rea-agents 4.0.1 → 5.0.0

package/dist/domain/{objcSwiftMetadata.js → native/objcSwiftMetadata.js}

@@ -133,6 +133,22 @@ export const objcDispatchImplementationSchema = z.strictObject({
     selector: z.string().min(1),
     method_type: z.enum(["instance", "class"]),
     implementation_address: z.string().nullable(),
+    /** Category that adds this method, when it is not defined by the class itself. */
+    category: z.string().nullable().optional(),
+    location: nativeMetadataLocationSchema,
+    decode: nativeMetadataDecodeSchema,
+    evidence: z.array(nativeMetadataEvidenceSchema).min(1),
+});
+/** Objective-C category: methods, protocols and properties added to a class. */
+export const objcCategorySchema = z.strictObject({
+    name: z.string().min(1),
+    /** Extended class; external classes come from the category's bind symbol. */
+    class_name: z.string().min(1).nullable(),
+    class_source: z.enum(["local", "external", "unresolved"]),
+    instance_methods: z.array(z.string()),
+    class_methods: z.array(z.string()),
+    protocols: z.array(z.string()),
+    properties: z.array(objcPropertySchema),
     location: nativeMetadataLocationSchema,
     decode: nativeMetadataDecodeSchema,
     evidence: z.array(nativeMetadataEvidenceSchema).min(1),
@@ -240,6 +256,7 @@ export const dbSaveResultSchema = z.strictObject({
 export const objcSwiftMetadataSchema = z.strictObject({
     objc_classes: z.array(objcClassSchema).default([]),
     objc_protocols: z.array(objcProtocolSchema).default([]),
+    objc_categories: z.array(objcCategorySchema).default([]),
     swift_decls: z.array(swiftDeclSchema).default([]),
     objc_ivars: z.array(objcIvarSchema).default([]),
     objc_protocol_records: z.array(objcProtocolRecordSchema).default([]),

package/dist/domain/processCapture.js

@@ -165,14 +165,15 @@ const processCaptureShapeSchema = z.strictObject({
     }),
 });
 /** Exact serialized shape plus all process-capture semantic invariants. */
-export const processCaptureSchema = processCaptureShapeSchema.superRefine((capture, context) => {
+export const processCaptureSchema = processCaptureShapeSchema
+    .superRefine((capture, context) => {
     for (const issue of collectProcessCaptureIssues(capture))
         context.addIssue({
             code: "custom",
             path: issue.path.split("."),
             message: issue.message,
         });
-});
+})
+    .describe("The capture must preserve its canonical scenario, comparison, and normalization SHA-256 commitments; ordered capture timestamps and contiguous sequence numbers; before and final filesystem snapshots with truncation propagated; and exit-code consistency with deadline termination. When parsing older input without an event journal, REA supplies an empty journal; empty journals are valid. A non-empty journal must reference every captured observation exactly once with unique in-range references. These cross-field invariants are checked by REA after capture.");
 export { parseProcessCapture } from "./processCaptureParsing.js";
 export { compareProcessCaptures, comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./processComparison.js";
-export { compareProcessTraces, processTraceComparisonResultSchema, processTraceSourceSchema, processTraceSpecificationSchema, } from "./processTraceComparison.js";

package/dist/domain/processEvidenceProvider.js

@@ -0,0 +1,11 @@
+/** Canonical provider identity for controlled process capture Evidence. */
+export const PROCESS_PROVIDER = {
+    id: "rea-process",
+    name: "REA process capture",
+    version: "3",
+};
+/** Admit current and previously emitted names for the same v3 process provider. */
+export const isProcessEvidenceProvider = (provider) => provider.id === PROCESS_PROVIDER.id &&
+    provider.version === PROCESS_PROVIDER.version &&
+    (provider.name === PROCESS_PROVIDER.name ||
+        provider.name === "REA deterministic process harness");

