rea-agents 5.0.0 → 6.1.0

package/dist/domain/apple/interfaceBuilderKeyedArchive.js

@@ -82,6 +82,7 @@ export const parseInterfaceBuilderRecords = (value) => {
         objectCount: objectEntries.length,
         omittedObjects: Math.max(0, objectEntries.length - 20_000),
         omittedConnections,
+        omittedHierarchyReferences: 0,
     };
 };
 /**
@@ -164,6 +165,7 @@ const keyedArchiveTable = (objectTable) => {
         return output;
     };
     const hierarchy = (start) => {
+        let omittedReferences = 0;
         const visited = new Set();
         const root = [];
         const pending = [
@@ -190,10 +192,17 @@ const keyedArchiveTable = (objectTable) => {
             const { value, output } = entry;
             const uid = archiveUid(value);
             if (uid !== undefined) {
+                // UID0 is archived nil, not a missing hierarchy object.
+                if (uid === 0)
+                    continue;
+                const target = objectTable[uid];
+                if (target === undefined) {
+                    omittedReferences += 1;
+                    continue;
+                }
                 if (visited.has(uid))
                     continue;
                 visited.add(uid);
-                const target = objectTable[uid];
                 if (Array.isArray(target)) {
                     for (let index = target.length - 1; index >= 0; index -= 1) {
                         const child = target[index];
@@ -229,7 +238,7 @@ const keyedArchiveTable = (objectTable) => {
                 appendNode(record(value), undefined, output);
             }
         }
-        return root;
+        return { items: root, omittedReferences };
     };
     const archivedArrayClass = (classReference) => {
         const uid = archiveUid(classReference);
@@ -317,11 +326,12 @@ const parseKeyedArchive = (root) => {
     return {
         objects,
         connections,
-        hierarchy,
+        hierarchy: hierarchy.items,
         classes,
         objectCount,
         omittedObjects: Math.max(0, objectCount - 20_000),
         omittedConnections,
+        omittedHierarchyReferences: hierarchy.omittedReferences,
     };
 };
 /** Coerce unknown values to a string-keyed record; non-objects become `{}`. */

package/dist/domain/apple/keyedArchive.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { AnalysisInputError } from "../analysisErrorCore.js";
 import { jsonValueSchema } from "../jsonValue.js";
 /** Select one archive within the active bundle and optionally one named root. */
 export const keyedArchiveInputSchema = z.strictObject({
@@ -72,7 +73,14 @@ export const projectKeyedArchive = (value, selection) => {
     if (top === undefined || Object.keys(top).length === 0)
         throw new TypeError("Keyed archive has no $top roots");
     if (selection.root !== undefined && !Object.hasOwn(top, selection.root))
-        throw new TypeError(`Archive root does not exist: ${selection.root}`);
+        throw new AnalysisInputError("inspect_keyed_archive", undefined, [
+            {
+                path: ["root"],
+                reason: "invalid_value",
+                message: `Archive root does not exist: ${selection.root}. Select one of the archive's $top roots or omit root.`,
+                expected: Object.keys(top),
+            },
+        ]);
     const roots = selection.root === undefined
         ? top
         : { [selection.root]: top[selection.root] ?? null };

