@ultimat3/action 2.0.0 → 4.0.0

package/CLAUDE.md

@@ -35,7 +35,7 @@ Owns the `action` + `mutator` primitives and their six projections. Tier 3.
 | `audit.ts` | the audit seam: `AuditRecord`, `AuditSink`, the memory sink, the installed-sink store |
 | `audit-gate.ts` | **the only** file that calls a sink, and where the two failure policies live |
 | `type-pins.ts` | compile-time assertions `tsc` checks — what the erased view projects, and why `client()` is not part of it |
-| `naming.ts`, `validate.ts`, `json-schema.ts`, `stable.ts` | pure helpers |
+| `naming.ts`, `validate.ts`, `json-schema.ts`, `stable.ts` | pure helpers. `stable.ts` is the DOCUMENT serializer only — the hash form is `@ultimat3/core`'s `canonicalJson`/`fingerprint` |
 
 ## Invariants
 
@@ -61,16 +61,32 @@ Owns the `action` + `mutator` primitives and their six projections. Tier 3.
   author, and never reach the evaluation that had the row. `meta.policy` stays set — dropping
   it would read as "this action is unguarded" in `x routes` and the manifest. `http.test.ts`
   drives a row-level action over the real pipeline and counts the evaluations: exactly one.
-- **`stable.ts` holds TWO serializers, and they are not one function.** `stableStringify` is the
-  DOCUMENT form: `serializeOpenApi` publishes it as `openapi.json` and `json-schema.ts` re-reads it
-  with `JSON.parse`, so a non-finite number has to be `null` — the bare token `NaN` would make a
-  published spec unparseable. `canonicalJson` is the HASH form `fingerprint` is taken over, and it
-  must be INJECTIVE: `NaN`, `±Infinity` and JSON `null` all encoded as `'null'` and `String(-0)` is
-  `"0"`, so four distinct inputs shared one `requestHash` — one caller handed another's stored
-  response on replay — and one job dedupe key. That is why the fix `@ultimat3/query` made in its own
-  `stable.ts` could not simply be copied here; it needed the split first. Ordinary payloads are
-  byte-identical between the two, so no idempotency record and no enqueued job moved.
-  `stable.test.ts` pins both duties, including a `JSON.parse` of the document form.
+- **`stable.ts` holds the DOCUMENT form and NOTHING else, `As of 2026-08`.** `stableStringify` is
+  published as `openapi.json` by `serializeOpenApi` and re-read with `JSON.parse` by
+  `json-schema.ts`, so a non-finite number has to be `null` and a `Date` has to be its ISO string —
+  the bare token `NaN` would make a published spec unparseable. The HASH form left this file:
+  `canonicalJson` + `fingerprint` are **`@ultimat3/core`'s**, because `@ultimat3/query` and
+  `@ultimat3/realtime` each held their own copy of the identical function and all three are tier 3,
+  so no two of them could import each other and a copy in any was a second answer for the other
+  two. They had already diverged — query's had no `Date` branch, so every date window of a read
+  shared one cache key. Nothing about this package's keys moved: `fingerprint` is the same code at
+  the same width, `stable.test.ts` still pins the document duty (a `JSON.parse` of what it emits)
+  and now pins the byte-equality against core's form for an ordinary payload, which is what says no
+  idempotency record and no enqueued job moved.
+  **Why the hash form must be a separate function at all** — the reason that survives the move.
+  `NaN`, `±Infinity` and JSON `null` all encoded as `'null'` and `String(-0)` is `"0"`, so four
+  distinct inputs shared one `requestHash` (one caller handed another's stored response on replay)
+  and one job dedupe key. And three more values folded onto `{}`, the first of which `t.date`
+  produces on every parse: a `Date`, a `Map` and a `Set` have no own enumerable key, so
+  `Object.keys` was empty and the object branch rendered all three `{}` —
+  `fingerprint({ x: new Map([['a', 1]]) })` equalled `fingerprint({ x: new Set([1, 2]) })` equalled
+  `fingerprint({ x: {} })`, and an `idempotent: true` action taking `t.object({ at: t.date })`,
+  called twice under one key with two DIFFERENT dates, handed the second caller the first one's
+  stored response with no `X_IDEMPOTENCY_CONFLICT` and the handler run once. The two forms disagree
+  about all four exactly as they disagree about numbers: the document form is `JSON.stringify`'s own
+  rendering, and the hash form TAGS them — `Date(<epoch>)`, `Map(k:v,...)`, `Set(v,...)`. The tag is
+  not decoration: an untagged epoch is the same token a `t.number` field holding that epoch emits.
+  Map and Set entries are SORTED, as object keys are.
 - **`tagKeys` is `@ultimat3/cache`'s, not this package's — moved 2026-08.** `packages/action/src/tags.ts`
   and `packages/query/src/tags.ts` were byte-identical, and both packages are tier 3, so neither can
   import the other and a copy in either is a second answer for the other. `tagKey` went with it: it
@@ -201,8 +217,11 @@ Owns the `action` + `mutator` primitives and their six projections. Tier 3.
