rea-agents 1.6.0 → 2.0.0

package/dist/contracts/toolEffects.js

@@ -0,0 +1,160 @@
+const effects = (overrides = {}) => ({
+    mutatesTarget: false,
+    mutatesSession: false,
+    writesFilesystem: false,
+    launchesProcess: false,
+    accessesNetwork: false,
+    changesUiState: false,
+    mayDiscardData: false,
+    idempotent: true,
+    ...overrides,
+});
+const evidence = effects({ mutatesSession: true });
+const nativeEvidence = effects({ mutatesSession: true, launchesProcess: true });
+const browserEvidence = effects({
+    mutatesSession: true,
+    accessesNetwork: true,
+});
+const sessionEvidence = effects({ mutatesSession: true });
+/** Explicit effect audit for every public tool. */
+export const TOOL_EFFECTS = {
+    address_name: evidence,
+    comment: evidence,
+    current_address: evidence,
+    current_procedure: evidence,
+    current_document: evidence,
+    goto_address: effects({ mutatesSession: true, changesUiState: true }),
+    inline_comment: evidence,
+    list_bookmarks: evidence,
+    list_documents: evidence,
+    list_names: evidence,
+    list_procedures: evidence,
+    list_segments: evidence,
+    list_strings: evidence,
+    next_address: evidence,
+    prev_address: evidence,
+    procedure_address: evidence,
+    procedure_assembly: evidence,
+    procedure_callees: evidence,
+    procedure_callers: evidence,
+    procedure_info: evidence,
+    procedure_references: evidence,
+    procedure_pseudo_code: evidence,
+    resolve_containing_procedure: evidence,
+    search_procedures: evidence,
+    search_strings: evidence,
+    set_address_name: effects({ mutatesTarget: true, mutatesSession: true }),
+    set_addresses_names: effects({ mutatesTarget: true, mutatesSession: true }),
+    set_bookmark: effects({ mutatesTarget: true, mutatesSession: true }),
+    set_comment: effects({ mutatesTarget: true, mutatesSession: true }),
+    set_current_document: effects({ mutatesSession: true, changesUiState: true }),
+    set_inline_comment: effects({ mutatesTarget: true, mutatesSession: true }),
+    unset_bookmark: effects({
+        mutatesTarget: true,
+        mutatesSession: true,
+        mayDiscardData: true,
+    }),
+    xrefs: evidence,
+    swift_classes: evidence,
+    get_objc_classes: evidence,
+    get_objc_protocols: evidence,
+    batch_decompile: evidence,
+    get_call_graph: evidence,
+    analyze_swift_types: evidence,
+    find_xrefs_to_name: evidence,
+    binary_overview: evidence,
+    analyze_function: evidence,
+    trace_feature: effects({ mutatesSession: true, idempotent: false }),
+    inspect_macho: nativeEvidence,
+    inspect_signature: nativeEvidence,
+    inspect_plist: nativeEvidence,
+    list_architectures: nativeEvidence,
+    demangle_swift: nativeEvidence,
+    inventory_artifact: evidence,
+    extract_artifact: effects({ mutatesSession: true, writesFilesystem: true }),
+    inspect_managed_artifact: evidence,
+    inspect_managed_members: evidence,
+    inspect_managed_native_boundaries: evidence,
+    compare_managed_members: sessionEvidence,
+    verify_managed_native_boundaries: sessionEvidence,
+    import_managed_reconstruction: sessionEvidence,
+    plan_managed_runtime_correlation: sessionEvidence,
+    project_managed_application_graph: sessionEvidence,
+    list_browser_targets: browserEvidence,
+    inspect_web_page: browserEvidence,
+    analyze_web_bundle: browserEvidence,
+    observe_web_session: browserEvidence,
+    discover_webmcp_tools: browserEvidence,
+    compare_web_captures: browserEvidence,
+    capture_web_screenshot: browserEvidence,
+    compare_web_screenshots: browserEvidence,
+    list_electron_targets: browserEvidence,
+    inspect_electron_page: browserEvidence,
+    analyze_javascript_application: evidence,
+    reconcile_javascript_runtime: evidence,
+    trace_application_feature: evidence,
+    compare_application_versions: evidence,
+    run_controlled_replay: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+    }),
+    open_binary: effects({ mutatesSession: true, launchesProcess: true }),
+    close_binary: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        mayDiscardData: true,
