rea-agents 6.1.0 → 6.3.0

package/dist/domain/residualUnknown.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const unknownIdSchema = prefixedDigestSchema("unk");
@@ -232,5 +233,5 @@ const canonicalJson = (value) => {
         throw new TypeError("Unknown identity failed");
     return serialized;
 };
-const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right));
-const sortedRelationships = (values) => [...values].sort((left, right) => `${left.type}:${left.unknown_id}`.localeCompare(`${right.type}:${right.unknown_id}`));
+const sortedUnique = (values) => [...new Set(values)].sort(compareUnicodeCodePoints);
+const sortedRelationships = (values) => [...values].sort((left, right) => compareUnicodeCodePoints(compositeKey([left.type, left.unknown_id]), compositeKey([right.type, right.unknown_id])));

package/dist/domain/staticRuntimeCorrelation.js

@@ -3,11 +3,12 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
-import { functionComparisonResultSchema } from "./functionComparison.js";
+import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
 import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
-import { comparisonStatusSchema, processCaptureComparisonSchema, } from "./process/processCapture.js";
+import { comparisonStatusSchema, processCaptureComparisonSchema, } from "./process/processComparison.js";
 import { PROCESS_COMPARISON_DIMENSIONS } from "./process/processComparison.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
@@ -146,7 +147,7 @@ export const correlateStaticAndRuntime = (input) => {
     const runtimeById = byId(runtimeEvidence);
     const correlations = parsed.mappings
         .map((mapping) => correlate(mapping, staticById, runtimeById))
-        .sort((left, right) => left.correlation_id.localeCompare(right.correlation_id, "en"));
+        .sort((left, right) => compareUnicodeCodePoints(left.correlation_id, right.correlation_id));
     if (new Set(correlations.map(({ correlation_id: id }) => id)).size !==
         correlations.length)
         throw new TypeError("Static/runtime correlation rejects duplicate mappings");

package/dist/domain/stringPatterns.js

@@ -0,0 +1,6 @@
+/** Portable ASCII identifier starting with a letter. */
+export const IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9._\x2d]*$/u;
+/** Stable evidence identifier, also admitting namespace and path separators. */
+export const STABLE_IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9._:\x2f\x2d]*$/u;
+/** Canonical padded base64, including zero pad bits and the empty encoding. */
+export const CANONICAL_BASE64_PATTERN = /^(?:[A-Za-z0-9+\x2f]{4})*(?:[A-Za-z0-9+\x2f][AQgw]==|[A-Za-z0-9+\x2f]{2}[AEIMQUYcgkosw048]=)?$/;

package/dist/domain/swiftSymbolClassification.js

@@ -0,0 +1,66 @@
+const LEGACY_CATEGORIES = [
+    ["_TtC", "classes"],
+    ["_TtV", "structs"],
+    ["_TtO", "enums"],
+    ["_TtP", "protocols"],
+    ["_TtE", "extensions"],
+];
+const NOMINAL_CATEGORIES = new Map([
+    ["C", "classes"],
+    ["V", "structs"],
+    ["O", "enums"],
+    ["P", "protocols"],
+]);
+/**
+ * Recognize Swift manglings and decode literal module/nominal contexts.
+ * Substitutions, generic contexts, and other encodings remain unknown.
+ */
+export const classifySwiftSymbol = (name) => {
+    const prefix = /^_?(?:\$[sS]|_T0)/u.exec(name);
+    if (prefix === null) {
+        if (!name.includes("_Tt"))
+            return undefined;
+        return {
+            category: LEGACY_CATEGORIES.find(([prefix]) => name.startsWith(prefix))?.[1] ??
+                null,
+        };
+    }
+    const mangling = name.slice(prefix[0].length);
+    let offset = identifierEnd(mangling, 0);
+    if (offset === undefined)
+        return { category: null };
+    let category = null;
+    for (;;) {
+        const end = identifierEnd(mangling, offset);
+        if (end === undefined)
+            break;
+        const kind = mangling.charAt(end);
+        const nominal = NOMINAL_CATEGORIES.get(kind);
+        if (nominal === undefined) {
+            // Current swiftc emits protocol descriptors as `…<Nominal>Mp` without
+            // the nominal `P` marker (e.g. `_$s4main7ScoringMp`). Decode that exact
+            // suffix; unknown substitution encodings stay unclassified, never guessed.
+            if (mangling.slice(end) === "Mp")
+                category = "protocols";
+            else if (kind === "E" && category !== null)
+                category = "extensions";
+            break;
+        }
+        category = nominal;
+        offset = end + 1;
+    }
+    return { category };
+};
+const identifierEnd = (mangling, offset) => {
+    const lengthToken = /^[1-9][0-9]*/u.exec(mangling.slice(offset))?.[0];
+    if (lengthToken === undefined)
+        return undefined;
+    const start = offset + lengthToken.length;
+    const end = start + Number(lengthToken);
+    // Swift identifiers with substitutions/punycode need a fuller decoder.
+    if (!Number.isSafeInteger(end) ||
+        end > mangling.length ||
+        !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(mangling.slice(start, end)))
+        return undefined;
+    return end;
+};

