rea-agents 6.2.0 → 6.3.0

package/dist/domain/process/processComparison.js

@@ -202,19 +202,6 @@ const differingContractFields = (left, right) => [...new Set([...Object.keys(lef
     !Object.hasOwn(right, field) ||
     canonicalize(left[field]) !== canonicalize(right[field]))
     .sort();
-const truncatedComparison = () => ({
-    status: "truncated",
-    terminal: "truncated",
-    interaction: "truncated",
-    exit: "truncated",
-    filesystem: "truncated",
-    process: "truncated",
-    first_divergence: {
-        status: "unknown",
-        reason: "At least one capture is truncated.",
-    },
-    limitations: ["At least one capture is truncated."],
-});
 const applyTraceVerdict = (dimensions, specification, trace, captures) => {
     const traceShowsDifference = processTraceOutcomesDiffer(trace);
     const traceStatus = trace.verdict === "unknown"
@@ -275,16 +262,6 @@ const compareDimensions = (left, right, sameNormalization) => {
  */
 export const compareProcessCaptures = (left, right, options = {}) => {
     assertComparable(left, right, options);
-    if ((left.truncated && left.truncation_details === undefined) ||
-        (right.truncated && right.truncation_details === undefined)) {
-        const truncated = truncatedComparison();
-        return options.traceSpecification === undefined
-            ? truncated
-            : {
-                ...truncated,
-                trace: compareProcessTraces(left, right, options.traceSpecification),
-            };
-    }
     const sameNormalization = sameJsonValue(left.normalization, right.normalization);
     const exactDimensions = compareDimensions(left, right, sameNormalization);
     const trace = options.traceSpecification === undefined

package/dist/domain/process/processScenario.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 const positiveBudget = z.number().int().safe().positive();
 const timedEventBase = { at_ms: z.number().int().safe().nonnegative() };
 const reservedRunIdEnvironmentName = "REA_PROCESS_RUN_ID";
-const ENVIRONMENT_NAME_CHARACTER = "[^=\\u0000]";
+const ENVIRONMENT_NAME_CHARACTER = "[^=\\x00]";
 /**
  * Nonempty environment names other than the reserved run identifier. The
  * exclusion is spelled as a complement instead of a negative look-ahead,
@@ -18,7 +18,7 @@ const environmentNamePattern = (reserved) => {
         const character = reserved[index] ?? "";
         // Diverge here, match the next reserved character, or (after a nonempty
         // prefix) end the name early.
-        const choice = `[^=\\u0000${character}]${ENVIRONMENT_NAME_CHARACTER}*|${character}${rest}`;
+        const choice = `[^=\\x00${character}]${ENVIRONMENT_NAME_CHARACTER}*|${character}${rest}`;
         rest = index === 0 ? choice : `(?:${choice})?`;
     }
     return new RegExp(`^(?:${rest})$`, "u");
@@ -33,7 +33,7 @@ const environmentName = z
 });
 const childProcessString = z
     .string()
-    .regex(/^[^\u0000]*$/u, "Values passed to operating-system APIs cannot contain NUL");
+    .regex(/^[^\x00]*$/u, "Values passed to operating-system APIs cannot contain NUL");
 export const normalizationSchema = z.object({
     paths: z.boolean(),
     pids: z.boolean(),

