urtext 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Noah Ogbi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,229 @@
+# Urtext
+
+[![CI](https://github.com/noahogbi/urtext/actions/workflows/ci.yml/badge.svg)](https://github.com/noahogbi/urtext/actions/workflows/ci.yml)
+
+**A diff reviewer that shows its evidence.** Point `urtext` at a git range and it reports what
+changed and why it matters — ranked, and with every claim labeled by the kind of evidence behind
+it. A `verified` finding can point at the line of code that proves it. Nothing is asserted on
+the reader's trust alone, and the tool never issues an approve/reject verdict; the judgement
+stays with the human.
+
+The name is the thesis: in philology, the *urtext* is the authoritative original from which all
+editions derive. Here the code is the urtext; a review is an edition of it, and an edition that
+cannot cite its source is worthless.
+
+## What it does
+
+`urtext review` takes a git range, analyses the change, and prints what
+matters — ranked, with every claim labeled by the kind of evidence behind it:
+
+- `verified` — proven by static analysis; the report points at the code
+- `inferred` — a model claim that analysis corroborates but does not prove
+- `model` — a model claim nothing mechanical confirms
+
+Five analyzers run over the change:
+
+- **guards** — conditionals, early returns, and throws removed from code that survived
+- **surface** — exports added, removed, or changed shape
+- **blast radius** — how many places reference a changed export
+- **effects** — network, filesystem, process, env, database, and timing effects appearing or disappearing
+- **citations** — prose that cites code by `path:line` or by a quoted phrase, where the citation resolved
+  when its line was last written and no longer resolves now
+
+Findings are ranked. A `verified` or `inferred` finding carries the evidence
+behind it — file, line, and the quoted source. A `model` finding carries none
+by construction, and the report says so where it prints one: it is a lead to
+check, not a result.
+
+A run that completes writes an HTML report into `.urtext/` at the repository
+root and prints its path; a run broken enough to exit non-zero deliberately
+writes none, so a report on disk never stands in for a review that worked.
+`--export md,pdf` additionally writes the review as GitHub-flavored Markdown
+and as a client-presentable PDF beside the HTML report, sharing its name;
+the same no-report rule applies to every format.
+urtext does not edit the reviewed repository's `.gitignore` — it suggests
+adding `.urtext/` when nothing already ignores it, and leaves the file alone.
+
+```bash
+npm run review                          # working tree vs merge-base with the default branch
+npm run review -- HEAD~3                # against a specific revision
+npm run review -- --no-llm              # deterministic analysis only; no API key needed
+npm run review -- --json                # machine-readable findings
+npm run review -- --open                # open the written report
+npm run review -- --export md,pdf       # also write Markdown and PDF beside the HTML report
+npm run review -- --model claude-opus-5 # pick the interpretation model
+npm run review -- --help                # every flag
+```
+
+The interpretation stage needs `ANTHROPIC_API_KEY`. Without it, urtext reports
+the analyzers' findings and says in the report that the model was never asked.
+
+## Install
+
+Not on npm yet. Install straight from GitHub — the build runs automatically
+on install — and `urtext` is on your PATH:
+
+```bash
+npm install -g github:noahogbi/urtext
+urtext review          # from any git repository
+```
+
+Or from a local checkout: `npm install -g path/to/urtext`. The
+`npm run review` form above is the dev loop inside this repository; it runs
+`src/` directly and needs no build.
+
+PDF export embeds the bundled DejaVu fonts, which cover Latin, Cyrillic, and
+Greek broadly but not CJK or other scripts — full-Unicode fonts cost tens of
+megabytes.
+
+### In CI
+
+`action.yml` at this repository's root is a composite GitHub Action that reviews a
+pull request and posts the result as one comment, edited in place on every push:
+
+```yaml
+name: urtext review
+on: pull_request
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # base...head needs the merge base, which a shallow clone lacks
+      - uses: noahogbi/urtext@v1
+```
+
+`@v1` is a tag, so the action cannot change under you between runs the way `@master`
+can. It was cut on a green cross-platform CI run — the check you can see for yourself
+on this repository.