+        idempotent: false,
+    }),
+    binary_session: effects(),
+    export_evidence_bundle: effects({
+        writesFilesystem: true,
+        mayDiscardData: true,
+    }),
+    import_evidence_bundle: effects({ mutatesSession: true }),
+    capture_process_scenario: effects({
+        mutatesSession: true,
+        writesFilesystem: true,
+        launchesProcess: true,
+        idempotent: false,
+    }),
+    compare_process_captures: sessionEvidence,
+    compare_artifacts: sessionEvidence,
+    compare_functions: sessionEvidence,
+    compare_bundles: effects({ mutatesSession: true }),
+    find_changed_behavior: sessionEvidence,
+    build_call_path: sessionEvidence,
+    correlate_static_and_runtime: sessionEvidence,
+    verify_reconstruction: sessionEvidence,
+    list_unknowns: effects(),
+    record_unknown: effects({ mutatesSession: true, idempotent: false }),
+    update_unknown: effects({ mutatesSession: true, idempotent: false }),
+    verify_unknown_resolution: effects(),
+};
+/** Derive MCP annotations without tool-name or tool-family heuristics. */
+export const annotationsFromEffects = (value) => ({
+    readOnlyHint: !(value.mutatesTarget ||
+        value.mutatesSession ||
+        value.writesFilesystem ||
+        value.launchesProcess ||
+        value.accessesNetwork ||
+        value.changesUiState ||
+        value.mayDiscardData),
+    destructiveHint: value.mayDiscardData,
+    idempotentHint: value.idempotent,
+    openWorldHint: value.launchesProcess || value.accessesNetwork,
+});
+/** Resolve the audited metadata for one public tool. */
+export const toolContractMetadata = (name) => {
+    const audited = TOOL_EFFECTS[name];
+    if (audited === undefined)
+        throw new Error(`Missing effect audit for ${name}`);
+    return {
+        title: name
+            .split("_")
+            .map((word) => word[0]?.toUpperCase() + word.slice(1))
+            .join(" "),
+        effects: audited,
+        annotations: annotationsFromEffects(audited),
+    };
+};

package/dist/contracts/toolOutputSchemas.js

@@ -1,11 +1,16 @@
 import { z } from "zod";
-import { evidenceSchema } from "../domain/evidence.js";
 import { processCaptureComparisonSchema, processCaptureSchema, } from "../domain/processCapture.js";
 import { evidenceBundleSchema } from "../domain/evidenceBundle.js";
 import { residualUnknownSchema } from "../domain/residualUnknown.js";
-import { functionDossierSchema } from "../domain/hopperValues.js";
+import { functionDossierSchema, localVariableSchema, procedureClassificationSchema, procedureIdentitySchema, referenceKindSchema, } from "../domain/hopperValues.js";
 import { demangleSwiftSchema, inspectMachoSchema, inspectPlistSchema, inspectSignatureSchema, listArchitecturesSchema, } from "../domain/nativeInspection.js";
 import { artifactExtractionResultSchema, artifactInventoryResultSchema, } from "../domain/artifactGraph.js";
+import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "../domain/managedArtifact.js";
+import { managedMemberComparisonResultSchema } from "../domain/managedMemberComparison.js";
+import { managedNativeVerificationResultSchema } from "../domain/managedNativeVerification.js";
+import { managedReconstructionImportResultSchema } from "../domain/managedReconstruction.js";
+import { managedRuntimeCorrelationResultSchema } from "../domain/managedRuntimeCorrelation.js";
+import { managedApplicationGraphResultSchema } from "../domain/managedApplicationGraph.js";
 import { artifactComparisonResultSchema } from "../domain/artifactComparison.js";
 import { functionComparisonResultSchema } from "../domain/functionComparison.js";
 import { bundleComparisonResultSchema } from "../domain/bundleComparison.js";
@@ -14,9 +19,15 @@ import { callPathResultSchema } from "../domain/callPath.js";
 import { staticRuntimeCorrelationResultSchema } from "../domain/staticRuntimeCorrelation.js";
 import { reconstructionVerificationResultSchema } from "../domain/reconstructionVerification.js";
 import { analysisErrorProjectionSchema } from "./errorSchemas.js";