package/dist/domain/apple/machoContainer.js

@@ -0,0 +1,54 @@
+/** Decode FAT table entries once so artifact and native readers share identity facts. */
+export const readFatSliceDeclarations = (tableBytes, options) => {
+    const { count, wide, littleEndian } = options;
+    const entrySize = wide ? 32 : 20;
+    if (tableBytes.byteLength < count * entrySize)
+        return { status: "malformed", reason: "FAT table is truncated" };
+    const view = new DataView(tableBytes.buffer, tableBytes.byteOffset, tableBytes.byteLength);
+    const slices = [];
+    for (let index = 0; index < count; index++) {
+        const base = index * entrySize;
+        const offset = wide
+            ? safeNumber(view.getBigUint64(base + 8, littleEndian))
+            : view.getUint32(base + 8, littleEndian);
+        const size = wide
+            ? safeNumber(view.getBigUint64(base + 16, littleEndian))
+            : view.getUint32(base + 12, littleEndian);
+        if (offset === null || size === null)
+            return {
+                status: "malformed",
+                reason: "FAT offset or size exceeds the safe range",
+            };
+        slices.push({
+            index,
+            offset,
+            size,
+            alignmentExponent: view.getUint32(base + (wide ? 24 : 16), littleEndian),
+            cpuType: view.getUint32(base, littleEndian),
+            cpuSubtype: view.getUint32(base + 4, littleEndian),
+        });
+    }
+    return { status: "parsed", slices };
+};
+/** Validate byte-range and table/header identity facts shared by Mach-O readers. */
+export const validateFatSlice = (declaration, containerSize, tableEnd, embedded) => {
+    const { index, offset, size, alignmentExponent, cpuType, cpuSubtype } = declaration;
+    if (!Number.isSafeInteger(offset) ||
+        !Number.isSafeInteger(size) ||
+        size <= 0 ||
+        offset < tableEnd)
+        return `FAT architecture ${index} has an invalid slice range`;
+    if (offset > containerSize || size > containerSize - offset)
+        return `FAT architecture ${index} slice range extends beyond the file`;
+    if (!Number.isInteger(alignmentExponent) ||
+        alignmentExponent < 0 ||
+        alignmentExponent > 52)
+        return `FAT architecture ${index} alignment exponent ${alignmentExponent} is unsupported`;
+    if (offset % 2 ** alignmentExponent !== 0)
+        return `FAT architecture ${index} offset is not aligned to 2^${alignmentExponent}`;
+    if (embedded !== undefined &&
+        (embedded.cpuType !== cpuType || embedded.cpuSubtype !== cpuSubtype))
+        return `FAT architecture ${index} CPU type/subtype disagrees with its Mach-O header`;
+    return null;
+};
+const safeNumber = (value) => value > BigInt(Number.MAX_SAFE_INTEGER) ? null : Number(value);

package/dist/domain/apple/plistNumbers.js

@@ -0,0 +1,76 @@
+/** Preserve unambiguous exact integers; disclose rounded or unclassified numbers. */
+export const createPlistNumberProjection = (literals) => {
+    let exactIntegerCount = 0;
+    let ambiguousNumberCount = 0;
+    const mapNumber = (item) => {
+        if (Number.isSafeInteger(item) || !Number.isInteger(item))
+            return item;
+        if (literals.incomplete) {
+            ambiguousNumberCount += 1;
+            return item;
+        }
+        const decimals = literals.integers.get(item);
+        if (decimals === undefined) {
+            if (!literals.reals.has(item))
+                ambiguousNumberCount += 1;
+            return item;
+        }
+        const [decimal] = decimals;
+        if (decimals.size !== 1 ||
+            decimal === undefined ||
+            literals.reals.has(item)) {
+            ambiguousNumberCount += 1;
+            return item;
+        }
+        exactIntegerCount += 1;
+        return { $plist_type: "integer", decimal };
+    };
+    const map = (item) => {
+        if (typeof item === "number")
+            return mapNumber(item);
+        if (Array.isArray(item))
+            return item.map(map);
+        if (item !== null && typeof item === "object") {
+            const keys = Object.keys(item);
+            const marker = item[keys[0] ?? ""];
+            const reference = keys.length === 1 &&
+                (keys[0] === "UID" || keys[0] === "CF$UID") &&
+                typeof marker === "number";
+            if (reference) {
+                // Keep malformed numeric reference markers recognizable by the graph reader.
+                if (typeof marker === "number" &&
+                    !Number.isSafeInteger(marker) &&
+                    (literals.integers.has(marker) || !literals.reals.has(marker)))
+                    ambiguousNumberCount += 1;
+                return item;
+            }
+            return Object.fromEntries(Object.entries(item).map(([key, child]) => [key, map(child)]));
+        }
+        return item;
+    };
+    return {
+        project: map,
+        limitations: () => [
+            ...(literals.incomplete
+                ? [
+                    "Original archive number metadata could not be completely observed; decoded numbers may lose integer precision and exact integer/real association is unavailable.",
+                ]
+                : []),
+            ...(literals.unsafeIntegerLiterals === 0
+                ? []
+                : [
+                    `${String(literals.unsafeIntegerLiterals)} observed integer literal(s) in the original archive exceed the exact range of a JSON number. Decoded numbers may lose integer precision unless represented as { "$plist_type": "integer", "decimal": "<exact digits>" }; the original archive bytes retain those literals.`,
+                ]),
+            ...(exactIntegerCount === 0
+                ? []
+                : [
+                    `${String(exactIntegerCount)} unambiguous integer value(s) are reported with exact decimal text as { "$plist_type": "integer", "decimal": "<exact digits>" }.`,
+                ]),
+            ...(ambiguousNumberCount === 0
+                ? []
+                : [
+                    `${String(ambiguousNumberCount)} number(s) beyond the exact integer range remain as decoded because their source integer/real type or reference marker cannot be associated unambiguously; integer precision loss remains possible.`,
+                ]),
+        ],
+    };
+};

