rea-agents 1.5.0 → 1.7.0

package/dist/application/BrowserObservationService.js

@@ -1,3 +1,4 @@
+import { isLiteralLoopbackHostname, } from "../domain/browserObservation.js";
 import { AnalysisCapabilityUnavailableError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 import { createBrowserEvidence } from "./BrowserEvidence.js";
@@ -21,6 +22,66 @@ export const inspectWebPage = async (browser, authority, input, options = {}) =>
         ? ok(createBrowserEvidence("inspect_web_page", input, result.value, ready.value.identity()))
         : result;
 };
+/** Capture approved sources and derive bounded static web-bundle evidence. */
+export const analyzeWebBundle = async (browser, authority, input, options = {}) => {
+    const ready = await prepare(browser, authority, input, "analyze_web_bundle");
+    if (!ready.ok)
+        return ready;
+    const analyzed = await ready.value.analyzeBundle(input, options);
+    if (!analyzed.ok)
+        return analyzed;
+    return ok(createBrowserEvidence("analyze_web_bundle", input, analyzed.value, ready.value.identity()));
+};
+/** Observe navigation caused by external user actions during one armed window. */
+export const observeWebSession = async (browser, authority, input, options = {}) => {
+    const ready = await prepare(browser, authority, input, "observe_web_session");
+    if (!ready.ok)
+        return ready;
+    const observed = await ready.value.observeSession(input, options);
+    return observed.ok
+        ? ok(createBrowserEvidence("observe_web_session", input, observed.value, ready.value.identity()))
+        : observed;
+};
+/** Discover WebMCP declarations without exposing an invocation surface. */
+export const discoverWebMcpTools = async (browser, authority, input, options = {}) => {
+    const ready = await prepare(browser, authority, input, "discover_webmcp_tools");
+    if (!ready.ok)
+        return ready;
+    const discovered = await ready.value.discoverWebMcpTools(input, options);
+    return discovered.ok
+        ? ok(createBrowserEvidence("discover_webmcp_tools", input, discovered.value, ready.value.identity()))
+        : discovered;
+};
+/** Compare two already-normalized web captures without external access. */
+export const compareWebCaptureEvidence = async (browser, input) => {
+    const ready = requireBrowser(browser, "compare_web_captures");
+    if (!ready.ok)
+        return ready;
+    const compared = await ready.value.compareCaptures(input);
+    return compared.ok
+        ? ok(createBrowserEvidence("compare_web_captures", input, compared.value, ready.value.identity()))
+        : compared;
+};
+/** Capture one explicitly approved visible-viewport screenshot. */
+export const captureWebScreenshot = async (browser, authority, input, options = {}) => {
+    const ready = await prepare(browser, authority, input, "capture_web_screenshot");
+    if (!ready.ok)
+        return ready;
+    const captured = await ready.value.captureScreenshot(input, options);
+    return captured.ok
+        ? ok(createBrowserEvidence("capture_web_screenshot", input, captured.value, ready.value.identity()))
+        : captured;
+};
+/** Compare two self-verifying PNG artifacts without external access. */
+export const compareWebScreenshotEvidence = async (browser, input) => {
+    const ready = requireBrowser(browser, "compare_web_screenshots");
+    if (!ready.ok)
+        return ready;
+    const compared = await ready.value.compareScreenshots(input);
+    return compared.ok
+        ? ok(createBrowserEvidence("compare_web_screenshots", input, compared.value, ready.value.identity()))
+        : compared;
+};
 const prepare = async (browser, authority, input, operation) => {
     if (authority === undefined)
         return err(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation permission policy is not configured"));
@@ -44,9 +105,12 @@ const prepare = async (browser, authority, input, operation) => {
         ? err(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation provider is not configured"))
         : ok(browser);
 };
+const requireBrowser = (browser, operation) => browser === undefined
+    ? err(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser comparison provider is not configured"))
+    : ok(browser);
 const browserNetworkScope = (allowedOrigins) => allowedOrigins.every((origin) => {
     const hostname = new URL(origin).hostname;
-    return hostname === "127.0.0.1" || hostname === "[::1]";
+    return isLiteralLoopbackHostname(hostname);
 })
     ? "loopback"
     : "external";

