rea-agents 6.1.0 → 6.2.0

package/dist/domain/analysisView/binaryLayoutView.js

@@ -0,0 +1,159 @@
+import { AnalysisInputError, } from "../analysisErrorCore.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { err, ok } from "../result.js";
+import { completeWithinViewCoverage as completeCoverage, pageViewCoverage as pageCoverage, } from "./analysisViewCoverage.js";
+const OPERATION = "inspect_analysis_view";
+const inputError = (issues) => new AnalysisInputError(OPERATION, undefined, issues);
+const layoutUnknowns = (layout) => {
+    const unknowns = [
+        "runtime_load_base is unknown",
+        "entry_point.execution_status is unknown",
+        "relocation_inventory_completeness is unknown",
+        "linkage.convenience_maps_completeness is unknown",
+        "linkage.runtime_library_paths are unknown",
+    ];
+    if (layout.mitigations.nx_indicator === null)
+        unknowns.push("mitigations.nx_indicator is unknown");
+    if (layout.mitigations.relro === null)
+        unknowns.push("mitigations.relro is unknown");
+    return unknowns;
+};
+const displayName = (name) => name.display;
+const namedMatches = (rows, name) => rows.flatMap((row, index) => row.name.unknown_reason === null && displayName(row.name) === name
+    ? [{ index, row }]
+    : []);
+const selectNamed = (collection, rows, name) => {
+    const matches = namedMatches(rows, name);
+    if (matches.length === 1) {
+        const selected = matches[0];
+        if (selected !== undefined)
+            return ok(selected.row);
+    }
+    if (matches.length === 0)
+        return err(inputError([
+            {
+                path: ["view", "selector", "name"],
+                reason: "invalid_value",
+                message: `No ${collection} named ${JSON.stringify(name)}. Collection has ${String(rows.length)} entries; page it to inspect exact indexes and names.`,
+            },
+        ]));
+    return err(inputError([
+        {
+            path: ["view", "selector", "name"],
+            reason: "invalid_value",
+            message: `Multiple ${collection} named ${JSON.stringify(name)}; select one by index.`,
+            expected: matches.map(({ index }) => ({ index })),
+        },
+    ]));
+};
+const selectIndexed = (collection, rows, index) => {
+    const row = rows[index];
+    if (row !== undefined)
+        return ok(row);
+    return err(inputError([
+        {
+            path: ["view", "selector", "index"],
+            reason: "out_of_range",
+            message: `${collection} index ${String(index)} is outside 0..${String(Math.max(0, rows.length - 1))} (${String(rows.length)} entries).`,
+            minimum: 0,
+            maximum: Math.max(0, rows.length - 1),
+        },
+    ]));
+};
+const pageRows = (rows, offset, limit) => rows.slice(offset, offset + limit);
+const layoutIncompatible = (detail) => inputError([
+    {
+        path: ["view"],
+        reason: "invalid_value",
+        message: detail,
+    },
+]);
+const parentFields = (parent, layout) => ({
+    parent_evidence_id: parent.evidenceId,
+    parent_operation: "inspect_binary_layout",
+    parent_digest: parent.evidenceId.slice(3),
+    artifact: {
+        path: layout.artifact.path,
+        sha256: layout.artifact.sha256,
+    },