package/dist/domain/process/processTraceEvaluation.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { processSourceTruncated } from "./processCaptureCoverage.js";
-import { processObservationLocationSchema, projectProcessObservation, } from "./processObservation.js";
-import { canonicalTraceJson, comparableTracePayload, processTraceCardinalityBounds, } from "./processTraceSpecification.js";
+import { comparableProcessObservationPayload, processObservationLocationSchema, projectProcessObservation, } from "./processObservation.js";
+import { canonicalTraceJson, processTraceCardinalityBounds, } from "./processTraceSpecification.js";
 const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._\x2d]{0,63}$/u);
 const matchedEventSchema = z.strictObject({
     event_id: identifierSchema,
@@ -121,10 +121,10 @@ const matchRecords = (records, specification) => {
     for (const event of specification.events) {
         const ignoredFields = event.ignore_fields ?? [];
         ignoredFieldsBySource.set(event.source, ignoredFields);
-        eventsByKey.set(`${event.source}\0${canonicalTraceJson(comparableTracePayload(event.exact, ignoredFields))}`, event);
+        eventsByKey.set(`${event.source}\0${canonicalTraceJson(comparableProcessObservationPayload(event.exact, ignoredFields))}`, event);
     }
     for (const record of records) {
-        const match = eventsByKey.get(`${record.source}\0${canonicalTraceJson(comparableTracePayload(record.payload, ignoredFieldsBySource.get(record.source)))}`);
+        const match = eventsByKey.get(`${record.source}\0${canonicalTraceJson(comparableProcessObservationPayload(record.payload, ignoredFieldsBySource.get(record.source)))}`);
         if (match === undefined)
             return failure({
                 kind: "predicate",

package/dist/domain/process/processTraceSpecification.js

@@ -86,8 +86,6 @@ export const canonicalTraceJson = (value) => {
         throw new TypeError("Trace specification contains a non-JSON value");
     return serialized;
 };
-/** Remove only explicitly declared schedule metadata before exact matching. */
-export const comparableTracePayload = (value, ignoredFields = []) => comparableProcessObservationPayload(value, ignoredFields);
 export const processTraceCardinalityBounds = (cardinality) => {
     switch (cardinality.kind) {
         case "required":
@@ -352,7 +350,7 @@ export const processTraceSpecificationSchema = specificationShapeSchema.superRef
                 message: "exact payload must omit every ignored schedule field",
                 path: ["events", index, "exact"],
             });
-        const predicate = `${event.source}\0${canonicalTraceJson(comparableTracePayload(event.exact, ignoredFields))}`;
+        const predicate = `${event.source}\0${canonicalTraceJson(comparableProcessObservationPayload(event.exact, ignoredFields))}`;
         if (predicates.has(predicate))
             context.addIssue({
                 code: "custom",

package/dist/domain/providerCleanupError.js

@@ -7,8 +7,12 @@ export class ProviderCleanupError extends ProviderAdapterError {
     constructor(providerId, resources, diagnostics, 
     /** Identify the operation owning these resources; binary callers retain their default. */
     options) {
-        const { operation = "close_binary", ...errorOptions } = options ?? {};
-        super(providerId, operation, { ...errorOptions, diagnostics });
+        const { operation = "close_binary", partialObservation, ...errorOptions } = options ?? {};
+        super(providerId, operation, {
+            ...errorOptions,
+            ...(partialObservation === undefined ? {} : { partialObservation }),
+            diagnostics,
+        });
         this.cleanupResources = [...resources];
     }
 }

package/dist/domain/reconstructionCoverage.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 import { evidenceBundleSchema, parseEvidenceBundle } from "./evidenceBundle.js";
 import { evaluateReconstructionClaims, evaluateReconstructionPackageProofs, evaluateReconstructionSurfaces, evaluateReconstructionCoverageRisks, recommendedReconstructionProbes, } from "./reconstructionCoverageEvaluation.js";
 import { digestSchema } from "./../domain/digests.js";
@@ -315,7 +316,7 @@ const closureStatus = (reasons) => {
         return "unknown";
     return "partial";
 };
-const reasonOrder = (left, right) => `${left.code}:${left.subject_id}`.localeCompare(`${right.code}:${right.subject_id}`);
+const reasonOrder = (left, right) => compareUnicodeCodePoints(compositeKey([left.code, left.subject_id]), compositeKey([right.code, right.subject_id]));
 const digest = (value) => {
     const encoded = canonicalize(value);
     if (encoded === undefined)