package/dist/domain/processScenario.js

@@ -3,10 +3,18 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 const positiveBudget = z.number().int().safe().positive();
 const timedEventBase = { at_ms: z.number().int().safe().nonnegative() };
+const reservedRunIdEnvironmentName = "REA_PROCESS_RUN_ID";
 const environmentName = z
     .string()
-    .regex(/^[^=\0]+$/u, "Environment names cannot contain '=' or NUL");
-const reservedEnvironment = new Set(["REA_PROCESS_RUN_ID"]);
+    .min(1, "Environment names must not be empty")
+    .regex(/^(?!REA_PROCESS_RUN_ID(?![\s\S]))[^=\0]+$/u, {
+    error: (issue) => issue.input === reservedRunIdEnvironmentName
+        ? `${reservedRunIdEnvironmentName} is reserved by the process adapter`
+        : "Environment names cannot contain '=' or NUL",
+});
+const childProcessString = z
+    .string()
+    .regex(/^[^\0]*$/u, "Values passed to operating-system APIs cannot contain NUL");
 export const normalizationSchema = z.object({
     paths: z.boolean(),
     pids: z.boolean(),
@@ -61,11 +69,13 @@ export const processComparisonContract = (scenario) => ({
  */
 export const processScenarioSchema = z
     .object({
-    executable: z.string().min(1),
-    arguments: z.array(z.string()).default([]),
-    working_directory: z.string().default("."),
-    environment: z.record(environmentName, z.string()).default({}),
-    filesystem_observation_paths: z.array(z.string().min(1)).default([]),
+    executable: childProcessString.min(1),
+    arguments: z.array(childProcessString).default([]),
+    working_directory: childProcessString.default("."),
+    environment: z.record(environmentName, childProcessString).default({}),
+    filesystem_observation_paths: z
+        .array(childProcessString.min(1))
+        .default([]),
     terminal: z
         .object({
         columns: z.number().int().min(1).max(65_535).default(80),
@@ -147,16 +157,6 @@ export const processScenarioSchema = z
             });
         }
     }
-    const explicit = new Set(Object.keys(scenario.environment));
-    for (const name of explicit) {
-        if (reservedEnvironment.has(name)) {
-            context.addIssue({
-                code: "custom",
-                message: `${name} is reserved by the process adapter`,
-                path: ["environment", name],
-            });
-        }
-    }
     for (const event of scenario.events) {
         if (event.at_ms > scenario.timeout_ms) {
             context.addIssue({

package/dist/domain/processTraceComparison.js

@@ -1,7 +1,7 @@
 import { evaluateProcessTraceSide, processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
 import { processTraceSpecificationSchema, } from "./processTraceSpecification.js";
 export { processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
-export { processTraceSourceSchema, processTraceSpecificationSchema, } from "./processTraceSpecification.js";
+export { processTraceSpecificationSchema, } from "./processTraceSpecification.js";
 /** Compare two captures against an explicit finite trace language. */
 export const compareProcessTraces = (left, right, specificationInput) => {
     const specification = processTraceSpecificationSchema.parse(specificationInput);

