rea-agents 4.0.0 → 4.1.0

package/dist/domain/javascriptStaticAnalysisHelpers.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { posix } from "node:path";
 import * as t from "@babel/types";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 export { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Explicit result for source text that Babel cannot parse. */
 export const failedJavaScriptStaticAnalysis = () => ({
@@ -130,7 +131,11 @@ const staticCallPath = (node) => {
     if ((name === "dirname" || name.endsWith(".dirname")) &&
         isFileIdentity(argumentNode(node.arguments[0])))
         return "";
-    if (!name.endsWith(".join") && !name.endsWith(".resolve") && name !== "join")
+    if (name.endsWith(".resolve"))
+        return name === "win32.resolve" || name.endsWith(".win32.resolve")
+            ? undefined
+            : staticResolvedPath(node);
+    if (!name.endsWith(".join") && name !== "join")
         return undefined;
     const parts = [];
     for (const argument of node.arguments) {
@@ -143,6 +148,27 @@ const staticCallPath = (node) => {
     }
     return parts.length === 0 ? undefined : posix.join(...parts);
 };
+const staticResolvedPath = (node) => {
+    const parts = [];
+    for (const argument of node.arguments) {
+        if (isDirectoryIdentity(argumentNode(argument))) {
+            parts.push(null);
+            continue;
+        }
+        const value = t.isNode(argument) ? staticPathAt(argument) : undefined;
+        // Validate every argument, including those before the last anchor.
+        if (value === undefined)
+            return undefined;
+        parts.push(value);
+    }
+    const anchor = parts.findLastIndex((part) => part === null || posix.isAbsolute(part));
+    // Relative-only calls depend on the target process cwd, which is unknown.
+    if (anchor === -1)
+        return undefined;
+    // A null anchor is the source directory; preserve its relative projection.
+    const path = posix.join(...parts.slice(anchor).filter((part) => part !== null));
+    return path === "/" ? path : path.replace(/\/$/u, "");
+};
 const isFilesystemPathExpression = (node) => {
     if (t.isStringLiteral(node))
         return node.value.startsWith("/");
@@ -153,6 +179,8 @@ const isFilesystemPathExpression = (node) => {
             isFilesystemPathExpression(node.right));
     if (t.isCallExpression(node) || t.isNewExpression(node)) {
         const name = calleeName(node.callee);
+        if (name.endsWith(".resolve") && staticCallPath(node) !== undefined)
+            return true;
         if (name === "URL" || name.endsWith(".URL"))
             return isFileIdentity(argumentNode(node.arguments[1]));
         if (name === "fileURLToPath" || name.endsWith(".fileURLToPath"))
@@ -284,7 +312,8 @@ export const sourceRangesEqual = (left, right) => left !== null &&
     left.end.column === right.end.column;
 const pointForOffset = (source, offset) => {
     const before = source.slice(0, offset);
-    const lines = before.split("\n");
+    // Match JavaScript line terminators, treating CRLF as a single newline.
+    const lines = before.split(/\r\n|[\n\r\u2028\u2029]/u);
     return { line: lines.length, column: lines.at(-1)?.length ?? 0 };
 };
 /** Observe known bundler/framework marker strings without claiming dependency use. */
@@ -295,8 +324,6 @@ export const registrationKey = (registration) => `${registration.runtime}\0${reg
 export const sortedUnique = (values, key) => [...new Map(values.map((value) => [key(value), value])).values()].sort((left, right) => compareCodePoints(key(left), key(right)));
 /** Hash exact UTF-8 source text. */
 export const sha256Text = (value) => createHash("sha256").update(value).digest("hex");
-/** Compare strings by Unicode code point for canonical ordering. */
-export const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 /** Recognized route-construction call suffixes. */
 export const STATIC_ROUTE_CALL_NAMES = [
     "route",

package/dist/domain/jsonShape.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { compareCodePoints } from "./canonicalOrdering.js";
 const jsonValueTypeSchema = z.enum([
     "object",
     "array",
@@ -24,7 +25,9 @@ export const inferJsonShape = (text) => {
     try {
         root = JSON.parse(text);
     }
-    catch {
+    catch (cause) {
+        // Invalid JSON is represented by the null return.
+        void cause;
         return null;
     }
     const properties = new Map();
@@ -76,7 +79,8 @@ export const inferJsonShape = (text) => {
             types: [...value.types].sort(),
             observations: value.observations,
         }))
-            .sort((left, right) => left.path.localeCompare(right.path)),
+            .sort((left, right) => left.path.localeCompare(right.path) ||
+            compareCodePoints(left.path, right.path)),
     });
 };
 const jsonValueType = (value) => {

