@hraness/peopleblade 0.3.5 → 0.4.0

package/dist/cloud-sync-client.js

@@ -3,8 +3,496 @@
 import { Effect as Effect3 } from "effect";
 
 // src/lib/contracts.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
+
+// node_modules/@hraness/oh/dist/index.js
+import { createHash, randomBytes } from "crypto";
+
+class OhValidationError extends Error {
+  code;
+  path;
+  constructor(code, path, message) {
+    super(`${path}: ${message}`);
+    this.name = "OhValidationError";
+    this.code = code;
+    this.path = path;
+  }
+}
+function isPlainRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function hasExactKeys(value, keys) {
+  const actual = Object.keys(value);
+  return actual.length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function assertUnicodeScalarString(value, path) {
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) {
+        throw new OhValidationError("invalid-unicode", path, "contains an unpaired surrogate");
+      }
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new OhValidationError("invalid-unicode", path, "contains an unpaired surrogate");
+    }
+  }
+}
+function encodeCanonical(value, path, ancestors) {
+  if (value === null || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (typeof value === "string") {
+    assertUnicodeScalarString(value, path);
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new OhValidationError("non-json-number", path, "must be finite");
+    }
+    if (Object.is(value, -0)) {
+      throw new OhValidationError("noncanonical-number", path, "negative zero is not canonical");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value !== "object" || value === null) {
+    throw new OhValidationError("non-json-value", path, `cannot encode ${typeof value}`);
+  }
+  if (ancestors.has(value)) {
+    throw new OhValidationError("cycle", path, "contains a cycle");
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      const encoded = [];
+      for (let index = 0;index < value.length; index += 1) {
+        if (!Object.hasOwn(value, index)) {
+          throw new OhValidationError("sparse-array", `${path}[${index}]`, "must not contain holes");
+        }
+        encoded.push(encodeCanonical(value[index], `${path}[${index}]`, ancestors));
+      }
+      const extraKeys = Reflect.ownKeys(value).filter((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= value.length));
+      if (extraKeys.length > 0) {
+        throw new OhValidationError("non-json-property", path, "array has non-index properties");
+      }
+      return `[${encoded.join(",")}]`;
+    }
+    if (!isPlainRecord(value)) {
+      throw new OhValidationError("non-plain-object", path, "must be a plain object");
+    }
+    const ownKeys = Reflect.ownKeys(value);
+    if (ownKeys.some((key) => typeof key !== "string")) {
+      throw new OhValidationError("non-json-property", path, "object has a symbol property");
+    }
+    const keys = ownKeys;
+    for (const key of keys) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
+        throw new OhValidationError("non-json-property", `${path}.${key}`, "must be an enumerable data property");
+      }
+    }
+    keys.sort();
+    const entries = keys.map((key) => {
+      assertUnicodeScalarString(key, `${path}.<key>`);
+      return `${JSON.stringify(key)}:${encodeCanonical(value[key], `${path}.${key}`, ancestors)}`;
+    });
+    return `{${entries.join(",")}}`;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function canonicalJson(value) {
+  return encodeCanonical(value, "$", new Set);
+}
+function sha256Hex(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function canonicalSha256(value) {
+  return sha256Hex(canonicalJson(value));
+}
+function parseSha256Hex(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/u.test(value) ? value : null;
+}
+function parseCanonicalInstantV1(value) {
+  if (typeof value !== "string" || !/^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d\.\d{3}Z$/u.test(value)) {
