rea-agents 3.2.1 → 4.0.0

package/dist/domain/electronStaticAnalysisNative.js

@@ -15,7 +15,7 @@ export const inspectElectronNativeNode = (node, context) => {
         inspectReExport(node, context);
 };
 const inspectImport = (node, context) => {
-    if (!isNativeSpecifier(node.source.value))
+    if (!isNativeSpecifier(node.source.value, "import"))
         return;
     const members = node.specifiers.map((specifier) => {
         if (t.isImportDefaultSpecifier(specifier))
@@ -29,13 +29,14 @@ const inspectImport = (node, context) => {
         node,
         specifier: node.source.value,
         kind: "import",
+        moduleKind: "import",
         members,
     });
 };
 const inspectNamedExport = (node, context) => {
     if (node.source === null ||
         node.source === undefined ||
-        !isNativeSpecifier(node.source.value))
+        !isNativeSpecifier(node.source.value, "import"))
         return;
     const members = node.specifiers.map((specifier) => {
         if (t.isExportSpecifier(specifier))
@@ -47,17 +48,20 @@ const inspectNamedExport = (node, context) => {
         node,
         specifier: node.source.value,
         kind: "re-export",
+        moduleKind: "import",
         members,
     });
 };
 const inspectExportAll = (node, context) => {
-    if (node.source === undefined || !isNativeSpecifier(node.source.value))
+    if (node.source === undefined ||
+        !isNativeSpecifier(node.source.value, "import"))
         return;
     addBinding({
         context,
         node,
         specifier: node.source.value,
         kind: "re-export",
+        moduleKind: "import",
         members: ["*"],
     });
 };
@@ -70,6 +74,7 @@ const inspectRequireBinding = (node, context) => {
         node,
         specifier: required.specifier,
         kind: "require",
+        moduleKind: "require",
         members: required.member === null ? bindingMembers(node.id) : [required.member],
     });
 };
@@ -82,6 +87,7 @@ const inspectReExport = (node, context) => {
         node,
         specifier: required.specifier,
         kind: "re-export",
+        moduleKind: "require",
         members: [required.member ?? exportedMember(node.left) ?? "*"],
     });
 };
@@ -98,6 +104,7 @@ const addBinding = (input) => {
         value: {
             specifier,
             binding_kind: kind,
+            module_kind: input.moduleKind,
             members,
             module_key: null,
             location: range(node),
@@ -122,7 +129,7 @@ const nativeRequire = (node) => {
         !name.includes("__webpack_require__"))
         return undefined;
     const specifier = stringValue(argumentNode(node.arguments[0]));
-    return specifier !== undefined && isNativeSpecifier(specifier)
+    return specifier !== undefined && isNativeSpecifier(specifier, "require")
         ? { specifier, member: null }
         : undefined;
 };
@@ -151,7 +158,9 @@ const exportedMember = (node) => {
         return name.slice("exports.".length);
     return undefined;
 };
-const isNativeSpecifier = (specifier) => {
-    const path = specifier.split("#", 1)[0]?.split("?", 1)[0] ?? "";
+const isNativeSpecifier = (specifier, moduleKind) => {
+    const path = moduleKind === "require"
+        ? specifier
+        : (specifier.split("#", 1)[0]?.split("?", 1)[0] ?? "");
     return path.toLowerCase().endsWith(".node");
 };

package/dist/domain/emptyArraySchema.js

@@ -0,0 +1,3 @@
+import { z } from "zod";
+/** An empty array whose JSON Schema is valid under Draft 2020-12. */
+export const emptyArraySchema = z.array(z.never()).length(0);