package/dist/domain/managedMemberComparison.js

@@ -97,6 +97,7 @@ const methodComparisonItemSchema = comparisonItemSchema({
     ...comparisonItemContextShape,
     item_id: prefixedDigestSchema("mmc_method"),
     dimensions: z.array(z.enum([
+        "metadata",
         "signature",
         "cil",
         "opcode-shape",

package/dist/domain/managedMemberComparisonItems.js

@@ -2,6 +2,8 @@ import canonicalize from "canonicalize";
 import { sha256, } from "./managedMemberComparisonMatch.js";
 const methodDimensions = (left, right) => {
     const dimensions = [];
+    if (left.flags !== right.flags || left.impl_flags !== right.impl_flags)
+        dimensions.push("metadata");
     if (left.signature.raw_sha256 !== right.signature.raw_sha256)
         dimensions.push("signature");
     const leftBodyComplete = left.body.status === "present" && left.body.truncated_instructions === 0;

package/dist/domain/managedNativeVerificationMatch.js

@@ -65,8 +65,10 @@ export const collectNativeSymbols = (observations) => {
     }
     return { symbols, accepted, unsupported };
 };
-const normalizeSymbol = (value) => value.replace(/^_+/u, "");
-const sameSymbolName = (left, right) => normalizeSymbol(left) === normalizeSymbol(right);
+const sameSymbolName = (expected, native) => expected ===
+    (native.source === "macho-export" && native.name.startsWith("_")
+        ? native.name.slice(1)
+        : native.name);
 const normalizeModule = (value) => basename(value)
     .toLowerCase()
     .replace(/^lib/u, "")
@@ -96,7 +98,7 @@ const candidateNames = (managed) => {
 };
 const matchPinvoke = (managed, symbols, supportedNativeEvidence) => {
     const names = candidateNames(managed);
-    const allCandidates = symbols.filter((symbol) => names.some((name) => sameSymbolName(name, symbol.name)));
+    const allCandidates = symbols.filter((symbol) => names.some((name) => sameSymbolName(name, symbol)));
     const [first, ...remaining] = allCandidates;
     if (first === undefined)
         return {

package/dist/domain/nativeDataType.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { nativeMetadataRecoverySchema } from "./nativeMetadataRecovery.js";
 /** Select a database type by exact category path or a defined typed data address. */
 export const nativeDataTypeInputSchema = z
     .strictObject({
@@ -48,4 +49,5 @@ export const nativeDataTypeSchema = z.strictObject({
     total_fields: z.number().int().nonnegative(),
     truncated: z.boolean(),
     limitations: z.array(z.string()),
+    metadata_recovery: nativeMetadataRecoverySchema.optional(),
 });

package/dist/domain/nativeFunctionAnnotations.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+import { functionDossierSchema } from "./hopperValues.js";
+/** One explicit function's analyst-authored metadata changes. */
+export const nativeFunctionAnnotationsInputSchema = z
+    .strictObject({
+    procedure: z.string().min(1),
+    name: z.string().min(1).optional(),
+    comment: z
+        .string()
+        .optional()
+        .describe("Regular entry comment; empty text clears it"),
+    inline_comment: z
+        .string()
+        .optional()
+        .describe("Inline entry comment; empty text clears it"),
+})
+    .refine((value) => value.name !== undefined ||
+    value.comment !== undefined ||
+    value.inline_comment !== undefined, "Supply at least one annotation change");
+/** Readback and refreshed analysis after one atomic metadata edit. */
+export const nativeFunctionAnnotationsSchema = z
+    .strictObject({
+    annotations: z.strictObject({
+        address: z.string().min(1),
+        name: z.string().min(1),
+        comment: z.string().nullable(),
+        inline_comment: z.string().nullable(),
+    }),
+    dossier: functionDossierSchema,
+    effects: z.strictObject({
+        scope: z.literal("session-analysis-database"),
+        source_bytes_modified: z.literal(false),
+        persists_after_close: z.literal(false),
+    }),
+})
+    .superRefine((value, context) => {
+    if (value.annotations.address !== value.dossier.procedure.address ||
+        value.annotations.name !== value.dossier.procedure.name)
+        context.addIssue({
+            code: "custom",
+            message: "Annotation readback disagrees with refreshed function identity",
+        });
+});