package/dist/domain/artifactIdentity.js

@@ -0,0 +1,29 @@
+import { canonicalDigest } from "./comparisonSemantics.js";
+/** Content-address an artifact independently of where it was observed. */
+export const artifactIdForContent = (sha256) => `art_${canonicalDigest({ sha256 }, "Artifact")}`;
+/** Identify an occurrence by its root and exact logical location. */
+export const occurrenceIdForLocation = (input) => input.logicalPath === "."
+    ? `occ_${canonicalDigest({ root: input.rootArtifactId }, "Artifact")}`
+    : `occ_${canonicalDigest({
+        root_artifact_id: input.rootArtifactId,
+        logical_path: input.logicalPath,
+        entry_kind: input.entryKind,
+    }, "Artifact")}`;
+/** Commit to graph members in the ordering established by the inventory owner. */
+export const artifactGraphDigest = (input) => canonicalDigest({
+    nodes: input.nodes,
+    occurrences: input.occurrences,
+    edges: input.edges,
+    integrity_contradictions: input.contradictions,
+}, "Artifact");
+/** Bind a root artifact to its graph commitment. */
+export const artifactManifestId = (rootArtifactId, graphSha256) => `agm_${canonicalDigest({ root_artifact_id: rootArtifactId, graph_sha256: graphSha256 }, "Artifact")}`;
+/** Identify one integrity disagreement at its observed logical path. */
+export const artifactContradictionId = (input) => `ic_${canonicalDigest({
+    root_artifact_id: input.rootArtifactId,
+    logical_path: input.logicalPath,
+    declared_sha256: input.declaredSha256,
+    observed_sha256: input.observedSha256,
+}, "Artifact")}`;
+/** Identify an edge by its semantic relationship and exact occurrence. */
+export const artifactEdgeId = (semantic) => `edge_${canonicalDigest(semantic, "Artifact")}`;

package/dist/domain/artifactInventoryEvidence.js

@@ -1,5 +1,6 @@
 import { artifactInventoryResultSchema, } from "./artifactGraph.js";
-import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
+import { canonicalJson } from "./comparisonSemantics.js";
+import { artifactContradictionId, artifactEdgeId, artifactGraphDigest, artifactIdForContent, artifactManifestId, occurrenceIdForLocation, } from "./artifactIdentity.js";
 import { parseEvidence } from "./evidence.js";
 import { artifactInspectionResultSchema } from "./artifactInspection.js";
 import { err, ok } from "./result.js";
@@ -29,8 +30,7 @@ const validateInventoryPage = (inventory) => {
     assertUnique(inventory.occurrences.map(({ logical_path: path }) => path), "logical path");
     assertUnique(inventory.edges.map(({ edge_id: id }) => id), "edge ID");
     for (const node of inventory.nodes)
-        if (node.artifact_id !==
-            `art_${canonicalDigest({ sha256: node.sha256 }, "Artifact inventory")}`)
+        if (node.artifact_id !== artifactIdForContent(node.sha256))
             throw new TypeError("Artifact node ID is not content-addressed");
 };
 /**
@@ -110,27 +110,24 @@ const validateCompleteInventory = (inventory) => {
         if (!nodeIds.has(contradiction.parent_artifact_id) ||
             !occurrenceIds.has(contradiction.occurrence_id))
             throw new TypeError("Integrity contradiction references a missing graph member");
-        const expectedId = `ic_${canonicalDigest({
-            root_artifact_id: inventory.manifest.root_artifact_id,
-            logical_path: contradiction.logical_path,
-            declared_sha256: contradiction.declared_sha256,
-            observed_sha256: contradiction.observed_sha256,
-        }, "Artifact inventory")}`;
+        const expectedId = artifactContradictionId({
+            rootArtifactId: inventory.manifest.root_artifact_id,
+            logicalPath: contradiction.logical_path,
+            declaredSha256: contradiction.declared_sha256,
+            observedSha256: contradiction.observed_sha256,
+        });
         if (contradiction.contradiction_id !== expectedId)
             throw new TypeError("Integrity contradiction ID does not match its identity");
     }
-    const graphSha256 = canonicalDigest({
+    const graphSha256 = artifactGraphDigest({
         nodes: inventory.nodes,
         occurrences: inventory.occurrences,
         edges: inventory.edges,
-        integrity_contradictions: inventory.integrityContradictions,
-    }, "Artifact inventory");
+        contradictions: inventory.integrityContradictions,
+    });
     if (graphSha256 !== inventory.manifest.graph_sha256)
         throw new TypeError("Artifact graph commitment does not match its members");
-    const manifestId = `agm_${canonicalDigest({
-        root_artifact_id: inventory.manifest.root_artifact_id,
-        graph_sha256: graphSha256,
-    }, "Artifact inventory")}`;
+    const manifestId = artifactManifestId(inventory.manifest.root_artifact_id, graphSha256);
     if (manifestId !== inventory.manifest.manifest_id)
         throw new TypeError("Artifact manifest ID does not match its commitment");
 };
@@ -140,13 +137,11 @@ const validateOccurrence = (occurrence, inventory, nodeIds, occurrenceIds) => {
     if (occurrence.parent_occurrence_id !== null &&
         !occurrenceIds.has(occurrence.parent_occurrence_id))
         throw new TypeError("Artifact occurrence references a missing parent");
-    const expectedId = occurrence.logical_path === "."
-        ? `occ_${canonicalDigest({ root: inventory.manifest.root_artifact_id }, "Artifact inventory")}`
-        : `occ_${canonicalDigest({
-            root_artifact_id: inventory.manifest.root_artifact_id,
-            logical_path: occurrence.logical_path,
-            entry_kind: occurrence.entry_kind,
-        }, "Artifact inventory")}`;
+    const expectedId = occurrenceIdForLocation({
+        rootArtifactId: inventory.manifest.root_artifact_id,
+        logicalPath: occurrence.logical_path,
+        entryKind: occurrence.entry_kind,
+    });
     if (occurrence.occurrence_id !== expectedId)
         throw new TypeError("Artifact occurrence ID does not match its identity");
 };
@@ -162,7 +157,7 @@ const validateEdge = (edge, nodeIds, occurrenceIds) => {
         occurrence_id: edge.occurrence_id,
         logical_path: edge.logical_path,
     };
-    if (edge.edge_id !== `edge_${canonicalDigest(semantic, "Artifact inventory")}`)
+    if (edge.edge_id !== artifactEdgeId(semantic))
         throw new TypeError("Artifact edge ID does not match its identity");
 };
 const mergeExact = (output, key, value, label) => {