+    return null;
+  }
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value ? value : null;
+}
+function safeCode(value, maximumLength = 128) {
+  return typeof value === "string" && value.length <= maximumLength && /^[a-z][a-z0-9]*(?:[._:/-][a-z0-9]+)*$/u.test(value) ? value : null;
+}
+function orderedUnique(values, key) {
+  return values.every((value, index) => index === 0 || key(values[index - 1]) < key(value));
+}
+function sortUnique(values, key) {
+  const sorted = [...values].sort((left, right) => {
+    const leftKey = key(left);
+    const rightKey = key(right);
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+  });
+  if (!orderedUnique(sorted, key)) {
+    throw new OhValidationError("duplicate", "$", "contains duplicate canonical values");
+  }
+  return sorted;
+}
+var OH_GRAPH_FORMAT_VERSION_V1 = 1;
+var OH_GRAPH_LIMITS_V1 = Object.freeze({
+  changesPerOperation: 8192,
+  dependenciesPerRecord: 4096,
+  recordBytes: 1024 * 1024,
+  recordsPerSnapshot: 65536
+});
+var OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1 = [
+  "activity",
+  "assertion",
+  "context",
+  "dependency-manifest",
+  "edition",
+  "entity",
+  "evidence",
+  "identity-operation",
+  "inquiry",
+  "inquiry-event",
+  "review-decision",
+  "rights-decision",
+  "schema",
+  "shape",
+  "statement",
+  "type-membership",
+  "view",
+  "vocabulary"
+];
+function recordKey(value) {
+  return typeof value === "string" && value.length <= 512 && /^[a-z][a-z0-9]*(?:[._:/-][a-z0-9]+)*$/u.test(value) ? value : null;
+}
+function createKnowledgeGraphRecordV1(input) {
+  if (!isPlainRecord(input) || !hasExactKeys(input, ["dependencies", "key", "kind", "v", "value"]) || input.v !== 1 || !Array.isArray(input.dependencies))
+    throw new TypeError("Invalid graph record input.");
+  const key = recordKey(input.key);
+  const kind = OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1.find((candidate) => candidate === input.kind);
+  if (key === null || kind === undefined || input.dependencies.length > OH_GRAPH_LIMITS_V1.dependenciesPerRecord)
+    throw new TypeError("Invalid graph record identity.");
+  const dependencies = input.dependencies.map(recordKey);
+  if (dependencies.some((dependency) => dependency === null) || !orderedUnique(dependencies, String) || dependencies.includes(key)) {
+    throw new TypeError("Graph dependencies must be ordered, unique, and non-reflexive.");
+  }
+  const valueJson = canonicalJson(input.value);
+  if (Buffer.byteLength(valueJson, "utf8") > OH_GRAPH_LIMITS_V1.recordBytes) {
+    throw new RangeError("Graph record value exceeds its canonical byte limit.");
+  }
+  const payload = { dependencies, key, kind, v: 1, value: input.value };
+  return { ...payload, recordSha256: canonicalSha256(payload) };
+}
+function parseKnowledgeGraphRecordV1(value) {
+  if (!isPlainRecord(value) || !Object.hasOwn(value, "recordSha256"))
+    return null;
+  const recordSha256 = parseSha256Hex(value.recordSha256);
+  const { recordSha256: _digest, ...input } = value;
+  try {
+    const created = createKnowledgeGraphRecordV1(input);
+    return recordSha256 !== null && created.recordSha256 === recordSha256 ? { ...created, recordSha256 } : null;
+  } catch {
+    return null;
+  }
+}
+function changeKey(change) {
+  return change.kind === "put" ? change.record.key : change.key;
+}
+function canonicalKnowledgeGraphChangesV1(changes) {
+  const normalized = [];
+  for (const change of changes) {
+    if (!isPlainRecord(change) || change.v !== 1)
+      throw new TypeError("Invalid graph change.");
+    if (change.kind === "put") {
+      const record = parseKnowledgeGraphRecordV1(change.record);
+      if (record === null)
+        throw new TypeError("Invalid graph record in change.");
+      normalized.push({ kind: "put", record, v: 1 });
+    } else if (change.kind === "tombstone") {
+      const key = recordKey(change.key);
+      const priorSha256 = parseSha256Hex(change.priorSha256);