package/dist/domain/nativeLoadImage.js

@@ -0,0 +1,95 @@
+import { z } from "zod";
+import { nativeMetadataRecoverySummarySchema } from "./nativeMetadataRecovery.js";
+import { jsonValueSchema } from "./jsonValue.js";
+const integer = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+const digest = z.string().regex(/^[a-f0-9]{64}$/u);
+const hexBytes = z.string().regex(/^(?:[a-f0-9]{2})*$/u);
+const address = z.string().min(1);
+/** Measured provider image, without exporting the complete executable bytes. */
+export const nativeLoadImageObservationSchema = z.strictObject({
+    metadata_recovery: z.array(nativeMetadataRecoverySummarySchema).optional(),
+    executable_format: z.string().min(1),
+    language_id: z.string().min(1),
+    compiler_spec_id: z.string().min(1),
+    image_base: address,
+    default_address_space: z.string().min(1),
+    source_files: z.array(z.strictObject({
+        name: z.string(),
+        size: integer,
+        original_sha256: digest,
+        modified_sha256: digest,
+    })),
+    mappings: z.array(z.strictObject({
+        block: z.string(),
+        start: address,
+        end: address,
+        address_space: z.string().min(1),
+        initialized: z.boolean(),
+        loaded: z.boolean(),
+        overlay: z.boolean(),
+        length: integer.min(1),
+        source_file_index: integer.nullable(),
+        file_offset: integer.nullable(),
+        sha256: digest.nullable(),
+    })),
+    relocations: z.array(z.strictObject({
+        address,
+        segment: integer.max(0xffff).nullable(),
+        offset: integer.max(0xffff).nullable(),
+        status: z.string().min(1),
+        type: z.number().int(),
+        values: z.array(z
+            .number()
+            .int()
+            .min(Number.MIN_SAFE_INTEGER)
+            .max(Number.MAX_SAFE_INTEGER)),
+        original_bytes_hex: hexBytes.nullable(),
+        memory_bytes_hex: hexBytes.nullable(),
+    })),
+    entry_points: z.array(address),
+    entry_context: z.array(z.strictObject({
+        address,
+        registers: z.array(z.strictObject({
+            name: z.string().min(1),
+            value_hex: z
+                .string()
+                .regex(/^0x[a-f0-9]+$/u)
+                .nullable(),
+        })),
+    })),
+});
+/** Independent comparison, preserving both expectations and measured values. */
+export const nativeLoadImageCheckSchema = z.strictObject({
+    name: z.string().min(1),
+    matched: z.boolean(),
+    expected: jsonValueSchema,
+    observed: jsonValueSchema,
+    file_offset: integer.nullable(),
+    address: address.nullable(),
+});
+/** Read-only native image verification; verified applies only to declared coverage. */
+export const nativeLoadImageSchema = z.discriminatedUnion("status", [
+    z.strictObject({
+        status: z.literal("unsupported"),
+        reason: z.string().min(1),
+        observations: nativeLoadImageObservationSchema,
+        limitations: z.array(z.string().min(1)),
+    }),
+    z.strictObject({
+        status: z.enum(["verified", "mismatch"]),
+        format: z.enum(["dos-mz", "dos-com"]),
+        target_sha256: digest,
+        load_segment: integer.max(0xffff),
+        header_bytes: integer,
+        module_bytes: integer,
+        overlay_bytes: integer,
+        entry: z.strictObject({
+            relative_segment: integer.max(0xffff),
+            offset: integer.max(0xffff),
+            linear_address: address,
+        }),
+        observations: nativeLoadImageObservationSchema,
+        checks: z.array(nativeLoadImageCheckSchema),
+        limitations: z.array(z.string().min(1)),
+    }),
+]);

