rea-agents 4.0.0 → 4.1.0

package/dist/domain/callPath.js

@@ -1,8 +1,48 @@
-import { DirectedGraph } from "graphology";
-import { bidirectional } from "graphology-shortest-path/unweighted.js";
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
 export { callPathInputSchema, callPathResultSchema };
+/** Minimal directed caller-to-callee adjacency for call-path search. */
+class CallGraph {
+    successors = new Map();
+    mergeNode(node) {
+        if (!this.successors.has(node))
+            this.successors.set(node, new Set());
+    }
+    mergeDirectedEdge(source, target) {
+        this.mergeNode(source);
+        this.mergeNode(target);
+        this.successors.get(source)?.add(target);
+    }
+    hasNode(node) {
+        return this.successors.has(node);
+    }
+    outDegree(node) {
+        return this.successors.get(node)?.size ?? 0;
+    }
+    outNeighbors(node) {
+        return [...(this.successors.get(node) ?? [])];
+    }
+}
+/** Breadth-first shortest depth from start to goal, or null when unreachable. */
+const shortestPathDepth = (graph, start, goal) => {
+    if (start === goal)
+        return 0;
+    const depth = new Map([[start, 0]]);
+    const queue = [start];
+    for (let index = 0; index < queue.length; index += 1) {
+        const node = queue[index] ?? "";
+        const next = (depth.get(node) ?? 0) + 1;
+        for (const neighbor of graph.outNeighbors(node)) {
+            if (neighbor === goal)
+                return next;
+            if (!depth.has(neighbor)) {
+                depth.set(neighbor, next);
+                queue.push(neighbor);
+            }
+        }
+    }
+    return null;
+};
 /** Reconstruct direct-callee paths from explicit analyze_function Evidence. */
 export const buildCallPath = (input) => {
     const parsed = callPathInputSchema.parse(input);
@@ -13,16 +53,16 @@ export const buildCallPath = (input) => {
         start: parsed.start.address,
         goal: parsed.goal.address,
     });
-    const shortest = graph.hasNode(parsed.start.address) && graph.hasNode(parsed.goal.address)
-        ? bidirectional(graph, parsed.start.address, parsed.goal.address)
+    const shortestDepth = graph.hasNode(parsed.start.address) && graph.hasNode(parsed.goal.address)
+        ? shortestPathDepth(graph, parsed.start.address, parsed.goal.address)
         : null;
-    const paths = shortest === null
+    const paths = shortestDepth === null
         ? []
         : enumeratePaths({
             graph,
             start: parsed.start.address,
             goal: parsed.goal.address,
-            shortestDepth: shortest.length - 1,
+            shortestDepth,
         }).paths.map((path) => citePath(path, snapshots));
     const shortestHops = paths[0]?.hops;
     const found = shortestHops !== undefined;
@@ -94,7 +134,7 @@ const assertCompatible = (snapshots) => {
     }
 };
 const createGraph = (snapshots) => {
-    const graph = new DirectedGraph({ allowSelfLoops: true, multi: false });
+    const graph = new CallGraph();
     for (const [address, snapshot] of snapshots) {
         graph.mergeNode(address);
         for (const callee of snapshot.collections.callees.items) {