+    limitations: uniqueSorted([...parent.limitations, ...layout.limitations]),
+    unknowns: uniqueSorted([...layoutUnknowns(layout)]),
+});
+const layoutSummary = (layout) => ({
+    bytes: layout.artifact.bytes,
+    format: layout.format,
+    architecture: layout.architecture,
+    image_type: layout.image_type,
+    entry: layout.entry_point,
+    counts: {
+        sections: layout.sections.length,
+        segments: layout.segments.length,
+        symbols: layout.symbols.length,
+        relocations: layout.relocations.length,
+    },
+    limitation_count: layout.limitations.length,
+});
+/** Project one layout view without re-running the decoder. */
+export const projectBinaryLayoutView = (parent, layout, view) => {
+    const shared = parentFields(parent, layout);
+    if (view.kind === "summary")
+        return ok({
+            kind: "summary",
+            view,
+            summary: layoutSummary(layout),
+            coverage: completeCoverage(layout.sections.length +
+                layout.segments.length +
+                layout.symbols.length +
+                layout.relocations.length, layout.sections.length +
+                layout.segments.length +
+                layout.symbols.length +
+                layout.relocations.length),
+            ...shared,
+        });
+    if (view.kind === "facet")
+        return ok({
+            kind: "facet",
+            view,
+            facet: view.facet === "mitigations" ? layout.mitigations : layout.linkage,
+            coverage: completeCoverage(1, 1),
+            ...shared,
+        });
+    if (view.kind === "item") {
+        if (view.collection === "modules")
+            return err(layoutIncompatible("modules collection applies to analyze_javascript_application Evidence."));
+        const selected = view.collection === "sections"
+            ? selectLayoutItem(view.collection, layout.sections, view.selector)
+            : selectLayoutItem(view.collection, layout.symbols, view.selector);
+        if (!selected.ok)
+            return selected;
+        return ok({
+            kind: "item",
+            view,
+            item: selected.value,
+            coverage: completeCoverage(1, view.collection === "sections"
+                ? layout.sections.length
+                : layout.symbols.length),
+            ...shared,
+        });
+    }
+    if (view.collection === "modules")
+        return err(layoutIncompatible("modules collection applies to analyze_javascript_application Evidence."));
+    const rows = view.collection === "sections" ? layout.sections : layout.symbols;
+    const items = view.collection === "sections"
+        ? pageRows(layout.sections, view.offset, view.limit)
+        : pageRows(layout.symbols, view.offset, view.limit);
+    return ok({
+        kind: "page",
+        view,
+        items: [...items],
+        coverage: pageCoverage(view.offset, items.length, rows.length),
+        ...shared,
+    });
+};
+const selectLayoutItem = (collection, rows, selector) => {
+    if ("index" in selector)
+        return selectIndexed(collection, rows, selector.index);
+    if ("name" in selector)
+        return selectNamed(collection, rows, selector.name);
+    return err(layoutIncompatible("Section and symbol items are selected by index or exact name."));
+};