package/dist/domain/symbolAnalysis.js

@@ -1,7 +1,20 @@
+import { classifySwiftSymbol, } from "./swiftSymbolClassification.js";
+/** Objective-C class definition markers emitted by modern Apple clang. */
+const OBJC_CLASS_MARKER = "OBJC_CLASS_$_";
+/** Local class records emitted by Apple's fragile Objective-C ABI. */
+const LEGACY_OBJC_CLASS_PREFIX = "l_OBJC_CLASS_";
+/**
+ * Objective-C protocol declaration marker. `PROTOCOL_REFERENCE` slots
+ * share the substring but are uses, not definitions.
+ */
+const OBJC_PROTOCOL_MARKER = "OBJC_PROTOCOL_$_";
 /** Select and deduplicate Objective-C class labels. */
 export const discoverObjcClasses = (names, pattern) => {
     const classes = uniqueByName(names
-        .filter(({ name }) => ["OBJC_CLASS", "OBJC_$_CLASS"].some((marker) => name.includes(marker)))
+        .filter(({ name }) => name.includes(OBJC_CLASS_MARKER) ||
+        (name.startsWith(LEGACY_OBJC_CLASS_PREFIX) &&
+            name.length > LEGACY_OBJC_CLASS_PREFIX.length &&
+            !/^l_OBJC_CLASS_NAME_(?:\.\d+)?$/u.test(name)))
         .filter(({ name }) => pattern.length === 0 || name.includes(pattern)));
     return {
         count: classes.length,
@@ -10,39 +23,89 @@ export const discoverObjcClasses = (names, pattern) => {
 };
 /** Select and deduplicate Objective-C and Swift protocol labels. */
 export const discoverObjcProtocols = (names) => {
-    const protocols = uniqueByName(names.filter(({ name }) => name.includes("OBJC_PROTOCOL") || name.includes("_TtP")));
+    const protocols = uniqueByName(names.filter(({ name }) => name.includes(OBJC_PROTOCOL_MARKER) ||
+        name.includes("_TtP") ||
+        (name.endsWith("Mp") &&
+            classifySwiftSymbol(name)?.category === "protocols")));
     return {
         count: protocols.length,
         protocols: protocols.map(toJsonEntry),
     };
 };
-const SWIFT_CATEGORIES = [
-    ["classes", "_TtC"],
-    ["structs", "_TtV"],
-    ["enums", "_TtO"],
-    ["protocols", "_TtP"],
-    ["extensions", "_TtE"],
-];
-/** Categorize deduplicated Swift mangled symbols. */
-export const categorizeSwiftTypes = (procedures, filter = {}) => {
-    const groups = Object.fromEntries([...SWIFT_CATEGORIES.map(([category]) => category), "other"].map((category) => [category, []]));
+/** Categorize procedure names using Swift manglings at their exact addresses. */
+export const categorizeSwiftTypes = (procedures, filter = {}, symbols = []) => {
+    const groups = Object.fromEntries(["classes", "structs", "enums", "protocols", "extensions", "other"].map((category) => [category, []]));
+    const aliases = swiftAliasesByAddress(symbols);
+    const pattern = filter.pattern;
     const seen = new Set();
+    const unclassifiedNames = new Set();
+    const unclassified = [];
     for (const entry of procedures) {
-        if (!entry.name.includes("_Tt") || seen.has(entry.name))
+        if (seen.has(entry.name))
             continue;
-        const category = SWIFT_CATEGORIES.find(([, prefix]) => entry.name.startsWith(prefix))?.[0] ?? "other";
-        if (filter.category !== undefined && filter.category !== category)
+        const mangledNames = [
+            ...new Set([
+                ...(classifySwiftSymbol(entry.name) === undefined ? [] : [entry.name]),