package/dist/domain/propertyListKeys.js

@@ -0,0 +1,69 @@
+import { parse } from "plist";
+/** The dictionary key REA results cannot carry: validation strips it. */
+const PROTOTYPE_KEY = "__proto__";
+/** Limitation for results whose source plist held `__proto__` entries. */
+export const omittedPrototypeKeysLimitation = (count) => `${String(count)} dictionary ${count === 1 ? "entry" : "entries"} keyed __proto__ ${count === 1 ? "was" : "were"} omitted because REA results cannot represent that key.`;
+const withoutKey = (value, key) => {
+    let omitted = 0;
+    const strip = (item) => {
+        if (Array.isArray(item))
+            return item.map(strip);
+        if (item === null ||
+            typeof item !== "object" ||
+            item instanceof Date ||
+            item instanceof Uint8Array)
+            return item;
+        return Object.fromEntries(Object.entries(item).flatMap(([name, entry]) => {
+            if (name !== key)
+                return [[name, strip(entry)]];
+            omitted += 1;
+            return [];
+        }));
+    };
+    const stripped = strip(value);
+    return { value: stripped, omittedPrototypeKeys: omitted };
+};
+/** Remove own `__proto__` entries, such as JSON.parse creates, and count them. */
+export const omitPrototypeKeys = (value) => withoutKey(value, PROTOTYPE_KEY);
+// Comments and CDATA text are consumed whole so only element keys match.
+const KEY_TOKEN = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<key>([^<]*)<\/key>|<key><!\[CDATA\[([\s\S]*?)\]\]><\/key>/gu;
+const XML_ENTITIES = {
+    amp: "&",
+    apos: "'",
+    gt: ">",
+    lt: "<",
+    quot: '"',
+};
+/**
+ * Expand XML character and predefined entity references. A reference beyond
+ * Unicode stays as written: comments and CDATA may hold such text literally,
+ * and the XML decoder rejects it anywhere else.
+ */
+const decodeXmlText = (text) => text.replace(/&(?:#x([\da-f]+)|#(\d+)|([a-z]+));/giu, (entity, hex, decimal, name) => {
+    const codePoint = hex !== undefined
+        ? parseInt(hex, 16)
+        : decimal !== undefined
+            ? parseInt(decimal, 10)
+            : undefined;
+    if (codePoint !== undefined)
+        return codePoint <= 0x10ffff ? String.fromCodePoint(codePoint) : entity;
+    return (name === undefined ? undefined : XML_ENTITIES[name]) ?? entity;
+});
+/**
+ * Decode an XML plist whose dictionaries may use the legal key `__proto__`,
+ * which the `plist` decoder rejects outright. Those entries are omitted and
+ * counted so callers can report them instead of failing the whole document.
+ */
+export const parseXmlPropertyList = (text) => {
+    // The decoded text holds every key the decoder can produce, including
+    // entity-encoded spellings of the placeholder, so no source key aliases it.
+    // Decoding comment or CDATA text too can only lengthen the placeholder.
+    const decoded = decodeXmlText(text);
+    let placeholder = "__rea_prototype_key__";
+    while (decoded.includes(placeholder))
+        placeholder = `_${placeholder}`;
+    const substituted = text.replace(KEY_TOKEN, (token, plain, cdata) => (plain === undefined ? cdata : decodeXmlText(plain)) === PROTOTYPE_KEY
+        ? `<key>${placeholder}</key>`
+        : token);
+    return withoutKey(parse(substituted), placeholder);
+};

package/dist/domain/providerAdapterError.js

@@ -0,0 +1,17 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** A provider adapter failed outside its more precise typed variants. */
+export class ProviderAdapterError extends AnalysisError {
+    providerId;
+    operation;
+    _tag = "ProviderAdapterError";
+    diagnostics;
+    constructor(providerId, operation, options = {}) {
+        super(`Provider ${providerId} adapter failed during ${operation}`, options);
+        this.providerId = providerId;
+        this.operation = operation;
+        this.diagnostics =
+            options.diagnostics === undefined
+                ? undefined
+                : structuredClone(options.diagnostics);
+    }
+}

package/dist/domain/providerCleanupError.js

@@ -1,11 +1,14 @@
-import { ProviderAdapterError } from "./errors.js";
+import { ProviderAdapterError } from "./providerAdapterError.js";
 /** Provider resources could not be proven closed after bounded cleanup. */
 export class ProviderCleanupError extends ProviderAdapterError {
     cleanupIncomplete = true;
     cleanupResources;
     userMessage = "Provider cleanup could not be fully confirmed. Review the reported local resources before opening another target.";
-    constructor(providerId, resources, diagnostics, options) {
-        super(providerId, "close_binary", { ...options, diagnostics });
+    constructor(providerId, resources, diagnostics, 
+    /** Identify the operation owning these resources; binary callers retain their default. */
+    options) {
+        const { operation = "close_binary", ...errorOptions } = options ?? {};
+        super(providerId, operation, { ...errorOptions, diagnostics });
         this.cleanupResources = [...resources];
     }
 }