package/dist/domain/analysisView/javascriptApplicationView.js

@@ -0,0 +1,238 @@
+import { AnalysisInputError, } from "../analysisErrorCore.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { jsonObjectSchema } from "../jsonValue.js";
+import { err, ok } from "../result.js";
+import { completeWithinViewCoverage as completeCoverage, pageViewCoverage as pageCoverage, } from "./analysisViewCoverage.js";
+const OPERATION = "inspect_analysis_view";
+const inputError = (issues) => new AnalysisInputError(OPERATION, undefined, issues);
+const jsIncompatible = (detail) => inputError([
+    {
+        path: ["view"],
+        reason: "invalid_value",
+        message: detail,
+    },
+]);
+/** Exact module path or original source-map reference, when available. */
+export const javascriptModulePath = (node) => {
+    if (node.identity.strategy === "canonical-path")
+        return node.identity.path;
+    if (node.identity.strategy === "source-map-original")
+        return node.identity.original_source;
+    for (const observation of node.observations) {
+        const path = observation.properties.path;
+        if (typeof path === "string")
+            return path;
+        const location = observation.evidence.location;
+        if (location.available && location.value.kind === "artifact-path")
+            return location.value.path;
+        if (location.available && location.value.kind === "source-range")
+            return location.value.source;
+    }
+    return null;
+};
+const moduleEntries = (nodes) => nodes
+    .filter((node) => node.kind === "javascript-asset" ||
+    node.kind === "javascript-module" ||
+    node.kind === "source-module")
+    .map((node) => ({ node, path: javascriptModulePath(node) }));
+const exportNames = (node) => {
+    const names = new Set();
+    for (const observation of node.observations) {
+        const value = observation.properties.export_names ?? observation.properties.exports;
+        if (!Array.isArray(value))
+            continue;
+        for (const entry of value)
+            if (typeof entry === "string")
+                names.add(entry);
+    }
+    return [...names];
+};
+const nodeHashes = (node) => {
+    const hashes = new Set();
+    const { identity } = node;
+    if (identity.strategy === "content-digest")
+        hashes.add(identity.sha256);
+    if (identity.strategy === "canonical-path")
+        hashes.add(identity.artifact_sha256);
+    if (identity.strategy === "source-map-original") {
+        hashes.add(identity.source_map_sha256);
+        if (identity.source_sha256 !== null)
+            hashes.add(identity.source_sha256);
+    }
+    for (const observation of node.observations) {
+        for (const key of [
+            "sha256",
+            "container_sha256",
+            "entry_sha256",
+            "source_sha256",
+        ]) {
+            const value = observation.properties[key];
+            if (typeof value === "string" && /^[a-f0-9]{64}$/u.test(value))
+                hashes.add(value);
+        }
+    }
+    return [...hashes];
+};
+const sourceRanges = (node) => node.observations.flatMap((observation) => {
+    const location = observation.evidence.location;
+    return location.available && location.value.kind === "source-range"
+        ? [location.value]
+        : [];
+});
+const moduleItem = (node) => ({
+    node_id: node.node_id,
+    kind: node.kind,
+    path: javascriptModulePath(node),
+    identity: node.identity,
+    hashes: [...nodeHashes(node)],
+    exports: [...exportNames(node)],
+    source_ranges: [...sourceRanges(node)],
+    observations: node.observations.map((observation) => ({
+        observation_id: observation.observation_id,
+        label: observation.label,
+        properties: observation.properties,
+        evidence: {
+            ...observation.evidence,
+            location: observation.evidence.location,
+        },
+    })),
+});
+const applicationUnknownCount = (analysis) => analysis.graph.nodes.reduce((count, node) => count + Number(node.kind === "unknown"), 0);
+const javascriptUnknowns = (analysis) => {
+    const unknowns = [
+        ...analysis.limitations,
+        ...analysis.graph.limitations,
+        ...analysis.semantic_graph.limitations,
+    ];
+    if (analysis.graph.coverage.status !== "complete")
+        unknowns.push(`graph.coverage.status is ${analysis.graph.coverage.status}`);
+    if (analysis.semantic_graph.coverage.status !== "complete")
+        unknowns.push(`semantic_graph.coverage.status is ${analysis.semantic_graph.coverage.status}`);
+    if (applicationUnknownCount(analysis) > 0)
+        unknowns.push(`${String(applicationUnknownCount(analysis))} application graph unknowns remain in the parent Evidence.`);
+    if (analysis.semantic_graph.unknowns.length > 0)
+        unknowns.push(`${String(analysis.semantic_graph.unknowns.length)} semantic graph unknowns remain in the parent Evidence.`);
+    return unknowns;
+};
+const parentFields = (parent, analysis) => ({
+    parent_evidence_id: parent.evidenceId,