package/dist/domain/artifactPathSyntax.js

@@ -15,7 +15,7 @@
  * Unifying those outcome vocabularies is a separate, observable change.
  */
 /** Whether a reference carries a URI scheme (`https:`, `file:`, …). */
-export const hasScheme = (value) => /^[A-Za-z][A-Za-z+.-]*:/u.test(value);
+export const hasScheme = (value) => /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(value);
 /** Whether a reference is scheme-qualified or protocol-relative. */
 export const looksExternal = (value) => hasScheme(value) || value.startsWith("//");
 /** Drop any query string and fragment from a declared reference. */

package/dist/domain/bridgeCandidateProjection.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+/** Coverage metadata for the bounded projection of candidate relationships. */
+export const bridgeCandidateCoverageSchema = z.strictObject({
+    status: z.enum(["complete", "partial"]),
+    total_candidates: z.number().int().nonnegative(),
+    emitted_candidates: z.number().int().nonnegative(),
+    omitted_candidates: z.number().int().nonnegative(),
+});
+// The serialized candidate array is the retained representation; accounting
+// its exact UTF-8 JSON size bounds both array objects and repeated path strings.
+/** Maximum UTF-8 JSON size of a retained candidate array. */
+export const MAX_BRIDGE_CANDIDATE_JSON_BYTES = 2 * 1024 * 1024;
+const jsonText = (value) => {
+    const serialized = JSON.stringify(value);
+    if (serialized === undefined)
+        throw new TypeError("Bridge candidate is not JSON serializable");
+    return serialized;
+};
+/** Retain a deterministic prefix of grouped Cartesian candidates within a byte budget. */
+export const projectCartesianCandidates = (input) => {
+    const total = input.groups.reduce((sum, group) => sum + group.left.length * group.right.length, 0);
+    const preparedGroups = input.groups.map((group) => ({
+        left: group.left.map((value) => ({
+            value,
+            pathBytes: Buffer.byteLength(jsonText(value.path)),
+        })),
+        right: group.right.map((value) => {
+            const emptyLeftCandidate = jsonText(input.createCandidate("", value));
+            return {
+                value,
+                rowOverhead: Buffer.byteLength(emptyLeftCandidate) - 2,
+            };
+        }),
+    }));
+    let estimatedFullBytes = 2 + Math.max(0, total - 1); // JSON array brackets and commas.
+    for (const group of preparedGroups) {
+        estimatedFullBytes +=
+            group.left.length *
+                group.right.reduce((sum, { rowOverhead }) => sum + rowOverhead, 0) +
+                group.right.length *
+                    group.left.reduce((sum, { pathBytes }) => sum + pathBytes, 0);
+    }
+    const shouldEmitAll = estimatedFullBytes <= MAX_BRIDGE_CANDIDATE_JSON_BYTES;
+    const candidates = [];
+    let estimatedRetainedBytes = 2;
+    candidateLoop: for (const group of preparedGroups) {
+        for (const left of group.left) {
+            for (const right of group.right) {
+                const candidateBytes = right.rowOverhead + left.pathBytes;
+                const additionalBytes = candidateBytes + (candidates.length > 0 ? 1 : 0);
+                if (!shouldEmitAll &&
+                    estimatedRetainedBytes + additionalBytes >
+                        MAX_BRIDGE_CANDIDATE_JSON_BYTES)
+                    break candidateLoop;
+                candidates.push(input.createCandidate(left.value.path, right.value));
+                estimatedRetainedBytes += additionalBytes;
+            }
+        }
+    }
+    return {
+        candidates,
+        coverage: {
+            status: candidates.length === total
+                ? "complete"
+                : "partial",
+            total_candidates: total,
+            emitted_candidates: candidates.length,
+            omitted_candidates: total - candidates.length,
+        },
+    };
+};

