rea-agents 6.2.0 → 6.4.0

package/dist/application/MacHopper.js

@@ -6,10 +6,10 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 import { z } from "zod";
 import { homeDirectoryFromEnvironment } from "../config/homeDirectory.js";
+import { downloadHopperPackage, HOPPER_DOWNLOAD_BYTES, } from "./HopperDownload.js";
 const execFileAsync = promisify(execFile);
 const RELEASES_URL = "https://www.hopperapp.com/include/files-api.php?request=releases&public=true";
 const DOWNLOAD_PREFIX = "https://www.hopperapp.com:443/downloader/public/";
-const MAX_PACKAGE_BYTES = 100_000_000;
 const BUNDLE_IDENTIFIER = "com.cryptic-apps.hopper-web-4";
 /** Stable network and command effects disclosed before macOS Hopper setup. */
 export const macHopperInstallDisclosure = {
@@ -25,173 +25,195 @@ export const macHopperInstallDisclosure = {
 export const installMacHopper = async (options = {}, host = systemMacHopperInstallHost(homeDirectoryFromEnvironment(process.env, process.platform), process.env)) => {
     let temporary;
     let mounted = false;
+    let result;
     try {
-        const metadata = await host.download(RELEASES_URL);
-        if (!metadata.ok)
-            return { status: "failed", reason: "release_metadata" };
-        const parsed = releasesSchema.safeParse(parseJson(metadata.bytes));
-        if (!parsed.success)
-            return { status: "failed", reason: "release_metadata" };
-        const release = parsed.data["OS X"];
-        if (!release.filename.startsWith(DOWNLOAD_PREFIX))
-            return { status: "failed", reason: "release_metadata" };
-        const archive = await host.download(release.filename);
-        if (!archive.ok)
-            return { status: "failed", reason: "download" };
-        if (!integrityMatches(archive.bytes, release))
-            return { status: "failed", reason: "integrity" };
-        const destination = host.destination();
-        const destinationExists = await host.destinationExists(destination);
-        if (destinationExists && options.replaceExisting !== true)
-            return { status: "failed", reason: "destination_exists" };
-        temporary = await host.createTemporaryDirectory();
-        const packagePath = join(temporary, "hopper.dmg");
-        const mountPath = join(temporary, "mounted");
-        await host.createMountDirectory(mountPath);
-        await host.writePackage(packagePath, archive.bytes);
-        if (!(await host.mount(packagePath, mountPath)))
-            return { status: "failed", reason: "mount" };
-        mounted = true;
-        const source = await host.appBundle(mountPath);
-        if (source === undefined || !(await host.validBundle(source)))
-            return { status: "failed", reason: "bundle" };
-        const stage = `${destination}.rea-stage`;
-        if (!(await host.installBundle(source, destination, stage, destinationExists)))
-            return { status: "failed", reason: "copy" };
-        const launcherPath = join(destination, "Contents/MacOS/hopper");
-        if (!(await host.launcherReady(launcherPath)))
-            return { status: "failed", reason: "launcher_missing" };
-        await host.openApplication(destination);
-        return { status: "installed", launcherPath };
+        result = await (async () => {
+            const metadata = await host.download(RELEASES_URL);
+            if (!metadata.ok)
+                return { status: "failed", reason: "release_metadata" };
+            const parsed = releasesSchema.safeParse(parseJson(metadata.bytes));
+            if (!parsed.success)
+                return { status: "failed", reason: "release_metadata" };
+            const release = parsed.data["OS X"];
+            if (!release.filename.startsWith(DOWNLOAD_PREFIX))
+                return { status: "failed", reason: "release_metadata" };
+            const archive = await host.download(release.filename);
+            if (!archive.ok)
+                return { status: "failed", reason: "download" };
+            if (!integrityMatches(archive.bytes, release))
+                return { status: "failed", reason: "integrity" };
+            const destination = host.destination();
+            const destinationExists = await host.destinationExists(destination);
+            if (destinationExists && options.replaceExisting !== true)
+                return { status: "failed", reason: "destination_exists" };
+            temporary = await host.createTemporaryDirectory();
+            const packagePath = join(temporary, "hopper.dmg");
+            const mountPath = join(temporary, "mounted");
+            await host.createMountDirectory(mountPath);
+            await host.writePackage(packagePath, archive.bytes);
+            if (!(await host.mount(packagePath, mountPath)))
+                return { status: "failed", reason: "mount" };
+            mounted = true;
+            const source = await host.appBundle(mountPath);
+            if (source === undefined || !(await host.validBundle(source)))
+                return { status: "failed", reason: "bundle" };
+            const stage = `${destination}.rea-stage`;
+            if (!(await host.installBundle(source, destination, stage, destinationExists)))
+                return { status: "failed", reason: "copy" };
+            const launcherPath = join(destination, "Contents/MacOS/hopper");
+            if (!(await host.launcherReady(launcherPath)))
+                return { status: "failed", reason: "launcher_missing" };
+            await host.openApplication(destination);
+            return { status: "installed", launcherPath };
+        })();
     }
     catch (cause) {
         // Install-stage failures share the download reason; the stage is cleaned below.