+                ...(aliases.get(entry.address) ?? []),
+            ]),
+        ];
+        if (mangledNames.length === 0)
             continue;
-        if (filter.pattern !== undefined && !entry.name.includes(filter.pattern))
+        if (pattern !== undefined &&
+            ![entry.name, ...mangledNames].some((name) => name.includes(pattern)))
             continue;
-        seen.add(entry.name);
-        groups[category]?.push(entry);
+        const kinds = new Set(mangledNames.map((name) => classifySwiftSymbol(name)?.category ?? null));
+        const category = kinds.size === 1 ? ([...kinds][0] ?? null) : null;
+        const item = {
+            address: entry.address,
+            name: entry.name,
+            mangled_names: mangledNames,
+        };
+        if (category === null && !unclassifiedNames.has(entry.name)) {
+            unclassifiedNames.add(entry.name);
+            unclassified.push({
+                ...item,
+                reason: kinds.size > 1 && !kinds.has(null)
+                    ? "conflicting_categories"
+                    : "category_not_decoded",
+            });
+        }
+        const bucket = category ?? "other";
+        if (filter.category === undefined || filter.category === bucket) {
+            seen.add(entry.name);
+            groups[bucket]?.push(item);
+        }
     }
     const categories = Object.fromEntries(Object.entries(groups).map(([category, items]) => [
         category,
-        { count: items.length, items: items.map(toJsonEntry) },
+        { count: items.length, items },
     ]));
-    return { total: seen.size, categories };
+    return {
+        total: Object.values(groups).reduce((sum, items) => sum + items.length, 0),
+        categories,
+        unclassified,
+        limitations: [
+            "Identification uses Swift mangled procedure names or same-address symbol aliases. Demangled names without retained Swift manglings cannot be identified. Counts deduplicate procedure names, not source declarations.",
+            ...(unclassified.length === 0
+                ? []
+                : [
+                    "Some Swift categories could not be established from the retained manglings. Unclassified observations remain inline regardless of the category filter.",
+                ]),
+        ],
+    };
+};
+const swiftAliasesByAddress = (symbols) => {
+    const aliases = new Map();
+    for (const { address, name } of symbols) {
+        if (classifySwiftSymbol(name) === undefined)
+            continue;
+        const existing = aliases.get(address);
+        if (existing === undefined)
+            aliases.set(address, [name]);
+        else
+            existing.push(name);
+    }
+    return aliases;
 };
 const uniqueByName = (entries) => {
     const seen = new Set();

package/dist/domain/unicodeCodePointOrder.js

@@ -15,3 +15,9 @@ export const compareUnicodeCodePoints = (left, right) => {
         return 0;
     return leftIndex === left.length ? -1 : 1;
 };
+/**
+ * Collision-free composite key for deduplication/sorting. `\0`-joins
+ * collide when any component contains NUL (valid in JS property names);
+ * a JSON tuple escapes every component. Single owner for composite keys.
+ */
+export const compositeKey = (parts) => JSON.stringify(parts);