package/dist/domain/reconstructionUnknowns.js

@@ -1,4 +1,5 @@
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 /** Select the latest revision of each residual unknown. */
 export const reconstructionUnknownHeads = (revisions) => {
     const heads = new Map();
@@ -44,7 +45,7 @@ export const reconstructionClaimUnknowns = (heads, comparisonId, sourceIds) => {
         const unknown = heads.get(id);
         return unknown === undefined ? [] : [unknown];
     })
-        .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id, "en"));
+        .sort((left, right) => compareUnicodeCodePoints(left.unknown_id, right.unknown_id));
 };
 /** Aggregate deterministic probes for unresolved claims. */
 export const reconstructionProbes = (results, heads) => {
@@ -57,7 +58,7 @@ export const reconstructionProbes = (results, heads) => {
         const probes = unknowns.flatMap(({ recommended_probes: items }) => items);
         const candidates = probes.length > 0 ? probes : [defaultProbe(result.kind)];
         for (const probe of candidates) {
-            const key = `${probe.operation}\0${probe.rationale}`;
+            const key = compositeKey([probe.operation, probe.rationale]);
             const current = output.get(key) ?? {
                 ...probe,
                 claim_ids: [],
@@ -71,7 +72,7 @@ export const reconstructionProbes = (results, heads) => {
             output.set(key, current);
         }
     }
-    const sorted = [...output.values()].sort((left, right) => `${left.operation}\0${left.rationale}`.localeCompare(`${right.operation}\0${right.rationale}`, "en"));
+    const sorted = [...output.values()].sort((left, right) => compareUnicodeCodePoints(compositeKey([left.operation, left.rationale]), compositeKey([right.operation, right.rationale])));
     return sorted;
 };
 const defaultProbe = (kind) => kind === "behavioral"

package/dist/domain/reconstructionVerification.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { artifactInventoryResultSchema } from "./artifactGraph.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { comparisonSourceEvidenceSides } from "./comparisonSourceEvidence.js";
 import { parseEvidence } from "./evidence.js";
 import { parseEvidenceBundle } from "./evidenceBundle.js";
@@ -42,7 +43,7 @@ export const verifyReconstruction = (specificationInput, bundleInput) => {
     const heads = reconstructionUnknownHeads(bundle.unknowns);
     const results = specification.claims
         .map((claim) => evaluateClaim(claim, records, heads))
-        .sort((left, right) => left.claim_id.localeCompare(right.claim_id, "en"));
+        .sort((left, right) => compareUnicodeCodePoints(left.claim_id, right.claim_id));
     const failed = count(results, "fail");
     const unresolved = count(results, "unknown");
     const probes = reconstructionProbes(results, heads);
@@ -51,7 +52,7 @@ export const verifyReconstruction = (specificationInput, bundleInput) => {
         status: failed > 0 ? "fail" : unresolved > 0 ? "unknown" : "pass",
         specification_sha256: digest({
             ...specification,
-            claims: [...specification.claims].sort((left, right) => left.claim_id.localeCompare(right.claim_id, "en")),
+            claims: [...specification.claims].sort((left, right) => compareUnicodeCodePoints(left.claim_id, right.claim_id)),
         }),
         summary: {
             total: results.length,