-const resultOf = (schema) => evidenceSchema
-    .omit({ normalized_result: true })
-    .extend({ normalized_result: schema });
+import { analysisProfileSchema } from "../domain/analysisProfile.js";
+import { PROVIDER_REJECTION_CODES, } from "./providerSelection.js";
+/** Compact MCP result with an immutable link to complete session Evidence. */
+export const evidenceResultOf = (schema) => z.strictObject({
+    result: schema,
+    evidence_id: z.string().regex(/^ev_[a-f0-9]{64}$/u),
+    evidence_uri: z.string().regex(/^rea:\/\/evidence\/ev_[a-f0-9]{64}$/u),
+});
+const resultOf = evidenceResultOf;
 const lifecycleResultOf = (schema) => z.object({ result: schema });
 /** Resolve a required named output schema or reject contract drift. */
 export const requireOutputSchema = (schemas, name) => {
@@ -27,6 +38,7 @@ export const requireOutputSchema = (schemas, name) => {
 };
 const targetFormatSchema = z.enum([
     "hopper",
+    "analysis-database",
     "mach-o",
     "elf",
     "pe",
@@ -75,10 +87,68 @@ const providerIdentity = z.object({
     name: z.string(),
     version: z.string().nullable(),
 });
+const providerRejectionCode = z.enum(PROVIDER_REJECTION_CODES);
+const providerDiagnostics = z.record(z.string(), z.json());
+const providerAvailability = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("available"),
+        code: z.null(),
+        reason: z.null(),
+        diagnostics: providerDiagnostics,
+    }),
+    z.object({
+        status: z.literal("unavailable"),
+        code: providerRejectionCode,
+        reason: z.string().min(1),
+        diagnostics: providerDiagnostics,
+    }),
+]);
+const providerTargetSupport = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("unknown"),
+        code: z.null(),
+        reason: z.string().min(1),
+        diagnostics: providerDiagnostics,
+    }),
+    z.object({
+        status: z.literal("supported"),
+        code: z.null(),
+        reason: z.null(),
+        diagnostics: providerDiagnostics,
+    }),
+    z.object({
+        status: z.literal("unsupported"),
+        code: z.enum([
+            "target_kind_unsupported",
+            "target_format_unsupported",
+            "architecture_unsupported",
+        ]),
+        reason: z.string().min(1),
+        diagnostics: providerDiagnostics,
+    }),
+]);
 const sessionProvider = z.object({
     provider: providerIdentity,
     providers: z.array(providerIdentity),
     capabilities: z.array(providerCapability),
+    analysis_provider_binding: z
+        .object({
+        provider: providerIdentity,
+        selection_source: z.enum([
+            "request",
+            "environment",
+            "auto-single-candidate",
+        ]),
+        analysis_profile: analysisProfileSchema,
+    })
+        .nullable(),
+    analysis_provider_candidates: z.array(z.object({
+        provider: providerIdentity,
+        availability: providerAvailability,
+        target_support: providerTargetSupport,
+        selected: z.boolean(),
+        capabilities: z.array(providerCapability),
+    })),
     tool_availability: z.array(z.object({
         name: z.string(),
         surface: z.string(),
@@ -93,6 +163,16 @@ const sessionProvider = z.object({
             "policy_disabled",
         ]),
         remediation: z.string().nullable(),
+        effects: z.strictObject({
+            mutatesTarget: z.boolean(),
+            mutatesSession: z.boolean(),
+            writesFilesystem: z.boolean(),
+            launchesProcess: z.boolean(),
+            accessesNetwork: z.boolean(),
+            changesUiState: z.boolean(),
+            mayDiscardData: z.boolean(),
+            idempotent: z.boolean(),
+        }),
         annotations: z.object({
             read_only: z.boolean(),
             destructive: z.boolean(),
@@ -144,11 +224,8 @@ const sessionProvider = z.object({
 const nullableText = z.string().nullable();
 const addressList = z.array(z.string());
 const addressedEntry = z.object({ address: z.string(), name: z.string() });
-const procedureIdentity = z.object({ address: z.string(), name: z.string() });
-const localVariable = z.object({