   can drive it by hand and still get the action's parse + policy. **The missing halves are
   `tenant` and `retry`**, both required on `JobDefinition` with deliberately no default, so "zero
   rewriting" was never reachable regardless of wiring. The bridge is one `job({ … })` call, and it
-  belongs in the app or at tier 4+: `action` and `jobs` are both tier 3. Not built here — that is
-  code, and this was a comment correction.
+  belongs in the app or at tier 4+: `action` and `jobs` are both tier 3. **It exists, `As of
+  2026-08`** — `agentJob()` in `@ultimat3/ai` (`agent-job.ts`), tier 4, which takes an `Action` and
+  nothing agent-specific and supplies the two missing halves as its own options. So "nothing in the
+  framework consumes it", which `job-handle.ts`'s header said until this was checked, is false: it
+  has one consumer, and an app writes the same three lines.
 - An action has no `.def`. Inside the package read it with `defOf(target)`; outside,
   read the lifted `.input`/`.output`/`.policy`/`.mcp` or `describe()`.
 - **`AnyAction` projects every surface, `client()` excepted.** The registry answers in the erased
@@ -332,6 +351,32 @@ Owns the `action` + `mutator` primitives and their six projections. Tier 3.
   `X_AUDIT_SINK_FAILED` fell into the failure branch and wrote a *second* record saying the
   action `failed` — for a handler that had committed. An audit trail lying about a write is
   worse than no audit trail; `audit.test.ts` counts the records a refusing sink was offered.
+- **`auditOutcomeFor` is TOTAL, because both callers ask inside a `catch`.**
+  `error instanceof ActionDeniedError` runs a `Proxy`'s `getPrototypeOf` trap, and the two call
+  sites are `execute`'s span attribute and the one place the `failed` record is produced — so a
+  handler throwing such a value made the probe throw *from the frame holding the app's error*,
+  and the caller got a `TypeError` in place of its own throwable. It fails closed to `failed`: a
+  value that refuses to be examined is not evidence of a policy denial. Same rule as core's
+  `isThrownError` / `isUltimateError`, and the same defect `@ultimat3/http`'s `finalize.ts` and
+  `factsOf` carried; `audit.test.ts` asserts the caller's throwable by IDENTITY, which is the only
+  assertion that catches a replacement.
+- **`json-schema.ts`'s refusal names `introspect()`, never a `toJsonSchema` member.**
+  `SchemaProvider` declares no such member and `toJsonSchema()` calls `introspect()`
+  unconditionally, so the old `fix:` told a reader to implement an API that does not exist —
+  axiom 4 inverted, and invisible to `x verify`'s `errors` step, which checks a fix line's shape
+  and never whether the API it names is real. The guard is `normalizeJsonSchema`, exported from
+  the module for its own test and absent from `src/index.ts` exactly as `sortSchema` is; the
+  shipped `toJsonSchema` cannot reach it today (it returns an object literal on every path), so
+  the test drives the guard directly rather than pretending a converter can be swapped.
+- **A lookup table is read with `Object.hasOwn`, never with the index alone.** `IRREGULAR[word]`
+  in `naming.ts` and `BY_FORMAT[node.format]` in `sample-input.ts` both read the prototype chain:
+  `splitWords` lowercases, which keeps `toString` and `hasOwnProperty` out of reach, but
+  `constructor` is already lowercase and survived — so `pluralize('constructor')` answered the
+  `Object` FUNCTION where its return type says `string`, `derivePath('addConstructor')` mounted the
+  action at `/api/function Object() { [native code] }/add` and published that as its OpenAPI path
+  and `tags`, and a provider emitting `format: 'constructor'` put a function in the payload the
+  policy contract test invokes with. Both keys are caller- or provider-supplied, which is the whole
+  test for whether this applies. Same discriminator `packages/flags/src/subject.ts:75` uses.
 - App code reaches a projection through the action (`publishPost.tool()`), never through
   `.def` and never by importing the projection function. `facade.ts` is where a new method
   is bound; the projection itself keeps living in its own file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/action",
-  "version": "2.0.0",
+  "version": "4.0.0",
   "description": "The action primitive: one declaration projected to route, OpenAPI, client, MCP tool, job handle, tests",
   "license": "MIT",
   "type": "module",
@@ -31,10 +31,10 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/cache": "2.0.0",
-    "@ultimat3/core": "2.0.0",
-    "@ultimat3/http": "2.0.0",
-    "@ultimat3/policy": "2.0.0",
-    "@ultimat3/schema": "2.0.0"
+    "@ultimat3/cache": "4.0.0",
+    "@ultimat3/core": "4.0.0",
+    "@ultimat3/http": "4.0.0",
+    "@ultimat3/policy": "4.0.0",
+    "@ultimat3/schema": "4.0.0"
   }
 }