+
+Four of the action's behaviours were verified against live pull requests, and it is
+worth being exact about where that evidence sits: it was recorded during development,
+in a private repository this one does not descend from, so **you cannot follow it from
+here.** What was observed there — the workflow posted one marked comment carrying a
+real review; a re-run edited that same comment rather than adding a second; a
+deliberately failed artifact upload left the job green with the comment intact; and the
+same failure without the upload guard took the job red. Read those as the author's
+report, not as something this repository lets you check.
+
+Two behaviours remain unverified anywhere and are not claimed — a pull request from a
+fork, where `GITHUB_TOKEN` is read-only and the post is expected to fail visibly, and
+the `pull_request_target` refusal, which cannot be observed from a branch because that
+trigger reads the base branch's workflow definition.
+
+The `permissions:` block sits at the job level, not the workflow level, so adopting
+this does not widen the token for a repository's other jobs. `issues: write` is not
+required — a pull request comment is created through the issue-comments endpoint on a
+pull request, which the `pull-requests` scope governs. The block itself is not
+optional: without `pull-requests: write` the post comes back HTTP 403, which looks
+exactly like the fork case below and is a different problem entirely.
+
+By default the review is deterministic: with no key, the action passes `--no-llm`,
+and the comment says so in urtext's own words. One line turns the model on:
+
+```yaml
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+An undefined secret expands to the empty string, so that line degrades to
+deterministic on its own rather than failing.
+
+The action never fails a pull request: a review that could not be produced is posted
+as a comment saying so, not as a red check. Every step that can fail captures its own
+status, and the one step that cannot — the artifact upload, which is a `uses:` step
+with no shell to capture in — is marked `continue-on-error`. A failed upload therefore
+costs the comment its `full report` link and empties the `report-artifact-url` output,
+rather than reddening the check. Note what that costs on a large review: the job summary
+is capped by GitHub at 1 MiB and the artifact is the uncapped copy, so past that size a
+failed upload loses the only complete copy of the review.
+`fail-on-error: true` opts into the opposite.
+
+One exception remains, deliberately, and `fail-on-error` does not govern it either: the
+`pull_request_target` refusal below fails the job on purpose.
+
+**Fork pull requests cannot be commented on.** On a `pull_request` run whose head is
+a fork, `GITHUB_TOKEN` is read-only regardless of the `permissions:` block and
+repository secrets are unavailable, so the post fails with HTTP 403; the action emits
+a warning, sets `posted: none`, leaves the full review in the job summary — and in the
+uploaded artifact when one was uploaded — and stays green. No configuration changes this — a personal access
+token does not help either, because secrets are not exposed to fork-PR runs. The
+known-safe pattern is a two-workflow split: a `pull_request` workflow runs the review
+and uploads the artifact this action already produces, and a `workflow_run` workflow —
+which runs from the base branch with a write token and never checks out head code —
+downloads it and posts. Shipping that second half is a deliberate follow-up.
+
+**`pull_request_target` is refused.** The action fails its first step on that trigger,
+on purpose: it grants a write token and secrets to a workflow that then reads the head
+revision, and urtext parses attacker-authored TypeScript.
+
+The job summary carries the full, untruncated review. GitHub caps a job summary at
+1 MiB and a larger review is cut by GitHub, not by urtext; the uploaded artifact is
+the uncapped copy. If a *review* comment exceeds `comment-limit`, whole findings are
+removed and the comment says how many and where the rest are.
+
+A *failure* comment does not shrink that way. Its headline, reason, closing sentence
+and footer are fixed copy, so a `comment-limit` below their combined length produces a
+comment longer than you asked for — and it is still posted. The action withholds a
+comment only when the body exceeds what the API itself accepts, which lowering
+`comment-limit` cannot cause; that run warns, sets `posted: none`, and leaves the review
+in the job summary — and in the artifact when one was uploaded.
