parseman 0.43.0 → 0.45.0

package/dist/oracle/digest.d.ts

@@ -5,17 +5,143 @@
  * comparing two reports should not have to diff hex to see that the format moved.
  */
 export declare const DIGEST_FORMAT = 1;
+/**
+ * Anything that absorbs a stream of text. Node's `crypto.Hash` satisfies it, and
+ * so does a three-line test double.
+ *
+ * The CALLER supplies this, and therefore owns the algorithm and the result.
+ * Deciding what the canonical byte stream IS depends on parseman's node shapes
+ * and on nothing else; deciding that you wanted sha256-hex does not.
+ */
+export type DigestTarget = {
+    update(chunk: string): void;
+};
+/**
+ * Raised when a walk exceeds its visit budget.
+ *
+ * A distinct class, and deliberately NOT an ordinary `Error` a caller might
+ * lump in with a parse failure: this says the TOOL gave up, which is the
+ * opposite of a fact about the grammar.
+ */
+export declare class CanonicalBudgetError extends Error {
+    readonly name = "CanonicalBudgetError";
+    constructor(budget: number, projected?: number);
+}
+/**
+ * Default visit budget.
+ *
+ * A backstop against unbounded work, not a correctness feature. Any walk that
+ * finishes under budget writes exactly the bytes it always did, so this cannot
+ * move a recorded digest — which is the only reason it can be added to a shipped
+ * format at all.
+ *
+ * It is NOT a fix for the underlying asymmetry. The fix is to dedupe by node
+ * IDENTITY instead of by ancestor path, and that rewrites the byte stream for
+ * every value with any sharing in it: `{ left: shared, right: shared }` stops
+ * being two full writes and becomes a back-reference. That invalidates every
+ * digest, every committed baseline, and {@link DIGEST_FORMAT} itself. It is a
+ * format decision for the owner, not something to slip in behind a bug fix.
+ *
+ * ## The tempting middle road does not exist
+ *
+ * Stated because it looks obviously right and is obviously right about the wrong
+ * thing: memoise the canonical BYTES of a subtree by node identity, splice the
+ * cached bytes in at each of the two places, and you get the identical output
+ * with the work done once. It is sound — a subtree's bytes depend only on the
+ * subtree, except for a back-edge leaving it, which is exactly the case
+ * {@link projectVisits} declines — and it does not help.
+ *
+ * It does not help because the walk is ALREADY linear in its own output, and it
+ * is the OUTPUT that is exponential: a depth-`d` two-way unroll writes 33·2^d
+ * chars, measured, and every one of them has to reach the hash. Caching removes
+ * re-derivation, of which there is a constant factor's worth; it cannot remove
+ * bytes the format requires. At depth 40 that is 36 TB of canonical text — 7
+ * hours of sha256 at the 1.37 Gchar/s this machine manages, with traversal,
+ * allocation and splicing all free. Depth 40 has no answer to compute quickly.
+ * There is only refusing quickly, which is what the probe does.
+ */
+export declare const DEFAULT_MAX_VISITS = 100000000;
+/** Options shared by every entry point that walks a value. */
+export type CanonicalOptions = {
+    /**
+     * Maximum object visits before {@link CanonicalBudgetError}. Defaults to
+     * {@link DEFAULT_MAX_VISITS}. A walk that finishes under budget is byte-for-byte
+     * unaffected, so this can never change a digest.
+     *
+     * MUST be a non-negative safe integer. `NaN`, `Infinity`, a negative and a
+     * fractional value are all REJECTED rather than clamped — see
+     * {@link newState} for why a bad budget is a thrown error and not a shrug.
+     */
+    maxVisits?: number | undefined;
+};
 /**
  * The canonical token string for a value. Exported because a moved digest is
  * only actionable if you can see WHAT moved: diff two canonical strings and the
  * answer is a line, not a hex mismatch.
