rea-agents 1.6.0 → 2.0.0

package/dist/application/ManagedMemberComparisonService.js

@@ -0,0 +1,122 @@
+import { readFile, stat } from "node:fs/promises";
+import { z } from "zod";
+import { compareManagedMembers, managedMemberComparisonResultSchema, parseManagedMemberEvidence, } from "../domain/managedMemberComparison.js";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { parseBinaryTarget } from "../domain/binaryTarget.js";
+import { err, ok } from "../domain/result.js";
+import { inspectManagedMembersBytes } from "../dotnet/ManagedMemberInspector.js";
+import { MANAGED_STATIC_PROVIDER } from "./InvestigationProviders.js";
+import { MANAGED_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
+/** Compare managed members from input parsed by a trusted adapter. */
+export const compareManagedMembersEvidenceValidated = (input) => {
+    const operation = "compare_managed_members";
+    try {
+        const left = parseManagedMemberEvidence(input.left);
+        const right = parseManagedMemberEvidence(input.right);
+        const result = compareManagedMembers({ evidenceId: left.evidenceId, result: left.result }, { evidenceId: right.evidenceId, result: right.result }, input.limits);
+        return ok(createManagedMemberComparisonEvidence(input, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+/** Inspect two local PE artifacts and return one derived comparison Evidence. */
+export const compareManagedMemberPaths = async (input) => {
+    const operation = "compare_managed_members";
+    try {
+        const [leftTarget, rightTarget] = await Promise.all([
+            parseBinaryTarget(input.leftPath),
+            parseBinaryTarget(input.rightPath),
+        ]);
+        if (!leftTarget.ok)
+            return err(new AnalysisInputError(operation, { cause: leftTarget.error }));
+        if (!rightTarget.ok)
+            return err(new AnalysisInputError(operation, { cause: rightTarget.error }));
+        const [leftStat, rightStat] = await Promise.all([
+            stat(leftTarget.value.path),
+            stat(rightTarget.value.path),
+        ]);
+        if (leftStat.size > input.memberLimits.maxFileBytes ||
+            rightStat.size > input.memberLimits.maxFileBytes)
+            return err(new AnalysisInputError(operation, {
+                cause: new RangeError(`Managed comparison input exceeds max_file_bytes ${String(input.memberLimits.maxFileBytes)}`),
+            }));
+        const [leftBytes, rightBytes] = await Promise.all([
+            readFile(leftTarget.value.path),
+            readFile(rightTarget.value.path),
+        ]);
+        const leftInspection = inspectManagedMembersBytes(leftBytes, leftTarget.value, input.memberLimits);
+        const rightInspection = inspectManagedMembersBytes(rightBytes, rightTarget.value, input.memberLimits);
+        const leftEvidence = createEvidence(leftTarget.value, MANAGED_STATIC_PROVIDER, {
+            operation: "inspect_managed_members",
+            parameters: memberLimitParameters(input.memberLimits),
+            result: jsonValueSchema.parse(leftInspection),
+            rawResult: null,
+            limitations: leftInspection.limitations,
+            locations: [{ kind: "artifact-path", path: leftTarget.value.path }],
+        });
+        const rightEvidence = createEvidence(rightTarget.value, MANAGED_STATIC_PROVIDER, {
+            operation: "inspect_managed_members",
+            parameters: memberLimitParameters(input.memberLimits),
+            result: jsonValueSchema.parse(rightInspection),
+            rawResult: null,
+            limitations: rightInspection.limitations,
+            locations: [{ kind: "artifact-path", path: rightTarget.value.path }],
+        });
+        const result = compareManagedMembers({
+            evidenceId: leftEvidence.evidence_id,
+            result: leftInspection,
+        }, {
+            evidenceId: rightEvidence.evidence_id,
+            result: rightInspection,
+        }, input.comparisonLimits);
+        return ok(createManagedMemberComparisonEvidence({
+            left: leftEvidence,
+            right: rightEvidence,
+            limits: input.comparisonLimits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+const createManagedMemberComparisonEvidence = (parameters, result) => createEvidence(undefined, MANAGED_WORKFLOW_PROVIDER, {
+    predicateType: "rea.managed-member-comparison/v1",
+    operation: "compare_managed_members",
+    parameters: {
+        left_evidence_id: parameters.left.evidence_id,
+        right_evidence_id: parameters.right.evidence_id,
+        limits: jsonValueSchema.parse(parameters.limits),
+    },
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});
+const memberLimitParameters = (limits) => ({
+    type_offset: limits.typeOffset,
+    type_limit: limits.typeLimit,
+    method_offset: limits.methodOffset,
+    method_limit: limits.methodLimit,
+    field_offset: limits.fieldOffset,
+    field_limit: limits.fieldLimit,
+    member_ref_offset: limits.memberRefOffset,
+    member_ref_limit: limits.memberRefLimit,
+    edge_offset: limits.edgeOffset,
+    edge_limit: limits.edgeLimit,
+    instruction_anchor_limit: limits.instructionAnchorLimit,
+    max_file_bytes: limits.maxFileBytes,
+    max_metadata_bytes: limits.maxMetadataBytes,
+    max_table_rows: limits.maxTableRows,
+    max_heap_item_bytes: limits.maxHeapItemBytes,
+    max_method_body_bytes: limits.maxMethodBodyBytes,
+    max_method_instructions: limits.maxMethodInstructions,
+});
+const workflowFailure = (operation, cause) => err(cause instanceof z.ZodError || cause instanceof TypeError
+    ? new AnalysisInputError(operation, { cause })
+    : new AnalysisProtocolError("Managed member comparison produced an invalid result", { cause }));