package/dist/domain/webBundleAnalyzerInspection.js

@@ -1,6 +1,7 @@
 import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
+import { compositeKey } from "./unicodeCodePointOrder.js";
 import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
 import { classifyParsedJavaScriptOpenReceivers } from "./javascript/javascriptSemanticAnalysis.js";
 import { semanticStaticPropertyName } from "./javascript/javascriptAstValues.js";
@@ -169,7 +170,14 @@ const addWebMcpDeclaration = (script, node, accumulator) => {
             ].filter(Boolean)
             : [])
         : [];
-    const key = `webmcp\0${script.script_key}\0${name ?? ""}\0${schemaPropertyNames.join("\0")}`;
+    // Property names are a variable-length source-derived list: NUL-joins
+    // would collapse ["a\0b"] with ["a", "b"] and drop a declaration.
+    const key = compositeKey([
+        "webmcp",
+        script.script_key,
+        name ?? "",
+        schemaPropertyNames,
+    ]);
     addUnique(accumulator, key, () => accumulator.webMcp.push({
         name: name ?? null,
         description: description ?? null,

package/dist/domain/webCaptureDiff.js

@@ -1,6 +1,6 @@
-import { canonicalDigest } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { webCaptureDiffSchema, } from "./webCaptureDiffSchemas.js";
-export { captureSnapshotSchema, compareWebCapturesInputSchema, webCaptureDiffSchema, } from "./webCaptureDiffSchemas.js";
 /** Compare normalized observations without treating incomplete absence as proof. */
 export const compareWebCaptures = (input) => {
     const before = input.before.inspection;
@@ -42,8 +42,8 @@ const compareIdentities = (before, after) => {
     for (const identity of after.keys())
         if (!before.has(identity))
             changes.push({ identity, change: "added" });
-    return changes.sort((left, right) => left.identity.localeCompare(right.identity) ||
-        left.change.localeCompare(right.change));
+    return changes.sort((left, right) => compareUnicodeCodePoints(left.identity, right.identity) ||
+        compareUnicodeCodePoints(left.change, right.change));
 };
 const compareDimension = (before, after, complete, reason) => {
     const all = compareIdentities(before, after).filter(({ change }) => complete || change === "modified");
@@ -73,7 +73,7 @@ const accessibilityDimension = (before, after) => {
     const afterAccess = accessibilityComparable(after);
     const textComparable = beforeAccess.text && afterAccess.text;
     const nodesComparable = beforeAccess.nodes && afterAccess.nodes;
-    return compareDimension(singleton("accessibility_tree", digest(accessibilityProjection(before.accessibility, textComparable, nodesComparable))), singleton("accessibility_tree", digest(accessibilityProjection(after.accessibility, textComparable, nodesComparable))), beforeAccess.complete && afterAccess.complete, "Accessibility tree or text capture was incomplete in at least one observation.");
+    return compareDimension(singleton("accessibility_tree", digestCanonicalValue(accessibilityProjection(before.accessibility, textComparable, nodesComparable))), singleton("accessibility_tree", digestCanonicalValue(accessibilityProjection(after.accessibility, textComparable, nodesComparable))), beforeAccess.complete && afterAccess.complete, "Accessibility tree or text capture was incomplete in at least one observation.");
 };
 const storageDimension = (before, after) => {
     const keysComplete = storageKeysComparable(before) && storageKeysComparable(after);
@@ -87,32 +87,65 @@ const storageDimension = (before, after) => {
 const compareWebCaptureDimensions = (input) => {
     const before = input.before.inspection;
     const after = input.after.inspection;
-    const dimension = compareDimension;
     return {
-        dom_structure: dimension(singleton("document", digest(domProjection(before))), singleton("document", digest(domProjection(after))), sectionsComplete(before, ["frames", "dom"]) &&
+        dom_structure: compareDimension(singleton("document", digestCanonicalValue(domProjection(before))), singleton("document", digestCanonicalValue(domProjection(after))), sectionsComplete(before, ["frames", "dom"]) &&
             sectionsComplete(after, ["frames", "dom"]), "DOM or frame capture was incomplete in at least one observation."),
-        scripts: dimension(keyed(before.scripts.items.map(scriptProjection), (item) => item.script_key), keyed(after.scripts.items.map(scriptProjection), (item) => item.script_key), sectionsComplete(before, ["scripts"]) &&