+      if (key === null || priorSha256 === null)
+        throw new TypeError("Invalid graph tombstone.");
+      normalized.push({ key, kind: "tombstone", priorSha256, v: 1 });
+    } else
+      throw new TypeError("Unknown graph change kind.");
+  }
+  return sortUnique(normalized, changeKey);
+}
+var OH_ONTOLOGY_VERSION_V1 = "1.0.0";
+var OH_CONTRACT_ID_V1 = "oh.ontology.v1";
+var OH_KNOWLEDGE_LIMITS_V1 = Object.freeze({
+  dimensions: 64,
+  listValues: 256,
+  qualifiers: 128,
+  statementBytes: 256 * 1024,
+  textBytes: 64 * 1024
+});
+var OH_SCHEMA_FORMAT_VERSION_V1 = 1;
+var manifestPayload = Object.freeze({
+  contractId: OH_CONTRACT_ID_V1,
+  graphFormatVersion: OH_GRAPH_FORMAT_VERSION_V1,
+  ontologyVersion: OH_ONTOLOGY_VERSION_V1,
+  recordKinds: OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1,
+  schemaFormatVersion: OH_SCHEMA_FORMAT_VERSION_V1,
+  v: 1
+});
+var OH_CONTRACT_MANIFEST_V1 = Object.freeze({
+  ...manifestPayload,
+  contractSha256: canonicalSha256(manifestPayload)
+});
+class OhRecordCodecRegistry {
+  #codecs = new Map;
+  #sealed = false;
+  register(codec) {
+    if (this.#sealed)
+      throw new TypeError("The codec registry is sealed.");
+    if (this.#codecs.has(codec.kind))
+      throw new TypeError(`A codec is already registered for ${codec.kind}.`);
+    this.#codecs.set(codec.kind, Object.freeze({ kind: codec.kind, parse: codec.parse }));
+    return this;
+  }
+  parse(kind, value) {
+    const codec = this.#codecs.get(kind);
+    if (codec !== undefined)
+      return codec.parse(value);
+    try {
+      canonicalJson(value);
+      return value;
+    } catch {
+      return null;
+    }
+  }
+  has(kind) {
+    return this.#codecs.has(kind);
+  }
+  parseRequired(kind, value) {
+    const codec = this.#codecs.get(kind);
+    if (codec === undefined)
+      return null;
+    try {
+      const parsed = codec.parse(value);
+      if (parsed === null)
+        return null;
+      canonicalJson(parsed);
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  seal() {
+    this.#sealed = true;
+    return this;
+  }
+  get sealed() {
+    return this.#sealed;
+  }
+}
+var OH_OPERATION_MAX_BYTES_V1 = 64 * 1024 * 1024;
+class OhProfileError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OhProfileError";
+  }
+}
+var OH_CANONICAL_STORE_PROFILE_V1 = createOhStoreProfileV1({
+  applicationProfileSha256: null,
+  capabilities: {
+    changesSince: true,
+    dependencyClosureExport: true,
+    exactSnapshots: true,
+    operationReplication: true,
+    semanticBundleCommit: true,
+    v: 1,
+    wholeSpacePurge: false
+  },
+  profileId: "oh.store.canonical.v1",
+  profileKind: "canonical",
+  v: 1
+});
+var OH_WORKING_STORE_PROFILE_V1 = createOhStoreProfileV1({
+  applicationProfileSha256: null,
+  capabilities: {
+    changesSince: true,
+    dependencyClosureExport: true,
+    exactSnapshots: true,
+    operationReplication: false,
+    semanticBundleCommit: true,
+    v: 1,
+    wholeSpacePurge: true
+  },
+  profileId: "oh.store.working.v1",
+  profileKind: "working",
+  v: 1
+});
+var OH_DEPENDENCY_CLOSURE_LIMITS_V1 = Object.freeze({
+  bytes: 64 * 1024 * 1024,
+  records: 8192,
+  roots: 1024
+});
+var EMPTY_RECORDS_SHA256 = canonicalSha256([]);
+function parseCapabilities(value) {
+  if (!isPlainRecord(value) || !hasExactKeys(value, [
+    "changesSince",
+    "dependencyClosureExport",
+    "exactSnapshots",
+    "operationReplication",
+    "semanticBundleCommit",
+    "v",
+    "wholeSpacePurge"
+  ]) || value.changesSince !== true || value.dependencyClosureExport !== true || value.exactSnapshots !== true || typeof value.operationReplication !== "boolean" || value.semanticBundleCommit !== true || value.v !== 1 || typeof value.wholeSpacePurge !== "boolean")
+    return null;
+  return {
+    changesSince: true,
+    dependencyClosureExport: true,
+    exactSnapshots: true,
+    operationReplication: value.operationReplication,