package/dist/domain/providerSelectionError.js

@@ -0,0 +1,44 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** No configured provider can satisfy a requested operation or target binding. */
+export class ProviderSelectionError extends AnalysisError {
+    _tag = "ProviderSelectionError";
+    operation;
+    reason;
+    requestedProviderId;
+    candidateIds;
+    rejections;
+    userMessage;
+    constructor(options) {
+        const operation = options.operation ?? "open_binary";
+        super(providerSelectionDiagnostic(options));
+        this.operation = operation;
+        this.reason = options.reason;
+        this.requestedProviderId = options.requestedProviderId;
+        this.candidateIds = [...options.candidateIds];
+        this.rejections = [...(options.rejections ?? [])].map((rejection) => ({
+            ...rejection,
+            diagnostics: structuredClone(rejection.diagnostics),
+        }));
+        this.userMessage = providerSelectionUserMessage(options);
+    }
+}
+const providerSelectionDiagnostic = (options) => {
+    const candidates = options.candidateIds.length === 0
+        ? "none"
+        : options.candidateIds.join(", ");
+    return `Analysis provider selection failed (${options.reason}) for ${options.requestedProviderId}; candidates: ${candidates}`;
+};
+const providerSelectionUserMessage = (options) => {
+    switch (options.reason) {
+        case "ambiguous":
+            return "Multiple analysis providers support this target. Choose one with provider_id, --provider, or REA_ANALYSIS_PROVIDER.";
+        case "unknown_provider":
+            return `The requested analysis provider is unknown. Choose one of: ${options.candidateIds.join(", ") || "no configured providers"}.`;
+        case "provider_unavailable":
+            return "The selected analysis provider is unavailable. Review the reported local diagnostics or run `rea doctor`, then retry.";
+        case "target_unsupported":
+            return "The selected analysis provider does not support this target. Choose another provider or open a supported extracted binary.";
+        case "invalid_options":
+            return "The analysis provider selection or open options are invalid. Correct them and try again.";
+    }
+};