+        scripts: compareDimension(keyed(before.scripts.items.map(scriptProjection), (item) => item.script_key), keyed(after.scripts.items.map(scriptProjection), (item) => item.script_key), sectionsComplete(before, ["scripts"]) &&
             sectionsComplete(after, ["scripts"]), "Script inventory was incomplete in at least one observation."),
-        resources: dimension(keyed(before.resources, (item) => item.resource_key), keyed(after.resources, (item) => item.resource_key), sectionsComplete(before, ["resources"]) &&
+        resources: compareDimension(keyed(before.resources, (item) => item.resource_key), keyed(after.resources, (item) => item.resource_key), sectionsComplete(before, ["resources"]) &&
             sectionsComplete(after, ["resources"]), "Resource inventory was incomplete in at least one observation."),
-        network: dimension(networkMap(before), networkMap(after), sectionsComplete(before, ["network_requests"]) &&
-            sectionsComplete(after, ["network_requests"]), "Network capture is attach-window limited or incomplete."),
-        metadata: dimension(singleton("metadata", digest(metadataProjection(before))), singleton("metadata", digest(metadataProjection(after))), sectionsComplete(before, ["metadata"]) &&
+        network: networkDimension(before, after),
+        metadata: compareDimension(singleton("metadata", digestCanonicalValue(metadataProjection(before))), singleton("metadata", digestCanonicalValue(metadataProjection(after))), sectionsComplete(before, ["metadata"]) &&
             sectionsComplete(after, ["metadata"]), "Safe metadata capture was incomplete in at least one observation."),
-        webmcp: dimension(webMcpMap(input.before.webmcp), webMcpMap(input.after.webmcp), webMcpComplete(input.before.webmcp) && webMcpComplete(input.after.webmcp), "WebMCP discovery was unavailable or incomplete in at least one capture."),
+        webmcp: compareDimension(webMcpMap(input.before.webmcp), webMcpMap(input.after.webmcp), webMcpComplete(input.before.webmcp) && webMcpComplete(input.after.webmcp), "WebMCP discovery was unavailable or incomplete in at least one capture."),
         accessibility: accessibilityDimension(before, after),
         storage: storageDimension(before, after),
     };
 };
-const keyed = (values, identity) => new Map(values.map((value) => [identity(value), digest(value)]));
-const networkMap = (inspection) => {
+const keyed = (values, identity) => new Map(values.map((value) => [identity(value), digestCanonicalValue(value)]));
+const bodyShapesSelected = (inspection) => !inspection.completeness.excluded.some(({ section, reason }) => section === "json_body_shapes" && reason === "not_approved") &&
+    (inspection.network.requests.length === 0 ||
+        inspection.network.requests.some(({ body_shapes }) => body_shapes.status !== "not_approved"));
+const networkIdentity = (request) => `net_${digestCanonicalValue({ method: request.method, url: request.url, resource_type: request.resource_type })}`;
+const networkDimension = (before, after) => {
+    const selected = bodyShapesSelected(before) && bodyShapesSelected(after);
+    const sources = new Map();
+    if (selected) {
+        const observedSources = (inspection) => {
+            const result = new Map();
+            for (const request of inspection.network.requests) {
+                const identity = networkIdentity(request);
+                const previous = result.get(identity);
+                result.set(identity, {
+                    request: previous?.request !== false && request.body_shapes.request !== null,
+                    response: previous?.response !== false &&
+                        request.body_shapes.response !== null,
+                });
+            }
+            return result;
+        };
+        const left = observedSources(before);
+        const right = observedSources(after);
+        for (const [identity, coverage] of left) {
+            const next = right.get(identity);
+            sources.set(identity, {
+                request: coverage.request && next?.request === true,
+                response: coverage.response && next?.response === true,
+            });
+        }
+    }
+    const shapesComplete = !selected ||
+        [before, after].every((inspection) => sectionsComplete(inspection, ["json_body_shapes"]) &&
+            inspection.network.requests.every(({ body_shapes }) => body_shapes.status === "included"));
+    return compareDimension(networkMap(before, sources), networkMap(after, sources), sectionsComplete(before, ["network_requests"]) &&
+        sectionsComplete(after, ["network_requests"]) &&