package/src/audit-gate.ts

@@ -20,9 +20,23 @@ export function auditSinkFor(action: string): AuditSink {
   return sink;
 }
 
-/** An authz refusal is `denied`; everything else that threw is `failed`, an unparsed input included. */
+/**
+ * An authz refusal is `denied`; everything else that threw is `failed`, an unparsed input
+ * included.
+ *
+ * TOTAL, the same rule core's `isThrownError` states: `instanceof` runs a `Proxy`'s
+ * `getPrototypeOf` trap, and both callers ask this question inside a `catch` that is still
+ * holding the app's own error — `execute`'s span attribute and the one place the `failed` record
+ * is produced. A probe that threw there REPLACED the caller's throwable with its own `TypeError`,
+ * so an app catching by `instanceof` upstream stopped matching. A value that refuses to be
+ * examined is not evidence of a policy denial, so it fails closed to `failed`.
+ */
 export function auditOutcomeFor(error: unknown): AuditOutcome {
-  return error instanceof ActionDeniedError ? 'denied' : 'failed';
+  try {
+    return error instanceof ActionDeniedError ? 'denied' : 'failed';
+  } catch {
+    return 'failed';
+  }
 }
 
 export function auditFailureFor(error: unknown): AuditFailure {

package/src/contract-test.ts

@@ -5,7 +5,7 @@
  */
 
 import type { Ctx } from '@ultimat3/core';
-import { createContext, isUltimateError } from '@ultimat3/core';
+import { createContext, isUltimateError, logger } from '@ultimat3/core';
 import type { AnyAction } from './action';
 import { ActionDeniedError, ContractDriftError } from './errors';
 import { actionName, invoke } from './invoke';
@@ -51,8 +51,9 @@ export function contractTestsFor(
         await expectThrow(
           () => invoke(target, garbage, { ctx, surface: 'http' }),
           'X_INPUT_INVALID',
-          `${name} accepted ${JSON.stringify(garbage) ?? 'undefined'} as input`,
+          `${name} accepted the value this assertion sent as garbage`,
           `tighten \`input:\` in the ${name} definition`,
+          { action: name, garbage },
         );
       },
     },
@@ -75,7 +76,7 @@ export function contractTestsFor(
         if (document.paths[path] === undefined) {
           throw new ContractDriftError(
             `OpenAPI document has no entry for ${path}`,
-            'x verify --contract',
+            'x verify --json   # the contract suite is a step of it',
           );
         }
       },
@@ -163,12 +164,21 @@ async function expectDenied(
   );
 }
 