package/dist/domain/reconstructionCoverageEvaluation.js

@@ -87,13 +87,14 @@ const evaluateOwner = (context, surfaceId) => {
 };
 export const evaluateReconstructionClaims = (context) => {
     const claims = indexUnique(context.coverage.claims, "claim_id");
+    const indexes = createVerifierIndexes(context.coverage);
     for (const claimId of context.boundary.required_claim_ids) {
         const claim = claims.get(claimId);
         if (claim === undefined) {
             addReason(context, "claim-missing", claimId, "Required finite claim is absent.");
             continue;
         }
-        const contracts = context.coverage.verifier_contracts.filter(({ claim_ids: ids }) => ids.includes(claimId));
+        const contracts = indexes.contractsByClaim.get(claimId) ?? [];
         if (contracts.length === 0) {
             addReason(context, "verifier-missing", claimId, "No verifier contract covers this claim.");
             continue;
@@ -104,20 +105,49 @@ export const evaluateReconstructionClaims = (context) => {
         }
         const contract = contracts[0];
         if (contract !== undefined)
-            evaluateVerifierResult(context, claim, contract);
+            evaluateVerifierResult(context, claim, contract, indexes);
     }
 };
-const evaluateVerifierResult = (context, claim, contract) => {
-    const results = context.coverage.verifier_results
-        .filter(({ verifier_id: id }) => id === contract.verifier_id)
-        .sort((left, right) => Date.parse(right.observed_at) - Date.parse(left.observed_at));
-    const result = results[0];
+const createVerifierIndexes = (coverage) => {
+    const contractsByClaim = new Map();
+    for (const contract of coverage.verifier_contracts)
+        for (const claimId of new Set(contract.claim_ids)) {
+            const contracts = contractsByClaim.get(claimId) ?? [];
+            contracts.push(contract);
+            contractsByClaim.set(claimId, contracts);
+        }
+    const latestResultsByVerifier = new Map();
+    for (const result of coverage.verifier_results) {
+        const latest = latestResultsByVerifier.get(result.verifier_id);
+        // Stable descending sort used to choose the first input record on ties.
+        if (latest === undefined ||
+            Date.parse(result.observed_at) > Date.parse(latest.observed_at))
+            latestResultsByVerifier.set(result.verifier_id, result);
+    }
+    const ownersBySurface = new Map();
+    for (const owner of coverage.owners) {
+        const owners = ownersBySurface.get(owner.surface_id) ?? [];
+        owners.push(owner);
+        ownersBySurface.set(owner.surface_id, owners);
+    }
+    return {
+        contractsByClaim,
+        latestResultsByVerifier,
+        artifactDigests: new Set(coverage.artifacts.map(({ artifact_sha256: value }) => value)),
+        ownerDigests: new Set(coverage.owners.flatMap(({ ownership }) => ownership.disposition === "implemented" ? [ownership.owner_sha256] : [])),
+        surfaces: indexUnique(coverage.surfaces, "surface_id"),
+        artifacts: indexUnique(coverage.artifacts, "artifact_id"),
+        ownersBySurface,
+    };
+};
+const evaluateVerifierResult = (context, claim, contract, indexes) => {
+    const result = indexes.latestResultsByVerifier.get(contract.verifier_id);
     if (result === undefined) {
         addReason(context, "verifier-result-missing", claim.claim_id, "Verifier has no recorded result.");
         return;
     }