+        shapesComplete, "Network capture or selected JSON body-shape coverage is attach-window limited, unavailable, or incomplete.");
+};
+const networkMap = (inspection, sources) => {
     const grouped = new Map();
     for (const request of inspection.network.requests) {
-        const identity = `net_${digest({
-            method: request.method,
-            url: request.url,
-            resource_type: request.resource_type,
-        })}`;
+        const identity = networkIdentity(request);
+        const shapes = sources.get(identity);
         const values = grouped.get(identity) ?? [];
         values.push({
             status: request.status,
@@ -120,13 +153,18 @@ const networkMap = (inspection) => {
             encoded_data_length: request.encoded_data_length,
             redirects: (request.redirects ?? []).map(({ request_timestamp: _requestTimestamp, redirect_event_timestamp: _redirectEventTimestamp, ...redirect }) => redirect),
             initiator: request.initiator,
-            body_shapes: request.body_shapes,
+            ...(shapes?.request === true
+                ? { request_shape: request.body_shapes.request }
+                : {}),
+            ...(shapes?.response === true
+                ? { response_shape: request.body_shapes.response }
+                : {}),
         });
         grouped.set(identity, values);
     }
     return new Map([...grouped].map(([identity, values]) => [
         identity,
-        digest(values.map((value) => digest(value)).sort()),
+        digestCanonicalValue(values.map((value) => digestCanonicalValue(value)).sort()),
     ]));
 };
 const webMcpMap = (discovery) => discovery === null
@@ -148,7 +186,9 @@ const incompleteSections = (completeness) => new Set([
 const domProjection = (inspection) => ({
     frames: inspection.frames
         .map(({ url, origin }) => ({ url, origin }))
-        .sort((left, right) => left.url.localeCompare(right.url)),
+        .sort((left, right) => compareUnicodeCodePoints(left.url, right.url) ||
+        compareUnicodeCodePoints(left.origin ?? "", right.origin ?? "") ||
+        Number(left.origin !== null) - Number(right.origin !== null)),
     nodes: inspection.dom.nodes.map(({ index: _index, ...node }) => node),
 });
 const scriptProjection = (script) => ({
@@ -163,17 +203,18 @@ const scriptProjection = (script) => ({
 const metadataProjection = (inspection) => ({
     responses: inspection.metadata.responses
         .map(({ request_id: _requestId, ...response }) => response)
-        .map((value) => digest(value))
+        .map((value) => digestCanonicalValue(value))
+        .sort(),
+    dom_urls: inspection.metadata.dom_urls
+        .map((value) => digestCanonicalValue(value))
         .sort(),
-    dom_urls: inspection.metadata.dom_urls.map((value) => digest(value)).sort(),
     agent_hints: inspection.metadata.agent_hints
-        .map((value) => digest(value))
+        .map((value) => digestCanonicalValue(value))
         .sort(),
     excluded_dom_urls: inspection.metadata.excluded_dom_urls,
     headers_allowlisted: inspection.metadata.headers_allowlisted,
 });
 const singleton = (key, value) => new Map([[key, value]]);
-const digest = (value) => canonicalDigest(value);
 const accessibilityComparable = (inspection) => {
     const text = inspection.accessibility.text_capture.status === "included" &&
         inspection.accessibility.text_capture.excluded_fields === 0;
@@ -210,7 +251,7 @@ const storageMap = (storage, includeKeys, includeUsage, fingerprintIdentities) =
     const map = new Map([
         [
             "storage:summary",
-            digest({
+            digestCanonicalValue({
                 origin: storage.origin,
                 values_redacted: storage.values_redacted,
                 ...(includeUsage
@@ -226,7 +267,7 @@ const storageMap = (storage, includeKeys, includeUsage, fingerprintIdentities) =
         return map;
     const add = (kind, keys) => {
         for (const key of keys) {
-            map.set(`storage:${kind}:${key}`, digest(key));
+            map.set(`storage:${kind}:${key}`, digestCanonicalValue(key));
         }
     };
     add("local_storage", storage.local_storage_keys);
@@ -237,7 +278,7 @@ const storageMap = (storage, includeKeys, includeUsage, fingerprintIdentities) =
         const identity = `${fingerprint.scope}:${fingerprint.identity_sha256}`;
         if (!fingerprintIdentities.has(identity))
             continue;
-        map.set(`storage:content:${identity}`, digest(fingerprint.value_sha256));
+        map.set(`storage:content:${identity}`, digestCanonicalValue(fingerprint.value_sha256));
     }
     return map;
 };