package/dist/domain/referenceSourceGraph.js

@@ -1,6 +1,7 @@
 import { posix } from "node:path";
 import { z } from "zod";
-import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
+import { canonicalJson } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -109,8 +110,6 @@ const exclusionSchema = z.strictObject({
     reason: z.enum([
         "configured-secret",
         "symlink-escape",
-        "size-limit",
-        "inventory-limit",
         "unreadable",
         "caller-excluded",
     ]),
@@ -331,7 +330,7 @@ const rootCommitment = (entries, exclusions) => ({
     }),
     exclusions,
 });
-const computeRootSha256 = (entries, exclusions) => canonicalDigest(rootCommitment(entries, exclusions), "Reference source graph");
+const computeRootSha256 = (entries, exclusions) => digestCanonicalValue(rootCommitment(entries, exclusions), "Reference source graph");
 /** Build and internally commit a normalized historical source graph. */
 export const createHistoricalSourceGraph = (input) => {
     const parsed = historicalSourceGraphInputSchema.parse(input);
@@ -343,7 +342,7 @@ export const createHistoricalSourceGraph = (input) => {
 /** Parse a graph and reject stale or caller-invented root commitments. */
 export const parseHistoricalSourceGraph = (input) => historicalSourceGraphSchema.parse(input);
 /** Compute a deterministic graph commitment containing no absolute root path. */
-export const computeHistoricalSourceGraphSha256 = (input) => canonicalDigest(parseHistoricalSourceGraph(input), "Reference source graph");
+export const computeHistoricalSourceGraphSha256 = (input) => digestCanonicalValue(parseHistoricalSourceGraph(input), "Reference source graph");
 /** Build a deterministic, relocation-independent manifest for a source graph. */
 export const createHistoricalSourceManifest = (input) => {
     const graph = parseHistoricalSourceGraph(input);
@@ -358,14 +357,15 @@ export const createHistoricalSourceManifest = (input) => {
     };
     return historicalSourceManifestBaseSchema.parse({
         ...semantic,
-        manifest_id: `hsm_${canonicalDigest(semantic, "Reference source graph")}`,
+        manifest_id: `hsm_${digestCanonicalValue(semantic, "Reference source graph")}`,
     });
 };
 /** Parse and verify a historical source manifest's semantic identifier. */
 export const parseHistoricalSourceManifest = (input) => {
     const manifest = historicalSourceManifestBaseSchema.parse(input);
     const { manifest_id: manifestId, ...semantic } = manifest;
-    if (`hsm_${canonicalDigest(semantic, "Reference source graph")}` !== manifestId)
+    if (`hsm_${digestCanonicalValue(semantic, "Reference source graph")}` !==
+        manifestId)
         throw new TypeError("Historical source manifest identifier does not match");
     return manifest;
 };

package/dist/domain/referenceSourceImportParsing.js

@@ -1,5 +1,7 @@
 import { parse } from "@babel/parser";
-import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isNode, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+import { parserPluginsForPath } from "./javascript/javascriptSourceParser.js";
+import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
 const codeSourceLanguages = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
 const safeModuleName = (node) => {
     if (isStringLiteral(node))
@@ -112,40 +114,18 @@ const isRequireCallee = (callee) => {
     }
     return false;
 };
-const isImportCallee = (callee) => isImport(callee);
-const collectModuleExpressions = (node, targets) => {
-    if (node === null || node === undefined)
-        return;
-    if (typeof node !== "object")
-        return;
-    if (Array.isArray(node)) {
-        for (const item of node)
-            collectModuleExpressions(item, targets);
-        return;
-    }
-    if (!isNode(node))
-        return;
-    if (isCallExpression(node) || isImportExpression(node)) {
-        targets.push(node);
-    }
-    for (const value of Object.values(node)) {
-        if (value !== null &&
-            value !== undefined &&
-            typeof value === "object" &&
-            !isSourceLocation(value)) {
-            collectModuleExpressions(value, targets);
-        }
-    }
-};
-const isSourceLocation = (value) => typeof value === "object" &&
-    value !== null &&
-    "start" in value &&
-    "end" in value &&
-    !("type" in value);
 const extractRequireAndDynamicImports = (body, from_path, relationships) => {
+    // Single traversal owner: iterative, VISITOR_KEYS-gated, no recursion over
+    // loc/comment objects. Survives deeply nested generated member chains that
+    // overflowed the previous hand-rolled Object.values walker.
     const expressions = [];
     for (const statement of body)
-        collectModuleExpressions(statement, expressions);
+        traverseJavaScriptAst(statement, {
+            enter: (node) => {
+                if (isCallExpression(node) || isImportExpression(node))
+                    expressions.push(node);
+            },
+        });
     for (const call of expressions) {
         if (isImportExpression(call)) {
             const specifier = safeModuleName(call.source);
@@ -171,7 +151,7 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
             }
             continue;
         }
-        if (isImportCallee(call.callee) && isModuleExpression(first)) {
+        if (isImport(call.callee) && isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
             if (result !== undefined) {
                 appendRelationship(relationships, {
@@ -185,17 +165,11 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
     }
 };
 const parseWithBabel = (path, source, language) => {
-    const plugins = ["jsx"];
-    if (language === "TypeScript" || language === "TSX") {
-        plugins.push([
-            "typescript",
-            {
-                dts: path.endsWith(".d.ts") ||
-                    path.endsWith(".d.mts") ||
-                    path.endsWith(".d.cts"),
-            },
-        ]);
-    }
+    // Single parser-mode owner: path-driven plugins (dts/JSX/mts) shared with
+    // the semantic pipeline. `language` only gates non-JS/TS callers upstream;
+    // TypeScript syntax must parse identically here and in semantic analysis.
+    void language;
+    const plugins = parserPluginsForPath(path);
     try {
         const ast = parse(source, {
             sourceType: "unambiguous",
@@ -218,7 +192,22 @@ const parseWithBabel = (path, source, language) => {
 export const parseReferenceSourceImports = (path, bytes, language) => {
     if (language !== null && !codeSourceLanguages.has(language))
         return { relationships: [], parse_failures: [] };
-    const source = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    let source;
+    try {
+        source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return {
+            relationships: [],
+            parse_failures: [
+                {
+                    path,
+                    parser: "utf-8",
+                    reason: "Source bytes are not valid UTF-8; import targets were not parsed.",
+                },
+            ],
+        };
+    }
     const { ast, reasons } = parseWithBabel(path, source, language);
     const parseFailures = reasons.map((reason) => ({
         path,