     addEvidence(context, result.evidence_ids);
-    if (!verifierResultIsCompatible(context, claim, contract, result)) {
+    if (!verifierResultIsCompatible(claim, contract, result, indexes)) {
         addReason(context, "verifier-result-incompatible", claim.claim_id, "Latest verifier result does not match current artifacts, owners, dimensions, authority, normalization, repeats, or contract.");
         return;
     }
@@ -132,23 +162,15 @@ const evaluateVerifierResult = (context, claim, contract) => {
     else if (result.status !== "pass")
         addReason(context, "verifier-unknown", claim.claim_id, `Latest compatible verifier result is ${result.status}.`);
 };
-const verifierResultIsCompatible = (context, claim, contract, result) => {
-    const artifactDigests = new Set(context.coverage.artifacts.map(({ artifact_sha256: value }) => value));
-    const ownerDigests = new Set(context.coverage.owners.flatMap(({ ownership }) => ownership.disposition === "implemented" ? [ownership.owner_sha256] : []));
-    const surfaces = new Map(context.coverage.surfaces.map((surface) => [surface.surface_id, surface]));
-    const artifacts = new Map(context.coverage.artifacts.map((artifact) => [
-        artifact.artifact_id,
-        artifact,
-    ]));
+const verifierResultIsCompatible = (claim, contract, result, indexes) => {
     const expectedArtifactDigests = claim.surface_ids.flatMap((surfaceId) => {
-        const surface = surfaces.get(surfaceId);
-        const artifact = surface === undefined ? undefined : artifacts.get(surface.artifact_id);
+        const surface = indexes.surfaces.get(surfaceId);
+        const artifact = surface === undefined
+            ? undefined
+            : indexes.artifacts.get(surface.artifact_id);
         return artifact === undefined ? [] : [artifact.artifact_sha256];
     });
-    const expectedOwnerDigests = context.coverage.owners.flatMap(({ surface_id: surfaceId, ownership }) => claim.surface_ids.includes(surfaceId) &&
-        ownership.disposition === "implemented"
-        ? [ownership.owner_sha256]
-        : []);
+    const expectedOwnerDigests = claim.surface_ids.flatMap((surfaceId) => (indexes.ownersBySurface.get(surfaceId) ?? []).flatMap(({ ownership }) => ownership.disposition === "implemented" ? [ownership.owner_sha256] : []));
     return (result.contract_sha256 === contract.contract_sha256 &&
         result.normalization_sha256 === contract.normalization_sha256 &&
         result.covered_claim_ids.includes(claim.claim_id) &&
@@ -156,9 +178,9 @@ const verifierResultIsCompatible = (context, claim, contract, result) => {
         claim.required_dimensions.every((item) => contract.dimensions.includes(item)) &&
         claim.required_dimensions.every((item) => result.covered_dimensions.includes(item)) &&
         result.covered_dimensions.every((item) => contract.dimensions.includes(item)) &&
-        result.artifact_sha256s.every((item) => artifactDigests.has(item)) &&
+        result.artifact_sha256s.every((item) => indexes.artifactDigests.has(item)) &&
         expectedArtifactDigests.every((item) => result.artifact_sha256s.includes(item)) &&
-        result.owner_sha256s.every((item) => ownerDigests.has(item)) &&
+        result.owner_sha256s.every((item) => indexes.ownerDigests.has(item)) &&
         expectedOwnerDigests.every((item) => result.owner_sha256s.includes(item)) &&
         result.repeats >= contract.minimum_repeats &&
         claim.required_authority === contract.authority);