+    semanticBundleCommit: true,
+    v: 1,
+    wholeSpacePurge: value.wholeSpacePurge
+  };
+}
+function createOhStoreProfileV1(input) {
+  if (!isPlainRecord(input) || !hasExactKeys(input, [
+    "applicationProfileSha256",
+    "capabilities",
+    "profileId",
+    "profileKind",
+    "v"
+  ]) || input.v !== 1)
+    throw new TypeError("Invalid Oh store profile input.");
+  const profileId = safeCode(input.profileId);
+  const applicationProfileSha256 = input.applicationProfileSha256 === null ? null : parseSha256Hex(input.applicationProfileSha256);
+  const capabilities = parseCapabilities(input.capabilities);
+  if (profileId === null || capabilities === null || input.applicationProfileSha256 !== null && applicationProfileSha256 === null || input.profileKind !== "canonical" && input.profileKind !== "working") {
+    throw new TypeError("Invalid Oh store profile input.");
+  }
+  if (input.profileKind === "working" && (capabilities.operationReplication || !capabilities.wholeSpacePurge)) {
+    throw new OhProfileError("A working profile must disable operation replication and permit whole-space purge.");
+  }
+  if (input.profileKind === "canonical" && capabilities.wholeSpacePurge) {
+    throw new OhProfileError("A canonical profile cannot permit whole-space purge.");
+  }
+  const payload = {
+    applicationProfileSha256,
+    capabilities: Object.freeze(capabilities),
+    profileId,
+    profileKind: input.profileKind,
+    v: 1
+  };
+  return Object.freeze({ ...payload, profileSha256: canonicalSha256(payload) });
+}
+class OhSemanticBundleIngressV1 {
+  #codecs;
+  #store;
+  constructor(store, codecs) {
+    this.#store = store;
+    this.#codecs = codecs.seal();
+  }
+  async commit(value) {
+    if (!isPlainRecord(value) || !hasExactKeys(value, [
+      "actorId",
+      "expectedHead",
+      "instant",
+      "operationId",
+      "puts",
+      "tombstones",
+      "v"
+    ]) || value.v !== 1 || !Array.isArray(value.puts) || !Array.isArray(value.tombstones) || value.puts.length + value.tombstones.length < 1 || value.puts.length + value.tombstones.length > OH_GRAPH_LIMITS_V1.changesPerOperation) {
+      throw new TypeError("Invalid semantic bundle.");
+    }
+    const actorId = safeCode(value.actorId);
+    const operationId = safeCode(value.operationId);
+    const expected = value.expectedHead;
+    const instant = value.instant === null ? undefined : parseCanonicalInstantV1(value.instant);
+    if (actorId === null || operationId === null || !isPlainRecord(expected) || !hasExactKeys(expected, ["generation", "operationSha256"]) || !Number.isSafeInteger(expected.generation) || expected.generation < 0 || expected.operationSha256 !== null && parseSha256Hex(expected.operationSha256) === null || expected.generation === 0 !== (expected.operationSha256 === null) || value.instant !== null && instant === null)
+      throw new TypeError("Invalid semantic bundle identity.");
+    const changes = [];
+    for (const item of value.puts) {
+      if (!isPlainRecord(item) || !hasExactKeys(item, ["dependencies", "key", "kind", "v", "value"]) || item.v !== 1 || !Array.isArray(item.dependencies) || !OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1.some((kind) => kind === item.kind)) {
+        throw new TypeError("Invalid semantic bundle put.");
+      }
+      const parsed = this.#codecs.parseRequired(item.kind, item.value);
+      if (parsed === null)
+        throw new TypeError(`The ${String(item.kind)} codec rejected a semantic value.`);
+      const record = createKnowledgeGraphRecordV1({
+        dependencies: item.dependencies,
+        key: item.key,
+        kind: item.kind,
+        v: 1,
+        value: parsed
+      });
+      changes.push({ kind: "put", record, v: 1 });
+    }
+    for (const item of value.tombstones) {
+      if (!isPlainRecord(item) || !hasExactKeys(item, ["key", "priorSha256", "v"]) || item.v !== 1) {
+        throw new TypeError("Invalid semantic bundle tombstone.");