package/dist/domain/errors.js

@@ -26,8 +26,6 @@ const ANALYSIS_ERROR_TAGS = [
     "ConfigurationError",
     "NoBinaryOpenError",
     "BinaryTargetError",
-    "PermissionRequiredError",
-    "ReplayPlanStaleError",
 ];
 /** Base class for expected analysis, provider, and session failures. */
 export class AnalysisError extends Error {
@@ -162,10 +160,20 @@ export class BrowserObservationError extends AnalysisError {
     operation;
     reason;
     _tag = "BrowserObservationError";
+    cleanupIncomplete;
+    cleanupResources;
+    userCategory;
     constructor(operation, reason, options) {
         super(`Browser observation ${operation} failed: ${reason}`, options);
         this.operation = operation;
         this.reason = reason;
+        this.cleanupIncomplete = reason === "cleanup_failed";
+        this.cleanupResources =
+            reason === "cleanup_failed" ? ["browser_transport"] : [];
+        this.userCategory =
+            reason === "cancelled" || options?.cause instanceof AnalysisCancelledError
+                ? "cancelled"
+                : undefined;
     }
 }
 /** Artifact inventory or extraction failed a typed safety boundary. */
@@ -314,29 +322,3 @@ export class BinaryTargetError extends AnalysisError {
         this.path = path;
     }
 }
-/** Exact denied authority used by both CLI and MCP remediation. */
-export class PermissionRequiredError extends AnalysisError {
-    _tag = "PermissionRequiredError";
-    requested;
-    missing;
-    ceiling;
-    remediation;
-    constructor(context) {
-        super(`Permission required for ${context.requested.capability}`);
-        this.requested = context.requested;
-        this.missing = context.missing;
-        this.ceiling = context.ceiling;
-        this.remediation = context.remediation;
-    }
-}
-/** Approved replay commitment no longer matches the immediately rebuilt plan. */
-export class ReplayPlanStaleError extends AnalysisError {
-    approvedDigest;
-    actualDigest;
-    _tag = "ReplayPlanStaleError";
-    constructor(approvedDigest, actualDigest) {
-        super("Controlled replay plan changed before execution");
-        this.approvedDigest = approvedDigest;
-        this.actualDigest = actualDigest;
-    }
-}

package/dist/domain/evidence.js

@@ -3,7 +3,8 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { analysisProfileSchema, } from "./analysisProfile.js";
 import { jsonValueSchema } from "./jsonValue.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 /** Provider identity schema shared by evidence-bearing persistence formats. */
 export const providerSchema = z.object({
     id: z.string().min(1),
@@ -19,6 +20,7 @@ const subjectSchema = z.object({
         "mach-o",
         "elf",
         "pe",
+        "dos-mz",
         "zip",
         "ipa",
         "apk",
@@ -72,7 +74,7 @@ const executionEnvironmentSchema = z.object({
 });
 const evidenceBaseSchema = z
     .object({
-    evidence_id: z.string().regex(/^ev_[a-f0-9]{64}$/u),
+    evidence_id: prefixedDigestSchema("ev"),
     subject: subjectSchema.nullable(),
     provider: providerSchema,
     predicate_type: z.string().min(1),
@@ -85,7 +87,7 @@ const evidenceBaseSchema = z
     environment: executionEnvironmentSchema.nullable(),
     limitations: z.array(z.string()),
     locations: z.array(evidenceLocationSchema),
-    evidence_links: z.array(z.string().regex(/^ev_[a-f0-9]{64}$/u)),
+    evidence_links: z.array(prefixedDigestSchema("ev")),
 })
     .strict();
 /** Object envelope used to specialize caller-visible Evidence result schemas. */

package/dist/domain/evidenceCompletionLedger.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const claimIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
 /** Terminal outcome recorded for one verifier claim. */
 export const evidenceCompletionStatusSchema = z.enum([
@@ -27,7 +28,7 @@ const completionSummarySchema = z.strictObject({
     complete: z.boolean(),
 });
 const completionLedgerObjectSchema = z.strictObject({
-    ledger_id: z.string().regex(/^ecl_[a-f0-9]{64}$/u),
+    ledger_id: prefixedDigestSchema("ecl"),
     records: z.array(evidenceCompletionRecordSchema).min(1),
     summary: completionSummarySchema,
 });