         void cause;
-        return { status: "failed", reason: "download" };
+        result = { status: "failed", reason: "download" };
     }
-    finally {
-        if (temporary !== undefined) {
-            const mountPath = join(temporary, "mounted");
-            if (mounted)
+    let cleanupFailure;
+    if (temporary !== undefined) {
+        const temporaryPath = temporary;
+        const mountPath = join(temporary, "mounted");
+        const cleanup = async () => {
+            if (mounted) {
                 await host.unmount(mountPath);
-            await host.cleanup(temporary);
-        }
-    }
-};
-/** Compose installer paths and subprocesses from one selected caller context. */
-export const systemMacHopperInstallHost = (homeDirectory, environment) => ({
-    download: downloadPackage,
-    createTemporaryDirectory: () => mkdtemp(join(tmpdir(), "rea-hopper-mac-")),
-    createMountDirectory: (path) => mkdir(path),
-    writePackage: (path, bytes) => writeFile(path, bytes, { mode: 0o600 }),
-    async mount(packagePath, mountPath) {
-        return commandSucceeds("hdiutil", [
-            "attach",
-            "-readonly",
-            "-nobrowse",
-            "-mountpoint",
-            mountPath,
-            packagePath,
-        ], environment);
-    },
-    async unmount(mountPath) {
-        await commandSucceeds("hdiutil", ["detach", mountPath, "-force"], environment);
-    },
-    async appBundle(mountPath) {
-        const entries = await readdir(mountPath, { withFileTypes: true });
-        const app = entries.find((entry) => entry.isDirectory() && /^Hopper.*\.app$/iu.test(entry.name));
-        return app === undefined ? undefined : join(mountPath, app.name);
-    },
-    async validBundle(appPath) {
-        if (!(await commandSucceeds("codesign", ["--verify", "--deep", "--strict", appPath], environment)))
-            return false;
-        try {
-            const identifier = (await execFileAsync("/usr/libexec/PlistBuddy", [
-                "-c",
-                "Print :CFBundleIdentifier",
-                join(appPath, "Contents/Info.plist"),
-            ], { env: environment })).stdout.trim();
-            return identifier === BUNDLE_IDENTIFIER;
-        }
-        catch (cause) {
-            // best-effort cleanup: optional bundle probing; unreadable means invalid.
-            void cause;
-            return false;
-        }
-    },
-    async destinationExists(path) {
+                mounted = false;
+            }
+            await host.cleanup(temporaryPath);
+        };
         try {
-            await access(path);
-            return true;
+            await cleanup();
         }
         catch (cause) {
-            // best-effort cleanup: optional existence probing; absence means missing.