+    parent_operation: "analyze_javascript_application",
+    parent_digest: parent.evidenceId.slice(3),
+    artifact: {
+        path: analysis.input_path,
+        sha256: analysis.root_artifact_sha256,
+    },
+    limitations: uniqueSorted([
+        ...parent.limitations,
+        ...analysis.limitations,
+        ...analysis.graph.limitations,
+        ...analysis.semantic_graph.limitations,
+    ]),
+    unknowns: uniqueSorted([...javascriptUnknowns(analysis)]),
+});
+const selectModule = (modules, selector) => {
+    if ("node_id" in selector) {
+        const matches = modules.filter(({ node }) => node.node_id === selector.node_id);
+        if (matches.length === 1) {
+            const selected = matches[0];
+            if (selected !== undefined)
+                return ok(selected.node);
+        }
+        return err(inputError([
+            {
+                path: ["view", "selector", "node_id"],
+                reason: "invalid_value",
+                message: `No module has node_id ${JSON.stringify(selector.node_id)}. Page the modules collection to inspect available identities.`,
+            },
+        ]));
+    }
+    if ("path" in selector) {
+        const matches = modules.filter((entry) => entry.path === selector.path);
+        if (matches.length === 1) {
+            const selected = matches[0];
+            if (selected !== undefined)
+                return ok(selected.node);
+        }
+        if (matches.length === 0)
+            return err(inputError([
+                {
+                    path: ["view", "selector", "path"],
+                    reason: "invalid_value",
+                    message: `No module has path ${JSON.stringify(selector.path)}. Page the modules collection to inspect exact paths and node_id values.`,
+                },
+            ]));
+        return err(inputError([
+            {
+                path: ["view", "selector", "path"],
+                reason: "invalid_value",
+                message: `Multiple modules have path ${JSON.stringify(selector.path)}; select one by node_id.`,
+                expected: matches.map((entry) => ({ node_id: entry.node.node_id })),
+            },
+        ]));
+    }
+    return err(jsIncompatible("Module items are selected by exact path or node_id."));
+};
+/** Project one JavaScript application view without re-running reconstruction. */
+export const projectJavaScriptApplicationView = (parent, analysis, view) => {
+    const shared = parentFields(parent, analysis);
+    const modules = moduleEntries(analysis.graph.nodes);
+    if (view.kind === "summary")
+        return ok({
+            kind: "summary",
+            view,
+            summary: {
+                input_path: analysis.input_path,
+                format: analysis.format,
+                root_artifact_sha256: analysis.root_artifact_sha256,
+                statistics: jsonObjectSchema.parse(analysis.statistics),
+                electron: jsonObjectSchema.parse(analysis.summary),
+                coverage: jsonObjectSchema.parse({
+                    application: analysis.graph.coverage,
+                    semantic: {
+                        ...analysis.semantic_graph.coverage,
+                        families: analysis.semantic_graph.coverage.families.map(({ unknown_ids, ...family }) => ({
+                            ...family,
+                            unknown_count: unknown_ids.length,
+                        })),
+                    },
+                    application_unknowns: applicationUnknownCount(analysis),
+                    semantic_unknowns: analysis.semantic_graph.unknowns.length,
+                }),
+                limitation_count: analysis.limitations.length,
+            },
+            coverage: completeCoverage(modules.length, analysis.graph.nodes.length),
+            ...shared,
+        });
+    if (view.kind === "facet")
+        return err(jsIncompatible("facet views apply to inspect_binary_layout Evidence (mitigations or linkage)."));
+    if (view.kind === "item") {
+        if (view.collection !== "modules")
+            return err(jsIncompatible("Section and symbol collections apply to inspect_binary_layout Evidence."));
+        const selected = selectModule(modules, view.selector);
+        if (!selected.ok)
+            return selected;
+        return ok({
+            kind: "item",
+            view,
+            item: moduleItem(selected.value),
+            coverage: completeCoverage(1, modules.length),
+            ...shared,
+        });
+    }
+    if (view.collection !== "modules")
+        return err(jsIncompatible("Section and symbol collections apply to inspect_binary_layout Evidence."));
+    const items = modules
+        .slice(view.offset, view.offset + view.limit)
+        .map(({ node, path }) => ({
+        node_id: node.node_id,
+        kind: node.kind,
+        path,
+    }));
+    return ok({
+        kind: "page",
+        view,
+        items,
+        coverage: pageCoverage(view.offset, items.length, modules.length),
+        ...shared,
+    });
+};