+ *
+ * This MATERIALISES the projection, so it is bounded by the maximum JS string
+ * length and by available memory. Use it to explain a move you already know
+ * about; take the digest itself with {@link digestInto}, which is bounded by
+ * neither.
+ */
+export declare function canonicalize(value: unknown, options?: CanonicalOptions): string;
+/**
+ * Stream a value's canonical projection into a caller-owned hash.
+ *
+ * This is the primitive: deterministic serialization of ONE parse result, which
+ * is the part only parseman can do — it is parseman's node shapes that decide
+ * which distinctions are semantically meaningful. The caller brings the hash and
+ * keeps the result, so the algorithm, the encoding and the digest width are all
+ * theirs.
+ *
+ * ```ts
+ * const sha = createHash('sha256')
+ * digestInto(sha, tree)
+ * const digest = sha.digest('hex')
+ * ```
+ *
+ * `prefix` is written ahead of the first token with NO separator, for callers
+ * that discriminate one digest space from another (parseman's own oracle writes
+ * `OK:` or `ERR:`). Pass `''` when there is nothing to discriminate.
+ *
+ * Equivalent to `hash(prefix + canonicalize(value))`, and preferable in every
+ * case where you do not need to READ the projection.
+ *
+ * ## Two sharp edges, stated because the target is YOURS
+ *
+ * **A throw leaves the target written-to.** The token stream is pushed at
+ * `target` as the walk proceeds, so a {@link CanonicalBudgetError}, a throwing
+ * getter, or any other failure mid-walk leaves an ARBITRARY PREFIX of the
+ * projection already absorbed. The hash object is then polluted: its digest is
+ * neither the value's nor anything else's, and it is not recoverable — a
+ * `crypto.Hash` cannot be rewound. On any throw, DISCARD the target and start a
+ * fresh one. {@link digestValue} does exactly that by owning its hash for a
+ * single call.
+ *
+ * **Two calls against one target concatenate with NO delimiter.** There is no
+ * record separator between calls: `digestInto(t, a); digestInto(t, b)` writes
+ * exactly `canonicalize(a) + canonicalize(b)`, with nothing in between. That is
+ * ambiguous across the call boundary — the byte stream does not record where one
+ * value ended, so a differently-split sequence can produce the identical stream
+ * and therefore the identical digest. Concretely, `digestInto(t, 1);
+ * digestInto(t, 2)` and the single call `digestInto(t, 2, '#1')` both write
+ * `#1#2`. (Within ONE call the projection is unambiguous — every token is
+ * self-contained and NUL-joined; it is only the seam between calls that is not.)
+ *
+ * This is DOCUMENTED rather than fixed. Any delimiter at the seam — written
+ * before, after, or between — changes the bytes some existing caller already
+ * hashes, and moving a recorded digest is a {@link DIGEST_FORMAT} decision for
+ * the owner, not a patch. Callers hashing a SEQUENCE should digest a wrapper
+ * value (`digestInto(t, [a, b])`), or write their own unambiguous separator
+ * between calls, or use one target per value.
  */
-export declare function canonicalize(value: unknown): string;
-/** Full 64-hex sha256 of a string. */
-export declare function hash(payload: string): string;
+export declare function digestInto(target: DigestTarget, value: unknown, prefix?: string, options?: CanonicalOptions): void;
 /**
- * Per-entry fingerprint width. 64 bits over any realistic corpus is far below
- * the collision floor, and a report a human has to read stays readable.
+ * Full 64-hex sha256 of a value's canonical projection, streamed.
+ *
+ * The convenience wrapper over {@link digestInto} for the common case.
+ * Identical to `sha256(prefix + canonicalize(value))` for every value the
+ * latter can survive, and unbounded where it is not.