+/**
+ * `fields` and not a rendered value: `garbage` is the caller's, typed `unknown`, and it was
+ * interpolated into `cause` with `JSON.stringify` — which throws on a circular object and on a
+ * `bigint`. That throw happened on the way INTO this helper, so the assertion never ran and the
+ * failure reported was the stringifier's, not the schema's. The logger takes the value as a field
+ * and shapes it itself, the way `cache-gate.ts` and `idempotency.ts` hand it their `error`.
+ */
 async function expectThrow(
   run: () => Promise<unknown>,
   code: string,
   cause: string,
   fix: string,
+  fields: Readonly<Record<string, unknown>>,
 ): Promise<void> {
+  const report = (): void => logger.error('action.contract.assertion-failed', { ...fields, code });
   try {
     await run();
   } catch (error) {
@@ -179,7 +189,9 @@ async function expectThrow(
     // answers it. It keeps its own code and its own runnable fix — the same rule `expectDenied`
     // follows for every code it cannot attribute to `input:`.
     if (error.code === 'X_AUDIT_SINK_MISSING') throw error;
+    report();
     throw new ContractDriftError(`${cause} (got ${error.code}, expected ${code})`, fix);
   }
+  report();
   throw new ContractDriftError(cause, fix);
 }

package/src/define-api.ts

@@ -132,7 +132,14 @@ function moduleList(modules: ApiModules | undefined): readonly ApiModule[] {
  * a name no surface serves, and the last module exporting that name would win in silence.
  */
 function byRegisteredName(primitives: readonly RegisteredPrimitive[]): ApiModule {
-  const map: Record<string, RegisteredPrimitive> = {};
+  // A null-prototype map, because `name` is an export name and `map['__proto__'] = value` on a
+  // plain object runs the PROTOTYPE SETTER instead of adding a key: the primitive would vanish
+  // from `Object.keys`, from `api.actions` and from `rpc()`, while `registerPrimitive` reported
+  // it registered. `Object.create(null)` has no such accessor, so the assignment is a key.
+  const map: Record<string, RegisteredPrimitive> = Object.create(null) as Record<
+    string,
+    RegisteredPrimitive
+  >;
   for (const primitive of primitives) map[primitive.name] = primitive;
   return Object.freeze(map);
 }