-            void cause;
-            return false;
+            cleanupFailure = `Hopper DMG cleanup failed: ${failureMessage(cause)}`;
+            host.retainCleanup?.(cleanup);
         }
-    },
-    async installBundle(source, destination, stage, replaceExisting) {
-        const previous = `${stage}-previous`;
-        try {
-            await mkdir(join(homeDirectory, "Applications"), { recursive: true });
-            await rm(stage, { recursive: true, force: true });
-            await rm(previous, { recursive: true, force: true });
-            await execFileAsync("ditto", [source, stage], { env: environment });
-            await access(join(stage, "Contents/MacOS/hopper"));
-            if (replaceExisting)
-                await rename(destination, previous);
-            await rename(stage, destination);
-            if (replaceExisting)
+    }
+    return cleanupFailure === undefined ? result : { ...result, cleanupFailure };
+};
+/** Compose installer paths and subprocesses from one selected caller context. */
+export const systemMacHopperInstallHost = (homeDirectory, environment) => {
+    const pendingCleanup = new Set();
+    return {
+        download: downloadHopperPackage,
+        createTemporaryDirectory: () => mkdtemp(join(tmpdir(), "rea-hopper-mac-")),
+        createMountDirectory: (path) => mkdir(path),
+        writePackage: (path, bytes) => writeFile(path, bytes, { mode: 0o600 }),
+        async mount(packagePath, mountPath) {
+            return commandSucceeds("hdiutil", [
+                "attach",
+                "-readonly",
+                "-nobrowse",
+                "-mountpoint",
+                mountPath,
+                packagePath,
+            ], environment);
+        },
+        async unmount(mountPath) {
+            if (!(await commandSucceeds("hdiutil", ["detach", mountPath, "-force"], environment)))
+                throw new Error(`hdiutil detach failed for ${JSON.stringify(mountPath)}`);
+        },
+        async appBundle(mountPath) {
+            const entries = await readdir(mountPath, { withFileTypes: true });
+            const app = entries.find((entry) => entry.isDirectory() && /^Hopper.*\.app$/iu.test(entry.name));
+            return app === undefined ? undefined : join(mountPath, app.name);
+        },
+        async validBundle(appPath) {
+            if (!(await commandSucceeds("codesign", ["--verify", "--deep", "--strict", appPath], environment)))
+                return false;
+            try {
+                const identifier = (await execFileAsync("/usr/libexec/PlistBuddy", [
+                    "-c",
+                    "Print :CFBundleIdentifier",
+                    join(appPath, "Contents/Info.plist"),
+                ], { env: environment })).stdout.trim();
+                return identifier === BUNDLE_IDENTIFIER;
+            }
+            catch (cause) {
+                // best-effort cleanup: optional bundle probing; unreadable means invalid.
+                void cause;
+                return false;
+            }
+        },
+        async destinationExists(path) {
+            try {
+                await access(path);
+                return true;
+            }
+            catch (cause) {
+                // best-effort cleanup: optional existence probing; absence means missing.
+                void cause;
+                return false;
+            }
+        },
+        async installBundle(source, destination, stage, replaceExisting) {
+            const previous = `${stage}-previous`;
+            try {
+                await mkdir(join(homeDirectory, "Applications"), { recursive: true });
+                await rm(stage, { recursive: true, force: true });
                 await rm(previous, { recursive: true, force: true });
-            return true;
-        }
-        catch (cause) {
-            // Install failure rolls back below; the false return reports it.
-            void cause;
-            await rm(stage, { recursive: true, force: true });
-            if (replaceExisting) {
+                await execFileAsync("ditto", [source, stage], { env: environment });
+                await access(join(stage, "Contents/MacOS/hopper"));
+                if (replaceExisting)
+                    await rename(destination, previous);
+                await rename(stage, destination);
+                if (replaceExisting)
+                    await rm(previous, { recursive: true, force: true });
+                return true;
+            }
+            catch (cause) {
+                // Install failure rolls back below; the false return reports it.
+                void cause;
+                await rm(stage, { recursive: true, force: true });
+                if (replaceExisting) {
+                    try {
+                        await rename(previous, destination);
+                    }
+                    catch (rollbackCause) {
+                        // The original destination was not moved, or rollback is impossible.
+                        void rollbackCause;
+                    }
+                }
+                return false;
+            }
+        },
+        async launcherReady(path) {
+            try {
+                await access(path);
+                return true;
+            }
+            catch (cause) {
+                // best-effort cleanup: optional launcher probing; absence means not ready.
+                void cause;
+                return false;
+            }
+        },
+        async openApplication(path) {
+            await execFileAsync("open", [path], { env: environment });
+        },
+        cleanup: (path) => rm(path, { recursive: true, force: true }),
+        retainCleanup: (cleanup) => pendingCleanup.add(cleanup),
+        async close() {
+            let failure;
+            for (const cleanup of pendingCleanup) {
                 try {
-                    await rename(previous, destination);
+                    await cleanup();
+                    pendingCleanup.delete(cleanup);
                 }
-                catch (rollbackCause) {
-                    // The original destination was not moved, or rollback is impossible.