  */
-export declare const FINGERPRINT_HEX = 16;
+export declare function digestValue(value: unknown, prefix?: string, options?: CanonicalOptions): string;
 //# sourceMappingURL=digest.d.ts.map

package/dist/oracle/digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/oracle/digest.ts"],"names":[],"mappings":"AAsDA;;;;;GAKG;AACH,eAAO,MAAM,aAAa,IAAI,CAAA;AAyG9B;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAInD;AAED,sCAAsC;AACtC,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,KAAK,CAAA"}
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/oracle/digest.ts"],"names":[],"mappings":"AAoEA;;;;;GAKG;AACH,eAAO,MAAM,aAAa,IAAI,CAAA;AAsC9B;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAA;AAkED;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,0BAAyB;IAE/C,YAAY,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAW7C;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,kBAAkB,YAAc,CAAA;AAkP7C,8DAA8D;AAC9D,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B,CAAA;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAI/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,OAAO,EACd,MAAM,SAAK,EACX,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CAKN;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,SAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAI3F"}

package/dist/oracle/index.cjs

@@ -20,24 +20,125 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/oracle/index.ts
 var oracle_exports = {};
 __export(oracle_exports, {
+  CanonicalBudgetError: () => CanonicalBudgetError,
+  DEFAULT_MAX_VISITS: () => DEFAULT_MAX_VISITS,
   DIGEST_FORMAT: () => DIGEST_FORMAT,
-  HARNESS_DIGEST: () => HARNESS_DIGEST,
   canonicalize: () => canonicalize,
-  compareReports: () => compareReports,
-  digestCorpus: () => digestCorpus,
-  formatComparison: () => formatComparison,
-  loadCorpus: () => loadCorpus
+  digestInto: () => digestInto,
+  digestValue: () => digestValue
 });
 module.exports = __toCommonJS(oracle_exports);
 
 // src/oracle/digest.ts
 var import_node_crypto = require("node:crypto");
 var DIGEST_FORMAT = 1;
+var SEPARATOR = String.fromCharCode(0);
 var str = (s) => JSON.stringify(s);
 var tagOf = (v) => {
   const ctor = v.constructor;
   return typeof ctor === "function" && typeof ctor.name === "string" ? ctor.name : "";
 };
+var ArraySink = class {
+  tokens = [];
+  push(token) {
+    this.tokens.push(token);
+  }
+};
+var StreamSink = class {
+  target;
+  buffer = [];
+  buffered = 0;
+  started = false;
+  constructor(target) {
+    this.target = target;
+  }
+  /**
+   * Write text that is NOT a canonical token and takes no separator — the
+   * `OK:` / `ERR:` discriminator, which the string form concatenates onto the
+   * front rather than joining.
+   */
+  prefix(text) {
+    if (text === "") return;
+    this.buffer.push(text);
+    this.buffered += text.length;
+  }
+  push(token) {
+    if (this.started) {
+      this.buffer.push(SEPARATOR);
+      this.buffered += 1;
+    } else {
+      this.started = true;
+    }
+    this.buffer.push(token);
+    this.buffered += token.length;
+    if (this.buffered >= FLUSH_CHARS) this.flush();
+  }
+  flush() {
+    if (this.buffer.length === 0) return;
+    this.target.update(this.buffer.join(""));
+    this.buffer = [];
+    this.buffered = 0;
+  }
+};
+var FLUSH_CHARS = 1 << 16;
+var CanonicalBudgetError = class extends Error {
+  name = "CanonicalBudgetError";
+  constructor(budget, projected) {
+    super(