package/dist/domain/reconstructionCoverageInput.js

@@ -0,0 +1,7 @@
+import { z } from "zod";
+import { reconstructionCoverageDataSchema } from "./reconstructionCoverage.js";
+/** Named-boundary input for inline reconstruction coverage evaluation. */
+export const reconstructionCoverageEvaluationInputSchema = z.strictObject({
+    coverage: reconstructionCoverageDataSchema,
+    boundary_id: z.string().min(1),
+});

package/dist/domain/reconstructionUnknowns.js

@@ -1,3 +1,4 @@
+import { uniqueSorted } from "./canonicalOrdering.js";
 /** Select the latest revision of each residual unknown. */
 export const reconstructionUnknownHeads = (revisions) => {
     const heads = new Map();
@@ -87,4 +88,3 @@ const defaultProbe = (kind) => kind === "behavioral"
             operation: "inspect_artifact",
             rationale: "Capture complete artifact inventories under equal limits.",
         };
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));

package/dist/domain/reconstructionVerification.js

@@ -3,9 +3,11 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { artifactInventoryResultSchema } from "./artifactGraph.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
 import { parseEvidence } from "./evidence.js";
 import { parseEvidenceBundle } from "./evidenceBundle.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./processEvidenceProvider.js";
 import { functionDossierSchema } from "./hopperValues.js";
 import { deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, processCaptureSchema, } from "./processCapture.js";
 import { reconstructionClaimResultSchema, reconstructionSpecificationSchema, reconstructionVerificationResultSchema, } from "./reconstructionVerificationSchemas.js";
@@ -17,8 +19,7 @@ const providers = {
     behavioral: {
         operation: "compare_process_captures",
         predicates: ["rea.process-comparison"],
-        id: "rea-process",
-        name: "REA deterministic process harness",
+        ...PROCESS_PROVIDER,
     },
     "structural-function": {
         operation: "compare_functions",
@@ -136,9 +137,11 @@ const validateComparisonIdentity = (claim, evidence) => {
     const expected = providers[claim.kind];
     if (evidence.operation !== expected.operation ||
         !acceptsPredicate(expected.predicates, evidence.predicate_type) ||
-        evidence.provider.id !== expected.id ||
-        evidence.provider.name !== expected.name ||
-        evidence.provider.version !== (claim.kind === "behavioral" ? "3" : "1") ||
+        (claim.kind === "behavioral"
+            ? !isProcessEvidenceProvider(evidence.provider)
+            : evidence.provider.id !== expected.id ||
+                evidence.provider.name !== expected.name ||
+                evidence.provider.version !== "1") ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null)
@@ -146,7 +149,10 @@ const validateComparisonIdentity = (claim, evidence) => {
 };
 const sourceSides = (claim, evidence) => {
     const parameters = evidence.parameters;
-    if (claim.kind === "behavioral") {
+    let singularSides;
+    if (claim.kind === "behavioral" ||
+        (claim.kind === "structural-function" &&
+            ("left_evidence_id" in parameters || "right_evidence_id" in parameters))) {
         const parsed = z
             .object({
             left_evidence_id: evidenceIdSchema,
@@ -154,10 +160,13 @@ const sourceSides = (claim, evidence) => {
         })
             .passthrough()
             .parse(parameters);
-        return {
+        singularSides = {
             left: [parsed.left_evidence_id],
             right: [parsed.right_evidence_id],
         };
+        if (claim.kind === "behavioral" ||
+            !("left_evidence_ids" in parameters || "right_evidence_ids" in parameters))
+            return singularSides;
     }
     const parsed = z
         .object({
@@ -166,6 +175,12 @@ const sourceSides = (claim, evidence) => {
     })
         .passthrough()
         .parse(parameters);
+    if (singularSides !== undefined &&
+        (parsed.left_evidence_ids.length !== 1 ||
+            parsed.right_evidence_ids.length !== 1 ||
+            parsed.left_evidence_ids[0] !== singularSides.left[0] ||
+            parsed.right_evidence_ids[0] !== singularSides.right[0]))
+        throw new TypeError("Function comparison source Evidence aliases disagree");
     return { left: parsed.left_evidence_ids, right: parsed.right_evidence_ids };
 };
 const observedStatus = (claim, evidence) => {
@@ -237,4 +252,3 @@ const digest = (value) => {
 const count = (items, status) => items.filter((item) => item.status === status).length;
 const sameSet = (left, right) => left.length === right.length &&
     uniqueSorted(left).every((id, index) => id === uniqueSorted(right)[index]);
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));

package/dist/domain/referenceSourceClassification.js

@@ -101,7 +101,7 @@ const MANIFEST_FILENAMES = new Set([
     "pipfile.lock",
     "setup.cfg",
     "manifest.in",
-    "CMakeLists.txt",
+    "cmakelists.txt",
     "meson.build",
     "configure",
     "configure.ac",
@@ -272,7 +272,8 @@ const filenameIsTest = (filename) => {
         return true;
     if (lower.endsWith("_test") || lower.endsWith("_spec"))
         return true;
-    return false;
+    const stem = basenameParts(lower).base;
+    return stem.endsWith("_test") || stem.endsWith("_spec");
 };
 const filenameIsGenerated = (filename) => {
     const lower = filename.toLowerCase();
@@ -312,11 +313,9 @@ const isPathUnderAny = (path, names) => {
 /** Detect a source language from a POSIX path. */
 export const detectReferenceSourceLanguage = (path) => {
     const filename = posix.basename(path);
-    if (filename === "Dockerfile" || filename.startsWith("Dockerfile."))
-        return "Dockerfile";
-    if (filename.toLowerCase().startsWith("dockerfile"))
-        return "Dockerfile";
     const lower = filename.toLowerCase();
+    if (lower === "dockerfile" || lower.startsWith("dockerfile."))
+        return "Dockerfile";
     if (lower.endsWith(".d.ts"))
         return "TypeScript";
     if (lower.endsWith(".d.mts"))