+      }
+      const priorSha256 = parseSha256Hex(item.priorSha256);
+      if (typeof item.key !== "string" || priorSha256 === null)
+        throw new TypeError("Invalid semantic bundle tombstone.");
+      changes.push({ key: item.key, kind: "tombstone", priorSha256, v: 1 });
+    }
+    const canonical = canonicalKnowledgeGraphChangesV1(changes);
+    return await this.#store.commit({
+      actorId,
+      changes: canonical,
+      expectedHead: {
+        generation: expected.generation,
+        operationSha256: expected.operationSha256
+      },
+      ...typeof instant === "string" ? { instant } : {},
+      operationId
+    });
+  }
+}
+
+// src/lib/contracts.ts
 import { z } from "zod";
+
+// src/lib/public-identity.ts
+var RESERVED_PROFILE_PUBLISHERS = new Set([
+  "api",
+  "connect",
+  "docs",
+  "about",
+  "sitemap.xml",
+  "robots.txt",
+  "llms.txt",
+  "llms-full.txt",
+  "manifest.json",
+  "favicon.ico",
+  "favicon.svg",
+  "opengraph-image",
+  "twitter-image",
+  "icon",
+  "apple-icon",
+  "_next"
+]);
+function parseSoulscrapeProfileUrl(value) {
+  if (typeof value !== "string" || value.length > 128)
+    return null;
+  const match = /^https:\/\/soulscrape\.com\/([a-z0-9_-]+)\/([a-z0-9-]+)$/u.exec(value);
+  if (match === null || match[0] !== value)
+    return null;
+  const username = match[1];
+  const handle = match[2];
+  if (username.length < 3 || username.length > 24 || !/^[a-z0-9](?:[a-z0-9]|[-_](?=[a-z0-9]))*[a-z0-9]$/u.test(username) || RESERVED_PROFILE_PUBLISHERS.has(username) || handle.length < 2 || handle.length > 64 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(handle))
+    return null;
+  return { url: value, username, handle };
+}
+function parseWikidataId(value) {
+  if (typeof value !== "string" || value.length > 11)
+    return null;
+  return /^Q[1-9][0-9]{0,9}$/u.exec(value)?.[0] === value ? value : null;
+}
+
+// src/lib/contracts.ts
 var enrichmentPolicyVersion = "identity-bound-claims-v15";
 var enrichmentPriorityPolicyVersion = "enrichment-value-v9";
 var exactProfileTitleOnlyEvidenceExcerpt = "Title-only result for the exact stored public profile URL; no page text was returned.";
@@ -77,7 +565,7 @@ var enrichmentInputSchema = legacyEnrichmentInputSchema.extend({
   identityAnchors: identityAnchorsSchema
 }).strict();
 function enrichmentInputSha256(value) {
-  return sha256(canonicalJson(enrichmentInputSchema.parse({
+  return sha256(canonicalJson2(enrichmentInputSchema.parse({
     displayName: value.displayName,
     emails: value.emails,
     phones: value.phones,
@@ -90,7 +578,7 @@ function enrichmentInputSha256(value) {
   })));
 }
 function legacyEnrichmentInputSha256(value) {
-  return sha256(canonicalJson(legacyEnrichmentInputSchema.parse({
+  return sha256(canonicalJson2(legacyEnrichmentInputSchema.parse({
     displayName: value.displayName,
     emails: value.emails,
     phones: value.phones,
@@ -258,6 +746,19 @@ var serverSyncPageInputSchema = z.object({
     });
   }
   input.contacts.forEach((contact, index) => {
+    try {
+      canonicalJson2(contact);
+    } catch (error) {
+      if (error instanceof OhValidationError) {
+        context.addIssue({
+          code: "custom",
+          path: ["contacts", index],
+          message: `Sync contact is not canonical JSON (${error.code}: ${error.message})`
+        });
+        return;
+      }
+      throw error;
+    }
     const version = syncContactInputVersion(contact);
     if (version === 0)
       return;
@@ -279,7 +780,7 @@ var serverSyncPageSchema = serverSyncPageInputSchema.transform((input) => {
     ordinal: input.ordinal,
     inputVersion,
     selectionVersion,
-    legacyPayloadSha256: inputVersion === 2 && selectionVersion === 1 ? null : sha256(canonicalJson(input.contacts)),
+    legacyPayloadSha256: inputVersion === 2 && selectionVersion === 1 ? null : sha256(canonicalJson2(input.contacts)),
     contacts: input.contacts.map((contact) => {