package/dist/domain/functionComparisonNormalization.js

@@ -23,27 +23,33 @@ export const functionMatch = (left, right) => {
     };
 };
 export const normalizeCfg = (blocks) => {
-    const parsed = blocks.map((block) => ({
-        block,
-        start: parseAddress(block.start),
-        end: parseAddress(block.end),
-    }));
-    if (parsed.some(({ start, end }) => start === null || end === null))
-        return null;
-    const ordered = parsed.sort((left, right) => (left.start ?? 0n) < (right.start ?? 0n) ? -1 : 1);
-    if (new Set(ordered.map(({ block }) => block.start)).size !== ordered.length)
-        return null;
-    if (ordered.some(({ start, end }) => (end ?? 0n) <= (start ?? 0n)))
+    const parsed = [];
+    for (const block of blocks) {
+        const start = parseAddress(block.start);
+        const end = parseAddress(block.end);
+        if (start === null || end === null || end <= start)
+            return null;
+        parsed.push({ block, start, end });
+    }
+    const ordered = parsed.sort((left, right) => left.start < right.start ? -1 : left.start > right.start ? 1 : 0);
+    if (new Set(ordered.map(({ start }) => start)).size !== ordered.length)
         return null;
-    const indices = new Map(ordered.map(({ block }, index) => [block.start, index]));
+    const indices = new Map(ordered.map(({ start }, index) => [start, index]));
     const graph = [];
     for (const { block, start, end } of ordered) {
-        const successors = block.successors.map((address) => indices.get(address));
-        if (successors.some((index) => index === undefined))
-            return null;
+        const successors = [];
+        for (const address of block.successors) {
+            const parsedAddress = parseAddress(address);
+            if (parsedAddress === null)
+                return null;
+            const index = indices.get(parsedAddress);
+            if (index === undefined)
+                return null;
+            successors.push(index);
+        }
         graph.push({
-            size: String((end ?? 0n) - (start ?? 0n)),
-            successors: successors.sort((left, right) => (left ?? 0) - (right ?? 0)),
+            size: String(end - start),
+            successors: successors.sort((left, right) => left - right),
         });
     }
     return graph;
@@ -132,7 +138,7 @@ export const combineCoverage = (left, right) => {
     };
 };
 export const project = (collection, mapper) => collection.items.map(mapper);
-export const isAutoName = (name) => /^(?:sub_[0-9a-f]+|fcn\.)/iu.test(name);
+export const isAutoName = (name) => /^(?:sub_[0-9a-f]+|fcn\.[0-9a-f]+)$/iu.test(name);
 const parseAddress = (value) => /^0x[0-9a-f]+$/iu.test(value) ? BigInt(value) : null;
 const relativeAddress = (value, base) => {
     const parsed = parseAddress(value);

package/dist/domain/functionComparisonResults.js

@@ -1,5 +1,4 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
+import { canonicalDigest, canonicalJson as encodeCanonicalJson, } from "./comparisonSemantics.js";
 export const dimensionResult = (input) => {
     const context = {
         dimension: input.dimension,
@@ -56,9 +55,6 @@ export const summarize = (dimensions) => ({
     unknown: dimensions.filter(({ status }) => status === "unknown").length,
 });
 export const canonicalJson = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Function comparison could not canonicalize data");
-    return encoded;
+    return encodeCanonicalJson(value, "Function comparison");
 };
-const digest = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
+const digest = (value) => canonicalDigest(value, "Function comparison");

package/dist/domain/functionComparisonSchemas.js

@@ -1,5 +1,7 @@
 import { z } from "zod";
 import { evidenceSchema } from "./evidence.js";
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const comparisonStatusSchema = z.enum([
     "unchanged",
     "changed",
@@ -16,8 +18,7 @@ const dimensionNameSchema = z.enum([
     "strings_names",
     "cfg",
 ]);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Inputs for explicit function-to-function comparison. */
 export const functionComparisonInputSchema = z.strictObject({
     left: evidenceSchema,