package/dist/domain/canonicalDigest.js

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+/** Hash canonicalize-compatible JSON without assembling an aggregate string. */
+export const digestCanonicalValue = (value, context = "Comparison") => {
+    const hash = createHash("sha256");
+    const encoded = emitCanonical(value, (part) => hash.update(part), new Set());
+    if (!encoded)
+        throw new TypeError(`${context} could not canonicalize data`);
+    return hash.digest("hex");
+};
+const emitCanonical = (value, emit, ancestors) => {
+    if (typeof value === "number" && !Number.isFinite(value))
+        throw new Error(Number.isNaN(value) ? "NaN is not allowed" : "Infinity is not allowed");
+    if (value === null || typeof value !== "object") {
+        const encoded = JSON.stringify(value);
+        if (encoded === undefined)
+            return false;
+        emit(encoded);
+        return true;
+    }
+    if (ancestors.has(value))
+        throw new Error("Circular reference detected");
+    ancestors.add(value);
+    try {
+        if ("toJSON" in value && typeof value.toJSON === "function") {
+            const normalized = value.toJSON();
+            return emitCanonical(normalized, emit, ancestors);
+        }
+        if (Array.isArray(value)) {
+            emit("[");
+            const length = value.length;
+            for (let index = 0; index < length; index += 1) {
+                if (index > 0)
+                    emit(",");
+                // Preserve canonicalize's sparse-array and unsupported-value behavior.
+                if (!(index in value))
+                    continue;
+                const item = value[index];
+                emitCanonical(item === undefined || typeof item === "symbol" ? null : item, emit, ancestors);
+            }
+            emit("]");
+        }
+        else {
+            emit("{");
+            let first = true;
+            for (const key of Object.keys(value).sort()) {
+                if (Reflect.get(value, key) === undefined ||
+                    typeof Reflect.get(value, key) === "symbol")
+                    continue;
+                const item = Reflect.get(value, key);
+                if (!first)
+                    emit(",");
+                first = false;
+                emit(JSON.stringify(key));
+                emit(":");
+                if (!emitCanonical(item, emit, ancestors))
+                    emit("undefined");
+            }
+            emit("}");
+        }
+        return true;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+};

package/dist/domain/canonicalOrdering.js

@@ -0,0 +1,11 @@
+/**
+ * Canonical code-point ordering shared across domain and application layers.
+ *
+ * Compares strings by Unicode code point (`<`/`>`) so graph ordering,
+ * fingerprints, and deterministic tie-breaks stay stable regardless of
+ * locale. Prefer this over `String.prototype.localeCompare`, which is
+ * locale-dependent.
+ */
+export const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+/** Deduplicate and sort strings with canonical code-point ordering. */
+export const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/changedBehavior.js

@@ -1,7 +1,9 @@
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./processEvidenceProvider.js";
 import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./processCapture.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
@@ -65,9 +67,7 @@ export const changedBehaviorResultSchema = z
 const EXPECTED_PROVIDERS = {
     compare_process_captures: {
         predicates: ["rea.process-comparison"],
-        id: "rea-process",
-        name: "REA deterministic process harness",
-        version: "3",
+        ...PROCESS_PROVIDER,
     },
     compare_artifacts: {
         predicates: ["rea.artifact-comparison"],
@@ -132,9 +132,11 @@ const parseComparisonEvidence = (input) => {
         .parse(evidence.operation);
     const expected = EXPECTED_PROVIDERS[operation];
     if (!acceptsPredicate(expected.predicates, evidence.predicate_type) ||
-        evidence.provider.id !== expected.id ||
-        evidence.provider.name !== expected.name ||
-        evidence.provider.version !== expected.version ||
+        (operation === "compare_process_captures"
+            ? !isProcessEvidenceProvider(evidence.provider)
+            : evidence.provider.id !== expected.id ||
+                evidence.provider.name !== expected.name ||
+                evidence.provider.version !== expected.version) ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null)
@@ -275,7 +277,6 @@ const count = (findings, classification) => findings.filter((finding) => finding
 const compareFindings = (left, right) => [left.scope, left.dimension, left.source_comparison_id]
     .join("\0")
     .localeCompare([right.scope, right.dimension, right.source_comparison_id].join("\0"), "en");
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));
 const assertUnique = (values, label) => {
     if (new Set(values).size !== values.length)
         throw new TypeError(`Changed-behavior analysis rejects duplicate ${label}`);