package/dist/application/CapabilityInventory.js

@@ -71,6 +71,13 @@ const availabilityFor = (name, kind, targetOpen, targetKind, descriptors, policy
                 reason: "policy_disabled",
                 remediation: "Enable browser observation and configure exact CDP endpoint and page origins.",
             };
+    if (kind === "electron-provider")
+        return policy.electronObservationEnabled === true
+            ? { reason: "available", remediation: null }
+            : {
+                reason: "policy_disabled",
+                remediation: "Enable Electron observation and configure a loopback CDP endpoint and canonical file roots.",
+            };
     if (kind === "session")
         return { reason: "available", remediation: null };
     if (!targetOpen)

package/dist/application/ClientConfigPath.js

@@ -0,0 +1,33 @@
+import { lstat, realpath } from "node:fs/promises";
+const systemFileSystem = { lstat, realpath };
+/**
+ * Resolve an existing, user-owned config symlink to one stable transaction
+ * path. Missing regular paths remain eligible for first-run creation.
+ */
+export const resolveClientConfigTransactionPath = async (requestedPath, fileSystem = systemFileSystem) => {
+    let requestedStats;
+    try {
+        requestedStats = await fileSystem.lstat(requestedPath);
+    }
+    catch (cause) {
+        return isMissing(cause) ? requestedPath : undefined;
+    }
+    if (!requestedStats.isSymbolicLink())
+        return requestedPath;
+    const currentUid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    if (currentUid === undefined ||
+        requestedStats.uid !== currentUid ||
+        fileSystem.realpath === undefined)
+        return undefined;
+    try {
+        const canonicalPath = await fileSystem.realpath(requestedPath);
+        const targetStats = await fileSystem.lstat(canonicalPath);
+        return targetStats.isFile?.() === true && targetStats.uid === currentUid
+            ? canonicalPath
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const isMissing = (cause) => cause instanceof Error && "code" in cause && cause.code === "ENOENT";

package/dist/application/CompositeProvider.js

@@ -1,8 +1,9 @@
-import { ProviderSelectionError } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-const compositeIdentity = (providers) => ({
-    id: `composite:${providers
-        .map((provider) => provider.identity().id)
+/** Synthetic compatibility identity for a deterministic provider set. */
+export const compositeProviderIdentity = (identities) => ({
+    id: `composite:${identities
+        .map(({ id }) => id)
         .sort()
         .join("+")}`,
     name: "REA composite analysis provider",
@@ -14,11 +15,16 @@ export class CompositeProvider {
     #identity;
     #capabilities;
     #providerByOperation;
+    #profileProvider;
     constructor(providers) {
         this.providers = providers;
         if (providers.length === 0)
             throw new RangeError("CompositeProvider requires at least one provider");
-        this.#identity = Object.freeze(compositeIdentity(providers));
+        const profileProviders = providers.filter(({ resolveAnalysisProfile }) => resolveAnalysisProfile !== undefined);
+        if (profileProviders.length > 1)
+            throw new TypeError("CompositeProvider supports at most one target-bound analysis profile");
+        this.#profileProvider = profileProviders[0];
+        this.#identity = Object.freeze(compositeProviderIdentity(providers.map((provider) => provider.identity())));
         const routes = new Map();
         const capabilities = [];
         for (const provider of providers) {
@@ -39,13 +45,19 @@ export class CompositeProvider {
     capabilities() {
         return this.#capabilities;
     }
-    createClient(target) {
+    resolveAnalysisProfile(target, options) {
+        const resolve = this.#profileProvider?.resolveAnalysisProfile;
+        return resolve === undefined
+            ? Promise.resolve(ok({ profile: null, compatibility: {} }))
+            : resolve.call(this.#profileProvider, target, options);
+    }
+    createClient(target, profile) {
         const clients = new Map();
         const clientFor = (provider) => {
             const existing = clients.get(provider);
             if (existing !== undefined)
                 return existing;
-            const created = provider.createClient(target);
+            const created = provider.createClient(target, profile?.provider.id === provider.identity().id ? profile : undefined);
             clients.set(provider, created);
             return created;
         };
@@ -62,7 +74,7 @@ export class CompositeProvider {
                     }));
                 const provider = this.#providerByOperation.get(operation);
                 return provider === undefined
-                    ? Promise.resolve(err(new ProviderSelectionError(operation)))
+                    ? Promise.resolve(err(new AnalysisCapabilityUnavailableError(this.#identity.id, operation, "operation is not declared by this provider set")))
                     : clientFor(provider).execute(operation, parameters, options);
             },
             close: async () => {