+      `canonicalize: exceeded ${budget} visits. The value is not merely large \u2014 it is almost certainly a DAG being unrolled. This projection writes a shared subtree once per PATH that reaches it (see "Sharing is not a cycle"), so a node referenced from two places at each of d levels costs 2^d. Deduplicate the shared structure, or raise \`maxVisits\` if the value really is that big.` + (projected === void 0 ? "" : ` Refused EARLY: the walk was projected to visit ${projected} objects, so it could not have finished under this budget however long it ran. See {@link projectVisits}.`)
+    );
+  }
+};
+var DEFAULT_MAX_VISITS = 1e8;
+var EXPANSION_PROBE_VISITS = 1e6;
+var EXPANSION_PROBE_NODES = 2e5;
+var EXPANSION_PROBE_MARGIN = 4;
+function projectVisits(root) {
+  const memo = /* @__PURE__ */ new Map();
+  const path = /* @__PURE__ */ new Set();
+  let nodes = 0;
+  let usable = true;
+  const count = (v) => {
+    if (typeof v !== "object" || v === null) return 0;
+    if (path.has(v)) {
+      usable = false;
+      return 1;
+    }
+    const done = memo.get(v);
+    if (done !== void 0) return done;
+    if (++nodes > EXPANSION_PROBE_NODES) {
+      usable = false;
+      return 1;
+    }
+    path.add(v);
+    let total = 1;
+    if (Array.isArray(v)) {
+      for (const item of v) total += count(item);
+    } else if (v instanceof Map) {
+      for (const [k, val] of v) total += count(k) + count(val);
+    } else if (v instanceof Set) {
+      for (const item of v) total += count(item);
+    } else if (!(v instanceof Date) && !(v instanceof RegExp)) {
+      for (const k of Object.keys(v)) total += count(v[k]);
+    }
+    path.delete(v);
+    memo.set(v, total);
+    return total;
+  };
+  try {
+    const total = count(root);
+    return usable ? total : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function probeExpansion(state) {
+  state.probeAt = -1;
+  const projected = projectVisits(state.root);
+  if (projected !== void 0 && projected / EXPANSION_PROBE_MARGIN > state.budget) {
+    throw new CanonicalBudgetError(state.budget, projected);
+  }
+}
 function writeScalar(v, out) {
   switch (typeof v) {
     case "undefined":
@@ -79,11 +180,15 @@ function writeScalar(v, out) {
       out.push("z");
   }
 }
-function write(v, path, depth, out) {
+function write(v, state, depth) {
+  const out = state.sink;
   if (typeof v !== "object" || v === null) {
     writeScalar(v, out);
     return;
   }
+  if (--state.visits < 0) throw new CanonicalBudgetError(state.budget);
+  if (state.visits === state.probeAt) probeExpansion(state);
+  const path = state.path;
   const seenAt = path.get(v);
   if (seenAt !== void 0) {
     out.push(`^${depth - seenAt}`);
@@ -92,18 +197,18 @@ function write(v, path, depth, out) {
   path.set(v, depth);
   if (Array.isArray(v)) {
     out.push("[");
-    for (const item of v) write(item, path, depth + 1, out);
+    for (const item of v) write(item, state, depth + 1);
     out.push("]");
   } else if (v instanceof Map) {
     out.push("M");
     for (const [k, val] of v) {
-      write(k, path, depth + 1, out);
-      write(val, path, depth + 1, out);
+      write(k, state, depth + 1);
+      write(val, state, depth + 1);
     }
     out.push("}");
   } else if (v instanceof Set) {
     out.push("S");
-    for (const item of v) write(item, path, depth + 1, out);
+    for (const item of v) write(item, state, depth + 1);
     out.push("}");
   } else if (v instanceof Date) {
     out.push(`D${v.getTime()}`);
@@ -114,310 +219,36 @@ function write(v, path, depth, out) {
     out.push(`{${str(tag === "Object" ? "" : tag)}`);
     for (const k of Object.keys(v).sort()) {
       out.push(`k${str(k)}`);
-      write(v[k], path, depth + 1, out);