package/dist/domain/browserCompleteness.js

@@ -33,6 +33,7 @@ const browserExclusionReasonSchema = z.enum([
     "out_of_target_scope",
     "provider_unavailable",
     "invalid_protocol_value",
+    "resource_budget_exhausted",
 ]);
 const browserExclusionSchema = z.object({
     section: browserSectionSchema,

package/dist/domain/browserObservation.js

@@ -77,7 +77,7 @@ const browserInput = {
     allowed_origins: browserAllowedOriginsSchema,
 };
 /** Public input for complete discovery, optionally filtered by exact origin. */
-export const listBrowserTargetsInputSchema = z.object({
+export const listBrowserTargetsInputSchema = z.strictObject({
     ...browserInput,
 });
 const inspectWebPageInputFacts = {

package/dist/domain/browserObservationError.js

@@ -1,4 +1,4 @@
-import { AnalysisError } from "./analysisErrorBase.js";
+import { AnalysisError, } from "./analysisErrorBase.js";
 import { AnalysisCancelledError } from "./analysisErrorCore.js";
 /** A bounded passive browser observation failed at its CDP boundary. */
 export class BrowserObservationError extends AnalysisError {
@@ -13,13 +13,32 @@ export class BrowserObservationError extends AnalysisError {
         super(`Browser observation ${operation} failed: ${reason}`, options);
         this.operation = operation;
         this.reason = reason;
-        this.userMessage = options?.detail;
-        this.cleanupIncomplete = reason === "cleanup_failed";
+        this.userMessage =
+            options?.detail ?? observationFailureMessage(operation, reason);
+        this.cleanupIncomplete =
+            this.cleanup !== undefined || reason === "cleanup_failed";
         this.cleanupResources =
-            reason === "cleanup_failed" ? ["browser_transport"] : [];
+            this.cleanup?.resources ??
+                (reason === "cleanup_failed" ? ["browser_transport"] : []);
         this.userCategory =
-            reason === "cancelled" || options?.cause instanceof AnalysisCancelledError
+            reason === "cancelled" ||
+                options?.cause instanceof AnalysisCancelledError ||
+                (options?.cause instanceof AnalysisError &&
+                    options.cause.userCategory === "cancelled")
                 ? "cancelled"
                 : undefined;
     }
 }
+const observationFailureMessage = (operation, reason) => {
+    if (reason === "cancelled")
+        return `${operation} was cancelled. Collected observations and cleanup status are reported when available.`;
+    if (reason === "timeout")
+        return `${operation} exceeded its execution deadline. Review the target's responsiveness and retained observations before retrying.`;
+    if (reason === "endpoint_unreachable")
+        return `${operation} could not reach the selected loopback debugging endpoint. Verify that the target process is running with debugging enabled and that the endpoint's port matches it, then retry.`;
+    if (reason === "target_not_found")
+        return `${operation} could not find the selected target at the debugging endpoint. Refresh target discovery for that endpoint and retry with a returned target ID.`;
+    if (reason === "disconnected")
+        return `${operation} lost its debugging connection. Verify that the target process is still running, refresh target discovery, and retry the observation.`;
+    return undefined;
+};