package/dist/application/CrossVersionInventory.js

@@ -7,6 +7,14 @@ import { paginateArtifactInventory, } from "./ArtifactInventory.js";
 import { scanAuthorizedArtifactInventory } from "./AuthorizedArtifactInventory.js";
 import { ARTIFACT_GRAPH_PROVIDER } from "./InvestigationProviders.js";
 export const AUTOMATIC_RUN_LIMITATION = "Automatic cross-version runs compare shipped artifact structure only; they do not execute either version.";
+/** Start both independent version scans while preserving left/right identity. */
+export const scanVersionInventories = async (options, scanner = scanAuthorizedArtifactInventory) => {
+    const [left, right] = await Promise.all([
+        scanner(options.leftPath, options.inputRoots, options.limits, options.signal, options.integrity),
+        scanner(options.rightPath, options.inputRoots, options.limits, options.signal, options.integrity),
+    ]);
+    return { left, right };
+};
 /** Authorize and scan both inputs once under the same bounded traversal policy. */
 export const scanVersions = async (input, inputRoots, signal, integrityContinueEnabled = false) => {
     try {
@@ -19,9 +27,14 @@ export const scanVersions = async (input, inputRoots, signal, integrityContinueE
             enabled: integrityContinueEnabled,
             maxMismatches: input.max_integrity_mismatches,
         };
-        const left = await scanAuthorizedArtifactInventory(input.left_path, inputRoots, limits, signal, integrity);
-        const right = await scanAuthorizedArtifactInventory(input.right_path, inputRoots, limits, signal, integrity);
-        return ok({ left, right });
+        return ok(await scanVersionInventories({
+            leftPath: input.left_path,
+            rightPath: input.right_path,
+            inputRoots,
+            limits,
+            ...(signal === undefined ? {} : { signal }),
+            integrity,
+        }));
     }
     catch (cause) {
         if (cause instanceof ArtifactReaderFailure)