+      write(v[k], state, depth + 1);
     }
     out.push("}");
   }
   path.delete(v);
 }
-function canonicalize(value) {
-  const out = [];
-  write(value, /* @__PURE__ */ new Map(), 0, out);
-  return out.join("\0");
-}
-function hash(payload2) {
-  return (0, import_node_crypto.createHash)("sha256").update(payload2).digest("hex");
-}
-var FINGERPRINT_HEX = 16;
-
-// src/oracle/identity.ts
-var defaultProjectError = (thrown) => thrown instanceof Error ? { name: thrown.name, message: thrown.message } : { thrown };
-function payload(surface, entry, options) {
-  try {
-    return { text: `OK:${canonicalize(surface.parse(entry.source, entry.id))}`, threw: false };
-  } catch (thrown) {
-    const project = options.projectError ?? defaultProjectError;
-    return { text: `ERR:${canonicalize(project(thrown, entry.id, surface.name))}`, threw: true };
-  }
-}
-var fingerprint = (text) => hash(text).slice(0, FINGERPRINT_HEX);
-function digestCorpus(surfaces, corpus, options = {}) {
-  if (surfaces.length === 0) throw new Error("digestCorpus: no surfaces \u2014 there is nothing to compare.");
-  const names = /* @__PURE__ */ new Set();
-  for (const s of surfaces) {
-    if (names.has(s.name)) throw new Error(`digestCorpus: duplicate surface name ${JSON.stringify(s.name)}.`);
-    names.add(s.name);
-  }
-  const entries = [...corpus].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-  for (let n = 1; n < entries.length; n++) {
-    if (entries[n].id === entries[n - 1].id) {
-      throw new Error(`digestCorpus: duplicate corpus id ${JSON.stringify(entries[n].id)}.`);
-    }
-  }
-  const perEntry = {};
-  const threw = {};
-  const texts = [];
-  for (const s of surfaces) threw[s.name] = 0;
-  for (const entry of entries) {
-    const row = {};
-    const rowTexts = /* @__PURE__ */ new Map();
-    for (const s of surfaces) {
-      const result = payload(s, entry, options);
-      if (result.threw) threw[s.name]++;
-      row[s.name] = fingerprint(result.text);
-      rowTexts.set(s.name, result.text);
-    }
-    perEntry[entry.id] = row;
-    texts.push(rowTexts);
-  }
-  verifyDeterminism(surfaces, entries, texts, options);
-  return {
-    format: DIGEST_FORMAT,
-    harness: HARNESS_DIGEST,
-    entries: entries.length,
-    surfaces: surfaces.map((s) => ({
-      name: s.name,
-      // The surface NAME is inside its own aggregate: two surfaces that happen
-      // to agree on every entry must still have distinct aggregates, or a
-      // report that swapped them would compare equal.
-      aggregate: hash(
-        [`surface:${s.name}`, ...entries.map((e) => `${e.id}:${perEntry[e.id][s.name]}`)].join("\n")
-      ),
-      threw: threw[s.name]
-    })),
-    perEntry
-  };
-}
-function verifyDeterminism(surfaces, entries, texts, options) {
-  const want = options.determinismSample ?? 32;
-  if (want <= 0 || entries.length === 0) return;
-  const stride = Math.max(1, Math.floor(entries.length / Math.min(want, entries.length)));
-  for (let n = 0; n < entries.length; n += stride) {
-    const entry = entries[n];
-    for (const s of surfaces) {
-      if (payload(s, entry, options).text === texts[n].get(s.name)) continue;
-      throw new Error(
-        `digestCorpus: surface ${JSON.stringify(s.name)} is NOT DETERMINISTIC on ${JSON.stringify(entry.id)} \u2014 two parses of the same source produced different output. Every digest from this grammar would move on its own, so a comparison against it cannot mean anything. Usual causes: a timestamp or counter in the output, iteration over a keyed-by-object Map, or a node carrying a reference to mutable shared state.`