package/dist/domain/browserObservationSchemas.js

@@ -106,6 +106,19 @@ const browserNetworkRequestSchema = z.object({
     status: z.number().nullable(),
     mime_type: z.string().nullable(),
     encoded_data_length: z.number().min(0).nullable(),
+    redirects: z
+        .array(z.object({
+        url: z.string(),
+        response_url: z.string(),
+        method: z.string(),
+        resource_type: z.string().nullable(),
+        status: z.number().nullable(),
+        mime_type: z.string().nullable(),
+        encoded_data_length: z.number().min(0).nullable(),
+        request_timestamp: z.number().nullable(),
+        redirect_event_timestamp: z.number().nullable(),
+    }))
+        .optional(),
     initiator: z.object({
         type: z.string(),
         url: z.string().nullable(),

package/dist/domain/browserScenarioValues.js

@@ -1,10 +1,13 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath, localPathStringSchema } from "./localPath.js";
 import { browserNetworkContentSelectionSchema } from "./browserNetworkEvidence.js";
 import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
 export const scenarioIdentifierSchema = z
     .string()
     .regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
-const browserExecutablePathSchema = z.string().trim().min(1);
+const browserExecutablePathSchema = localPathStringSchema.refine(isAbsoluteLocalPath, {
+    message: "executable_path must be an absolute local filesystem path (for example /opt/chromium/chrome or C:\\chromium\\chrome.exe)",
+});
 const browserScenarioBaseUrlSchema = z
     .string()
     .min(1)
@@ -52,7 +55,7 @@ export const browserScenarioUrlSchema = z.strictObject({
 export const browserScenarioBrowserSchema = z.discriminatedUnion("mode", [
     z.strictObject({
         mode: z.literal("launch"),
-        executable_path: browserExecutablePathSchema,
+        executable_path: browserExecutablePathSchema.describe("Absolute local filesystem path for the browser executable; relative paths are rejected."),
         headless: z
             .boolean()
             .default(true)

package/dist/domain/bundleComparison.js

@@ -4,6 +4,7 @@ import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 import { comparisonStatusSchema } from "./comparisonStatus.js";
+import { localPathStringSchema } from "./localPath.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const classificationSchema = z.enum([
     "added",
@@ -15,8 +16,8 @@ const classificationSchema = z.enum([
 ]);
 /** Strict input for canonical Evidence bundle comparison. */
 export const bundleComparisonInputSchema = z.strictObject({
-    left_bundle_path: z.string().min(1),
-    right_bundle_path: z.string().min(1),
+    left_bundle_path: localPathStringSchema,
+    right_bundle_path: localPathStringSchema,
     record_pairs: z
         .array(z.object({
         left_evidence_id: evidenceIdSchema,

package/dist/domain/callPathSchemas.js

@@ -19,7 +19,7 @@ const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Normalize a hexadecimal offset while preserving its optional address space. */
 export const parseCallPathAddress = (input) => inputAddressSchema.parse(input);
 /** Strict input for explicit call-path reconstruction from complete dossiers. */
-export const callPathInputSchema = z.object({
+export const callPathInputSchema = z.strictObject({
     functions: z.array(evidenceSchema).min(1),
     start: z.object({ address: inputAddressSchema }).strict(),
     goal: z.object({ address: inputAddressSchema }).strict(),

package/dist/domain/canonicalDigest.js

@@ -2,9 +2,21 @@ import { createHash } from "node:crypto";
 /** Hash canonicalize-compatible JSON without assembling an aggregate string. */
 export const digestCanonicalValue = (value, context = "Comparison") => {
     const hash = createHash("sha256");
-    const encoded = emitCanonical(value, (part) => hash.update(part), new Set());
+    // Batch small emitted parts to cut hash.update crossings.
+    // Flush cuts only at part boundaries, so the hashed byte stream is unchanged.
+    let buffered = "";
+    const emit = (part) => {
+        buffered += part;
+        if (buffered.length >= 8192) {
+            hash.update(buffered);
+            buffered = "";
+        }
+    };
+    const encoded = emitCanonical(value, emit, new Set());
     if (!encoded)
         throw new TypeError(`${context} could not canonicalize data`);
+    if (buffered)
+        hash.update(buffered);
     return hash.digest("hex");
 };
 const emitCanonical = (value, emit, ancestors) => {