package/dist/application/ManagedNativeVerificationService.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { managedNativeVerificationInputSchema, verifyManagedNativeBoundaries, } from "../domain/managedNativeVerification.js";
+import { err, ok } from "../domain/result.js";
+import { MANAGED_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
+const OPERATION = "verify_managed_native_boundaries";
+/** Verify managed/native boundary declarations against native Evidence. */
+export const verifyManagedNativeBoundariesEvidence = (rawInput) => {
+    const parsed = managedNativeVerificationInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(OPERATION, { cause: parsed.error }));
+    try {
+        const result = verifyManagedNativeBoundaries(parsed.data);
+        return ok(createManagedNativeVerificationEvidence(parsed.data, result));
+    }
+    catch (cause) {
+        return err(cause instanceof TypeError || cause instanceof z.ZodError
+            ? new AnalysisInputError(OPERATION, { cause })
+            : new AnalysisProtocolError("Managed/native verification produced an invalid result", { cause }));
+    }
+};
+const createManagedNativeVerificationEvidence = (input, result) => createEvidence(undefined, MANAGED_WORKFLOW_PROVIDER, {
+    predicateType: "rea.managed-native-verification/v1",
+    operation: OPERATION,
+    parameters: {
+        managed_boundaries_evidence_id: input.managed_boundaries.evidence_id,
+        native_evidence_ids: jsonValueSchema.parse(input.native_observations.map(({ evidence_id: id }) => id)),
+        limits: jsonValueSchema.parse(input.limits),
+    },
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});