package/dist/domain/android/androidApplication.js

@@ -77,7 +77,7 @@ export const projectAndroidApplication = (input) => {
             path: occurrence.logical_path,
             artifact_id: node.artifact_id,
             sha256: node.sha256,
-            format: node.format,
+            format: occurrence.artifact_format,
         };
     });
     const classified = classify(all);

package/dist/domain/apple/appleApplication.js

@@ -85,7 +85,7 @@ export const projectAppleApplication = (input) => {
                 path: occurrence.logical_path,
                 artifact_id: node.artifact_id,
                 sha256: node.sha256,
-                format: node.format,
+                format: occurrence.artifact_format,
             },
         };
     });

package/dist/domain/apple/dylibResolution.js

@@ -3,9 +3,16 @@ import { compatibleSlice, directoryOf, expandPrefix, joinPath, resolveTreePath,
 import { digestSchema } from "../digests.js";
 import { hasApplicableDyldOverrides, embeddedDyldOverrides, } from "./dyldEnvironment.js";
 import { DYLIB_RESOLUTION_LIMITATIONS, deriveFindings, } from "./dylibResolutionFindings.js";
-/** Normalized path below the analyzed root: no `.`/`..` or empty segments. */
-const ROOT_RELATIVE_PATH = /^(?!\/)(?!(?:.*\/)?\.{1,2}(?:\/|$))(?!.*\/\/)(?!.*\/$)[^\\\0]+$/u;
-const rootRelativePathSchema = z.string().min(1).regex(ROOT_RELATIVE_PATH);
+/**
+ * Normalized path below the analyzed root: nonempty segments joined by single
+ * `/`, none of them `.` or `..`, without backslash or NUL. Advertised schema
+ * patterns avoid look-around, which RE2 and Rust validators reject.
+ */
+const ROOT_RELATIVE_PATH = /^(?:[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.\.[^\x2f\\\u0000]+)(?:\x2f(?:[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.\.[^\x2f\\\u0000]+))*$/u;
+const rootRelativePathSchema = z
+    .string()
+    .min(1)
+    .regex(ROOT_RELATIVE_PATH, "Use a normalized path relative to the analyzed root, without a leading or trailing '/', '//', or '.' and '..' segments");
 /** Caller selection of process roots and one CPU slice. */
 export const dylibResolutionInputSchema = z.strictObject({
     roots: z.array(rootRelativePathSchema).min(1).optional(),

package/dist/domain/apple/interfaceBuilderGraph.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { firstString, parseInterfaceBuilderRecords, record, } from "./interfaceBuilderKeyedArchive.js";
 import { nativeInvestigationEdgeSchema, nativeInvestigationGraphSchema, nativeInvestigationNodeSchema, nativeInvestigationTraceLimitsSchema, } from "../native/nativeInvestigationGraph.js";
-export { parseInterfaceBuilderRecords } from "./interfaceBuilderKeyedArchive.js";
 /** One compiled Interface Builder document projected from ibtool output. */
 export const interfaceBuilderDocumentSchema = z.strictObject({
     relative_path: z.string().min(1),

package/dist/domain/apple/keyedArchive.js

@@ -1,6 +1,20 @@
 import { z } from "zod";
 import { AnalysisInputError } from "../analysisErrorCore.js";
 import { jsonValueSchema } from "../jsonValue.js";
+/**
+ * The selected file is intact but is another kind of file, so another tool
+ * applies. A malformed NSKeyedArchiver archive is not this error.
+ */
+export class KeyedArchiveKindError extends TypeError {
+    kind;
+    name = "KeyedArchiveKindError";
+    constructor(message, 
+    /** What the selected file is instead. */
+    kind) {
+        super(message);
+        this.kind = kind;
+    }
+}
 /** Select one archive within the active bundle and optionally one named root. */
 export const keyedArchiveInputSchema = z.strictObject({
     path: z.string().min(1).default("."),
@@ -60,11 +74,21 @@ const uid = (value) => {
     const marker = Object.hasOwn(object, "UID") ? object.UID : object["CF$UID"];
     return typeof marker === "number" ? marker : undefined;
 };
+const archiverMismatch = (archive) => {
+    if (archive === undefined)
+        return "its root is not a dictionary";
+    if (!Object.hasOwn(archive, "$archiver"))
+        return "it has no $archiver key";
+    return typeof archive.$archiver === "string"
+        ? `its $archiver is ${JSON.stringify(archive.$archiver)}`
+        : "its $archiver is not a string";
+};
 /** Interpret serialized Foundation references without instantiating archive classes. */
 export const projectKeyedArchive = (value, selection) => {
     const archive = record(jsonValueSchema.parse(value));
-    if (archive?.$archiver !== "NSKeyedArchiver" ||
-        !Array.isArray(archive.$objects))
+    if (archive?.$archiver !== "NSKeyedArchiver")
+        throw new KeyedArchiveKindError(`Selected property list is not an NSKeyedArchiver archive: ${archiverMismatch(archive)}`, "property-list");
+    if (!Array.isArray(archive.$objects))
         throw new TypeError("Expected NSKeyedArchiver with an $objects array");
     const table = archive.$objects;
     if (table.length > 200_000)