package/dist/domain/comparisonSemantics.js

@@ -1,14 +1,12 @@
-import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 /** Whether an inventory can support a claim that an item is absent. */
 export const absenceClaimable = (coverage) => coverage.status === "complete" &&
     coverage.truncated !== true &&
     (coverage.omitted_count === undefined || coverage.omitted_count === 0);
 /** SHA-256 of canonical JSON for stable, provider-neutral comparison IDs. */
 export const canonicalDigest = (value, context = "Comparison") => {
-    return createHash("sha256")
-        .update(canonicalJson(value, context))
-        .digest("hex");
+    return digestCanonicalValue(value, context);
 };
 /** Canonical JSON used for deterministic tie breaking and stable digests. */
 export const canonicalJson = (value, context = "Comparison") => {

package/dist/domain/configurationErrors.js

@@ -0,0 +1,25 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Runtime configuration could not be parsed safely. */
+export class ConfigurationError extends AnalysisError {
+    _tag = "ConfigurationError";
+}
+/** No app or binary session exists for an analysis request. */
+export class NoBinaryOpenError extends AnalysisError {
+    _tag = "NoBinaryOpenError";
+    constructor() {
+        super("No app is open. Ask the user which app to investigate, then call open_binary with its local path.");
+    }
+}
+/** A supplied target path could not be safely opened as a supported app or binary. */
+export class BinaryTargetError extends AnalysisError {
+    path;
+    reason;
+    _tag = "BinaryTargetError";
+    constraint;
+    constructor(path, reason, options) {
+        super(`Cannot open artifact: ${reason}`, options);
+        this.path = path;
+        this.reason = reason;
+        this.constraint = options?.constraint;
+    }
+}

package/dist/domain/dosCom.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+import { err, ok } from "./result.js";
+/** Headerless DOS COM interpretation explicitly selected by the caller. */
+export const executableFormatHintSchema = z.literal("dos-com");
+/** Validate the single 64 KiB COM segment, excluding its 256-byte PSP prefix. */
+export const validateDosComLength = (length) => Number.isSafeInteger(length) && length >= 1 && length <= 0xff00
+    ? ok(null)
+    : err("DOS COM requires 1..65280 file bytes (64 KiB segment minus the 256-byte PSP prefix)");

package/dist/domain/electronActiveObservation.js

@@ -14,7 +14,9 @@ const deepLinkUrlSchema = z
     try {
         return new URL(value).protocol.length > 0;
     }
-    catch {
+    catch (cause) {
+        // Invalid input fails the refinement.
+        void cause;
         return false;
     }
 }, "deep-link url must be an absolute URL");

package/dist/domain/electronStaticAnalysisBrowser.js

@@ -1,7 +1,8 @@
 import * as t from "@babel/types";
 import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, compareCodePoints, propertyName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, propertyName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
 export const inspectElectronBrowserNode = (node, context) => {
     if (t.isNewExpression(node))
@@ -38,29 +39,16 @@ const inspectBrowserWindow = (node, context) => {
     });
 };
 const collectWindowOptions = (source, options) => {
-    if (!t.isObjectExpression(options))
+    const lookup = objectProperty(options, "webPreferences");
+    if (lookup.status !== "explicit" ||
+        !t.isObjectExpression(lookup.property.value))
         return {
-            status: options === undefined ? "missing" : "dynamic",
+            status: lookup.status === "missing" ? "missing" : "dynamic",
             preferences: [],
             preload: { preload_path: null, preload_resolution_context: null },
-            unknown: options === undefined ? 0 : 1,
+            unknown: lookup.status === "missing" ? 0 : 1,
         };
-    const property = objectProperty(options, "webPreferences");
-    if (property === undefined)
-        return {
-            status: "missing",
-            preferences: [],
-            preload: { preload_path: null, preload_resolution_context: null },
-            unknown: 0,
-        };
-    if (!t.isObjectExpression(property.value))
-        return {
-            status: "dynamic",
-            preferences: [],
-            preload: { preload_path: null, preload_resolution_context: null },
-            unknown: 1,
-        };
-    return collectWebPreferences(source, property.value);
+    return collectWebPreferences(source, lookup.property.value);
 };
 const collectWebPreferences = (source, object) => {
     const preferences = [];
@@ -164,10 +152,12 @@ const inspectUtilityProcess = (node, context) => {
     const moduleNode = argumentNode(node.arguments[0]);
     const modulePath = moduleNode === undefined ? undefined : staticPath(moduleNode);
     const options = argumentNode(node.arguments[2]);
-    const serviceName = t.isObjectExpression(options) &&
-        objectProperty(options, "serviceName") !== undefined
-        ? staticPath(objectProperty(options, "serviceName")?.value ?? options)
+    const serviceNameProperty = objectProperty(options, "serviceName");
+    const serviceName = serviceNameProperty.status === "explicit"
+        ? staticPath(serviceNameProperty.property.value)
         : undefined;
+    if (serviceNameProperty.status !== "missing" && serviceName === undefined)
+        context.accumulator.unknownFindings += 1;
     if (modulePath === undefined)
         context.accumulator.unknownFindings += 1;
     const moduleReference = modulePath === undefined || moduleNode === undefined