package/dist/application/ManagedReconstructionService.js

@@ -0,0 +1,58 @@
+import { z } from "zod";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { importManagedReconstruction, managedReconstructionImportInputSchema, } from "../domain/managedReconstruction.js";
+import { err, ok } from "../domain/result.js";
+import { MANAGED_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
+const OPERATION = "import_managed_reconstruction";
+/** Authenticate and import managed decompiler reconstruction as Evidence. */
+export const importManagedReconstructionEvidence = (rawInput) => {
+    const parsed = managedReconstructionImportInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(OPERATION, { cause: parsed.error }));
+    return importManagedReconstructionEvidenceValidated(parsed.data);
+};
+/** Import reconstruction from input parsed by a trusted adapter. */
+export const importManagedReconstructionEvidenceValidated = (input) => {
+    try {
+        const result = importManagedReconstruction(input);
+        return ok(createManagedReconstructionEvidence(input, result));
+    }
+    catch (cause) {
+        return err(cause instanceof TypeError || cause instanceof z.ZodError
+            ? new AnalysisInputError(OPERATION, { cause })
+            : new AnalysisProtocolError("Managed reconstruction import produced an invalid result", { cause }));
+    }
+};
+const createManagedReconstructionEvidence = (input, result) => createEvidence({
+    path: result.static_observation.artifact_path,
+    sha256: result.static_observation.artifact_sha256,
+    format: "pe",
+}, MANAGED_WORKFLOW_PROVIDER, {
+    predicateType: "rea.managed-reconstruction-import/v1",
+    operation: OPERATION,
+    parameters: {
+        static_members_evidence_id: input.static_members.evidence_id,
+        decompiler: jsonValueSchema.parse(result.decompiler),
+        method_locks: jsonValueSchema.parse(input.methods.map(({ token, signature_sha256, normalized_il_sha256 }) => ({
+            token,
+            signature_sha256,
+            normalized_il_sha256,
+        }))),
+        notes: jsonValueSchema.parse(input.notes),
+    },
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    locations: [
+        {
+            kind: "artifact-path",
+            path: result.static_observation.artifact_path,
+        },
+    ],
+    evidenceLinks: result.evidence_links,
+});

package/dist/application/ManagedRuntimeCorrelationService.js

@@ -0,0 +1,103 @@
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { createEvidence, parseEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { managedRuntimeCorrelationInputSchema, planManagedRuntimeCorrelation, } from "../domain/managedRuntimeCorrelation.js";
+import { err, ok } from "../domain/result.js";
+import { MANAGED_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+const OPERATION = "plan_managed_runtime_correlation";
+/** Create a separately authorized, non-executing managed runtime plan Evidence. */
+export const planManagedRuntimeCorrelationEvidence = async (dependencies, rawInput) => {
+    const parsed = managedRuntimeCorrelationInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(OPERATION, { cause: parsed.error }));
+    return planManagedRuntimeCorrelationEvidenceValidated(dependencies, parsed.data);
+};
+/** Plan runtime correlation from input parsed by a trusted adapter. */
+export const planManagedRuntimeCorrelationEvidenceValidated = async (dependencies, input) => {
+    if (!dependencies.policy.enabled)
+        return err(new AnalysisCapabilityUnavailableError(MANAGED_WORKFLOW_PROVIDER.id, OPERATION, "managed runtime correlation is disabled; configure exact roots and runtime executable before enabling it"));
+    if (dependencies.authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError(MANAGED_WORKFLOW_PROVIDER.id, OPERATION, "managed runtime permission policy is not configured"));
+    let staticEvidence;
+    let artifactPath;
+    try {
+        staticEvidence = parseEvidence(input.static_members);
+        artifactPath = artifactPathFor(staticEvidence);
+    }
+    catch (cause) {
+        return err(new AnalysisInputError(OPERATION, { cause }));
+    }
+    const authorized = await dependencies.authority.explain({
+        capability: "managed_runtime",
+        roots: [artifactPath],
+        executables: [dependencies.policy.executablePath],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: operationIdentity(input, staticEvidence),
+    }, "read", { restartRequired: true });
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+    try {
+        const result = planManagedRuntimeCorrelation(input, dependencies.policy.executablePath, authorized.value.grant_id);
+        return ok(createEvidence({
+            path: result.static_observation.artifact_path,
+            sha256: result.static_observation.artifact_sha256,
+            format: "pe",
+        }, MANAGED_WORKFLOW_PROVIDER, {
+            predicateType: "rea.managed-runtime-correlation-plan/v1",
+            operation: OPERATION,
+            parameters: {
+                static_members_evidence_id: staticEvidence.evidence_id,
+                method: jsonValueSchema.parse(input.method),
+                requested_effect: input.requested_effect,
+                host: jsonValueSchema.parse(input.host),
+                bounds: jsonValueSchema.parse(input.bounds),
+            },
+            result: jsonValueSchema.parse(result),
+            rawResult: null,
+            confidence: "derived",
+            authority: "analyst-inference",
+            environment: null,
+            limitations: result.limitations,
+            locations: [
+                {
+                    kind: "artifact-path",
+                    path: result.static_observation.artifact_path,
+                },
+            ],
+            evidenceLinks: result.evidence_links,
+        }));
+    }
+    catch (cause) {
+        return err(cause instanceof TypeError
+            ? new AnalysisInputError(OPERATION, { cause })
+            : new AnalysisProtocolError("Managed runtime correlation planning produced an invalid result", { cause }));
+    }
+};
+const artifactPathFor = (evidence) => {
+    const result = evidence.normalized_result;
+    if (typeof result === "object" &&
+        result !== null &&
+        "artifact" in result &&
+        typeof result.artifact === "object" &&
+        result.artifact !== null &&
+        "path" in result.artifact &&
+        typeof result.artifact.path === "string")
+        return result.artifact.path;
+    throw new AnalysisInputError(OPERATION, {
+        cause: new TypeError("Managed member Evidence does not expose an artifact path"),
+    });
+};
+const operationIdentity = (input, evidence) => `${OPERATION}:${digestJson({
+    evidence_id: evidence.evidence_id,
+    method: input.method,
+    requested_effect: input.requested_effect,
+    host: input.host,
+    bounds: input.bounds,
+})}`;