+
+Every input is optional:
+
+| Input | What it does |
+|---|---|
+| `range` | The git range to review, passed to `urtext review` verbatim. Empty derives `<base sha>...<head sha>` from the pull request payload. |
+| `anthropic-api-key` | Key for the interpretation stage, passed to the CLI as an environment variable and never as an argument. Empty runs `--no-llm`; it never fails. |
+| `model` | Passed as `--model` when non-empty. No effect without `anthropic-api-key`. |
+| `github-token` | The token `gh` authenticates with. Needs `pull-requests: write`. |
+| `comment-marker` | The hidden marker identifying this action's comment. Change it to keep two independent urtext comments on one pull request. |
+| `comment-limit` | Maximum comment body length in characters — the forge's cap carried as data rather than compiled into urtext. |
+| `upload-report` | Upload the run's `.urtext/` directory and the Markdown review as a build artifact, and link it from the comment. |
+| `artifact-name` | The name of that artifact. |
+| `fail-on-error` | Exit non-zero when the review could not be produced or could not be posted. |
+
+And the outputs a later step can read:
+
+| Output | Value |
+|---|---|
+| `outcome` | `reviewed` when urtext produced a review, `failed` when it did not. |
+| `posted` | `created`, `edited`, or `none`. `none` collapses three causes — a body the API would reject on length, a body that could not be composed, and a post the API refused — and the run's warning names which. |
+| `comment-id` | The created or edited comment's id; empty when `posted` is `none`. |
+| `comment-url` | The comment's `html_url`; empty when `posted` is `none`. |
+| `exit-code` | urtext's own exit code, verbatim. The action interprets it; it never rewrites it. |
+| `omitted-findings` | How many findings the character cap left out. |
+| `report-artifact-url` | The uploaded artifact's URL; empty when `upload-report` is false, and also when the upload failed, which no longer fails the job. |
+
+Every default lives in `action.yml` and is deliberately not restated here, so there is
+one place to read it and one place to change it.
+
+## Layout
+
+- `src/extract/` — git range → changeset (files, hunks, changed symbols)
+- `src/analyze/` — analyzers producing typed facts with source evidence
+- `src/interpret/` — the model stage: facts in, labelled claims out
+- `src/score/` — importance weights, tier assignment, ranking
+- `src/report/` — terminal and HTML renderers, and report writing
+- `src/cli.ts` — entry point
+- `action.yml` — the composite GitHub Action that reviews a pull request
+- `action/` — the action's comment composer, plain ESM run by the runner's `node`
+- `archive/prototype/` — the klar-era IR prototype, kept for provenance
+
+Design: `docs/superpowers/specs/2026-08-15-urtext-diff-review-design.md`, and
+`docs/superpowers/README.md` for how to read the rest of them — including which
+citations in them no longer resolve here, and why they were left that way.
+
+## Provenance
+
+Built ~March 13, 2026 as a standalone prototype under the working name
+**klar** — an AI-native IR the model authored directly. Renamed **urtext**
+and first committed to version control August 15, 2026. In August 2026 it was
+re-aimed at the problem that had become the real bottleneck: reviewing
+AI-written diffs rather than authoring code in an IR. The prototype lives in
+`archive/prototype/`.

package/dist/analyze/blast-radius.d.ts

@@ -0,0 +1,28 @@
+import ts from "typescript";
+import type { Analyzer, EvidenceRef } from "../types.js";
+/**
+ * Every identifier in the program that resolves to the named export of the
+ * given file, excluding the declaration itself. Every identifier in every
+ * file is checked against the resolved symbol — not filtered by spelling
+ * first — because a name-matching shortcut is exactly the bug this function
+ * exists to avoid: it would both count an unrelated `used` in a different
+ * file and miss `import { used as u }` used later as `u(...)`, since `u`
+ * never shares text with `used`. Symbol identity, via `getSymbolAtLocation`
+ * and `getAliasedSymbol`, is the only thing that decides a match.
+ */
+export declare function countReferences(program: ts.Program, root: string, path: string, name: string): EvidenceRef[];
+/**
+ * Reports how widely a changed export is used. Only symbols that actually
+ * changed are considered — a busy export nobody touched is not news.
+ *
+ * This is the first analyzer whose interesting evidence is not co-located
+ * with its subject: the fact concerns a changed export in one file, but the
+ * evidence a reader wants — the call sites — lives in other files.
+ * `evidence[0]` is still the changed declaration itself, matching
+ * `Fact.file`/`Fact.line` exactly as every other analyzer in this codebase
+ * does; the reference sites follow it in `evidence[1..]` rather than
+ * displacing it. `detail.references` counts only the reference sites, not
+ * the declaration entry that precedes them — the number in the finding text
+ * means "places that use this".