package/dist/application/CrossVersionInvestigation.js

@@ -1,14 +1,12 @@
-import { compareArtifacts } from "../domain/artifactComparison.js";
-import { findChangedBehavior } from "../domain/changedBehavior.js";
-import { createEvidence } from "../domain/evidence.js";
+import {} from "../domain/evidence.js";
 import { createEvidenceBundle, } from "../domain/evidenceBundle.js";
 import { AnalysisCancelledError, AnalysisInputError, EvidenceIntegrityError, InvestigationWorkspaceError, } from "../domain/errors.js";
-import { createLegacyInvestigationRunIdentity, createInvestigationRunIdentity, createInvestigationWorkspace, crossVersionInvestigationInputSchema, investigationRunSchema, investigationRunSummarySchema, reviseInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
+import { createLegacyInvestigationRunIdentity, createInvestigationRunIdentity, createInvestigationWorkspace, crossVersionInvestigationInputSchema, investigationRunSchema, reviseInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { err, ok } from "../domain/result.js";
-import { AUTOMATIC_RUN_LIMITATION, createInventoryEvidencePages, runLimitations, scanVersions, targetFor, } from "./CrossVersionInventory.js";
+import { createInventoryEvidencePages, runLimitations, scanVersions, targetFor, } from "./CrossVersionInventory.js";
 import { readInvestigationWorkspace, writeInvestigationWorkspace, } from "./InvestigationWorkspaceStore.js";
-import { ARTIFACT_COMPARISON_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, } from "./InvestigationProviders.js";
+import { createArtifactComparisonEvidence, createChangedBehaviorEvidence, } from "./CrossVersionInvestigationEvidence.js";
+import { selectCompletedInvestigationReplay } from "./CrossVersionInvestigationReplay.js";
 /** Run or resume a deterministic cross-version artifact investigation. */
 export const runCrossVersionInvestigation = async (input, policy, execution) => {
     const parsed = crossVersionInvestigationInputSchema.safeParse(input);
@@ -24,6 +22,17 @@ export const runCrossVersionInvestigation = async (input, policy, execution) =>
         return preflight;
     if (isCancelled(execution.signal))
         return err(new AnalysisCancelledError("find_changed_behavior"));
+    if (parsed.data.replay_run_id !== undefined) {
+        const replay = selectCompletedInvestigationReplay(initial.value, parsed.data);
+        if (!replay.ok)
+            return replay;
+        return completeOutcome(replay.value.workspace, replay.value.run, true, execution.session);
+    }
+    if (execution.authorizeInputRead !== undefined) {
+        const authorized = await execution.authorizeInputRead();
+        if (!authorized.ok)
+            return authorized;
+    }
     await execution.progress?.report({
         phase: "scan_versions",
         completed: 0,
@@ -198,31 +207,11 @@ const ensureComparisonCheckpoint = async (input, state, policy) => {
     });
     return saved.ok ? ok({ workspace: saved.value, run }) : saved;
 };
-const createArtifactComparisonEvidence = (inventory, limit) => {
-    const comparison = compareArtifacts(inventory.left, inventory.right, 0, limit);
-    const leftIds = evidenceIds(inventory.left);
-    const rightIds = evidenceIds(inventory.right);
-    return createEvidence(undefined, ARTIFACT_COMPARISON_PROVIDER, {
-        predicateType: "rea.artifact-comparison/v1",
-        operation: "compare_artifacts",
-        parameters: {
-            left_evidence_ids: leftIds,
-            right_evidence_ids: rightIds,
-            offset: 0,
-            limit,
-        },
-        result: jsonValueSchema.parse(comparison),
-        confidence: "derived",
-        authority: "analyst-inference",
-        limitations: comparison.limitations,
-        evidenceLinks: [...leftIds, ...rightIds],
-    });
-};
 const finalizeInvestigation = async (input, state, policy, session) => {
     const comparison = comparisonEvidenceFor(state.workspace, state.run);
     if (!comparison.ok)
         return comparison;
-    const evidence = createChangedBehaviorEvidence(state, comparison.value);
+    const evidence = createChangedBehaviorEvidence(state.workspace, state.run, comparison.value);
     const run = investigationRunSchema.parse({
         ...state.run,
         status: "complete",
@@ -244,40 +233,6 @@ const finalizeInvestigation = async (input, state, policy, session) => {
     });
     return saved.ok ? completeOutcome(saved.value, run, false, session) : saved;
 };
-const createChangedBehaviorEvidence = (state, comparison) => {
-    const limit = Math.min(state.run.options.change_limit, 100);
-    const changed = findChangedBehavior([comparison], 0, limit);
-    const summary = investigationRunSummarySchema.parse({
-        schema_version: 1,
-        workspace_id: state.workspace.workspace_id,
-        run_id: state.run.run_id,
-        left_manifest_id: state.run.left.manifest_id,
-        right_manifest_id: state.run.right.manifest_id,
-        inventory_evidence_count: state.run.left_inventory_evidence_ids.length +
-            state.run.right_inventory_evidence_ids.length,
-        comparison_evidence_id: comparison.evidence_id,
-        limitations: state.run.limitations,
-    });
-    return createEvidence(undefined, CHANGED_BEHAVIOR_PROVIDER, {
-        predicateType: "rea.changed-behavior/v1",
-        operation: "find_changed_behavior",
-        parameters: {
-            workspace_id: state.workspace.workspace_id,
-            run_id: state.run.run_id,
-            comparison_evidence_ids: [comparison.evidence_id],
-            offset: 0,
-            limit,
-        },
-        result: jsonValueSchema.parse({
-            ...changed,
-            investigation_run: summary,
-        }),
-        confidence: "derived",
-        authority: "analyst-inference",
-        limitations: [...changed.limitations, AUTOMATIC_RUN_LIMITATION],
-        evidenceLinks: changed.evidence_links,
-    });
-};
 const comparisonEvidenceFor = (workspace, run) => {
     const evidence = workspace.bundle.records.find(({ evidence_id: id }) => id === run.comparison_evidence_id);
     return evidence === undefined