package/dist/domain/electronStaticAnalysisNative.js

@@ -1,6 +1,7 @@
 import * as t from "@babel/types";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, compareCodePoints, propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect JavaScript-side imports and re-exports of native .node addons. */
 export const inspectElectronNativeNode = (node, context) => {
     if (t.isImportDeclaration(node))

package/dist/domain/electronStaticAnalysisValues.js

@@ -1,5 +1,7 @@
 import * as t from "@babel/types";
-import { compareCodePoints, propertyName, sourceSlice, } from "./javascriptStaticAnalysisHelpers.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { propertyName, sourceSlice, } from "./javascriptStaticAnalysisHelpers.js";
 /** Preserve one literal value or the exact inert expression. */
 export const electronStaticValue = (source, node) => {
     const literal = literalValue(node);
@@ -18,8 +20,26 @@ export const boundedExpression = (source, node) => {
     const expression = sourceSlice(source, node).trim();
     return expression === "" ? `[${node.type}]` : expression;
 };
-/** Read one named object property without following spreads or bindings. */
-export const objectProperty = (object, name) => object.properties.find((property) => t.isObjectProperty(property) && propertyName(property.key) === name);
+/** Find the effective explicit property, preserving unresolved overrides. */
+export const objectProperty = (object, name) => {
+    if (object === undefined)
+        return { status: "missing" };
+    if (!t.isObjectExpression(object))
+        return { status: "dynamic" };
+    for (const property of object.properties.toReversed()) {
+        if (t.isSpreadElement(property))
+            return { status: "dynamic" };
+        const key = semanticStaticPropertyName(property.key, property.computed);
+        if (key === "" && !t.isStringLiteral(property.key))
+            return { status: "dynamic" };
+        if (key !== name)
+            continue;
+        return t.isObjectProperty(property)
+            ? { status: "explicit", property }
+            : { status: "dynamic" };
+    }
+    return { status: "missing" };
+};
 export function handlerKind(node) {
     if (node === null || node === undefined)
         return "missing";