package/src/http.ts

@@ -95,7 +95,17 @@ export function toRoute(target: AnyAction): Route {
     // stage deciding first would decide from `row: null` — a denial for the row's own
     // author, from an authz system that never saw the row.
     enforcedBy: 'handler',
-    input: def.input,
+    // `input` stays ABSENT, deliberately, exactly as `@ultimat3/query`'s `toQueryRoute` leaves it.
+    // Setting it hands the action's schema to the pipeline's `body` stage, which throws
+    // `bodyInvalid` — so this route answered `422 X_BODY_INVALID` for every malformed body while
+    // the operation two hundred lines down published `400 X_INPUT_INVALID`, and the SAME action
+    // called over MCP, over the typed client or directly answered `X_INPUT_INVALID`. One action,
+    // one input schema, two codes, decided by the surface the call arrived through.
+    //
+    // `invoke`'s own `validateInput` is the one parser now, and nothing is lost by dropping this:
+    // `bodyRaw()` still parses by content-type, caches, and enforces the size cap — the body stage
+    // only ever added SCHEMA validation on top. `X_BODY_INVALID` keeps its job, which is a body
+    // failing a plain `route.ts`'s own schema, where no primitive owns the input.
     cache: { mode: 'no-store', tags: tagKeys(def.cache?.invalidates ?? []) },
     tags: [resource],
     // Name AND numbers. The name alone selected a bucket the limiter's table never held, so
@@ -145,7 +155,15 @@ export function toOpenApiOperation(target: AnyAction): OpenApiOperation {
         description: 'ok',
         content: { 'application/json': { schema: { $ref: schemaRef(outputSchemaName(name)) } } },
       },
+      // BOTH, because they are two different failures and this operation published only one of
+      // them while the route answered only the other. `X_INPUT_INVALID` is the body that parsed
+      // and failed THIS action's declared schema — the primitive's own code, identical over MCP,
+      // the typed client and a direct call. `X_BODY_INVALID` is the bytes never becoming a body
+      // at all: malformed JSON, over `bodyLimitBytes`, an unreadable content type. That one is
+      // HTTP-only, because only HTTP has bytes, and it is raised in `bodyRaw()` before any schema
+      // exists to fail.
       '400': problemResponse('X_INPUT_INVALID'),
+      '422': problemResponse('X_BODY_INVALID'),
       '403': problemResponse('policy denied'),
       ...(idempotent ? { '409': problemResponse('X_IDEMPOTENCY_CONFLICT') } : {}),
     },

package/src/idempotency.ts

@@ -4,14 +4,13 @@
  * a value or a failure — and a concurrent duplicate is refused rather than run twice, because a
  * double charge is worse than a 409.
  */
-import { isUltimateError, logger } from '@ultimat3/core';
+import { fingerprint, isUltimateError, logger } from '@ultimat3/core';
 import {
   IdempotencyConflictError,
   IdempotencyNotSharedError,
   IdempotencyReplayedFailureError,
 } from './errors';
 import { MemoryIdempotencyStore } from './idempotency-memory';
-import { fingerprint } from './stable';
 
 /**
  * Where a store's records live. Declared by the driver, never inferred — the same rule

package/src/job-handle.ts

@@ -2,13 +2,14 @@
  * Projection 5: an action as durable work — its input schema, a payload-derived
  * idempotency key, and an `invoke` that runs the action's one execution path under
  * `surface: 'job'`, so a queued run gets the same validation and policy evaluation
- * as the HTTP call. Nothing in the framework consumes it — an app bridges it into `job()`.
+ * as the HTTP call. `@ultimat3/ai`'s `agentJob()` is the framework's one consumer — it takes any
+ * `Action` and composes `job()` around this shape — and an app may write the same three lines.
  */
 import type { Ctx } from '@ultimat3/core';
+import { fingerprint } from '@ultimat3/core';
 import type { InferInput, InferOutput, StandardSchemaV1 } from '@ultimat3/schema';
 import type { Action } from './action';
 import { actionName, invoke } from './invoke';
-import { fingerprint } from './stable';
 
 /**
  * **`@ultimat3/jobs` does not consume this, and cannot as written** (`As of 2026-08`; the header
@@ -24,9 +25,10 @@ import { fingerprint } from './stable';
  * `tenant` and `retry` are what the bridge cannot fill: both are REQUIRED on `JobDefinition` with
  * no default, on purpose — jobs states that every candidate default for `tenant` is a
  * cross-tenant read waiting to happen. So "enqueueing an action costs zero rewriting" was never
- * reachable; two facts an action does not declare have to come from somewhere. Whoever closes
- * this writes the adapter in the app or at tier 4+: `action` and `jobs` are both tier 3, so
- * neither may import the other.
+ * reachable; two facts an action does not declare have to come from somewhere. The adapter that
+ * supplies them is `agentJob()` in `@ultimat3/ai` (`agent-job.ts`) — tier 4, which is where this
+ * paragraph said it belongs, since `action` and `jobs` are both tier 3 and neither may import the
+ * other. It takes an `Action` and nothing agent-specific, so it is the bridge for any action.
  */
 export interface ActionJobHandle<
   TInput extends StandardSchemaV1 = StandardSchemaV1,

package/src/json-schema.ts

@@ -20,22 +20,33 @@ export type JsonSchemaObject = Record<string, unknown>;
  * reach a projection that throws.
  */
 export function jsonSchemaOf(schema: StandardSchemaV1): JsonSchemaObject {
-  return normalize(() => toJsonSchema(schema));
+  return normalizeJsonSchema(() => toJsonSchema(schema));
 }
 