-    description: z.string(),
-    provenance: z.literal("hopper-public-python-api"),
-});
+const procedureIdentity = procedureIdentitySchema;
+const localVariable = localVariableSchema;
 const containingProcedureResolution = z.discriminatedUnion("found", [
     z.object({
         query_address: z.string(),
@@ -166,6 +243,10 @@ const unavailable = z.object({
     available: z.literal(false),
     reason: z.string(),
 });
+const availableMemoryPermissions = z.object({
+    available: z.literal(true),
+    source: z.literal("ghidra-memory-block"),
+});
 const bounded = (item) => z.object({
     items: z.array(item),
     total: z.number().int().min(0).nullable(),
@@ -173,8 +254,36 @@ const bounded = (item) => z.object({
     truncated: z.boolean(),
     next_offset: z.number().int().min(0).nullable(),
 });
+const addressedValue = z.object({
+    address: z.string(),
+    value: z.string(),
+    value_truncated: z.boolean().optional(),
+    symbol: z
+        .object({
+        primary: z.boolean(),
+        dynamic: z.boolean(),
+        external: z.boolean(),
+        type: z.string(),
+        source: z.enum(["default", "analysis", "ai", "imported", "user_defined"]),
+    })
+        .optional(),
+    procedure: z
+        .object({
+        external: z.boolean(),
+        thunk: z.boolean(),
+        thunk_target: z.string().nullable(),
+    })
+        .optional(),
+    string: z
+        .object({
+        encoding: z.string(),
+        termination: z.enum(["missing", "present_or_not_required"]),
+        byte_length: z.number().int().min(0),
+    })
+        .optional(),
+});
 const pageOutput = z.object({
-    items: z.array(z.object({ address: z.string(), value: z.string() })),
+    items: z.array(addressedValue),
     offset: z.number().int().min(0),
     limit: z.number().int().min(1),
     total: z.number().int().min(0),
@@ -195,8 +304,12 @@ const memoryRegionOutput = z.object({
     readable: z.boolean().nullable(),
     writable: z.boolean().nullable(),
     executable: z.boolean().nullable(),
-    permissions: unavailable,
-    provenance: z.literal("hopper-public-python-api"),
+    permissions: z.union([unavailable, availableMemoryPermissions]),
+    provenance: z.enum(["hopper-public-python-api", "ghidra-memory-block"]),
+    address_space: z.string().optional(),
+    image_base: z.string().optional(),
+    initialized: z.boolean().optional(),
+    overlay: z.boolean().optional(),
 });
 const segmentOutput = resultOf(z.array(memoryRegionOutput.extend({ sections: z.array(memoryRegionOutput) })));
 const procedureInfoOutput = resultOf(z.object({
@@ -206,6 +319,7 @@ const procedureInfoOutput = resultOf(z.object({
     length: z.number().min(0),
     signature: nullableText,
     locals: z.array(localVariable),
+    classification: procedureClassificationSchema.nullable().default(null),
 }));
 const symbolDiscoveryOutput = (property) => resultOf(z.object({
     count: z.number().int().min(0),
@@ -224,7 +338,7 @@ const graphNode = z.discriminatedUnion("status", [
     }),
 ]);
 const functionDossierOutput = resultOf(functionDossierSchema);
-/** Exact structured-content schemas for the direct Hopper operations. */
+/** Exact structured-content schemas shared by direct analysis providers. */
 export const officialOutputSchemas = {
     address_name: resultOf(nullableText),
     comment: resultOf(nullableText),
@@ -254,7 +368,7 @@ export const officialOutputSchemas = {
             target_address: z.string(),
             source_procedure: procedureIdentity.nullable(),
             target_procedure: procedureIdentity.nullable(),
-            kind: unavailable,
+            kind: referenceKindSchema,
         })),
         instructions_scanned: z.number().int().min(0),
         instruction_scan_truncated: z.boolean(),
@@ -361,6 +475,20 @@ export const artifactOutputSchemas = {
     inventory_artifact: resultOf(artifactInventoryResultSchema),
     extract_artifact: resultOf(artifactExtractionResultSchema),
 };
+/** Exact Evidence v2 schema for execution-free managed static analysis. */
+export const managedOutputSchemas = {
+    inspect_managed_artifact: resultOf(managedArtifactInspectionSchema),