package/dist/domain/evidence.js

@@ -1,6 +1,5 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
 import { z } from "zod";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { analysisProfileSchema, } from "./analysisProfile.js";
 import { jsonValueSchema } from "./jsonValue.js";
 import { digestSchema } from "./../domain/digests.js";
@@ -21,6 +20,7 @@ const subjectSchema = z.object({
         "elf",
         "pe",
         "dos-mz",
+        "dos-com",
         "zip",
         "ipa",
         "apk",
@@ -116,14 +116,6 @@ export const evidenceRecordSchema = z.union([
     profiledEvidenceSchema,
     evidenceBaseSchema,
 ]);
-const sha256 = (value) => createHash("sha256").update(value).digest("hex");
-/** Serialize JSON according to RFC 8785 JSON Canonicalization Scheme. */
-const canonicalJson = (value) => {
-    const serialized = canonicalize(value);
-    if (serialized === undefined)
-        throw new TypeError("RFC 8785 canonicalization rejected a JSON value");
-    return serialized;
-};
 const semanticProjection = (evidence) => ({
     subject: evidence.subject === null
         ? null
@@ -149,7 +141,7 @@ const semanticProjection = (evidence) => ({
     evidence_links: evidence.evidence_links,
 });
 /** Recompute the semantic identifier, excluding paths and raw payload bytes. */
-const computeEvidenceId = (evidence) => `ev_${sha256(canonicalJson(semanticProjection(evidence)))}`;
+const computeEvidenceId = (evidence) => `ev_${digestCanonicalValue(semanticProjection(evidence), "Evidence")}`;
 /** Parse evidence and reject a syntactically valid but tampered semantic ID. */
 export const parseEvidence = (input) => {
     const evidence = evidenceRecordSchema.parse(input);

package/dist/domain/evidenceErrors.js

@@ -0,0 +1,30 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Evidence identity, schema, or bundle manifests failed integrity checks. */
+export class EvidenceIntegrityError extends AnalysisError {
+    _tag = "EvidenceIntegrityError";
+}
+/** A session Evidence reference is missing or has the wrong semantic identity. */
+export class EvidenceReferenceError extends EvidenceIntegrityError {
+    evidenceId;
+    reason;
+    expected;
+    actual;
+    constructor(evidenceId, reason, expected, actual) {
+        super(`Evidence reference ${reason}: ${evidenceId}`);
+        this.evidenceId = evidenceId;
+        this.reason = reason;
+        this.expected = expected;
+        this.actual = actual;
+    }
+}
+/** Evidence bundle filesystem access failed within the configured policy. */
+export class EvidenceFileError extends AnalysisError {
+    operation;
+    reason;
+    _tag = "EvidenceFileError";
+    constructor(operation, reason, options) {
+        super(`Evidence bundle ${operation} failed: ${reason}`, options);
+        this.operation = operation;
+        this.reason = reason;
+    }
+}