package/dist/domain/webCaptureDiffSchemas.js

@@ -1,11 +1,14 @@
 import { z } from "zod";
 import { emptyArraySchema } from "./emptyArraySchema.js";
-import { webPageInspectionSchema } from "./browserObservation.js";
+import { webPageInspectionSchema } from "./browserObservationSchemas.js";
 import { webMcpDiscoverySchema } from "./webMcpDiscovery.js";
 /** One normalized passive page snapshot accepted by capture comparison. */
 export const captureSnapshotSchema = z.object({
-    inspection: webPageInspectionSchema,
-    webmcp: webMcpDiscoverySchema.nullable().default(null),
+    inspection: webPageInspectionSchema.describe("Complete normalized_result from inspect_web_page, including capture identity, observations, completeness, and limitations."),
+    webmcp: webMcpDiscoverySchema
+        .nullable()
+        .default(null)
+        .describe("Complete normalized_result from discover_webmcp_tools for this capture, or null when it was not recorded."),
 });
 /** Input for deterministic comparison of two normalized web captures. */
 export const compareWebCapturesInputSchema = z.strictObject({
@@ -47,12 +50,6 @@ const dimensionSchema = z.union([
         reason: z.string(),
     }),
 ]);
-const legacyUnknownDimension = {
-    status: "unknown",
-    total_changes: 0,
-    changes: [],
-    reason: "Dimension was not recorded by this version 1 capture diff.",
-};
 /** Completeness-aware changes across stable browser evidence dimensions. */
 export const webCaptureDiffSchema = z
     .object({
@@ -66,8 +63,8 @@ export const webCaptureDiffSchema = z
         network: dimensionSchema,
         metadata: dimensionSchema,
         webmcp: dimensionSchema,
-        accessibility: dimensionSchema.default(legacyUnknownDimension),
-        storage: dimensionSchema.default(legacyUnknownDimension),
+        accessibility: dimensionSchema,
+        storage: dimensionSchema,
     }),
     limitations: z.array(z.string()),
 })

package/dist/domain/webEventListeners.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
-import { webRuntimeBrowserSchema, webRuntimeLocationSchema, webRuntimeScopeSchema, webRuntimeSourceSchema, webRuntimeTargetSchema, } from "./webRuntime.js";
+import { webRuntimeLocationSchema, webRuntimeScopeSchema, webRuntimeSourceSchema, webRuntimeTargetSchema, } from "./webRuntime.js";
+import { browserVersionSchema } from "./browserObservationSchemas.js";
 /** Inspect listeners registered directly on the first main-document CSS match. */
 export const inspectWebEventListenersInputSchema = webRuntimeScopeSchema.extend({
     selector: z.string().min(1),
 });
 /** A listener declaration and its source location do not establish that it ran. */
 export const webEventListenersSchema = z.object({
-    browser: webRuntimeBrowserSchema,
+    browser: browserVersionSchema,
     target: webRuntimeTargetSchema,
     inspected_at: z.iso.datetime(),
     selected_node: z.object({

