custom-rules/host.mjs`). `verify` is the one verdict verb: exit 1 when
+  the catalog's recorded digests disagree with the shipped bytes (a digest
+  mismatch, an artifact the host refuses, or one that escaped its directory),
+  exit 3 when the catalog could not be read — the two lanes `check` uses, so
+  "the artifact was modified" never reads as "the catalog could not be looked
+  at". `list` and `info` are always exit 0; `add` exits 0 on success and 3 on
+  any failure. Catalog-derived paths are contained to the catalog's own
+  directory (`../containment.mjs`), so data a consumer vendored cannot name a
+  path outside its tree. `check` never reads the catalog.
+
 ## Shared modules
 
 - **`snapshot-meta.mjs`** — `compareSnapshotMetadata`, shared by `diff` and

package/src/commands/change-intent.mjs

@@ -84,6 +84,30 @@ export const CONSTRAINT_ROW_NAMES = Object.freeze({
   noNewCycles: "no-new-cycles",
 });
 
+/**
+ * The one spelling of a declared edge row's identity: the NUL-separated
+ * `(from, to)` project pair. Two sites must read one edge declaration as one
+ * fact — this module's duplicate rejection (the dedup key
+ * `sectionListViolations` carries rows by) and `./change.mjs`'s
+ * reconciliation (which matches a declared row against the observed graph's
+ * `{source, target}`) — so the string is built here and imported, never
+ * spelled twice. Two private spellings were the live defect this helper
+ * closes (#613): they produced the same bytes until a shape moved, which is
+ * byte-for-byte the silent direction — the reconciliation would stop
+ * recognizing declarations it was handed while every command-local test
+ * stayed green.
+ *
+ * The observed edge's `type` is deliberately not part of the pair: whether
+ * the graph emits a dependency as `static` or `dynamic` is the model's
+ * spelling, not the author's promise (`./change.mjs`, `reconcileMaterialDelta`).
+ *
+ * @param {{from: string, to: string}} row A validated edge row.
+ * @returns {string}
+ */
+export function edgePairKey({ from, to }) {
+  return `${from}\u0000${to}`;
+}
+
 /** A value's type, for an error message that shows what was actually there. */
 function describe(value) {
   if (Array.isArray(value)) return `an array (${JSON.stringify(value)})`;
@@ -280,7 +304,7 @@ export function findChangeIntentViolations(raw) {
       },
       identity: (entry) =>
         isPlainObject(entry) && nonEmptyString(entry.from) && nonEmptyString(entry.to)
-          ? `${entry.from}\u0000${entry.to}`
+          ? edgePairKey(/** @type {{from: string, to: string}} */ (entry))
           : "",
     }),
   );