package/dist/application/PermissionAuthority.js

@@ -93,7 +93,7 @@ export class PermissionAuthority {
         const decision = evaluatePermission(this.policy, canonical.value);
         if (!decision.allowed)
             return err(new PermissionRequiredError(canonical.value, decision.missing, ceilingFor(this.policy, canonical.value.capability), options.elicitationSupported ?? false, options.restartRequired ?? false));
-        return ok(decision);
+        return ok({ ...decision, request: canonical.value });
     }
     /** Add authority beneath the administrator ceiling. */
     grant(grant) {

package/dist/application/ProcessCaptureLifecycle.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { authorizeProcessScenario, digestProcessCommitment, processComparisonContract, processScenarioCommitment, } from "../domain/processCapture.js";
 import { PRODUCT_IDENTITY } from "../identity.js";
 import { snapshotRoots } from "./FilesystemSnapshot.js";
-import { cleanupOwnedProcessGroup, observeOwnedProcessGroup, } from "./ProcessOwnership.js";
+import { cleanupOwnedProcessGroup, observeOwnedProcessGroup, } from "../process/ProcessOwnership.js";
 import { classifyFilesystemEffects, ProcessCheckpoints, } from "./ProcessCheckpoints.js";
 import { ProcessCaptureError } from "./ProcessCaptureError.js";
 import { assertNotCancelled, assertRealPathAuthority, } from "./ProcessCaptureAuthority.js";

package/dist/application/ProcessHarness.js

@@ -10,7 +10,7 @@ import { ProcessCheckpoints } from "./ProcessCheckpoints.js";
 import { TerminalRenderer } from "./TerminalRenderer.js";
 import { startCommandShimReplay, } from "./CommandShimReplay.js";
 import { normalizeProcessText } from "./ProcessNormalization.js";
-import { selectCapturedProcessGroupIds } from "./ProcessOwnership.js";
+import { selectCapturedProcessGroupIds } from "../process/ProcessOwnership.js";
 import { awaitTerminalExit, buildCaptureResult, captureTerminalFrames, createRunManifest, observeSettlement, prepareProcessCapture, releaseProcessResources, resolveProcessResult, } from "./ProcessCaptureLifecycle.js";
 import { assertNotCancelled } from "./ProcessCaptureAuthority.js";
 export { probeProcessCaptureCapability } from "./ProcessCaptureCapability.js";