+    inspect_managed_members: resultOf(managedMemberInspectionSchema),
+    inspect_managed_native_boundaries: resultOf(managedNativeBoundaryInspectionSchema),
+};
+/** Exact Evidence v2 schema for provider-neutral managed workflows. */
+export const managedWorkflowOutputSchemas = {
+    compare_managed_members: resultOf(managedMemberComparisonResultSchema),
+    verify_managed_native_boundaries: resultOf(managedNativeVerificationResultSchema),
+    import_managed_reconstruction: resultOf(managedReconstructionImportResultSchema),
+    plan_managed_runtime_correlation: resultOf(managedRuntimeCorrelationResultSchema),
+    project_managed_application_graph: resultOf(managedApplicationGraphResultSchema),
+};
 /** Exact structured-content schemas for target lifecycle operations. */
 export const sessionOutputSchemas = {
     open_binary: lifecycleResultOf(z.object({
@@ -402,33 +530,15 @@ export const sessionOutputSchemas = {
         imported: z.number().int().min(0),
         total: z.number().int().min(0),
     })),
-    capture_process_scenario: lifecycleResultOf(evidenceSchema
-        .omit({ normalized_result: true })
-        .extend({ normalized_result: processCaptureSchema })),
-    compare_process_captures: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: processCaptureComparisonSchema,
-    })),
-    compare_artifacts: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: artifactComparisonResultSchema,
-    })),
-    compare_functions: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: functionComparisonResultSchema,
-    })),
-    compare_bundles: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: bundleComparisonResultSchema,
-    })),
-    find_changed_behavior: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: changedBehaviorResultSchema,
-    })),
-    build_call_path: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: callPathResultSchema,
-    })),
-    correlate_static_and_runtime: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: staticRuntimeCorrelationResultSchema,
-    })),
-    verify_reconstruction: lifecycleResultOf(evidenceSchema.omit({ normalized_result: true }).extend({
-        normalized_result: reconstructionVerificationResultSchema,
-    })),
+    capture_process_scenario: resultOf(processCaptureSchema),
+    compare_process_captures: resultOf(processCaptureComparisonSchema),
+    compare_artifacts: resultOf(artifactComparisonResultSchema),
+    compare_functions: resultOf(functionComparisonResultSchema),
+    compare_bundles: resultOf(bundleComparisonResultSchema),
+    find_changed_behavior: resultOf(changedBehaviorResultSchema),
+    build_call_path: resultOf(callPathResultSchema),
+    correlate_static_and_runtime: resultOf(staticRuntimeCorrelationResultSchema),
+    verify_reconstruction: resultOf(reconstructionVerificationResultSchema),
     list_unknowns: lifecycleResultOf(z.array(residualUnknownSchema)),
     record_unknown: lifecycleResultOf(residualUnknownSchema),
     update_unknown: lifecycleResultOf(residualUnknownSchema),

package/dist/doctorRuntime.js

@@ -0,0 +1,47 @@
+import { systemDoctorHost, } from "./application/Doctor.js";
+import { inspectSystemGhidraProvider } from "./ghidra/GhidraDoctor.js";
+import { parseConfig } from "./config.js";
+import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
+/** Compose provider diagnostics at the outer CLI adapter boundary. */
+export const createSystemDoctorHost = () => systemDoctorHost({
+    providerInspections: async () => [await inspectSystemGhidraProvider()],
+    javascriptReplayCheck: inspectJavaScriptReplay,
+});
+const inspectJavaScriptReplay = async () => {
+    const config = parseConfig(process.env);
+    if (!config.ok)
+        return {
+            name: "javascript-replay",
+            ok: false,
+            classification: "config_drift",
+            detail: config.error.message,
+            remediation: "Fix the reported REA_JAVASCRIPT_REPLAY_* configuration.",
+        };
+    if (!config.value.javascriptReplayPolicy.enabled)
+        return {
+            name: "javascript-replay",