package/dist/domain/nativeMetadataRecovery.js

@@ -0,0 +1,55 @@
+import { z } from "zod";
+const address = z.string().regex(/^0x[0-9a-f]+$/u);
+const relatedType = z.strictObject({ address, type: z.string().nullable() });
+/** Runtime-format metadata recovered in an analysis image, with explicit inference boundaries. */
+export const nativeMetadataRecoverySchema = z.strictObject({
+    format: z.literal("dotnet-nativeaot"),
+    status: z.enum(["complete", "partial"]),
+    header_address: address,
+    format_major: z.number().int().nonnegative(),
+    format_minor: z.number().int().nonnegative(),
+    method_table_address: address,
+    name_origin: z.enum(["generated", "inferred"]),
+    original_name: z.null(),
+    base_size_bytes: z.number().int().nonnegative(),
+    related_type: relatedType.nullable(),
+    interfaces: z.array(relatedType),
+    virtual_slots: z.array(z.strictObject({
+        slot: z.number().int().nonnegative(),
+        slot_address: address,
+        target_address: address.nullable(),
+        procedure_name: z.string().nullable(),
+        basis: z.literal("method-table-pointer"),
+    })),
+    derived_memory: z.strictObject({
+        address,
+        size_bytes: z.number().int().nonnegative(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+        file_offset: z.null(),
+    }),
+    diagnostics: z.array(z.string()),
+    limitations: z.array(z.string()),
+});
+/** Discover a recovered runtime format and reusable type identities from the loaded image. */
+export const nativeMetadataRecoverySummarySchema = z.strictObject({
+    format: z.literal("dotnet-nativeaot"),
+    status: z.enum(["complete", "partial", "not_applicable"]),
+    reason: z.string().nullable(),
+    analysis_artifact_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    header_address: address.nullable(),
+    discovery: z.enum(["symbol", "signature-heuristic"]).nullable(),
+    format_major: z.number().int().nonnegative().nullable(),
+    format_minor: z.number().int().nonnegative().nullable(),
+    method_tables: z.number().int().nonnegative(),
+    types: z.array(relatedType),
+    derived_memory: nativeMetadataRecoverySchema.shape.derived_memory.nullable(),
+    coverage: z
+        .strictObject({
+        frozen_object_candidates: z.number().int().nonnegative(),
+        frozen_objects_annotated: z.number().int().nonnegative(),
+        basis: z.literal("rehydrated-pointer-candidates-and-committed-instance-types"),
+    })
+        .nullable(),
+    diagnostics: z.array(z.string()),
+    limitations: z.array(z.string()),
+});

package/dist/domain/processCapture.js

@@ -175,4 +175,3 @@ export const processCaptureSchema = processCaptureShapeSchema.superRefine((captu
 });
 export { parseProcessCapture } from "./processCaptureParsing.js";
 export { compareProcessCaptures, comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./processComparison.js";
-export { compareProcessTraces, processTraceComparisonResultSchema, processTraceSourceSchema, processTraceSpecificationSchema, } from "./processTraceComparison.js";

package/dist/domain/processEvidenceProvider.js

@@ -0,0 +1,11 @@
+/** Canonical provider identity for controlled process capture Evidence. */
+export const PROCESS_PROVIDER = {
+    id: "rea-process",
+    name: "REA process capture",
+    version: "3",
+};
+/** Admit current and previously emitted names for the same v3 process provider. */
+export const isProcessEvidenceProvider = (provider) => provider.id === PROCESS_PROVIDER.id &&
+    provider.version === PROCESS_PROVIDER.version &&
+    (provider.name === PROCESS_PROVIDER.name ||
+        provider.name === "REA deterministic process harness");

package/dist/domain/processTraceComparison.js

@@ -1,7 +1,7 @@
 import { evaluateProcessTraceSide, processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
 import { processTraceSpecificationSchema, } from "./processTraceSpecification.js";
 export { processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
-export { processTraceSourceSchema, processTraceSpecificationSchema, } from "./processTraceSpecification.js";
+export { processTraceSpecificationSchema, } from "./processTraceSpecification.js";
 /** Compare two captures against an explicit finite trace language. */
 export const compareProcessTraces = (left, right, specificationInput) => {
     const specification = processTraceSpecificationSchema.parse(specificationInput);