-                    void rollbackCause;
+                catch (cause) {
+                    failure ??= `Hopper DMG cleanup remains incomplete: ${failureMessage(cause)}`;
                 }
             }
-            return false;
-        }
-    },
-    async launcherReady(path) {
-        try {
-            await access(path);
-            return true;
-        }
-        catch (cause) {
-            // best-effort cleanup: optional launcher probing; absence means not ready.
-            void cause;
-            return false;
-        }
-    },
-    async openApplication(path) {
-        await execFileAsync("open", [path], { env: environment });
-    },
-    cleanup: (path) => rm(path, { recursive: true, force: true }),
-    destination: () => join(homeDirectory, "Applications/Hopper Disassembler.app"),
-});
-const downloadPackage = async (url) => {
-    const response = await fetch(url, {
-        headers: { accept: "application/json", "user-agent": "rea-installer" },
-        signal: AbortSignal.timeout(120_000),
-    });
-    const length = Number(response.headers.get("content-length") ?? "0");
-    if (length > MAX_PACKAGE_BYTES)
-        return { ok: false, bytes: new Uint8Array() };
-    const bytes = new Uint8Array(await response.arrayBuffer());
-    return { ok: response.ok && bytes.byteLength <= MAX_PACKAGE_BYTES, bytes };
+            return failure;
+        },
+        destination: () => join(homeDirectory, "Applications/Hopper Disassembler.app"),
+    };
 };
 const parseJson = (bytes) => JSON.parse(new TextDecoder().decode(bytes));
 const integrityMatches = (bytes, release) => bytes.byteLength === Number(release.file_length) &&
-    bytes.byteLength <= MAX_PACKAGE_BYTES &&
+    bytes.byteLength <= HOPPER_DOWNLOAD_BYTES &&
     createHash("sha1").update(bytes).digest("hex") === release.file_hash;
 const commandSucceeds = async (command, args, environment) => {
     try {
@@ -204,6 +226,7 @@ const commandSucceeds = async (command, args, environment) => {
         return false;
     }
 };
+const failureMessage = (cause) => cause instanceof Error ? cause.message : String(cause);
 const releaseSchema = z.object({
     filename: z.string().url(),
     file_length: z.string().regex(/^\d+$/u),

package/dist/application/MipsElfAbiFlags.js

@@ -0,0 +1,140 @@
+import { err, ok } from "../domain/result.js";
+/**
+ * Read ELF32 MIPS ABI declarations from the caller's already-open file.
+ * Inspect both typed tables (not section names), including records beyond the
+ * initial header probe. A missing record is unknown, not a default FP ABI.
+ * The caller supplies its cancellation check so its tagged error is preserved.
+ */
+export const readMipsElfAbiFlags = async (handle, metadata, checkCancelled) => {
+    checkCancelled();
+    if (metadata.elfClass !== 32)
+        return err("MIPS ABI record inspection currently supports ELF32 only");
+    const fileSize = (await handle.stat()).size;
+    checkCancelled();
+    const read = async (offset, length, label) => {
+        checkCancelled();
+        if (!Number.isSafeInteger(fileSize) ||
+            offset < 0 ||
+            length < 0 ||
+            offset > fileSize - length)
+            return err(`MIPS ${label} lies outside the file`);
+        const bytes = Buffer.alloc(length);
+        let total = 0;
+        while (total < length) {
+            checkCancelled();
+            const observed = await handle.read(bytes, total, length - total, offset + total);
+            checkCancelled();
+            if (observed.bytesRead === 0)
+                return err(`truncated MIPS ${label}`);
+            total += observed.bytesRead;
+        }
+        return ok(bytes);
+    };
+    const header = await read(0, 52, "ELF32 header");
+    if (!header.ok)
+        return header;
+    const bytes = header.value;
+    const little = metadata.byteOrder === "little";
+    const u16 = (data, offset) => little ? data.readUInt16LE(offset) : data.readUInt16BE(offset);
+    const u32 = (data, offset) => little ? data.readUInt32LE(offset) : data.readUInt32BE(offset);
+    if (bytes.toString("hex", 0, 4) !== "7f454c46" ||
+        bytes[4] !== 1 ||
+        bytes[5] !== (little ? 1 : 2) ||
+        u16(bytes, 18) !== 8 ||
+        u16(bytes, 16) !== metadata.type ||
+        u32(bytes, 36) !== metadata.flags)
+        return err("MIPS ELF header no longer matches the resolved identity");
+    if (bytes[6] !== 1 || u32(bytes, 20) !== 1 || u16(bytes, 40) !== 52)
+        return err("invalid MIPS ELF32 version or header size");