package/dist/domain/artifactComparison.js

@@ -1,3 +1,4 @@
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { z } from "zod";
 import {} from "./artifactGraph.js";
 import { evidenceSchema } from "./evidence.js";
@@ -111,7 +112,7 @@ export const compareArtifacts = (leftEvidence, rightEvidence) => {
         right_manifest_id: right.inventory.manifest.manifest_id,
         summary,
         changes,
-        limitations: [...new Set(limitations)].sort((a, b) => a.localeCompare(b)),
+        limitations: [...new Set(limitations)].sort(compareCodePoints),
     });
 };
 const compareOccurrences = (left, right, evidenceLinks, complete) => {
@@ -123,7 +124,7 @@ const compareOccurrences = (left, right, evidenceLinks, complete) => {
     const rightRelations = relationsByPath(right);
     const paths = [
         ...new Set([...leftByPath.keys(), ...rightByPath.keys()]),
-    ].sort((a, b) => a.localeCompare(b, "en"));
+    ].sort(compareCodePoints);
     const output = [];
     for (const path of paths) {
         const leftOccurrence = leftByPath.get(path);
@@ -208,8 +209,17 @@ const changedDimensions = (input) => {
         return ["availability"];
     const checks = [
         ["content", left.sha256 !== right.sha256],
-        ["kind", left.kind !== right.kind],
-        ["format", left.format !== right.format],
+        [
+            "kind",
+            input.leftOccurrence?.artifact_kind !==
+                input.rightOccurrence?.artifact_kind,
+        ],
+        [
+            "format",
+            left.format !== right.format ||
+                input.leftOccurrence?.artifact_format !==
+                    input.rightOccurrence?.artifact_format,
+        ],
         ["size", left.size !== right.size],
         [
             "executable",
@@ -228,7 +238,6 @@ const changedDimensions = (input) => {
 };
 const metadataChanged = (input, left, right) => left.media_type !== right.media_type ||
     left.architecture !== right.architecture ||
-    left.executable !== right.executable ||
     left.content_state !== right.content_state ||
     input.leftOccurrence?.entry_kind !== input.rightOccurrence?.entry_kind ||
     input.leftOccurrence?.encrypted !== input.rightOccurrence?.encrypted ||
@@ -262,7 +271,7 @@ const relationsByPath = (inventory) => {
             values.push(projection);
     }
     for (const values of output.values())
-        values.sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)));
+        values.sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right)));
     return output;
 };
 const summarize = (left, right, changes, covered) => {

package/dist/domain/artifactGraph.js

@@ -55,6 +55,19 @@ const artifactFormatSchema = z.enum([
     "file",
     "unknown",
 ]);
+/** Formats established from bytes or a virtual directory tree, independent of path roles. */
+const artifactContentFormatSchema = artifactFormatSchema.extract([
+    "zip",
+    "mach-o-universal",
+    "mach-o",
+    "elf",
+    "pe",
+    "dos-mz",
+    "plist",
+    "directory",
+    "file",
+    "unknown",
+]);
 /** File byte interval for an artifact derived without writing it to disk. */
 const artifactByteRangeSchema = z.object({
     offset: z.number().int().min(0),
@@ -72,13 +85,11 @@ const artifactCommandSchema = z.object({
 /** One content-addressed application artifact in deterministic manifest order. */
 const artifactNodeSchema = z.object({
     artifact_id: artifactIdSchema,
-    kind: artifactKindSchema,
-    format: artifactFormatSchema,
+    format: artifactContentFormatSchema,
     sha256: sha256Schema,
     size: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
     media_type: z.string().min(1).nullable(),
     architecture: z.string().min(1).nullable(),
-    executable: z.boolean(),
     content_state: z.enum(["materialized", "embedded", "virtual"]),
     limitations: z.array(z.string()),
 });
@@ -89,6 +100,8 @@ const artifactOccurrenceSchema = z.object({
     parent_occurrence_id: occurrenceIdSchema.nullable(),
     logical_path: boundedRelativePathSchema,
     entry_kind: z.enum(["file", "directory", "symlink", "slice"]),
+    artifact_kind: artifactKindSchema,
+    artifact_format: artifactFormatSchema,
     declared_size: z
         .number()
         .int()