       if (inputVersion === 2 && selectionVersion === 1)
         return cloudContactSchema.parse(contact);
@@ -461,8 +962,34 @@ var enrichmentEvidenceRecordSchema = enrichmentEvidenceReferenceSchema.extend({
 }).strict();
 var publicEvidenceSchema = enrichmentEvidenceReferenceSchema.omit({ kind: true }).strict();
 var manualResearchSchema = enrichmentOutputSchema.extend({
-  evidence: z.array(publicEvidenceSchema).max(5)
-}).strict();
+  wikidataId: z.string().max(11).refine((value) => parseWikidataId(value) !== null, "Invalid Wikidata QID").nullable().optional(),
+  wikidataIdEvidenceIndex: z.number().int().min(0).max(4).nullable().optional(),
+  soulscrapeProfileUrl: z.string().max(128).refine((value) => parseSoulscrapeProfileUrl(value) !== null, "Invalid canonical Soulscrape profile URL").nullable().optional(),
+  soulscrapeProfileUrlEvidenceIndex: z.number().int().min(0).max(4).nullable().optional(),
+  evidence: z.array(publicEvidenceSchema.extend({
+    url: z.string().refine((value) => publicEvidenceSchema.shape.url.safeParse(value).success, "Evidence URL must be a bounded HTTP or HTTPS URL")
+  })).max(5)
+}).strict().superRefine((output, context) => {
+  for (const [field, indexField] of [
+    ["wikidataId", "wikidataIdEvidenceIndex"],
+    ["soulscrapeProfileUrl", "soulscrapeProfileUrlEvidenceIndex"]
+  ]) {
+    const value = output[field];
+    const index = output[indexField];
+    if (value == null) {
+      if (index != null)
+        context.addIssue({ code: "custom", path: [indexField], message: `${indexField} requires ${field}.` });
+      continue;
+    }
+    if (output.identityMatch !== "confirmed") {
+      context.addIssue({ code: "custom", path: [field], message: `${field} requires a confirmed identity match.` });
+    }
+    const referenceUrl = field === "wikidataId" ? `https://www.wikidata.org/wiki/${value}` : value;
+    if (index == null || output.evidence[index]?.url !== referenceUrl) {
+      context.addIssue({ code: "custom", path: [indexField], message: `${field} requires its exact cited public reference URL.` });
+    }
+  }
+}).transform((output) => ({ ...output, evidence: output.evidence.map((item) => publicEvidenceSchema.parse(item)) }));
 function normalizedEvidenceText(value) {
   return value.normalize("NFKC").toLocaleLowerCase("en-US").replaceAll(/[^\p{L}\p{N}]+/gu, " ").trim();
 }
@@ -1267,15 +1794,11 @@ var IDENTITY_GRADE_CONTENT_FREE_TEXT = new Set([
   "verified profile",
   normalizedEvidenceText(exactProfileTitleOnlyEvidenceExcerpt)
 ]);
-function canonicalJson(value) {
-  if (value === null || typeof value !== "object")
-    return JSON.stringify(value);
-  if (Array.isArray(value))
-    return `[${value.map(canonicalJson).join(",")}]`;
-  return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+function canonicalJson2(value) {
+  return canonicalJson(value);
 }
 function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
+  return createHash2("sha256").update(value).digest("hex");
 }
 
 // src/local/cloud-configuration.ts
@@ -1417,7 +1940,7 @@ function providerHandleKey(candidate, databaseInstanceId) {
     return candidate.provider;
   if (candidate.service === null || candidate.realmExternalIdSha256 === null || candidate.bindingAuthSha256 === null)
     throw new Error("Beeper provider handle is missing its bound source realm.");
-  const realmDiscriminator = createHmac("sha256", databaseInstanceId).update(canonicalJson([
+  const realmDiscriminator = createHmac("sha256", databaseInstanceId).update(canonicalJson2([
     "peopleblade-beeper-provider-handle-realm-v1",
     candidate.bindingAuthSha256,
     candidate.realmExternalIdSha256
@@ -1674,7 +2197,7 @@ function projectCloudContacts(database, options = {}) {
     };
     return cloudContactSchema.parse({
       ...data,
-      metadataSha256: sha256(canonicalJson(data)),
+      metadataSha256: sha256(canonicalJson2(data)),
       enrichmentInputSha256: enrichmentInputSha256(data)
     });
   });