package/dist/domain/hopperValues.js

@@ -38,6 +38,103 @@ const segmentSchema = z.object({
 const unavailableAnalysisFactSchema = z
     .object({ available: z.literal(false), reason: z.string() })
     .strict();
+/** Complete observed function-body ranges; every range endpoint is inclusive. */
+export const functionBodySchema = z.discriminatedUnion("available", [
+    unavailableAnalysisFactSchema,
+    z
+        .strictObject({
+        available: z.literal(true),
+        provenance: z.string().min(1),
+        ranges: z.array(z.strictObject({
+            start: z.string(),
+            end: z
+                .string()
+                .describe("Inclusive last address of this observed body range."),
+        })),
+        total_bytes: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+        span_bytes: z
+            .number()
+            .int()
+            .min(0)
+            .max(Number.MAX_SAFE_INTEGER)
+            .nullable(),
+        non_contiguous: z.boolean(),
+        contains_entry: z.boolean(),
+    })
+        .superRefine((body, context) => {
+        let total = 0n;
+        const bounds = new Map();
+        const closedSpaces = new Set();
+        let previousSpace = null;
+        for (const range of body.ranges) {
+            const start = addressCoordinate(range.start);
+            const end = addressCoordinate(range.end);
+            if (start === null ||
+                end === null ||
+                start.space !== end.space ||
+                end.offset < start.offset) {
+                context.addIssue({
+                    code: "custom",
+                    message: "Function body range has invalid inclusive endpoints",
+                });
+                return;
+            }
+            if (previousSpace !== null && previousSpace !== start.space)
+                closedSpaces.add(previousSpace);
+            const previous = bounds.get(start.space);
+            if (closedSpaces.has(start.space) ||
+                (previous !== undefined && start.offset <= previous.end + 1n)) {
+                context.addIssue({
+                    code: "custom",
+                    message: "Function body ranges must be ordered, disjoint and maximal within each address space",
+                });
+                return;
+            }
+            bounds.set(start.space, {
+                start: previous?.start ?? start.offset,
+                end: end.offset,
+            });
+            previousSpace = start.space;
+            total += end.offset - start.offset + 1n;
+        }
+        const onlyBounds = bounds.size === 1 ? [...bounds.values()][0] : undefined;
+        const span = bounds.size === 0
+            ? 0n
+            : onlyBounds === undefined
+                ? null
+                : onlyBounds.end - onlyBounds.start + 1n;
+        const reportedSpan = body.span_bytes === null ? null : BigInt(body.span_bytes);
+        if (total !== BigInt(body.total_bytes) ||
+            span !== reportedSpan ||
+            body.non_contiguous !== body.ranges.length > 1)
+            context.addIssue({
+                code: "custom",
+                message: "Function body counts, enclosing span or contiguity disagree with inclusive ranges",
+            });
+    }),
+]);
+const unknownFunctionBody = () => functionBodySchema.default({
+    available: false,
+    reason: "The provider did not report complete function body ranges.",
+});
+/** Check the declared entry membership against complete, inclusive body ranges. */
+export const functionBodyEntryAgrees = (body, address) => {
+    if (!body.available)
+        return true;
+    const entry = addressCoordinate(address);
+    if (entry === null)
+        return false;
+    const contains = body.ranges.some((range) => {
+        const start = addressCoordinate(range.start);
+        const end = addressCoordinate(range.end);
+        return (start !== null &&
+            end !== null &&
+            start.space === entry.space &&
+            entry.offset >= start.offset &&
+            entry.offset <= end.offset);
+    });
+    return contains === body.contains_entry;
+};
 export const procedureClassificationSchema = z
     .object({
     external: z.boolean(),
@@ -51,8 +148,16 @@ export const procedureIdentitySchema = z
     address: z.string(),
     name: z.string(),
     classification: procedureClassificationSchema.nullable().default(null),
+    body: unknownFunctionBody(),
 })
-    .strict();
+    .strict()
+    .superRefine((identity, context) => {
+    if (!functionBodyEntryAgrees(identity.body, identity.address))
+        context.addIssue({
+            code: "custom",
+            message: "Function body entry membership disagrees with procedure identity",
+        });
+});
 export const localVariableSchema = z
     .object({
     description: z.string(),
@@ -102,15 +207,10 @@ const referenceEdgeSchema = z
     .strict();
 export const functionDossierSchema = z
     .object({
-    procedure: z
-        .object({
-        address: z.string(),
-        name: z.string(),
-        classification: procedureClassificationSchema.nullable().default(null),
+    procedure: procedureIdentitySchema.safeExtend({
         signature: z.string().nullable(),
         locals: z.array(localVariableSchema),
-    })
-        .strict(),
+    }),
     pseudocode: z.string(),
     assembly: z.array(z.string()),
     comments: z.array(z