+ */
+export declare const blastRadiusAnalyzer: Analyzer;

package/dist/analyze/blast-radius.js

@@ -0,0 +1,163 @@
+import { join } from "node:path";
+import ts from "typescript";
+import { isTypeScriptFile } from "../extract/symbols.js";
+import { makeFact, MAX_EVIDENCE } from "./fact.js";
+import { relativePathOf } from "./program.js";
+/**
+ * Every identifier in the program that resolves to the named export of the
+ * given file, excluding the declaration itself. Every identifier in every
+ * file is checked against the resolved symbol — not filtered by spelling
+ * first — because a name-matching shortcut is exactly the bug this function
+ * exists to avoid: it would both count an unrelated `used` in a different
+ * file and miss `import { used as u }` used later as `u(...)`, since `u`
+ * never shares text with `used`. Symbol identity, via `getSymbolAtLocation`
+ * and `getAliasedSymbol`, is the only thing that decides a match.
+ */
+export function countReferences(program, root, path, name) {
+    const checker = program.getTypeChecker();
+    const declFile = program.getSourceFile(join(root, path));
+    if (!declFile)
+        return [];
+    const moduleSymbol = checker.getSymbolAtLocation(declFile);
+    if (!moduleSymbol)
+        return [];
+    const resolve = (sym) => {
+        if (!sym)
+            return undefined;
+        return sym.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(sym) : sym;
+    };
+    const exportsOfModule = checker.getExportsOfModule(moduleSymbol);
+    // A default export sits in the export table under "default", whatever its
+    // declared name is, so the bare-name lookup finds nothing for `export
+    // default function main` and its reach silently never attached. When the
+    // bare name misses, take the default export — resolved through its alias
+    // for the `export default main;` statement form — but only when its own
+    // declaration really carries this name: the fallback must not hand an
+    // unrelated symbol the default export's reference count.
+    const declaresName = (sym) => (sym.declarations ?? []).some((d) => {
+        const declName = d.name;
+        return !!declName && ts.isIdentifier(declName) && declName.text === name;
+    });
+    const defaultExport = resolve(exportsOfModule.find((s) => s.getName() === ts.InternalSymbolName.Default));
+    const target = exportsOfModule.find((s) => s.getName() === name) ??
+        (defaultExport && declaresName(defaultExport) ? defaultExport : undefined);
+    if (!target)
+        return [];
+    // Set<ts.Node>, not Set<ts.Declaration>: it is only ever compared against
+    // node.parent below, which is typed as ts.Node.
+    const declarations = new Set(target.declarations ?? []);
+    const refs = [];
+    // A binding position — `import { used } from ...`, `import used from ...`
+    // (a default import is the ImportClause's own name, not a specifier),
+    // `export { used }`, or the bare identifier of `export default used;` —
+    // introduces a local name for the symbol; it does not read the value the
+    // symbol holds. Without this exclusion, every importing file counts
+    // twice: once for the import binding itself (which resolves through
+    // its alias to the same target) and once for each place that actually
+    // calls or reads it, so a file imported and used once would inflate the
+    // count to two.
+    const isBindingIdentifier = (node) => {
+        const p = node.parent;
+        if (ts.isImportSpecifier(p) || ts.isExportSpecifier(p)) {
+            return node === p.name || node === p.propertyName;
+        }
+        if (ts.isImportClause(p) || ts.isNamespaceImport(p) || ts.isNamespaceExport(p)) {
+            return node === p.name;
+        }
+        if (ts.isExportAssignment(p)) {
+            return node === p.expression;
+        }
+        return false;
+    };
+    for (const sf of program.getSourceFiles()) {
+        if (sf.isDeclarationFile)
+            continue;
+        const relPath = relativePathOf(root, sf);
+        const lines = sf.text.split("\n");
+        const visit = (node) => {
+            if (ts.isIdentifier(node)) {
+                const inDeclaration = declarations.has(node.parent);
+                if (!inDeclaration &&
+                    !isBindingIdentifier(node) &&
+                    resolve(checker.getSymbolAtLocation(node)) === target) {
+                    const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+                    refs.push({
+                        file: relPath,
+                        line,
+                        excerpt: (lines[line - 1] ?? "").trim(),
+                        // The program is built at the after revision, so every line
+                        // number here counts in the working tree the reader is looking
+                        // at.