package/dist/domain/webExecution.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { jsonObjectSchema } from "./jsonValue.js";
-import { webRuntimeBrowserSchema, webRuntimeLocationSchema, webRuntimeScopeSchema, webRuntimeSourceSchema, webRuntimeTargetSchema, } from "./webRuntime.js";
+import { webRuntimeLocationSchema, webRuntimeScopeSchema, webRuntimeSourceSchema, webRuntimeTargetSchema, } from "./webRuntime.js";
+import { browserVersionSchema } from "./browserObservationSchemas.js";
 /** Explicit instrumentation request for one finite, externally driven execution window. */
 export const observeWebExecutionInputSchema = webRuntimeScopeSchema.extend({
     observation_ms: z.number().int().min(1).max(2_147_483_647).default(10_000),
@@ -18,7 +19,7 @@ const functionSchema = z.object({
 });
 /** Precise V8 ranges retain their nested structure and counts without summing them. */
 export const webExecutionSchema = z.object({
-    browser: webRuntimeBrowserSchema,
+    browser: browserVersionSchema,
     target: webRuntimeTargetSchema,
     window: z.object({
         armed_at: z.iso.datetime(),

package/dist/domain/webInventory.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /** Assign deterministic identities to a bounded resource inventory. */
 export const stableWebResources = (resources) => {
     const keyed = resources.map((resource) => ({
@@ -8,8 +9,8 @@ export const stableWebResources = (resources) => {
     }));
     return [
         ...new Map(keyed.map((resource) => [resource.resource_key, resource])).values(),
-    ].sort((left, right) => left.resource_key.localeCompare(right.resource_key) ||
-        left.url.localeCompare(right.url));
+    ].sort((left, right) => compareUnicodeCodePoints(left.resource_key, right.resource_key) ||
+        compareUnicodeCodePoints(left.url, right.url));
 };
 /** Reconcile one script with resource-tree observations without fuzzy matching. */
 export const reconcileWebScript = (script, resources) => {

package/dist/domain/webMcpDiscovery.js

@@ -2,8 +2,8 @@ import { z } from "zod";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
 import { browserVersionSchema } from "./browserObservationSchemas.js";
-import { jsonShapeSchema } from "./jsonShape.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { jsonValueSchema } from "./jsonValue.js";
+import { digestSchema, prefixedDigestSchema } from "./../domain/digests.js";
 /** Input for passive discovery of page-registered WebMCP tools. */
 export const discoverWebMcpToolsInputSchema = z.strictObject({
     cdp_endpoint: browserEndpointSchema,
@@ -19,7 +19,8 @@ const webMcpToolSchema = z.object({
     frame_url: z.string(),
     owner_origin: z.string(),
     declaration_kind: z.enum(["declarative", "imperative"]),
-    input_schema_shape: jsonShapeSchema.nullable(),
+    input_schema: jsonValueSchema.nullable(),
+    input_schema_sha256: digestSchema.nullable(),
     annotations: z.object({
         read_only: z.boolean().nullable(),
         untrusted_content: z.boolean().nullable(),

package/dist/domain/webRuntime.js

@@ -71,8 +71,6 @@ export const webRuntimeTargetSchema = z.object({
     frame_id: z.string().min(1),
     loader_id: z.string().nullable(),
 });
-/** Producer product identity is observed separately from the unknown host platform. */
-export const webRuntimeBrowserSchema = browserVersionSchema;
 /** Complete runtime evidence has explicit byte budgets rather than silent item truncation. */
 export const WEB_RUNTIME_LIMITS = {
     protocolBytes: 64 * 1024 * 1024,

package/dist/domain/webScriptExport.js

@@ -18,13 +18,13 @@ const sourceSchema = z.discriminatedUnion("kind", [
         kind: z.literal("page-script"),
         script_key: z.string().min(1),
         frame_id: z.string().nullable(),
-        is_module: z.boolean(),
+        is_module: z.boolean().nullable(),
         language: z.string().nullable(),
         source_map_url: z.string().nullable(),
     }),
     z.strictObject({
         kind: z.literal("scenario-response"),
-        transaction_id: z.string().nullable(),
+        transaction_id: z.string().min(1),
         request_sequence: z.number().int().min(1),
         response_sequence: z.number().int().min(1).nullable(),
         status: z.number().nullable(),