-      );
-    }
-  }
-}
-function compareReports(before, after) {
-  if (before.harness !== after.harness) {
-    return incomparable(
-      `harness drift: reports were produced by DIFFERENT versions of the identity harness (${before.harness.slice(0, 12)}\u2026 vs ${after.harness.slice(0, 12)}\u2026). Their digests are not comparable, and treating them as such would either invent a regression or hide one. Re-run BOTH sides on one harness.`
-    );
-  }
-  if (before.format !== after.format) {
-    return incomparable(`digest format ${before.format} vs ${after.format} \u2014 re-run both sides on one version.`);
-  }
-  const beforeIds = new Set(Object.keys(before.perEntry));
-  const afterIds = new Set(Object.keys(after.perEntry));
-  const addedEntries = [...afterIds].filter((id) => !beforeIds.has(id)).sort();
-  const removedEntries = [...beforeIds].filter((id) => !afterIds.has(id)).sort();
-  const shared = [...beforeIds].filter((id) => afterIds.has(id)).sort();
-  const byName = /* @__PURE__ */ new Map();
-  for (const s of before.surfaces) byName.set(s.name, { ...byName.get(s.name), before: s });
-  for (const s of after.surfaces) byName.set(s.name, { ...byName.get(s.name), after: s });
-  const surfaces = [...byName.entries()].sort(([a], [b]) => a < b ? -1 : 1).map(([name, pair]) => {
-    const moved = pair.before && pair.after ? shared.filter((id) => before.perEntry[id][name] !== after.perEntry[id][name]) : [];
-    return {
-      name,
-      before: pair.before?.aggregate ?? null,
-      after: pair.after?.aggregate ?? null,
-      equal: pair.before !== void 0 && pair.after !== void 0 && pair.before.aggregate === pair.after.aggregate,
-      moved,
-      beforeThrew: pair.before?.threw ?? null,
-      afterThrew: pair.after?.threw ?? null
-    };
-  });
-  const identical = addedEntries.length === 0 && removedEntries.length === 0 && surfaces.every((s) => s.equal);
-  return { verdict: identical ? "identical" : "moved", reason: null, addedEntries, removedEntries, surfaces };
-}
-function incomparable(reason) {
-  return { verdict: "incomparable", reason, addedEntries: [], removedEntries: [], surfaces: [] };
-}
-function formatComparison(c, options = {}) {
-  if (c.verdict === "incomparable") return `INCOMPARABLE \u2014 ${c.reason ?? "unknown reason"}`;
-  const max = options.maxMoved ?? 10;
-  const lines = [];
-  for (const s of c.surfaces) {
-    if (s.before === null) lines.push(`  + surface ${s.name} (added)`);
-    else if (s.after === null) lines.push(`  - surface ${s.name} (removed)`);
-    else if (s.equal) lines.push(`  = ${s.name}  ${s.before.slice(0, 16)}\u2026  threw=${s.afterThrew}`);
-    else {
-      lines.push(
-        `  ! ${s.name}  ${s.before.slice(0, 16)}\u2026 -> ${s.after.slice(0, 16)}\u2026  threw ${s.beforeThrew} -> ${s.afterThrew}  (${s.moved.length} entries moved)`
-      );
-      for (const id of s.moved.slice(0, max)) lines.push(`      ${id}`);
-      if (s.moved.length > max) lines.push(`      \u2026 and ${s.moved.length - max} more`);
-    }
-  }
-  if (c.addedEntries.length > 0) lines.push(`  corpus GAINED ${c.addedEntries.length} entries`);
-  if (c.removedEntries.length > 0) {
-    lines.push(
-      `  corpus LOST ${c.removedEntries.length} entries \u2014 a differential over a SMALLER corpus is a weaker gate, not a passing one`
+function newState(sink, options, root) {
+  const budget = options?.maxVisits ?? DEFAULT_MAX_VISITS;
+  if (!Number.isSafeInteger(budget) || budget < 0) {
+    throw new RangeError(