package/dist/domain/artifactInventoryEvidence.js

@@ -1,9 +1,9 @@
 import { artifactInventoryResultSchema, } from "./artifactGraph.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { canonicalJson } from "./comparisonSemantics.js";
 import { artifactContradictionId, artifactEdgeId, artifactGraphDigest, artifactIdForContent, artifactManifestId, occurrenceIdForLocation, } from "./artifactIdentity.js";
 import { parseEvidence } from "./evidence.js";
 import { artifactInspectionResultSchema } from "./artifactInspection.js";
-import { err, ok } from "./result.js";
 /** Parse, merge, and verify inventory Evidence pages. */
 export const parseArtifactInventoryEvidence = (input) => assembleInventorySet((Array.isArray(input) ? input : [input]).map((value) => {
     const evidence = parseEvidence(value);
@@ -33,17 +33,6 @@ const validateInventoryPage = (inventory) => {
         if (node.artifact_id !== artifactIdForContent(node.sha256))
             throw new TypeError("Artifact node ID is not content-addressed");
 };
-/**
- * Result-returning seam for the empty-pages leaf. Other assembly failures
- * still throw TypeError (migration in progress); parseArtifactInventoryEvidence
- * keeps its throwing contract until callers switch.
- */
-export const tryAssembleInventorySet = (pages) => pages.length === 0
-    ? err({
-        code: "empty",
-        message: "Artifact inventory requires Evidence pages",
-    })
-    : ok(assembleInventorySet(pages));
 const assembleInventorySet = (pages) => {
     const first = pages[0];
     if (first === undefined)
@@ -79,9 +68,9 @@ const assembleInventorySet = (pages) => {
     return { evidence: pages.map(({ evidence }) => evidence), inventory };
 };
 const orderedInventory = (first, pages, values) => {
-    const nodes = [...values.nodes.values()].sort((left, right) => left.artifact_id.localeCompare(right.artifact_id));
-    const occurrences = [...values.occurrences.values()].sort((left, right) => left.logical_path.localeCompare(right.logical_path, "en"));
-    const edges = [...values.edges.values()].sort((left, right) => left.edge_id.localeCompare(right.edge_id));
+    const nodes = [...values.nodes.values()].sort((left, right) => compareCodePoints(left.artifact_id, right.artifact_id));
+    const occurrences = [...values.occurrences.values()].sort((left, right) => compareCodePoints(left.logical_path, right.logical_path));
+    const edges = [...values.edges.values()].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id));
     return {
         manifest: first.manifest,
         nodes,
@@ -90,7 +79,7 @@ const orderedInventory = (first, pages, values) => {
         integrityContradictions: first.integrity_contradictions,
         limitations: [
             ...new Set(pages.flatMap(({ inventory }) => inventory.limitations)),
-        ].sort((left, right) => left.localeCompare(right)),
+        ].sort(compareCodePoints),
         complete: nodes.length === first.manifest.node_count &&
             occurrences.length === first.manifest.occurrence_count &&
             edges.length === first.manifest.edge_count,
@@ -102,6 +91,10 @@ const validateCompleteInventory = (inventory) => {
     const rootNode = inventory.nodes.find(({ artifact_id: id }) => id === inventory.manifest.root_artifact_id);
     if (rootNode?.sha256 !== inventory.manifest.root_sha256)
         throw new TypeError("Artifact root node does not match its manifest digest");
+    const rootOccurrence = inventory.occurrences.find(({ logical_path }) => logical_path === ".");
+    if (rootOccurrence?.artifact_id !== inventory.manifest.root_artifact_id ||
+        rootOccurrence.artifact_format !== inventory.manifest.root_format)
+        throw new TypeError("Artifact root occurrence does not match its manifest representation");
     for (const occurrence of inventory.occurrences)
         validateOccurrence(occurrence, inventory, nodeIds, occurrenceIds);
     for (const edge of inventory.edges)