 /** Draft-07, no `$schema` — the exact shape an MCP `tools/list` entry needs. */
 export function mcpSchemaOf(schema: StandardSchemaV1): JsonSchemaObject {
-  return normalize(() => toMcpInputSchema(schema));
+  return normalizeJsonSchema(() => toMcpInputSchema(schema));
 }
 
-function normalize(convert: () => unknown): JsonSchemaObject {
+/**
+ * The narrowing both projections share, and the refusal it earns: a converter that answered with
+ * something that is not a JSON object is the same failure by a quieter route, so it gets the same
+ * shipped code rather than a permissive node. Exported for its own test and nothing else — it is
+ * absent from `src/index.ts`, exactly as `sortSchema` is.
+ *
+ * **The `fix:` names `introspect`, never a `toJsonSchema` member.** `SchemaProvider` declares no
+ * such member (`packages/schema/src/provider.ts`) and `toJsonSchema()` calls `introspect()`
+ * unconditionally, so the old line — "configure a provider whose toJsonSchema returns an object" —
+ * instructed a reader to implement an API that does not exist, which is axiom 4 inverted. It is
+ * the same false clause `@ultimat3/schema` deleted from its own docs; this was the user-visible
+ * half, one package over.
+ */
+export function normalizeJsonSchema(convert: () => unknown): JsonSchemaObject {
   const raw: unknown = convert();
   if (isJsonObject(raw)) return raw;
-  // A converter that answered with something that is not a JSON object is the same failure by a
-  // quieter route, so it gets the same shipped code rather than a permissive node.
   throw new SchemaUnsupportedError({
     cause: `the schema converted to ${raw === null ? 'null' : typeof raw}, not a JSON Schema object`,
-    fix: 'declare the schema with `t` from @ultimat3/action, or configure a provider whose toJsonSchema returns an object: configureSchemaProvider({ ... })',
+    fix: 'declare the schema with `t` from @ultimat3/action, or add an introspect() returning a SchemaNode to the object passed to configureSchemaProvider()',
   });
 }
 

package/src/naming.ts

@@ -40,8 +40,12 @@ export function splitWords(name: string): string[] {
  * alone, so `publishPosts` and `publishPost` agree on the `posts` resource.
  */
 export function pluralize(word: string): string {
-  const irregular = IRREGULAR[word];
-  if (irregular !== undefined) return irregular;
+  // `Object.hasOwn`, never a truthiness check on the read: `IRREGULAR['constructor']` is the
+  // `Object` FUNCTION off the prototype chain, not `undefined`, and `splitWords` lowercases —
+  // which keeps `toString` out of reach and lets `constructor` straight through. `pluralize` is
+  // public API returning `string`, and `derivePath` publishes what it answers as the action's
+  // HTTP path, its OpenAPI `paths` key and its `tags` entry.
+  if (Object.hasOwn(IRREGULAR, word)) return IRREGULAR[word] ?? word;
   if (word.endsWith('s')) return word;
   if (/(x|z|ch|sh)$/.test(word)) return `${word}es`;
   if (/[^aeiou]y$/.test(word)) return `${word.slice(0, -1)}ies`;