+      `canonicalize: maxVisits must be a non-negative safe integer, received ${String(budget)}. A non-finite or fractional budget does not raise the ceiling, it REMOVES it \u2014 the budget is spent with \`--visits < 0\`, which is false forever for NaN and never reached for Infinity \u2014 so the walk this bounds would run unbounded into the OOM the budget exists to prevent.`
     );
   }
-  return [c.verdict === "identical" ? "IDENTICAL \u2014 output-neutral" : "MOVED \u2014 this is not a refactor", ...lines].join("\n");
+  const probeAt = budget >= EXPANSION_PROBE_VISITS ? budget - EXPANSION_PROBE_VISITS : -1;
+  return { path: /* @__PURE__ */ new Map(), sink, budget, root, visits: budget, probeAt };
 }
-function canaryReport() {
-  class Tagged {
-    x;
-    constructor(x) {
-      this.x = x;
-    }
-  }
-  const shared = { shared: true };
-  const cyclic = { name: "root" };
-  cyclic.self = cyclic;
-  cyclic.child = { up: cyclic };
-  const values = {
-    "a/scalars": [0, -0, 1.5, Number.NaN, Number.POSITIVE_INFINITY, Number.NEGATIVE_INFINITY, 10n, true, false, null],
-    "b/absent": [{ a: void 0 }, {}, { a: null }, [void 0], []],
-    "c/key-order": [{ a: 1, b: 2 }, { b: 2, a: 1 }],
-    "d/collections": [/* @__PURE__ */ new Map([["k", 1], ["j", 2]]), /* @__PURE__ */ new Set([1, 2]), /* @__PURE__ */ new Date(0), /ab+c/giu],
-    "e/tagged": [new Tagged(1), { x: 1 }],
-    "f/sharing": { left: shared, right: shared },
-    "g/cycle": cyclic,
-    "h/text": ["", "a\0b", "a b", '"quoted"', "\\"],
-    "i/callable": [function named() {
-    }, /* @__PURE__ */ Symbol("sym")]
-  };
-  const surfaces = [
-    { name: "value", parse: (_source, id) => values[id] },
-    {
-      name: "thrower",
-      parse: (_source, id) => {
-        if (id === "a/scalars") throw new TypeError("canary");
-        if (id === "b/absent") throw "a bare string";
-        return { id };
-      }
-    }
-  ];
-  const corpus = Object.keys(values).map((id) => ({ id, source: id }));
-  const perEntry = {};
-  const threw = { value: 0, thrower: 0 };
-  for (const entry of [...corpus].sort((a, b) => a.id < b.id ? -1 : 1)) {
-    const row = {};
-    for (const s of surfaces) {
-      const result = payload(s, entry, {});
-      if (result.threw) threw[s.name]++;
-      row[s.name] = fingerprint(result.text);
-    }
-    perEntry[entry.id] = row;
-  }
-  const ids = Object.keys(perEntry).sort();
-  return {
-    format: DIGEST_FORMAT,
-    harness: "",
-    entries: ids.length,
-    surfaces: surfaces.map((s) => ({
-      name: s.name,
-      aggregate: hash([`surface:${s.name}`, ...ids.map((id) => `${id}:${perEntry[id][s.name]}`)].join("\n")),
-      threw: threw[s.name]
-    })),
-    perEntry
-  };
+function canonicalize(value, options) {
+  const out = new ArraySink();
+  write(value, newState(out, options, value), 0);
+  return out.tokens.join(SEPARATOR);
 }
-var HARNESS_DIGEST = (() => {
-  const canary = canaryReport();
-  return hash(
-    [`format:${DIGEST_FORMAT}`, ...canary.surfaces.map((s) => `${s.name}:${s.aggregate}:${s.threw}`)].join("\n")
-  );
-})();
-
-// src/oracle/corpus.ts
-var import_node_fs = require("node:fs");
-var import_node_path = require("node:path");
-var DEFAULT_IGNORE = [".git", "node_modules/.cache"];
-function loadCorpus(options) {
-  const base = (0, import_node_path.resolve)(options.base);
-  const ignoreDirs = options.ignoreDirs ?? DEFAULT_IGNORE;
-  const ignoreNames = new Set(ignoreDirs.filter((d) => !d.includes("/")));
-  const ignorePaths = ignoreDirs.filter((d) => d.includes("/")).map((d) => d.replace(/^\.?\/+/, "").replace(/\/+$/, ""));