package/dist/application/CrossVersionInvestigationEvidence.js

@@ -0,0 +1,64 @@
+import { compareArtifacts } from "../domain/artifactComparison.js";
+import { findChangedBehavior } from "../domain/changedBehavior.js";
+import { createEvidence } from "../domain/evidence.js";
+import { investigationRunSummarySchema, } from "../domain/investigationWorkspace.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { AUTOMATIC_RUN_LIMITATION } from "./CrossVersionInventory.js";
+import { ARTIFACT_COMPARISON_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, } from "./InvestigationProviders.js";
+/** Derive deterministic artifact-comparison Evidence from inventory pages. */
+export const createArtifactComparisonEvidence = (inventory, limit) => {
+    const comparison = compareArtifacts(inventory.left, inventory.right, 0, limit);
+    const leftIds = evidenceIds(inventory.left);
+    const rightIds = evidenceIds(inventory.right);
+    return createEvidence(undefined, ARTIFACT_COMPARISON_PROVIDER, {
+        predicateType: "rea.artifact-comparison/v1",
+        operation: "compare_artifacts",
+        parameters: {
+            left_evidence_ids: leftIds,
+            right_evidence_ids: rightIds,
+            offset: 0,
+            limit,
+        },
+        result: jsonValueSchema.parse(comparison),
+        confidence: "derived",
+        authority: "analyst-inference",
+        limitations: comparison.limitations,
+        evidenceLinks: [...leftIds, ...rightIds],
+    });
+};
+/** Derive the deterministic final report for one comparison checkpoint. */
+export const createChangedBehaviorEvidence = (workspace, run, comparison) => {
+    const limit = Math.min(run.options.change_limit, 100);
+    const changed = findChangedBehavior([comparison], 0, limit);
+    const summary = investigationRunSummarySchema.parse({
+        schema_version: 1,
+        workspace_id: workspace.workspace_id,
+        run_id: run.run_id,
+        left_manifest_id: run.left.manifest_id,
+        right_manifest_id: run.right.manifest_id,
+        inventory_evidence_count: run.left_inventory_evidence_ids.length +
+            run.right_inventory_evidence_ids.length,
+        comparison_evidence_id: comparison.evidence_id,
+        limitations: run.limitations,
+    });
+    return createEvidence(undefined, CHANGED_BEHAVIOR_PROVIDER, {
+        predicateType: "rea.changed-behavior/v1",
+        operation: "find_changed_behavior",
+        parameters: {
+            workspace_id: workspace.workspace_id,
+            run_id: run.run_id,
+            comparison_evidence_ids: [comparison.evidence_id],
+            offset: 0,
+            limit,
+        },
+        result: jsonValueSchema.parse({
+            ...changed,
+            investigation_run: summary,
+        }),
+        confidence: "derived",
+        authority: "analyst-inference",
+        limitations: [...changed.limitations, AUTOMATIC_RUN_LIMITATION],
+        evidenceLinks: changed.evidence_links,
+    });
+};
+const evidenceIds = (records) => records.map(({ evidence_id: id }) => id);