+    const tables = [
+        {
+            label: "program header table",
+            offset: u32(bytes, 28),
+            count: u16(bytes, 44),
+            stride: u16(bytes, 42),
+            entrySize: 32,
+            typeOffset: 0,
+            dataOffset: 4,
+            sizeOffset: 16,
+            recordType: 0x70000003, // PT_MIPS_ABIFLAGS
+            optional: false,
+        },
+        {
+            label: "section header table",
+            offset: u32(bytes, 32),
+            count: u16(bytes, 48),
+            stride: u16(bytes, 46),
+            entrySize: 40,
+            typeOffset: 4,
+            dataOffset: 16,
+            sizeOffset: 20,
+            recordType: 0x7000002a, // SHT_MIPS_ABIFLAGS
+            optional: true,
+        },
+    ];
+    // Extended numbering needs a separate section-zero reader. Refuse it rather
+    // than silently treating an unexamined table as having no ABI declarations.
+    if (u16(bytes, 44) === 0xffff || u16(bytes, 48) >= 0xff00)
+        return err("extended or reserved MIPS ELF table numbering is unsupported");
+    let record;
+    const limitations = [];
+    for (const table of tables) {
+        if (table.count === 0) {
+            if (table.offset !== 0)
+                return err(`unsupported extended or inconsistent MIPS ${table.label}`);
+            continue;
+        }
+        if (table.offset < 52 || table.stride !== table.entrySize)
+            return err(`invalid MIPS ${table.label} offset or entry size`);
+        const count = table.optional
+            ? Math.min(table.count, Math.max(0, Math.floor((fileSize - table.offset) / table.entrySize)))
+            : table.count;
+        if (count < table.count)
+            limitations.push(`MIPS ${table.label} at file offset ${table.offset} extends beyond the captured file: examined ${count} of ${table.count} complete headers. ABI declarations in unavailable headers remain unknown.`);
+        if (count === 0)
+            continue;
+        // Counts are bounded by the ELF16 fields and strides by their exact ELF32
+        // structure sizes. Never allocate according to an untrusted section size.
+        const contents = await read(table.offset, count * table.entrySize, table.label);
+        if (!contents.ok)
+            return contents;
+        let found = false;
+        for (let i = 0; i < count; i += 1) {
+            checkCancelled();
+            const position = i * table.entrySize;
+            if (u32(contents.value, position + table.typeOffset) !== table.recordType)
+                continue;
+            if (found)
+                return err(`duplicate MIPS ABI records in ${table.label}`);
+            found = true;
+            const offset = u32(contents.value, position + table.dataOffset);
+            const size = u32(contents.value, position + table.sizeOffset);
+            if (size !== 24)
+                return err("unsupported MIPS ABI record size; expected 24 bytes");
+            const candidate = await read(offset, 24, "ABI record");
+            if (!candidate.ok)
+                return candidate;
+            if (record !== undefined && !record.equals(candidate.value))
+                return err("conflicting MIPS program/section ABI declarations");
+            record = candidate.value;
+        }
+    }
+    if (record === undefined)
+        return ok({ abiFlags: null, limitations });
+    // Preserve declarations verbatim, including unknown versions/values. Provider
+    // admission, not parsing, decides which interpretations have been verified.
+    const abiFlags = {
+        version: u16(record, 0),
+        isaLevel: record.readUInt8(2),
+        isaRevision: record.readUInt8(3),
+        gprSize: record.readUInt8(4),
+        cpr1Size: record.readUInt8(5),
+        cpr2Size: record.readUInt8(6),
+        fpAbi: record.readUInt8(7),
+        isaExtension: u32(record, 8),
+        ases: u32(record, 12),
+        flags1: u32(record, 16),
+        flags2: u32(record, 20),
+    };
+    return ok({ abiFlags, limitations });
+};

package/dist/application/ProviderOperationExecution.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+import { AnalysisCancelledError, AnalysisInputError, } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+/**
+ * Shared CLI/MCP admission, execution, and Evidence composition for
+ * single-request providers. The caller retains its operation vocabulary and
+ * confidence; this normalizes cancellation, input validation, and Evidence
+ * assembly once instead of per provider.