package/dist/domain/providerAdapterError.js

@@ -0,0 +1,17 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** A provider adapter failed outside its more precise typed variants. */
+export class ProviderAdapterError extends AnalysisError {
+    providerId;
+    operation;
+    _tag = "ProviderAdapterError";
+    diagnostics;
+    constructor(providerId, operation, options = {}) {
+        super(`Provider ${providerId} adapter failed during ${operation}`, options);
+        this.providerId = providerId;
+        this.operation = operation;
+        this.diagnostics =
+            options.diagnostics === undefined
+                ? undefined
+                : structuredClone(options.diagnostics);
+    }
+}

package/dist/domain/providerCleanupError.js

@@ -1,4 +1,4 @@
-import { ProviderAdapterError } from "./errors.js";
+import { ProviderAdapterError } from "./providerAdapterError.js";
 /** Provider resources could not be proven closed after bounded cleanup. */
 export class ProviderCleanupError extends ProviderAdapterError {
     cleanupIncomplete = true;

package/dist/domain/providerSelectionError.js

@@ -0,0 +1,44 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** No configured provider can satisfy a requested operation or target binding. */
+export class ProviderSelectionError extends AnalysisError {
+    _tag = "ProviderSelectionError";
+    operation;
+    reason;
+    requestedProviderId;
+    candidateIds;
+    rejections;
+    userMessage;
+    constructor(options) {
+        const operation = options.operation ?? "open_binary";
+        super(providerSelectionDiagnostic(options));
+        this.operation = operation;
+        this.reason = options.reason;
+        this.requestedProviderId = options.requestedProviderId;
+        this.candidateIds = [...options.candidateIds];
+        this.rejections = [...(options.rejections ?? [])].map((rejection) => ({
+            ...rejection,
+            diagnostics: structuredClone(rejection.diagnostics),
+        }));
+        this.userMessage = providerSelectionUserMessage(options);
+    }
+}
+const providerSelectionDiagnostic = (options) => {
+    const candidates = options.candidateIds.length === 0
+        ? "none"
+        : options.candidateIds.join(", ");
+    return `Analysis provider selection failed (${options.reason}) for ${options.requestedProviderId}; candidates: ${candidates}`;
+};
+const providerSelectionUserMessage = (options) => {
+    switch (options.reason) {
+        case "ambiguous":
+            return "Multiple analysis providers support this target. Choose one with provider_id, --provider, or REA_ANALYSIS_PROVIDER.";
+        case "unknown_provider":
+            return `The requested analysis provider is unknown. Choose one of: ${options.candidateIds.join(", ") || "no configured providers"}.`;
+        case "provider_unavailable":
+            return "The selected analysis provider is unavailable. Review the reported local diagnostics or run `rea doctor`, then retry.";
+        case "target_unsupported":
+            return "The selected analysis provider does not support this target. Choose another provider or open a supported extracted binary.";
+        case "invalid_options":
+            return "The analysis provider selection or open options are invalid. Correct them and try again.";
+    }
+};

package/dist/domain/reconstructionUnknowns.js

@@ -1,3 +1,4 @@
+import { uniqueSorted } from "./canonicalOrdering.js";
 /** Select the latest revision of each residual unknown. */
 export const reconstructionUnknownHeads = (revisions) => {
     const heads = new Map();
@@ -87,4 +88,3 @@ const defaultProbe = (kind) => kind === "behavioral"
             operation: "inspect_artifact",
             rationale: "Capture complete artifact inventories under equal limits.",
         };
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));