package/dist/domain/javascriptApplicationAnalysis.js

@@ -1,15 +1,12 @@
-import { isAbsolute } from "node:path";
 import { z } from "zod";
 import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
 import { javaScriptSemanticGraphSchema } from "./javascriptSemanticGraph.js";
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const countSchema = z.number().int().min(0);
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 /** Public target-free request for static JavaScript application analysis. */
 export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
-    input_path: z
-        .string()
-        .min(1)
-        .refine(isAbsolute, "JavaScript application input path must be absolute"),
+    input_path: z.string().min(1),
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
 });
 /** Compact counts for the high-level Electron architecture/security surface. */
@@ -54,7 +51,7 @@ export const javascriptApplicationAnalysisResultSchema = z
     input_path: z.string().min(1),
     format: z.enum(["asar", "directory"]),
     root_artifact_sha256: digestSchema,
-    inventory_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
+    inventory_manifest_id: prefixedDigestSchema("agm"),
     inventory_graph_sha256: digestSchema,
     graph: javascriptApplicationGraphSchema,
     summary: electronBoundarySummarySchema,

package/dist/domain/javascriptApplicationEvidenceSchemas.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const boundedTextSchema = z.string().min(1);
 const boundedKeySchema = z.string().min(1);
 const unsafePathSegments = new Set(["", ".", ".."]);
@@ -59,7 +60,7 @@ const unavailableFactSchema = z.strictObject({
 const availableArtifactSchema = z
     .strictObject({
     available: z.literal(true),
-    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    artifact_id: prefixedDigestSchema("art"),
     sha256: digestSchema,
 })
     .superRefine((artifact, context) => {
@@ -229,7 +230,7 @@ const applicationGraphEvidenceBaseSchema = z.strictObject({
     extractor: applicationExtractorSchema,
     coverage: applicationCoverageSchema,
     limitations: z.array(boundedTextSchema),
-    evidence_ids: z.array(z.string().regex(/^ev_[a-f0-9]{64}$/u)),
+    evidence_ids: z.array(prefixedDigestSchema("ev")),
 });
 const checkAuthorityState = (evidence, context) => {
     if (evidence.authority === "static-relationship-inference" &&

package/dist/domain/javascriptApplicationGraphSchemas.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { applicationCoverageSchema, applicationGraphEvidenceSchema, applicationNodeIdentitySchema, } from "./javascriptApplicationEvidenceSchemas.js";
 import { jsonValueSchema } from "./jsonValue.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const boundedTextSchema = z.string().min(1);
 /** Node kinds admitted by JavaScript Application Graph. */
 export const JAVASCRIPT_APPLICATION_NODE_KINDS = [
@@ -67,7 +68,7 @@ const applicationNodeObservationInputSchema = z.strictObject({
 });
 /** One immutable, evidence-bearing observation attached to an entity. */
 export const applicationNodeObservationSchema = applicationNodeObservationInputSchema.extend({
-    observation_id: z.string().regex(/^jag_observation_[a-f0-9]{64}$/u),
+    observation_id: prefixedDigestSchema("jag_observation"),
     identifier_strategy: z.strictObject({
         strategy: z.literal("semantic-content-sha256"),
         stability: z.literal("observation-exact"),
@@ -81,22 +82,22 @@ export const applicationNodeInputSchema = z.strictObject({
 });
 /** One stable application entity with one or more bounded observations. */
 export const applicationNodeSchema = z.strictObject({
-    node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
+    node_id: prefixedDigestSchema("jag_node"),
     kind: applicationNodeKindSchema,
     identity: applicationNodeIdentitySchema,
     observations: z.array(applicationNodeObservationSchema).min(1),
 });
 /** One directed relationship before its semantic identifier is derived. */
 export const applicationEdgeInputSchema = z.strictObject({
-    source_node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
-    target_node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
+    source_node_id: prefixedDigestSchema("jag_node"),
+    target_node_id: prefixedDigestSchema("jag_node"),
     relation: applicationRelationSchema,
     properties: applicationPropertiesSchema,
     evidence: applicationGraphEvidenceSchema,
 });
 /** One directed, evidence-bearing application relationship. */
 export const applicationEdgeSchema = applicationEdgeInputSchema.extend({
-    edge_id: z.string().regex(/^jag_edge_[a-f0-9]{64}$/u),
+    edge_id: prefixedDigestSchema("jag_edge"),
     identifier_strategy: z.strictObject({
         strategy: z.literal("semantic-content-sha256"),
         stability: z.literal("relationship-exact"),
@@ -105,7 +106,7 @@ export const applicationEdgeSchema = applicationEdgeInputSchema.extend({
 /** Graph content before its top-level semantic identifier is derived. */
 export const javascriptApplicationGraphInputSchema = z.strictObject({
     schema: z.literal("JavaScriptApplicationGraph"),
-    root_node_ids: z.array(z.string().regex(/^jag_node_[a-f0-9]{64}$/u)).min(1),
+    root_node_ids: z.array(prefixedDigestSchema("jag_node")).min(1),
     nodes: z.array(applicationNodeSchema).min(1),
     edges: z.array(applicationEdgeSchema),
     coverage: applicationCoverageSchema,
@@ -113,5 +114,5 @@ export const javascriptApplicationGraphInputSchema = z.strictObject({
 });
 /** Strict stored shape for a JavaScript Application Graph. */
 export const javascriptApplicationGraphRecordSchema = javascriptApplicationGraphInputSchema.extend({
-    graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+    graph_id: prefixedDigestSchema("jag"),
 });