package/dist/application/ProcessSampling.js

@@ -1,19 +1,23 @@
 import { execFile } from "node:child_process";
 import { readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
-import { readProcessRunId } from "./ProcessOwnership.js";
+import { readProcessRunId } from "../process/ProcessOwnership.js";
 const execFileAsync = promisify(execFile);
 const PROC_READ_CONCURRENCY = 64;
 /** Prove that forkpty completed session setup and installed the run token. */
-export const isInitializedPtyRoot = (options) => options.before.pid === options.rootPid &&
-    options.before.process_group_id === options.rootPid &&
-    options.before.session_id === options.rootPid &&
-    options.after.pid === options.rootPid &&
-    options.after.parent_pid === options.before.parent_pid &&
-    options.after.process_group_id === options.rootPid &&
-    options.after.session_id === options.rootPid &&
-    options.after.startTime === options.before.startTime &&
-    options.observedRunId === options.expectedRunId;
+export const isInitializedPtyRoot = (options) => {
+    const sessionIdentityMatches = (options.before.session_id === options.rootPid &&
+        options.after.session_id === options.rootPid) ||
+        (options.before.session_id === null && options.after.session_id === null);
+    return (options.before.pid === options.rootPid &&
+        options.before.process_group_id === options.rootPid &&
+        sessionIdentityMatches &&
+        options.after.pid === options.rootPid &&
+        options.after.parent_pid === options.before.parent_pid &&
+        options.after.process_group_id === options.rootPid &&
+        options.after.startTime === options.before.startTime &&
+        options.observedRunId === options.expectedRunId);
+};
 const isExpectedProcReadFailure = (cause) => cause instanceof Error &&
     "code" in cause &&
     (cause.code === "ENOENT" ||
@@ -215,7 +219,7 @@ const readPsRows = async (signal) => {
         pid: Number(match[1]),
         parent_pid: Number(match[2]),
         process_group_id: Number(match[3]),
-        session_id: Number(match[4]),
+        session_id: Number(match[4]) || null,
         command: match[5] ?? "",
         startTime: undefined,
     }))
@@ -232,7 +236,7 @@ const inspectInitializedPtyRoot = async (rootPid, runId, signal) => {
     const before = await readRootIdentity(rootPid, signal);
     if (before === undefined ||
         before.process_group_id !== rootPid ||
-        before.session_id !== rootPid)
+        (before.session_id !== rootPid && before.session_id !== null))
         return undefined;
     let observedRunId;
     try {

package/dist/application/ProjectPermissionStore.js

@@ -21,6 +21,7 @@ const grantSchema = z.object({
         "artifact_extract",
         "native_mount",
         "reference_read",
+        "javascript_replay",
     ]),
     roots: z.array(z.string()),
     executables: z.array(z.string()),