package/dist/domain/residualUnknown.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const unknownIdSchema = prefixedDigestSchema("unk");
@@ -232,5 +233,5 @@ const canonicalJson = (value) => {
         throw new TypeError("Unknown identity failed");
     return serialized;
 };
-const sortedUnique = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right));
-const sortedRelationships = (values) => [...values].sort((left, right) => `${left.type}:${left.unknown_id}`.localeCompare(`${right.type}:${right.unknown_id}`));
+const sortedUnique = (values) => [...new Set(values)].sort(compareUnicodeCodePoints);
+const sortedRelationships = (values) => [...values].sort((left, right) => compareUnicodeCodePoints(compositeKey([left.type, left.unknown_id]), compositeKey([right.type, right.unknown_id])));

package/dist/domain/staticRuntimeCorrelation.js

@@ -3,6 +3,7 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
@@ -146,7 +147,7 @@ export const correlateStaticAndRuntime = (input) => {
     const runtimeById = byId(runtimeEvidence);
     const correlations = parsed.mappings
         .map((mapping) => correlate(mapping, staticById, runtimeById))
-        .sort((left, right) => left.correlation_id.localeCompare(right.correlation_id, "en"));
+        .sort((left, right) => compareUnicodeCodePoints(left.correlation_id, right.correlation_id));
     if (new Set(correlations.map(({ correlation_id: id }) => id)).size !==
         correlations.length)
         throw new TypeError("Static/runtime correlation rejects duplicate mappings");

package/dist/domain/swiftSymbolClassification.js

@@ -37,7 +37,12 @@ export const classifySwiftSymbol = (name) => {
         const kind = mangling.charAt(end);
         const nominal = NOMINAL_CATEGORIES.get(kind);
         if (nominal === undefined) {
-            if (kind === "E" && category !== null)
+            // Current swiftc emits protocol descriptors as `…<Nominal>Mp` without
+            // the nominal `P` marker (e.g. `_$s4main7ScoringMp`). Decode that exact
+            // suffix; unknown substitution encodings stay unclassified, never guessed.
+            if (mangling.slice(end) === "Mp")
+                category = "protocols";
+            else if (kind === "E" && category !== null)
                 category = "extensions";
             break;
         }