package/dist/domain/reconstructionVerification.js

@@ -3,9 +3,11 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { artifactInventoryResultSchema } from "./artifactGraph.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
 import { parseEvidence } from "./evidence.js";
 import { parseEvidenceBundle } from "./evidenceBundle.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./processEvidenceProvider.js";
 import { functionDossierSchema } from "./hopperValues.js";
 import { deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, processCaptureSchema, } from "./processCapture.js";
 import { reconstructionClaimResultSchema, reconstructionSpecificationSchema, reconstructionVerificationResultSchema, } from "./reconstructionVerificationSchemas.js";
@@ -17,8 +19,7 @@ const providers = {
     behavioral: {
         operation: "compare_process_captures",
         predicates: ["rea.process-comparison"],
-        id: "rea-process",
-        name: "REA deterministic process harness",
+        ...PROCESS_PROVIDER,
     },
     "structural-function": {
         operation: "compare_functions",
@@ -136,9 +137,11 @@ const validateComparisonIdentity = (claim, evidence) => {
     const expected = providers[claim.kind];
     if (evidence.operation !== expected.operation ||
         !acceptsPredicate(expected.predicates, evidence.predicate_type) ||
-        evidence.provider.id !== expected.id ||
-        evidence.provider.name !== expected.name ||
-        evidence.provider.version !== (claim.kind === "behavioral" ? "3" : "1") ||
+        (claim.kind === "behavioral"
+            ? !isProcessEvidenceProvider(evidence.provider)
+            : evidence.provider.id !== expected.id ||
+                evidence.provider.name !== expected.name ||
+                evidence.provider.version !== "1") ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null)
@@ -146,7 +149,10 @@ const validateComparisonIdentity = (claim, evidence) => {
 };
 const sourceSides = (claim, evidence) => {
     const parameters = evidence.parameters;
-    if (claim.kind === "behavioral") {
+    let singularSides;
+    if (claim.kind === "behavioral" ||
+        (claim.kind === "structural-function" &&
+            ("left_evidence_id" in parameters || "right_evidence_id" in parameters))) {
         const parsed = z
             .object({
             left_evidence_id: evidenceIdSchema,
@@ -154,10 +160,13 @@ const sourceSides = (claim, evidence) => {
         })
             .passthrough()
             .parse(parameters);
-        return {
+        singularSides = {
             left: [parsed.left_evidence_id],
             right: [parsed.right_evidence_id],
         };
+        if (claim.kind === "behavioral" ||
+            !("left_evidence_ids" in parameters || "right_evidence_ids" in parameters))
+            return singularSides;
     }
     const parsed = z
         .object({
@@ -166,6 +175,12 @@ const sourceSides = (claim, evidence) => {
     })
         .passthrough()
         .parse(parameters);
+    if (singularSides !== undefined &&
+        (parsed.left_evidence_ids.length !== 1 ||
+            parsed.right_evidence_ids.length !== 1 ||
+            parsed.left_evidence_ids[0] !== singularSides.left[0] ||
+            parsed.right_evidence_ids[0] !== singularSides.right[0]))
+        throw new TypeError("Function comparison source Evidence aliases disagree");
     return { left: parsed.left_evidence_ids, right: parsed.right_evidence_ids };
 };
 const observedStatus = (claim, evidence) => {
@@ -237,4 +252,3 @@ const digest = (value) => {
 const count = (items, status) => items.filter((item) => item.status === status).length;
 const sameSet = (left, right) => left.length === right.length &&
     uniqueSorted(left).every((id, index) => id === uniqueSorted(right)[index]);
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));

package/dist/domain/referenceSourceClassification.js

@@ -101,7 +101,7 @@ const MANIFEST_FILENAMES = new Set([
     "pipfile.lock",
     "setup.cfg",
     "manifest.in",
-    "CMakeLists.txt",
+    "cmakelists.txt",
     "meson.build",
     "configure",
     "configure.ac",
@@ -272,7 +272,8 @@ const filenameIsTest = (filename) => {
         return true;
     if (lower.endsWith("_test") || lower.endsWith("_spec"))
         return true;
-    return false;
+    const stem = basenameParts(lower).base;
+    return stem.endsWith("_test") || stem.endsWith("_spec");
 };
 const filenameIsGenerated = (filename) => {
     const lower = filename.toLowerCase();
@@ -312,11 +313,9 @@ const isPathUnderAny = (path, names) => {
 /** Detect a source language from a POSIX path. */
 export const detectReferenceSourceLanguage = (path) => {
     const filename = posix.basename(path);
-    if (filename === "Dockerfile" || filename.startsWith("Dockerfile."))
-        return "Dockerfile";
-    if (filename.toLowerCase().startsWith("dockerfile"))
-        return "Dockerfile";
     const lower = filename.toLowerCase();
+    if (lower === "dockerfile" || lower.startsWith("dockerfile."))
+        return "Dockerfile";
     if (lower.endsWith(".d.ts"))
         return "TypeScript";
     if (lower.endsWith(".d.mts"))