package/dist/domain/javascriptApplicationVersionComparisonSchemas.js

@@ -1,9 +1,11 @@
 import { z } from "zod";
+import { emptyArraySchema } from "./emptyArraySchema.js";
 import { evidenceSchema } from "./evidence.js";
 import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
 import { JAVASCRIPT_APPLICATION_NODE_KINDS } from "./javascriptApplicationGraphSchemas.js";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-const nodeIdSchema = z.string().regex(/^jag_node_[a-f0-9]{64}$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const nodeIdSchema = prefixedDigestSchema("jag_node");
 const textSchema = z.string().min(1);
 /** Two authenticated application versions and their native observations. */
 export const compareApplicationVersionsInputSchema = z
@@ -33,7 +35,7 @@ export const compareApplicationVersionsInputSchema = z
             });
     }
 });
-const emptyCandidateNodesSchema = z.tuple([]);
+const emptyCandidateNodesSchema = emptyArraySchema;
 const candidateNodesSchema = z.tuple([nodeIdSchema]).rest(nodeIdSchema);
 const exactMatchSchema = z.strictObject({
     status: z.literal("matched"),
@@ -87,7 +89,7 @@ const rightAmbiguousMatchSchema = z.strictObject({
     candidate_right_node_ids: emptyCandidateNodesSchema,
 });
 const comparisonItemContextShape = {
-    item_id: z.string().regex(/^javc_item_[a-f0-9]{64}$/u),
+    item_id: prefixedDigestSchema("javc_item"),
     node_kind: z.enum(JAVASCRIPT_APPLICATION_NODE_KINDS),
     dimensions: z.array(z.enum([
         "content",
@@ -147,15 +149,15 @@ const comparisonCoverageSchema = z.strictObject({
 /** Tiered module/entity matching plus its complete cross-version change graph. */
 export const applicationVersionComparisonResultSchema = z
     .strictObject({
-    comparison_id: z.string().regex(/^javc_[a-f0-9]{64}$/u),
+    comparison_id: prefixedDigestSchema("javc"),
     left: z.strictObject({
         evidence_id: evidenceIdSchema,
-        graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+        graph_id: prefixedDigestSchema("jag"),
         root_artifact_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
     }),
     right: z.strictObject({
         evidence_id: evidenceIdSchema,
-        graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+        graph_id: prefixedDigestSchema("jag"),
         root_artifact_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
     }),
     summary: z.strictObject({