package/dist/application/CrossVersionInvestigationReplay.js

@@ -0,0 +1,170 @@
+import { isDeepStrictEqual } from "node:util";
+import { artifactInventoryResultSchema, } from "../domain/artifactGraph.js";
+import { parseArtifactInventoryEvidence } from "../domain/artifactInventoryEvidence.js";
+import { EvidenceIntegrityError, InvestigationWorkspaceError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { createArtifactComparisonEvidence, createChangedBehaviorEvidence, } from "./CrossVersionInvestigationEvidence.js";
+import { AUTOMATIC_RUN_LIMITATION } from "./CrossVersionInventory.js";
+import { ARTIFACT_GRAPH_PROVIDER } from "./InvestigationProviders.js";
+/** Select and verify one caller-identified complete run without input access. */
+export const selectCompletedInvestigationReplay = (workspace, input) => {
+    const run = workspace?.runs.find(({ run_id: runId }) => runId === input.replay_run_id);
+    if (workspace === null ||
+        run === undefined ||
+        run.status !== "complete" ||
+        !controlsMatch(run, input))
+        return replayConflict();
+    const records = new Map(workspace.bundle.records.map((record) => [record.evidence_id, record]));
+    const left = inventoryRecords(records, run.left_inventory_evidence_ids);
+    const right = inventoryRecords(records, run.right_inventory_evidence_ids);
+    if (!left.ok)
+        return left;
+    if (!right.ok)
+        return right;
+    if (!pathsMatch(left.value, input.left_path) ||
+        !pathsMatch(right.value, input.right_path))
+        return replayConflict();
+    const validated = validateLinkedEvidence(workspace, run, left.value, right.value);
+    return validated.ok ? ok({ workspace, run }) : validated;
+};
+const controlsMatch = (run, input) => isDeepStrictEqual(run.options, input.options) &&
+    run.integrity_policy === input.integrity_policy &&
+    run.integrity_continue_approved === input.integrity_continue_approved &&
+    run.max_integrity_mismatches === input.max_integrity_mismatches;
+const inventoryRecords = (records, evidenceIds) => {
+    if (new Set(evidenceIds).size !== evidenceIds.length)
+        return replayIntegrity("Investigation replay repeats inventory Evidence");
+    const selected = evidenceIds.flatMap((evidenceId) => {
+        const evidence = records.get(evidenceId);
+        return evidence === undefined ? [] : [evidence];
+    });
+    return selected.length === evidenceIds.length
+        ? ok(selected)
+        : replayIntegrity("Investigation replay is missing inventory Evidence");
+};
+const pathsMatch = (records, path) => records.every(({ subject }) => subject?.local_path === path);
+const validateLinkedEvidence = (workspace, run, leftRecords, rightRecords) => {
+    try {
+        const left = validateInventory(leftRecords, run.left, run);
+        const right = validateInventory(rightRecords, run.right, run);
+        if (!left.ok)
+            return left;
+        if (!right.ok)
+            return right;
+        const expectedLimitations = runLimitations(left.value, right.value);
+        if (!isDeepStrictEqual(run.limitations, expectedLimitations))
+            return replayIntegrity("Investigation replay limitations disagree with inventory Evidence");
+        const comparison = createArtifactComparisonEvidence({ left: left.value.records, right: right.value.records }, run.options.change_limit);
+        const storedComparison = evidenceFor(workspace, run.comparison_evidence_id);
+        if (storedComparison === undefined ||
+            !isDeepStrictEqual(storedComparison, comparison))
+            return replayIntegrity("Investigation replay comparison Evidence is inconsistent");
+        const result = createChangedBehaviorEvidence(workspace, run, comparison);
+        const storedResult = evidenceFor(workspace, run.result_evidence_id);
+        return storedResult !== undefined && isDeepStrictEqual(storedResult, result)
+            ? ok(null)
+            : replayIntegrity("Investigation replay result Evidence is inconsistent");
+    }
+    catch (cause) {
+        return replayIntegrity("Investigation replay linked Evidence is invalid", cause);
+    }
+};
+const validateInventory = (records, target, run) => {
+    const pages = records.map((record) => artifactInventoryResultSchema.parse(record.normalized_result));
+    const expectedPageCount = Math.max(1, Math.ceil((pages[0]?.manifest.node_count ?? 0) / run.options.page_size), Math.ceil((pages[0]?.manifest.occurrence_count ?? 0) / run.options.page_size), Math.ceil((pages[0]?.manifest.edge_count ?? 0) / run.options.page_size));
+    if (records.length !== expectedPageCount)
+        return replayIntegrity("Investigation replay inventory Evidence pagination is inconsistent");
+    if (!sameSnapshotMetadata(pages))
+        return replayIntegrity("Investigation replay inventory pages disagree on snapshot metadata");
+    for (const [index, record] of records.entries()) {