package/src/sample-input.ts

@@ -33,7 +33,11 @@ function sampleString(node: SchemaNode): string {
   if (node.format !== undefined) {
     // A format value is already the exact shape its validator wants; padding or truncating it
     // to a length bound would break the only thing that makes it valid.
-    const known: string | undefined = BY_FORMAT[node.format];
+    // `Object.hasOwn`, never the read alone: `node.format` comes from a provider's IR, and
+    // `BY_FORMAT['constructor']` is the `Object` function off the prototype chain rather than
+    // `undefined` — a function in the payload the policy assertion invokes with, where the type
+    // says `string`. Same discriminator `naming.ts` uses on its irregular-plural table.
+    const known = Object.hasOwn(BY_FORMAT, node.format) ? BY_FORMAT[node.format] : undefined;
     return known ?? SAMPLE_STRING;
   }
   const min = node.minLength ?? 0;
@@ -172,6 +176,10 @@ function patternAt(node: SchemaNode | undefined, path: string): string | undefin
   if (node === undefined) return undefined;
   if (path === '' || path === ROOT_PATH) return node.pattern;
   const [head, ...rest] = path.split('.');
-  const child = head === undefined ? undefined : node.properties?.[head];
+  // `path` is the caller's — `describeSampleGap` is exported — so the same own-property read the
+  // format table takes: `properties['constructor']` is otherwise the `Object` function.
+  const properties = node.properties ?? {};
+  const child =
+    head === undefined || !Object.hasOwn(properties, head) ? undefined : properties[head];
   return child === undefined ? undefined : patternAt(child, rest.join('.'));
 }

package/src/stable.ts

@@ -1,8 +1,12 @@
 /**
- * Deterministic JSON in two forms, deliberately NOT one function. `stableStringify` is the
- * DOCUMENT form — `openapi.json` is published from it and `json-schema.ts` re-reads it with
- * `JSON.parse`, so a non-finite number must be `null`. `canonicalJson` is the HASH form — it is
- * only ever hashed, so it must be INJECTIVE. One walk, two number rules.
+ * Deterministic JSON, DOCUMENT form. `serializeOpenApi` publishes this string as `openapi.json`
+ * and `json-schema.ts` re-reads it with `JSON.parse`, so what it emits must be valid JSON: a
+ * non-finite number is `null` and a `Date` is what `JSON.stringify` makes of one.
+ *
+ * The HASH form is `@ultimat3/core`'s `canonicalJson`, and the two are deliberately NOT one
+ * function. That one must be INJECTIVE, so it emits bare `NaN` / `Infinity` / `-0` tokens and tags
+ * a `Date`, a `Map` and a `Set` — none of which parses, which is exactly why it may not be
+ * published. Ordinary payloads are byte-identical between the two; `stable.test.ts` pins that.
  */
 
 export type JsonObject = Record<string, unknown>;
@@ -11,47 +15,19 @@ export function isJsonObject(value: unknown): value is JsonObject {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
-/** How the two forms disagree, and the only thing they disagree about. */
-type NumberForm = (value: number) => string;
-
-/** JSON's own rule: a non-finite number has no token in the grammar, so it is `null`. */
-const jsonNumber: NumberForm = (value) => (Number.isFinite(value) ? String(value) : 'null');
-
-/**
- * Bare tokens, never quoted and never `'null'`. This output is only ever hashed, so an unquoted
- * word cannot collide with the `string` branch (which always quotes), while `'null'` collided with
- * JSON `null` itself — `{ n: NaN }`, `{ n: Infinity }`, `{ n: -Infinity }` and `{ n: null }` were
- * one `requestHash` and therefore one idempotency record. `-0` is spelled out for the same reason:
- * `String(-0)` is `"0"`, so `-0` and `0` were one record too. The twin of `@ultimat3/query`'s rule
- * in its own `stable.ts`; both are tier 3, so neither can import the other.
- */
-const hashNumber: NumberForm = (value) => {
-  if (Number.isNaN(value)) return 'NaN';
-  if (!Number.isFinite(value)) return value > 0 ? 'Infinity' : '-Infinity';
-  return Object.is(value, -0) ? '-0' : String(value);
-};
-
 /** JSON with object keys sorted at every depth. No timestamps, no insertion-order leaks. */
 export function stableStringify(value: unknown, indent = 0): string {
-  return write(value, indent, 0, jsonNumber);
-}
-
-/**
- * The canonical form a `fingerprint` is taken over. Byte-identical to `stableStringify(value)` for
- * any value carrying no `NaN`, no `±Infinity` and no `-0`, which is why no idempotency record and
- * no job dedupe key issued before this moved.
- */
-export function canonicalJson(value: unknown): string {
-  return write(value, 0, 0, hashNumber);
+  return write(value, indent, 0);
 }
 