package/dist/domain/referenceSourceGraph.js

@@ -1,7 +1,6 @@
-import { createHash } from "node:crypto";
 import { posix } from "node:path";
-import canonicalize from "canonicalize";
 import { z } from "zod";
+import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -184,13 +183,6 @@ const historicalSourceManifestBaseSchema = z.strictObject({
 });
 /** Stable identity used to sort and deduplicate source parse failures. */
 export const historicalSourceParseFailureKey = (failure) => `${failure.path}\u0000${failure.parser}\u0000${failure.reason}`;
-const canonicalJson = (value) => {
-    const serialized = canonicalize(value);
-    if (serialized === undefined)
-        throw new TypeError("RFC 8785 canonicalization rejected a graph value");
-    return serialized;
-};
-const digestCanonical = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
 const relationshipKey = (relationship) => `${relationship.from_path}\u0000${relationship.to}\u0000${relationship.kind}\u0000${relationship.resolution}\u0000${relationship.parse_state}`;
 const checkSortedUnique = (values, field, context) => {
     for (let index = 1; index < values.length; index += 1)
@@ -293,15 +285,15 @@ function checkGraphInvariants(graph, context) {
     checkSortedUnique(graph.relationships.map(relationshipKey), "relationships", context);
     checkSortedUnique(graph.parse_failures.map(historicalSourceParseFailureKey), "parse_failures", context);
     checkSortedUnique(graph.exclusions.map(({ path, reason }) => `${path}\u0000${reason}`), "exclusions", context);
-    if (canonicalJson(graph.languages) !==
-        canonicalJson(historicalSourceLanguages(graph.entries)))
+    if (canonicalJson(graph.languages, "Reference source graph") !==
+        canonicalJson(historicalSourceLanguages(graph.entries), "Reference source graph"))
         context.addIssue({
             code: "custom",
             message: "languages must be derived from file entries",
             path: ["languages"],
         });
-    if (canonicalJson(graph.manifests) !==
-        canonicalJson(historicalSourceManifests(graph.entries)))
+    if (canonicalJson(graph.manifests, "Reference source graph") !==
+        canonicalJson(historicalSourceManifests(graph.entries), "Reference source graph"))
         context.addIssue({
             code: "custom",
             message: "manifests must be derived from classified file entries",
@@ -340,7 +332,7 @@ const rootCommitment = (entries, exclusions) => ({
     }),
     exclusions,
 });
-const computeRootSha256 = (entries, exclusions) => digestCanonical(rootCommitment(entries, exclusions));
+const computeRootSha256 = (entries, exclusions) => canonicalDigest(rootCommitment(entries, exclusions), "Reference source graph");
 /** Build and internally commit a normalized historical source graph. */
 export const createHistoricalSourceGraph = (input) => {
     const parsed = historicalSourceGraphInputSchema.parse(input);
@@ -352,7 +344,7 @@ export const createHistoricalSourceGraph = (input) => {
 /** Parse a graph and reject stale or caller-invented root commitments. */
 export const parseHistoricalSourceGraph = (input) => historicalSourceGraphSchema.parse(input);
 /** Compute a deterministic graph commitment containing no absolute root path. */
-export const computeHistoricalSourceGraphSha256 = (input) => digestCanonical(parseHistoricalSourceGraph(input));
+export const computeHistoricalSourceGraphSha256 = (input) => canonicalDigest(parseHistoricalSourceGraph(input), "Reference source graph");
 /** Build a deterministic, relocation-independent manifest for a source graph. */
 export const createHistoricalSourceManifest = (input) => {
     const graph = parseHistoricalSourceGraph(input);
@@ -367,14 +359,14 @@ export const createHistoricalSourceManifest = (input) => {
     };
     return historicalSourceManifestBaseSchema.parse({
         ...semantic,
-        manifest_id: `hsm_${digestCanonical(semantic)}`,
+        manifest_id: `hsm_${canonicalDigest(semantic, "Reference source graph")}`,
     });
 };
 /** Parse and verify a historical source manifest's semantic identifier. */
 export const parseHistoricalSourceManifest = (input) => {
     const manifest = historicalSourceManifestBaseSchema.parse(input);
     const { manifest_id: manifestId, ...semantic } = manifest;
-    if (`hsm_${digestCanonical(semantic)}` !== manifestId)
+    if (`hsm_${canonicalDigest(semantic, "Reference source graph")}` !== manifestId)
         throw new TypeError("Historical source manifest identifier does not match");
     return manifest;
 };