package/dist/domain/firmwareAnalysis.js

@@ -0,0 +1,121 @@
+import { z } from "zod";
+import { digestSchema } from "./digests.js";
+import { jsonValueSchema } from "./jsonValue.js";
+const bytes = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+const range = z.strictObject({ offset: bytes, length: bytes.positive() });
+const target = {
+    path: z.string().min(1).describe("Local firmware file; never executed"),
+};
+/** Explicit firmware inspection and extraction intent, independent of engines. */
+export const firmwareInputSchemas = {
+    inspect_firmware_regions: z.strictObject(target),
+    extract_firmware: z.strictObject({
+        ...target,
+        output_directory: z
+            .string()
+            .min(1)
+            .describe("Absolute, absent output directory; parent must exist"),
+        range: range
+            .optional()
+            .describe("Explicit file-byte interval; omit to extract the whole file"),
+        max_depth: z
+            .number()
+            .int()
+            .min(1)
+            .max(10)
+            .default(3)
+            .describe("Extraction depth; reaching it yields partial analysis"),
+        max_output_bytes: z
+            .number()
+            .int()
+            .min(1)
+            .max(512 * 1024 * 1024)
+            .default(256 * 1024 * 1024)
+            .describe("Staging file-byte budget, checked during extraction; transient overshoot is possible"),
+        max_output_files: z
+            .number()
+            .int()
+            .min(1)
+            .max(100_000)
+            .default(10_000)
+            .describe("Staging entry budget, including directories and links"),
+    }),
+};
+/** Validate the operation with its exact input contract. */
+export const firmwareRequestSchema = z.discriminatedUnion("operation", [
+    z.strictObject({
+        operation: z.literal("inspect_firmware_regions"),
+        input: firmwareInputSchemas.inspect_firmware_regions,
+    }),
+    z.strictObject({
+        operation: z.literal("extract_firmware"),
+        input: firmwareInputSchemas.extract_firmware,
+    }),
+]);
+const engine = z.strictObject({
+    name: z.string(),
+    version: z.string(),
+    executable_path: z.string(),
+    executable_sha256: digestSchema,
+    source_revision: z.null(),
+    worker_count: z.literal(1),
+});
+const selection = z.strictObject({ ...range.shape, sha256: digestSchema });
+const chunk = z.strictObject({
+    input_path: z.string(),
+    provider_id: z.string(),
+    range,
+    handler: z.string().nullable(),
+    encrypted: z.boolean().nullable(),
+    root_file_range: range.nullable(),
+});
+/** Portable results retain reported boundaries, unknowns and extraction lineage. */
+export const firmwareResultSchemas = {
+    inspect_firmware_regions: z.strictObject({
+        engine,
+        input_size: bytes,
+        regions: z.array(z.strictObject({
+            provider_id: z.string(),
+            offset: bytes,
+            reported_size: bytes,
+            signature: z.string(),
+            description: z.string(),
+            reported_confidence: z.number().int().min(0).max(255),
+            size_basis: z.literal("provider_reported_validation_unknown"),
+        })),
+        coverage: z.literal("signature_scan"),
+    }),
+    extract_firmware: z.strictObject({
+        engine,
+        selection,
+        output_directory: z.string(),
+        coverage: z.enum(["complete", "partial"]),
+        files: z.array(z.strictObject({
+            relative_path: z.string(),
+            path: z.string(),
+            size: bytes,
+            sha256: digestSchema,
+            reported_sha256: digestSchema.nullable(),
+            mime_type: z.string().nullable(),
+            analysis_depth: bytes.nullable(),
+            runtime_address: z.null(),
+            original_file_range: z.null(),
+        })),
+        unpublished_entries: z.array(z.strictObject({
+            relative_path: z.string(),
+            kind: z.enum(["symlink", "special"]),
+            link_target: z.string().nullable(),
+        })),
+        chunks: z.array(chunk),
+        derivations: z.array(z.strictObject({
+            parent_path: z.string(),
+            child_path: z.string(),
+            provider_blob_id: z.string(),
+            handler: z.string().nullable(),
+            parent_file_range: range.nullable(),
+        })),
+        depth_limited_paths: z.array(z.string()),
+        diagnostics: z.array(jsonValueSchema),
+        published_bytes: bytes,
+    }),
+};

package/dist/domain/functionComparison.js

@@ -1,7 +1,8 @@
+import { canonicalJson } from "./comparisonSemantics.js";
 import { parseFunctionEvidence } from "./functionDossierEvidence.js";
 import { functionMatch } from "./functionComparisonNormalization.js";
 import { functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
-import { overallStatus, summarize, canonicalJson, } from "./functionComparisonResults.js";
+import { overallStatus, summarize } from "./functionComparisonResults.js";
 import { compareDimensions } from "./functionComparisonDimensions.js";
 export { functionComparisonInputSchema, functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
 /** Compare two complete function Evidence records without fuzzy matching. */
@@ -9,7 +10,8 @@ export const compareFunctions = (leftInput, rightInput) => {
     const left = parseFunctionEvidence(leftInput);
     const right = parseFunctionEvidence(rightInput);
     const links = [left.evidence[0].evidence_id, right.evidence[0].evidence_id];
-    const providersDiffer = canonicalJson(left.provider) !== canonicalJson(right.provider);
+    const providersDiffer = canonicalJson(left.provider, "Function comparison") !==
+        canonicalJson(right.provider, "Function comparison");
     const dimensions = compareDimensions(left, right, links, providersDiffer);
     const match = functionMatch(left, right);
     const changes = dimensions.filter(({ status }) => status !== "unchanged");