package/dist/domain/symbolAnalysis.js

@@ -1,8 +1,20 @@
 import { classifySwiftSymbol, } from "./swiftSymbolClassification.js";
+/** Objective-C class definition markers emitted by modern Apple clang. */
+const OBJC_CLASS_MARKER = "OBJC_CLASS_$_";
+/** Local class records emitted by Apple's fragile Objective-C ABI. */
+const LEGACY_OBJC_CLASS_PREFIX = "l_OBJC_CLASS_";
+/**
+ * Objective-C protocol declaration marker. `PROTOCOL_REFERENCE` slots
+ * share the substring but are uses, not definitions.
+ */
+const OBJC_PROTOCOL_MARKER = "OBJC_PROTOCOL_$_";
 /** Select and deduplicate Objective-C class labels. */
 export const discoverObjcClasses = (names, pattern) => {
     const classes = uniqueByName(names
-        .filter(({ name }) => ["OBJC_CLASS", "OBJC_$_CLASS"].some((marker) => name.includes(marker)))
+        .filter(({ name }) => name.includes(OBJC_CLASS_MARKER) ||
+        (name.startsWith(LEGACY_OBJC_CLASS_PREFIX) &&
+            name.length > LEGACY_OBJC_CLASS_PREFIX.length &&
+            !/^l_OBJC_CLASS_NAME_(?:\.\d+)?$/u.test(name)))
         .filter(({ name }) => pattern.length === 0 || name.includes(pattern)));
     return {
         count: classes.length,
@@ -11,7 +23,10 @@ export const discoverObjcClasses = (names, pattern) => {
 };
 /** Select and deduplicate Objective-C and Swift protocol labels. */
 export const discoverObjcProtocols = (names) => {
-    const protocols = uniqueByName(names.filter(({ name }) => name.includes("OBJC_PROTOCOL") || name.includes("_TtP")));
+    const protocols = uniqueByName(names.filter(({ name }) => name.includes(OBJC_PROTOCOL_MARKER) ||
+        name.includes("_TtP") ||
+        (name.endsWith("Mp") &&
+            classifySwiftSymbol(name)?.category === "protocols")));
     return {
         count: protocols.length,
         protocols: protocols.map(toJsonEntry),

package/dist/domain/unicodeCodePointOrder.js

@@ -15,3 +15,9 @@ export const compareUnicodeCodePoints = (left, right) => {
         return 0;
     return leftIndex === left.length ? -1 : 1;
 };
+/**
+ * Collision-free composite key for deduplication/sorting. `\0`-joins
+ * collide when any component contains NUL (valid in JS property names);
+ * a JSON tuple escapes every component. Single owner for composite keys.
+ */
+export const compositeKey = (parts) => JSON.stringify(parts);

package/dist/domain/webBundleAnalyzerInspection.js

@@ -1,6 +1,7 @@
 import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
+import { compositeKey } from "./unicodeCodePointOrder.js";
 import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
 import { classifyParsedJavaScriptOpenReceivers } from "./javascript/javascriptSemanticAnalysis.js";
 import { semanticStaticPropertyName } from "./javascript/javascriptAstValues.js";
@@ -169,7 +170,14 @@ const addWebMcpDeclaration = (script, node, accumulator) => {
             ].filter(Boolean)
             : [])
         : [];
-    const key = `webmcp\0${script.script_key}\0${name ?? ""}\0${schemaPropertyNames.join("\0")}`;
+    // Property names are a variable-length source-derived list: NUL-joins
+    // would collapse ["a\0b"] with ["a", "b"] and drop a declaration.
+    const key = compositeKey([
+        "webmcp",
+        script.script_key,
+        name ?? "",
+        schemaPropertyNames,
+    ]);
     addUnique(accumulator, key, () => accumulator.webMcp.push({
         name: name ?? null,
         description: description ?? null,