+ */
+export const executeProviderOperation = async (operation, input, options, schema, provider, confidence) => {
+    if (options?.signal?.aborted === true)
+        return err(new AnalysisCancelledError(operation));
+    const request = schema.safeParse({ operation, input });
+    if (!request.success)
+        return err(new AnalysisInputError(operation, { cause: request.error }));
+    const executed = await provider.execute(request.data, options);
+    if (!executed.ok)
+        return executed;
+    const execution = executed.value;
+    return ok(createEvidence(execution.subject ?? undefined, execution.provider, {
+        operation,
+        parameters: jsonObjectSchema.parse(request.data.input),
+        result: execution.result,
+        rawResult: execution.rawResult,
+        limitations: execution.limitations,
+        locations: execution.locations,
+        confidence,
+    }));
+};

package/dist/application/ReconstructionObligationCandidates.js

@@ -29,7 +29,12 @@ const deriveApplicationCandidates = (evidence, records, candidates, limitations)
     ].includes(evidence.operation))
         return;
     try {
-        const source = parseApplicationGraphEvidence(evidence);
+        const parsed = parseApplicationGraphEvidence(evidence);
+        if (!parsed.ok) {
+            limitations.add(`Application Evidence ${evidence.evidence_id} could not generate candidates because it failed graph validation.`);
+            return;
+        }
+        const source = parsed.value;
         for (const node of source.graph.nodes) {
             const candidatePolicy = applicationObligationPolicy(node.kind);
             if (candidatePolicy === undefined) {
@@ -49,11 +54,18 @@ const deriveApplicationCandidates = (evidence, records, candidates, limitations)
                 authorityReferences: reference,
             }));
         }
-        if (source.semanticGraph !== null)
+        if (source.semanticGraph !== null) {
+            const evidenceContexts = new Map(source.semanticGraph.evidence_contexts.map((context) => [
+                context.context_id,
+                context,
+            ]));
             for (const node of source.semanticGraph.nodes) {
                 const candidatePolicy = semanticObligationPolicy(node.kind);
                 if (candidatePolicy === undefined)
                     continue;
+                const evidenceContext = evidenceContexts.get(node.evidence.context_id);
+                if (evidenceContext === undefined)
+                    throw new TypeError("Semantic evidence reference names an absent context");
                 addCandidate(candidates, generatedCandidate({
                     key: `semantic:${node.node_id}:${candidatePolicy.family}`,
                     title: node.label ?? `${node.kind} semantic boundary`,
@@ -63,10 +75,11 @@ const deriveApplicationCandidates = (evidence, records, candidates, limitations)
                     semanticNodeId: node.node_id,
                     location: `semantic-graph:${source.semanticGraph.graph_id}/nodes/${node.node_id}`,
                     authorityReferences: [
-                        graphReference(evidence, records, node.evidence, `${source.semanticGraph.graph_id}/node/${node.node_id}`),
+                        graphReference(evidence, records, evidenceContext, `${source.semanticGraph.graph_id}/node/${node.node_id}`),
                     ],
                 }));
             }
+        }
         if (source.graph.coverage.status !== "complete")
             limitations.add(`Application graph ${source.graph.graph_id} coverage is ${source.graph.coverage.status}; omitted candidates remain unknown.`);
     }

package/dist/application/ReconstructionObligationLedgerProjection.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
+import { canonicalJson } from "../domain/comparisonSemantics.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 export const obligationLedgerCoverage = (incomplete) => ({
     status: incomplete ? "partial" : "complete",
 });
@@ -64,7 +66,7 @@ export const obligationLedgerStatus = (obligations) => {
         return "unknown";
     return requiredOpen.length === 0 ? "ready" : "open";
 };
-export const obligationEdgeOrder = (left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right));
+export const obligationEdgeOrder = (left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right));
 export const digestObligationLedgerValue = (value) => {
     const encoded = canonicalize(value);
     if (encoded === undefined)