package/dist/domain/functionComparisonDimensions.js

@@ -1,6 +1,7 @@
+import { canonicalJson } from "./comparisonSemantics.js";
 import { diffLines } from "diff";
 import { commentProjection, combineCoverage, identityProjection, isAutoName, normalizeCfg, project, referenceKindProjection, referenceProjection, sorted, stringAndNameProjection, } from "./functionComparisonNormalization.js";
-import { canonicalJson, dimensionResult, unresolvedDimension as buildUnresolvedDimension, } from "./functionComparisonResults.js";
+import { dimensionResult, unresolvedDimension as buildUnresolvedDimension, } from "./functionComparisonResults.js";
 const unresolvedDimension = (...[dimension, status, links, leftCount, rightCount, limitations]) => buildUnresolvedDimension({
     dimension,
     status,
@@ -86,7 +87,8 @@ const compareReferences = (left, right, links, providersDiffer) => {
     const rightProjection = referenceProjection(right);
     if (leftProjection.length === 0 && rightProjection.length === 0)
         return compareValues("references", leftProjection, rightProjection, links, true, true, providersDiffer);
-    if (canonicalJson(leftProjection) !== canonicalJson(rightProjection))
+    if (canonicalJson(leftProjection, "Function comparison") !==
+        canonicalJson(rightProjection, "Function comparison"))
         return dimensionResult({
             dimension: "references",
             status: "changed",
@@ -147,8 +149,8 @@ const compareCfg = (left, right, links, providersDiffer) => {
 const compareValues = (...[dimension, left, right, links, leftComplete, rightComplete, providersDiffer,]) => {
     if (!leftComplete || !rightComplete)
         return unresolvedDimension(dimension, "unknown", links, null, null, []);
-    const leftJson = canonicalJson(left);
-    const rightJson = canonicalJson(right);
+    const leftJson = canonicalJson(left, "Function comparison");
+    const rightJson = canonicalJson(right, "Function comparison");
     return dimensionResult({
         dimension,
         status: leftJson === rightJson ? "unchanged" : "changed",

package/dist/domain/functionComparisonNormalization.js

@@ -1,4 +1,5 @@
 import canonicalize from "canonicalize";
+import { compareCodePoints } from "./canonicalOrdering.js";
 export const identityProjection = (snapshot) => ({
     name: snapshot.procedure.name,
     signature: snapshot.procedure.signature,
@@ -128,7 +129,13 @@ export const stringAndNameProjection = (snapshot) => {
         ? null
         : sorted(values);
 };
-export const sorted = (values) => [...values].sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)));
+export const sorted = (values) => [...values].sort((left, right) => {
+    const leftJson = canonicalJson(left);
+    const rightJson = canonicalJson(right);
+    // Preserve existing collation while ordering distinct values within a tie.
+    return (leftJson.localeCompare(rightJson) ||
+        compareCodePoints(leftJson, rightJson));
+});
 export const combineCoverage = (left, right) => {
     return {
         items: [...left.items, ...right.items],

package/dist/domain/functionComparisonResults.js

@@ -1,4 +1,4 @@
-import { canonicalDigest, canonicalJson as encodeCanonicalJson, } from "./comparisonSemantics.js";
+import { canonicalDigest } from "./comparisonSemantics.js";
 export const dimensionResult = (input) => {
     const context = {
         dimension: input.dimension,
@@ -54,7 +54,4 @@ export const summarize = (dimensions) => ({
     truncated: dimensions.filter(({ status }) => status === "truncated").length,
     unknown: dimensions.filter(({ status }) => status === "unknown").length,
 });
-export const canonicalJson = (value) => {
-    return encodeCanonicalJson(value, "Function comparison");
-};
 const digest = (value) => canonicalDigest(value, "Function comparison");