+        const page = pages[index];
+        if (page === undefined || !inventoryRecordMatches(record, page, run, index))
+            return replayIntegrity("Investigation replay inventory Evidence is inconsistent");
+    }
+    const result = parseArtifactInventoryEvidence(records);
+    if (!result.inventory.complete || !targetMatches(result.inventory, target))
+        return replayIntegrity("Investigation replay inventory commitment is inconsistent");
+    return ok({ records, result });
+};
+const inventoryRecordMatches = (record, page, run, index) => {
+    const offset = index * run.options.page_size;
+    const parameters = {
+        node_offset: offset,
+        node_limit: run.options.page_size,
+        occurrence_offset: offset,
+        occurrence_limit: run.options.page_size,
+        edge_offset: offset,
+        edge_limit: run.options.page_size,
+        max_entries: run.options.max_entries,
+        max_total_bytes: run.options.max_total_bytes,
+        max_entry_bytes: run.options.max_entry_bytes,
+        max_compression_ratio: run.options.max_compression_ratio,
+        max_depth: run.options.max_depth,
+        max_path_bytes: run.options.max_path_bytes,
+        integrity_policy: run.integrity_policy,
+        integrity_continue_approved: run.integrity_continue_approved,
+        max_integrity_mismatches: run.max_integrity_mismatches,
+    };
+    const locations = page.occurrences.items.map(({ logical_path: path }) => ({
+        kind: "artifact-path",
+        path,
+    }));
+    return (record.subject !== null &&
+        record.subject.name === record.subject.local_path.split("/").at(-1) &&
+        record.subject.digest.sha256 === page.manifest.root_sha256 &&
+        record.subject.format === page.manifest.root_format &&
+        record.subject.architecture === null &&
+        isDeepStrictEqual(record.provider, ARTIFACT_GRAPH_PROVIDER) &&
+        record.predicate_type === "rea.analysis/v2" &&
+        record.operation === "inventory_artifact" &&
+        isDeepStrictEqual(record.parameters, parameters) &&
+        record.raw_result === null &&
+        record.confidence === "observed" &&
+        record.authority === "shipped-artifact" &&
+        record.environment === null &&
+        isDeepStrictEqual(record.limitations, page.limitations) &&
+        isDeepStrictEqual(record.locations, locations) &&
+        record.evidence_links.length === 0 &&
+        isDeepStrictEqual(page.limits, traversalLimits(run)) &&
+        pageMatches(page.nodes, offset, run.options.page_size, page.manifest.node_count) &&
+        pageMatches(page.occurrences, offset, run.options.page_size, page.manifest.occurrence_count) &&
+        pageMatches(page.edges, offset, run.options.page_size, page.manifest.edge_count));
+};
+const sameSnapshotMetadata = (pages) => {
+    const first = pages[0];
+    return (first !== undefined &&
+        pages.every((page) => isDeepStrictEqual(page.manifest, first.manifest) &&
+            isDeepStrictEqual(page.limits, first.limits) &&
+            isDeepStrictEqual(page.provenance, first.provenance) &&
+            isDeepStrictEqual(page.integrity_contradictions, first.integrity_contradictions) &&
+            isDeepStrictEqual(page.limitations, first.limitations)));
+};
+const pageMatches = (page, offset, limit, total) => page.offset === offset &&
+    page.limit === limit &&
+    page.total === total &&
+    page.items.length === Math.max(0, Math.min(limit, page.total - offset)) &&
+    page.next_offset === (offset + limit < page.total ? offset + limit : null);
+const traversalLimits = (run) => ({
+    max_entries: run.options.max_entries,
+    max_total_bytes: run.options.max_total_bytes,
+    max_entry_bytes: run.options.max_entry_bytes,
+    max_compression_ratio: run.options.max_compression_ratio,
+    max_depth: run.options.max_depth,
+    max_path_bytes: run.options.max_path_bytes,
+});
+const targetMatches = (inventory, target) => inventory.manifest.root_sha256 === target.root_sha256 &&
+    inventory.manifest.graph_sha256 === target.graph_sha256 &&
+    inventory.manifest.manifest_id === target.manifest_id &&
+    inventory.manifest.root_format === target.format;
+const runLimitations = (left, right) => [
+    ...new Set([
+        ...left.result.inventory.limitations.map((item) => `Left: ${item}`),
+        ...right.result.inventory.limitations.map((item) => `Right: ${item}`),
+        AUTOMATIC_RUN_LIMITATION,
+    ]),
+].sort((first, second) => first.localeCompare(second));
+const evidenceFor = (workspace, evidenceId) => evidenceId === null
+    ? undefined
+    : workspace.bundle.records.find(({ evidence_id: current }) => current === evidenceId);
+const replayConflict = () => err(new InvestigationWorkspaceError("read", "revision-conflict"));
+const replayIntegrity = (message, cause) => err(new EvidenceIntegrityError(message, cause === undefined ? undefined : { cause }));