package/dist/domain/referenceSourceGraph.js

@@ -1,7 +1,6 @@
-import { createHash } from "node:crypto";
 import { posix } from "node:path";
-import canonicalize from "canonicalize";
 import { z } from "zod";
+import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -184,13 +183,6 @@ const historicalSourceManifestBaseSchema = z.strictObject({
 });
 /** Stable identity used to sort and deduplicate source parse failures. */
 export const historicalSourceParseFailureKey = (failure) => `${failure.path}\u0000${failure.parser}\u0000${failure.reason}`;
-const canonicalJson = (value) => {
-    const serialized = canonicalize(value);
-    if (serialized === undefined)
-        throw new TypeError("RFC 8785 canonicalization rejected a graph value");
-    return serialized;
-};
-const digestCanonical = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
 const relationshipKey = (relationship) => `${relationship.from_path}\u0000${relationship.to}\u0000${relationship.kind}\u0000${relationship.resolution}\u0000${relationship.parse_state}`;
 const checkSortedUnique = (values, field, context) => {
     for (let index = 1; index < values.length; index += 1)
@@ -293,15 +285,15 @@ function checkGraphInvariants(graph, context) {
     checkSortedUnique(graph.relationships.map(relationshipKey), "relationships", context);
     checkSortedUnique(graph.parse_failures.map(historicalSourceParseFailureKey), "parse_failures", context);
     checkSortedUnique(graph.exclusions.map(({ path, reason }) => `${path}\u0000${reason}`), "exclusions", context);
-    if (canonicalJson(graph.languages) !==
-        canonicalJson(historicalSourceLanguages(graph.entries)))
+    if (canonicalJson(graph.languages, "Reference source graph") !==
+        canonicalJson(historicalSourceLanguages(graph.entries), "Reference source graph"))
         context.addIssue({
             code: "custom",
             message: "languages must be derived from file entries",
             path: ["languages"],
         });
-    if (canonicalJson(graph.manifests) !==
-        canonicalJson(historicalSourceManifests(graph.entries)))
+    if (canonicalJson(graph.manifests, "Reference source graph") !==
+        canonicalJson(historicalSourceManifests(graph.entries), "Reference source graph"))
         context.addIssue({
             code: "custom",
             message: "manifests must be derived from classified file entries",
@@ -340,7 +332,7 @@ const rootCommitment = (entries, exclusions) => ({
     }),
     exclusions,
 });
-const computeRootSha256 = (entries, exclusions) => digestCanonical(rootCommitment(entries, exclusions));
+const computeRootSha256 = (entries, exclusions) => canonicalDigest(rootCommitment(entries, exclusions), "Reference source graph");
 /** Build and internally commit a normalized historical source graph. */
 export const createHistoricalSourceGraph = (input) => {
     const parsed = historicalSourceGraphInputSchema.parse(input);
@@ -352,7 +344,7 @@ export const createHistoricalSourceGraph = (input) => {
 /** Parse a graph and reject stale or caller-invented root commitments. */
 export const parseHistoricalSourceGraph = (input) => historicalSourceGraphSchema.parse(input);
 /** Compute a deterministic graph commitment containing no absolute root path. */
-export const computeHistoricalSourceGraphSha256 = (input) => digestCanonical(parseHistoricalSourceGraph(input));
+export const computeHistoricalSourceGraphSha256 = (input) => canonicalDigest(parseHistoricalSourceGraph(input), "Reference source graph");
 /** Build a deterministic, relocation-independent manifest for a source graph. */
 export const createHistoricalSourceManifest = (input) => {
     const graph = parseHistoricalSourceGraph(input);
@@ -367,14 +359,14 @@ export const createHistoricalSourceManifest = (input) => {
     };
     return historicalSourceManifestBaseSchema.parse({
         ...semantic,
-        manifest_id: `hsm_${digestCanonical(semantic)}`,
+        manifest_id: `hsm_${canonicalDigest(semantic, "Reference source graph")}`,
     });
 };
 /** Parse and verify a historical source manifest's semantic identifier. */
 export const parseHistoricalSourceManifest = (input) => {
     const manifest = historicalSourceManifestBaseSchema.parse(input);
     const { manifest_id: manifestId, ...semantic } = manifest;
-    if (`hsm_${digestCanonical(semantic)}` !== manifestId)
+    if (`hsm_${canonicalDigest(semantic, "Reference source graph")}` !== manifestId)
         throw new TypeError("Historical source manifest identifier does not match");
     return manifest;
 };