-function write(value: unknown, indent: number, depth: number, number: NumberForm): string {
+function write(value: unknown, indent: number, depth: number): string {
   if (value === null) return 'null';
   switch (typeof value) {
     case 'string':
       return JSON.stringify(value);
+    // JSON's own rule: a non-finite number has no token in the grammar, so it is `null`.
     case 'number':
-      return number(value);
+      return Number.isFinite(value) ? String(value) : 'null';
     case 'boolean':
       return String(value);
     case 'bigint':
@@ -63,11 +39,17 @@ function write(value: unknown, indent: number, depth: number, number: NumberForm
     default:
       break;
   }
+  // Ahead of the object branch, because none of the three has an own enumerable key: `Object.keys`
+  // is empty for all of them, so the branch below would answer `{}` for a date as well. What each
+  // becomes is `JSON.stringify`'s own answer — the ISO string (`null` for an Invalid Date), and
+  // `{}` for a Map and a Set — because this string is published and re-parsed.
+  if (value instanceof Date) return JSON.stringify(value);
+  if (value instanceof Map || value instanceof Set) return '{}';
   const pad = indent > 0 ? '\n'.padEnd(1 + indent * (depth + 1), ' ') : '';
   const close = indent > 0 ? '\n'.padEnd(1 + indent * depth, ' ') : '';
   if (Array.isArray(value)) {
     if (value.length === 0) return '[]';
-    const items = value.map((item) => write(item, indent, depth + 1, number));
+    const items = value.map((item) => write(item, indent, depth + 1));
     return `[${pad}${items.join(`,${pad || ''}`)}${close}]`;
   }
   const record = value as JsonObject;
@@ -77,27 +59,7 @@ function write(value: unknown, indent: number, depth: number, number: NumberForm
   if (keys.length === 0) return '{}';
   const gap = indent > 0 ? ' ' : '';
   const entries = keys.map(
-    (key) => `${JSON.stringify(key)}:${gap}${write(record[key], indent, depth + 1, number)}`,
+    (key) => `${JSON.stringify(key)}:${gap}${write(record[key], indent, depth + 1)}`,
   );
   return `{${pad}${entries.join(`,${pad || ''}`)}${close}}`;
 }
-
-/**
- * SHA-256, first 16 hex characters — the same primitive and width `@ultimat3/query`'s `fingerprint`
- * and `@ultimat3/realtime`'s `stableDigest` already chose, and for the same reason.
- *
- * A fingerprint here is a SHARING key over input a client chooses, not a checksum. It is the
- * `requestHash` that decides "same request, replay the stored response" and the job dedupe key
- * `job-handle.ts` files an enqueue under, so a collision hands one caller's stored response to a
- * different request, or drops an enqueue as a duplicate of a job it shares nothing with. FNV-1a/32
- * — what this was — is 4x10^9 values, brute-forceable offline in seconds, so a payload landing on
- * another request's hash was something an attacker could mint rather than something they had to
- * wait for.
- *
- * It is taken over `canonicalJson` and not `stableStringify` for the second half of the same
- * argument: the document form is not injective, so four distinct inputs shared one hash without
- * anyone having to mint anything.
- */
-export function fingerprint(value: unknown): string {
-  return new Bun.CryptoHasher('sha256').update(canonicalJson(value)).digest('hex').slice(0, 16);
-}