+                        side: "after",
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        ts.forEachChild(sf, visit);
+    }
+    return refs;
+}
+/**
+ * Reports how widely a changed export is used. Only symbols that actually
+ * changed are considered — a busy export nobody touched is not news.
+ *
+ * This is the first analyzer whose interesting evidence is not co-located
+ * with its subject: the fact concerns a changed export in one file, but the
+ * evidence a reader wants — the call sites — lives in other files.
+ * `evidence[0]` is still the changed declaration itself, matching
+ * `Fact.file`/`Fact.line` exactly as every other analyzer in this codebase
+ * does; the reference sites follow it in `evidence[1..]` rather than
+ * displacing it. `detail.references` counts only the reference sites, not
+ * the declaration entry that precedes them — the number in the finding text
+ * means "places that use this".
+ */
+export const blastRadiusAnalyzer = async (changeset, ctx) => {
+    const relevant = changeset.files.filter((f) => isTypeScriptFile(f.path) &&
+        f.status !== "deleted" &&
+        f.symbols.some((s) => s.exported && s.change !== "removed"));
+    if (relevant.length === 0)
+        return [];
+    const program = await ctx.programAt(ctx.range.to);
+    const facts = [];
+    for (const file of relevant) {
+        const sf = program.getSourceFile(join(ctx.cwd, file.path));
+        const lines = sf ? sf.text.split("\n") : [];
+        for (const sym of file.symbols) {
+            if (!sym.exported || sym.change === "removed")
+                continue;
+            const refs = countReferences(program, ctx.cwd, file.path, sym.name);
+            // Nothing references it, so there is no blast radius to report — and
+            // a fact with only its own declaration as evidence would say nothing
+            // a surface_changed fact hasn't already said.
+            if (refs.length === 0)
+                continue;
+            const line = sym.range.startLine || 1;
+            const declaration = {
+                file: file.path,
+                line,
+                excerpt: (lines[line - 1] ?? "").trim(),
+                side: "after",
+            };
+            // No text to show for the declaration itself — the file was not in
+            // the program, or the line is blank. A fact whose anchor evidence is
+            // an empty excerpt asks the reader to take it on faith, which is what
+            // the `verified` badge is supposed to replace.
+            if (!declaration.excerpt)
+                continue;
+            facts.push(makeFact({
+                id: `blast_radius:${file.path}:${sym.qualifiedName}`,
+                kind: "blast_radius",
+                // The qualified name, matching the id: `countReferences` above
+                // takes the bare `sym.name` because a module's export table is
+                // keyed on the exported name, but nothing downstream may be. The
+                // two agree for a top-level export and only for that; the fact's
+                // identity does not get to depend on which of them was handy.
+                qualifiedSymbol: sym.qualifiedName,
+                detail: { symbol: sym.qualifiedName, references: refs.length },
+                evidence: [declaration, ...refs.slice(0, MAX_EVIDENCE)],
+            }));
+        }
+    }
+    return facts;
+};

package/dist/analyze/canonical.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Canonical form of a printed type, for COMPARISON only — never for display.
+ *
+ * `checker.typeToString` prints a union's members in type-interning order:
+ * the order each member type was first materialized anywhere in that
+ * program's checking history. That order is not source order, and it is not
+ * stable across two separately-built programs — reviewing a range that
+ * merely added a module shifted it, and three byte-identical declarations
+ * were reported as `verified` signature changes. `structuralSignature`'s
+ * top-level union sort fixed one position; this fixes the class, because a
+ * union can sit at ANY depth of a printed type — a property's type, a
+ * generic argument, a parameter.
+ *
+ * The printed text is itself valid TypeScript type syntax, so the real
+ * parser does the understanding: parse it, recursively sort every
+ * set-semantic construct — union constituents, intersection constituents,
+ * type-literal members — by the canonical text of each part, and print the
+ * result. A pipe inside a string-literal type is data, not grammar, and the
+ * parser knows the difference; pinned by `test/analyze/canonical.test.ts`,
+ * "is not fooled by separators inside string-literal types".