package/dist/application/SessionProviderRouter.js

@@ -0,0 +1,219 @@
+import { analysisProfileSchema, } from "../domain/analysisProfile.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, ProviderAdapterError, ProviderSelectionError, } from "../domain/errors.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+import { AnalysisProviderRegistry, } from "./AnalysisProviderRegistry.js";
+import { ABORTED, waitForAbortable } from "./AbortablePromise.js";
+import { CompositeProvider, compositeProviderIdentity, } from "./CompositeProvider.js";
+/** Resolve either the compatibility single-provider seam or a selectable set. */
+export class SessionProviderRouter {
+    runtime;
+    constructor(runtime) {
+        this.runtime = runtime;
+    }
+    /** Preserve the existing provider/factory seam used by focused embedders. */
+    static legacy(provider, options = {}) {
+        const identity = typeof provider === "function"
+            ? { id: "unidentified", name: "Unidentified provider", version: null }
+            : provider.identity();
+        const capabilities = typeof provider === "function"
+            ? undefined
+            : capabilityMap(provider.capabilities());
+        const resolveProfile = options.resolveAnalysisProfile ??
+            (typeof provider === "function" ||
+                provider.resolveAnalysisProfile === undefined
+                ? () => Promise.resolve(ok({ profile: null, compatibility: {} }))
+                : (target, resolutionOptions) => provider.resolveAnalysisProfile?.(target, resolutionOptions) ??
+                    Promise.resolve(ok({ profile: null, compatibility: {} })));
+        return new SessionProviderRouter({
+            kind: "legacy",
+            provider,
+            identity,
+            capabilities,
+            resolveProfile,
+        });
+    }
+    /** Create selection-aware routing while keeping auxiliary families disjoint. */
+    static selectable(registry, auxiliaryProviders) {
+        const identities = [
+            ...registry.identities(),
+            ...auxiliaryProviders.map((provider) => provider.identity()),
+        ];
+        assertUniqueProviderIds(identities);
+        const auxiliaryOperations = assertDisjoint(auxiliaryProviders);
+        for (const operation of registry.declaredOperations())
+            if (auxiliaryOperations.has(operation))
+                throw new TypeError(`Deep and auxiliary providers both declare operation ${operation}`);
+        const initialRoute = selectableRoute(auxiliaryProviders, undefined);
+        return new SessionProviderRouter({
+            kind: "selectable",
+            registry,
+            auxiliaryProviders: [...auxiliaryProviders],
+            identity: identities.length === 0
+                ? emptyProviderIdentity()
+                : compositeProviderIdentity(identities),
+            initialRoute,
+        });
+    }
+    /** Compatibility identity covering every configured provider. */
+    configuredIdentity() {
+        return structuredClone(this.runtime.identity);
+    }
+    /** Provider identities exposed through the flat 1.x compatibility field. */
+    providerIdentities(route) {
+        if (this.runtime.kind === "legacy") {
+            if (route.capabilities === undefined)
+                return [route.identity];
+            return uniqueProviderIdentities([...route.capabilities.values()].map(({ provider }) => provider));
+        }
+        const selected = route.binding?.identity;
+        return uniqueProviderIdentities([
+            ...this.runtime.auxiliaryProviders.map((provider) => provider.identity()),
+            ...this.runtime.registry
+                .identities()
+                .map((identity) => identity.id === selected?.id ? selected : identity),
+        ]);
+    }
+    /** Target-free routes and discovery metadata. */
+    initialRoute() {
+        if (this.runtime.kind === "selectable")
+            return this.runtime.initialRoute;
+        const runtime = this.runtime;
+        return {
+            identity: structuredClone(runtime.identity),
+            capabilities: runtime.capabilities,
+            profile: null,
+            compatibility: {},
+            binding: null,
+            selection: undefined,
+            createClient: (target) => createLegacyClient(runtime, target, undefined),
+        };
+    }
+    /** Resolve target routes before any provider client is created. */
+    async resolve(target, providerId, signal) {
+        const resolutionOptions = signal === undefined ? undefined : { signal };
+        if (this.runtime.kind === "selectable") {
+            const selected = await this.runtime.registry.select(target, providerId, resolutionOptions);
+            return selected.ok
+                ? ok(selectableRoute(this.runtime.auxiliaryProviders, selected.value))
+                : selected;
+        }
+        const runtime = this.runtime;
+        if (providerId !== undefined &&