+            ok: true,
+            classification: "healthy",
+            detail: "disabled by default; no extracted-module execution path is admitted",
+        };
+    try {
+        await new SystemJavaScriptReplayHost().probe(config.value.javascriptReplayPolicy);
+        return {
+            name: "javascript-replay",
+            ok: true,
+            classification: "healthy",
+            detail: "Linux namespace, seccomp, and delegated cgroup probes passed",
+        };
+    }
+    catch (cause) {
+        return {
+            name: "javascript-replay",
+            ok: false,
+            classification: process.platform === "linux"
+                ? "missing_dependency"
+                : "unsupported_host",
+            detail: cause instanceof Error ? cause.message : "sandbox probe failed",
+            remediation: "Install and configure compatible Bubblewrap and systemd user cgroup delegation, or disable controlled replay.",
+        };
+    }
+};

package/dist/domain/analysisProfile.js

@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { isJsonWithinLimits } from "./jsonLimits.js";
+import { jsonObjectSchema } from "./jsonValue.js";
+const PROFILE_MAX_BYTES = 64 * 1024;
+const PROFILE_JSON_LIMITS = Object.freeze({
+    maxDepth: 16,
+    maxStringLength: 16 * 1024,
+    maxNodes: 4_096,
+});
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+/** Concrete provider identity committed by an analysis profile. */
+export const committedProviderSchema = z.object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    version: z.string().min(1),
+});
+const boundedParametersSchema = jsonObjectSchema.superRefine((parameters, context) => {
+    if (!isJsonWithinLimits(parameters, PROFILE_JSON_LIMITS)) {
+        context.addIssue({
+            code: "custom",
+            message: "Analysis profile parameters exceed structural limits",
+        });
+        return;
+    }
+    if (Buffer.byteLength(canonicalJson(parameters), "utf8") > PROFILE_MAX_BYTES)
+        context.addIssue({
+            code: "custom",
+            message: "Analysis profile parameters exceed the byte limit",
+        });
+});
+const unsignedAnalysisProfileSchema = z.object({
+    schema_version: z.literal(1),
+    provider: committedProviderSchema,
+    provider_profile_schema_version: z.number().int().min(1),
+    parameters: boundedParametersSchema,
+});
+/** Canonical, provider-neutral commitment to analysis-affecting semantics. */
+export const analysisProfileSchema = unsignedAnalysisProfileSchema
+    .extend({ digest: digestSchema })
+    .superRefine((profile, context) => {
+    const { digest: _digest, ...unsigned } = profile;
+    if (profileDigest(unsigned) !== profile.digest)
+        context.addIssue({
+            code: "custom",
+            path: ["digest"],
+            message: "Analysis profile digest does not match its parameters",
+        });
+});
+/** Create a validated RFC 8785 profile commitment at a provider boundary. */
+export const createAnalysisProfile = (provider, providerProfileSchemaVersion, parameters) => {
+    const unsigned = unsignedAnalysisProfileSchema.parse({
+        schema_version: 1,
+        provider,
+        provider_profile_schema_version: providerProfileSchemaVersion,
+        parameters,
+    });
+    return analysisProfileSchema.parse({
+        ...unsigned,
+        digest: profileDigest(unsigned),
+    });
+};
+/** Compare two already-validated commitments without interpreting parameters. */
+export const analysisProfilesEqual = (left, right) => left.digest === right.digest &&
+    left.provider.id === right.provider.id &&
+    left.provider.name === right.provider.name &&
+    left.provider.version === right.provider.version &&
+    left.schema_version === right.schema_version &&
+    left.provider_profile_schema_version ===
+        right.provider_profile_schema_version;
+const profileDigest = (profile) => createHash("sha256").update(canonicalJson(profile)).digest("hex");
+const canonicalJson = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("RFC 8785 canonicalization rejected analysis profile");
+    return encoded;
+};