+ *
+ * Text that does not parse cleanly (a signature truncated mid-token by the
+ * storage cap) is returned unchanged: comparison then degrades to the raw
+ * string equality it was before this module existed, never to anything
+ * looser. Two different unparseable texts stay different.
+ */
+export declare function canonicalSignature(text: string): string;

package/dist/analyze/canonical.js

@@ -0,0 +1,74 @@
+import ts from "typescript";
+/**
+ * Canonical form of a printed type, for COMPARISON only — never for display.
+ *
+ * `checker.typeToString` prints a union's members in type-interning order:
+ * the order each member type was first materialized anywhere in that
+ * program's checking history. That order is not source order, and it is not
+ * stable across two separately-built programs — reviewing a range that
+ * merely added a module shifted it, and three byte-identical declarations
+ * were reported as `verified` signature changes. `structuralSignature`'s
+ * top-level union sort fixed one position; this fixes the class, because a
+ * union can sit at ANY depth of a printed type — a property's type, a
+ * generic argument, a parameter.
+ *
+ * The printed text is itself valid TypeScript type syntax, so the real
+ * parser does the understanding: parse it, recursively sort every
+ * set-semantic construct — union constituents, intersection constituents,
+ * type-literal members — by the canonical text of each part, and print the
+ * result. A pipe inside a string-literal type is data, not grammar, and the
+ * parser knows the difference; pinned by `test/analyze/canonical.test.ts`,
+ * "is not fooled by separators inside string-literal types".
+ *
+ * Text that does not parse cleanly (a signature truncated mid-token by the
+ * storage cap) is returned unchanged: comparison then degrades to the raw
+ * string equality it was before this module existed, never to anything
+ * looser. Two different unparseable texts stay different.
+ */
+export function canonicalSignature(text) {
+    const sf = ts.createSourceFile("__sig.ts", `type __T = ${text};`, ts.ScriptTarget.ES2022, true);
+    // `parseDiagnostics` is not on the public SourceFile type, but it is the
+    // only place the parser records recoverable syntax errors, and a wrapper
+    // program just to surface them would type-check the text — far more than
+    // this function may assume about it. Worst case if the field ever
+    // vanishes: `undefined` here reads as "no diagnostics" and a truncated
+    // signature canonicalizes best-effort — still deterministic, since the
+    // same cut text always parses to the same tree.
+    const diagnostics = sf
+        .parseDiagnostics;
+    const alias = sf.statements[0];
+    if (sf.statements.length !== 1 ||
+        !ts.isTypeAliasDeclaration(alias) ||
+        (diagnostics?.length ?? 0) > 0) {
+        return text;
+    }
+    const printer = ts.createPrinter({ removeComments: true });
+    const print = (node) => printer.printNode(ts.EmitHint.Unspecified, node, sf);
+    // Plain code-unit order: deterministic on every machine, unlike a locale
+    // collation. What the order IS does not matter; that it never varies does.
+    const byPrintedText = (nodes) => nodes
+        .map((node) => ({ node, key: print(node) }))
+        .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0))
+        .map((entry) => entry.node);
+    const transformed = ts.transform(alias.type, [
+        (context) => {
+            const visit = (node) => {
+                // Children first, so a constituent's sort key is already canonical
+                // by the time its parent orders it.
+                const visited = ts.visitEachChild(node, visit, context);
+                if (ts.isUnionTypeNode(visited)) {
+                    return ts.factory.updateUnionTypeNode(visited, ts.factory.createNodeArray(byPrintedText(visited.types)));
+                }
+                if (ts.isIntersectionTypeNode(visited)) {
+                    return ts.factory.updateIntersectionTypeNode(visited, ts.factory.createNodeArray(byPrintedText(visited.types)));
+                }
+                if (ts.isTypeLiteralNode(visited)) {
+                    return ts.factory.updateTypeLiteralNode(visited, ts.factory.createNodeArray(byPrintedText(visited.members)));
+                }
+                return visited;
+            };
+            return (root) => ts.visitNode(root, visit);
+        },
+    ]);
+    return print(transformed.transformed[0]);
+}