+            providerId !== "auto" &&
+            providerId !== runtime.identity.id)
+            return err(new ProviderSelectionError({
+                reason: "unknown_provider",
+                requestedProviderId: providerId,
+                candidateIds: [runtime.identity.id],
+            }));
+        const resolved = await waitForAbortable(runtime.resolveProfile(target, resolutionOptions), signal);
+        if (resolved === ABORTED)
+            return err(new AnalysisCancelledError("open_binary"));
+        if (!resolved.ok)
+            return resolved;
+        const normalized = normalizeProfileResolution(resolved.value, runtime.identity.id);
+        if (!normalized.ok)
+            return normalized;
+        return ok({
+            identity: structuredClone(runtime.identity),
+            capabilities: runtime.capabilities,
+            profile: normalized.value.profile,
+            compatibility: normalized.value.compatibility,
+            binding: null,
+            selection: undefined,
+            createClient: (openedTarget) => createLegacyClient(runtime, openedTarget, normalized.value.profile ?? undefined),
+        });
+    }
+    /** Candidate status authoritative for the active or target-free route. */
+    candidateStatuses(route) {
+        if (this.runtime.kind === "legacy")
+            return [];
+        return route.selection?.candidates ?? this.runtime.registry.candidates();
+    }
+    /** Produce exact candidate rejections for an intentionally unbound route. */
+    unboundOperationError(operation, route) {
+        if (this.runtime.kind !== "selectable" ||
+            route.binding !== null ||
+            route.selection === undefined)
+            return undefined;
+        return this.runtime.registry.unboundOperationError(operation, route.selection);
+    }
+}
+const selectableRoute = (auxiliaryProviders, selection) => {
+    const binding = selection?.binding ?? null;
+    const providers = [
+        ...auxiliaryProviders,
+        ...(binding === null ? [] : [binding.provider]),
+    ];
+    const provider = providers.length === 0 ? undefined : new CompositeProvider(providers);
+    const identity = provider?.identity() ?? emptyProviderIdentity();
+    const capabilities = capabilityMap(provider?.capabilities() ?? []);
+    return {
+        identity,
+        capabilities,
+        profile: binding?.profile ?? null,
+        compatibility: structuredClone(binding?.compatibility ?? {}),
+        binding,
+        selection,
+        createClient: (target) => provider?.createClient(target, binding?.profile) ?? emptyClient(identity),
+    };
+};
+const createLegacyClient = (runtime, target, profile) => typeof runtime.provider === "function"
+    ? runtime.provider(target, profile)
+    : runtime.provider.createClient(target, profile);
+const emptyClient = (identity) => ({
+    execute: (operation) => operation === "health"
+        ? Promise.resolve(ok({
+            result: null,
+            rawResult: null,
+            provider: identity,
+            limitations: [],
+            locations: [],
+            subject: null,
+        }))
+        : Promise.resolve(err(new AnalysisCapabilityUnavailableError(identity.id, operation, "operation is not declared by this provider set"))),
+    close: () => Promise.resolve(),
+});
+const emptyProviderIdentity = () => ({
+    id: "composite:none",
+    name: "REA composite analysis provider",
+    version: null,
+});
+const capabilityMap = (capabilities) => new Map(capabilities.map((descriptor) => [descriptor.operation, descriptor]));
+const uniqueProviderIdentities = (identities) => [...new Map(identities.map((identity) => [identity.id, identity])).values()]
+    .sort((left, right) => left.id.localeCompare(right.id))
+    .map((identity) => structuredClone(identity));
+const assertDisjoint = (providers) => {
+    const routes = new Set();
+    for (const provider of providers)
+        for (const { operation } of provider.capabilities()) {
+            if (routes.has(operation))
+                throw new TypeError(`Multiple auxiliary providers declare operation ${operation}`);
+            routes.add(operation);
+        }
+    return routes;
+};
+const assertUniqueProviderIds = (identities) => {
+    const ids = new Set();
+    for (const identity of identities) {
+        if (ids.has(identity.id))
+            throw new TypeError(`Duplicate configured provider ID: ${identity.id}`);
+        ids.add(identity.id);
+    }
+};
+const normalizeProfileResolution = (resolution, providerId) => {
+    try {
+        return ok({
+            profile: resolution.profile === null
+                ? null
+                : analysisProfileSchema.parse(resolution.profile),
+            compatibility: jsonObjectSchema.parse(resolution.compatibility),
+        });
+    }
+    catch (cause) {
+        return err(new ProviderAdapterError(providerId, "resolve_analysis_profile", {
+            cause,
+        }));
+    }
+};