-  const maxBytes = options.maxBytes ?? Number.POSITIVE_INFINITY;
-  const exts = new Set(options.extensions.map((e) => e.toLowerCase()));
-  const missingRoots = [];
-  const skippedLarge = [];
-  const files = /* @__PURE__ */ new Map();
-  const isIgnored = (name, relFromRoot) => {
-    if (ignoreNames.has(name)) return true;
-    return ignorePaths.some((p) => relFromRoot === p || relFromRoot.endsWith(`/${p}`));
-  };
-  const walk = (dir, root, visited) => {
-    let real;
-    try {
-      real = (0, import_node_fs.realpathSync)(dir);
-    } catch {
-      return;
-    }
-    if (visited.has(real)) return;
-    visited.add(real);
-    for (const item of (0, import_node_fs.readdirSync)(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1)) {
-      const full = (0, import_node_path.join)(dir, item.name);
-      if (isIgnored(item.name, (0, import_node_path.relative)(root, full).split(import_node_path.sep).join("/"))) continue;
-      let isDir = item.isDirectory();
-      let isFile = item.isFile();
-      let size = 0;
-      if (item.isSymbolicLink() || !isDir && !isFile) {
-        try {
-          const st = (0, import_node_fs.statSync)(full);
-          isDir = st.isDirectory();
-          isFile = st.isFile();
-          size = st.size;
-        } catch {
-          continue;
-        }
-      }
-      if (isDir) {
-        walk(full, root, visited);
-        continue;
-      }
-      if (!isFile) continue;
-      const dot = item.name.lastIndexOf(".");
-      if (dot < 0 || !exts.has(item.name.slice(dot).toLowerCase())) continue;
-      if (size === 0) {
-        try {
-          size = (0, import_node_fs.statSync)(full).size;
-        } catch {
-          continue;
-        }
-      }
-      if (size > maxBytes) {
-        skippedLarge.push(idOf(base, full));
-        continue;
-      }
-      let realFile;
-      try {
-        realFile = (0, import_node_fs.realpathSync)(full);
-      } catch {
-        continue;
-      }
-      const id = idOf(base, full);
-      const existing = files.get(realFile);
-      if (existing === void 0 || id < existing) files.set(realFile, id);
-    }
-  };
-  for (const root of options.roots) {
-    const full = (0, import_node_path.resolve)(base, root);
-    try {
-      if (!(0, import_node_fs.statSync)(full).isDirectory()) throw new Error("not a directory");
-    } catch {
-      if (!options.allowMissingRoots) {
-        throw new Error(
-          `loadCorpus: root ${JSON.stringify(root)} does not resolve to a directory (${full}). A corpus that quietly shrank produces a different aggregate that looks like a grammar change. Fix the root, or pass allowMissingRoots and record \`missingRoots\` alongside the digest.`
-        );
-      }
-      missingRoots.push(root);
-      continue;
-    }
-    walk(full, full, /* @__PURE__ */ new Set());
-  }
-  const entries = [...files.values()].sort().map((id) => ({ id, source: (0, import_node_fs.readFileSync)((0, import_node_path.resolve)(base, id), "utf8") }));
-  return { entries, missingRoots, skippedLarge: skippedLarge.sort() };
+function digestInto(target, value, prefix = "", options) {
+  const sink = new StreamSink(target);
+  sink.prefix(prefix);
+  write(value, newState(sink, options, value), 0);
+  sink.flush();
 }
-function idOf(base, full) {
-  return (0, import_node_path.relative)(base, full).split(import_node_path.sep).join("/");
+function digestValue(value, prefix = "", options) {
+  const sha = (0, import_node_crypto.createHash)("sha256");
+  digestInto(sha, value, prefix, options);
+  return sha.digest("hex");
 }
 //# sourceMappingURL=index.cjs.map