rea-agents 1.7.0 → 2.1.0

package/dist/server/registerSessionRecordTools.js

@@ -0,0 +1,137 @@
+import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
+import { exportEvidenceBundleInputSchema, importEvidenceBundleInputSchema, listUnknownsInputSchema, SESSION_TOOL_CONTRACTS, verifyUnknownResolutionInputSchema, } from "../contracts/toolContracts.js";
+import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { recordUnknownInputSchema, updateUnknownInputSchema, } from "../domain/residualUnknown.js";
+import { err, ok } from "../domain/result.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { toCallToolResult } from "./toolResult.js";
+/** Register evidence bundle import and export tools. */
+export const registerEvidenceTools = (registration) => {
+    registerExportEvidenceTool(registration);
+    registerImportEvidenceTool(registration);
+};
+const registerExportEvidenceTool = ({ server, session, exportContract, filePolicy, permissionAuthority, }) => {
+    server.registerTool(exportContract.name, toolRegistrationOptions(exportContract), async (input) => {
+        const parsedInput = safeParseToolInput(exportEvidenceBundleInputSchema, input, exportContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, exportContract);
+        const parsed = parsedInput.value;
+        const bundle = session.exportEvidenceBundle();
+        if (parsed.path === undefined)
+            return toCallToolResult(ok(bundle), exportContract);
+        const denied = await authorizeEvidencePath({
+            authority: permissionAuthority,
+            capability: "evidence_write",
+            path: parsed.path,
+            access: "write",
+            operationIdentity: `export_evidence:${parsed.path}`,
+        });
+        if (denied !== undefined)
+            return toCallToolResult(denied, exportContract);
+        const written = await writeEvidenceBundle(bundle, parsed.path, parsed.overwrite, filePolicy);
+        return written.ok
+            ? toCallToolResult(ok({
+                path: written.value.path,
+                bytes: written.value.bytes,
+                records: bundle.records.length,
+            }), exportContract)
+            : toCallToolResult(written, exportContract);
+    });
+};
+const registerImportEvidenceTool = ({ server, session, importContract, filePolicy, permissionAuthority, }) => {
+    server.registerTool(importContract.name, toolRegistrationOptions(importContract), async (input) => {
+        const parsedInput = safeParseToolInput(importEvidenceBundleInputSchema, input, importContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, importContract);
+        const path = parsedInput.value.path;
+        const denied = await authorizeEvidencePath({
+            authority: permissionAuthority,
+            capability: "evidence_read",
+            path,
+            access: "read",
+            operationIdentity: `import_evidence:${path}`,
+        });
+        if (denied !== undefined)
+            return toCallToolResult(denied, importContract);
+        const loaded = await readEvidenceBundle(path, filePolicy);
+        if (!loaded.ok)
+            return toCallToolResult(loaded, importContract);
+        const imported = session.importEvidenceBundle(loaded.value);
+        if (imported.ok && imported.value > 0)
+            server.sendResourceListChanged();
+        return imported.ok
+            ? toCallToolResult(ok({
+                imported: imported.value,
+                total: session.exportEvidenceBundle().records.length,
+            }), importContract)
+            : toCallToolResult(imported, importContract);
+    });
+};
+const authorizeEvidencePath = async (input) => {
+    if (input.authority === undefined)
+        return undefined;
+    const authorized = await input.authority.authorize({
+        capability: input.capability,
+        roots: [input.path],
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: input.operationIdentity,
+    }, input.access);
+    return authorized.ok ? undefined : permissionFailure(authorized);
+};
+/** Register residual-unknown query and mutation tools. */
+export const registerUnknownTools = ({ server, session, contracts, }) => {
+    const listContract = contracts[14];
+    const recordContract = contracts[15];
+    const updateContract = contracts[16];
+    const verifyContract = contracts[17];
+    server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input) => {
+        const parsed = safeParseToolInput(listUnknownsInputSchema, input, listContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, listContract);
+        const filters = parsed.value;
+        return toCallToolResult(ok(session.listUnknowns({
+            ...(filters.status === undefined ? {} : { status: filters.status }),
+            ...(filters.severity === undefined
+                ? {}
+                : { severity: filters.severity }),
+            ...(filters.domain === undefined ? {} : { domain: filters.domain }),
+        })), listContract);
+    });
+    server.registerTool(recordContract.name, toolRegistrationOptions(recordContract), (input) => {
+        const parsed = safeParseToolInput(recordUnknownInputSchema, input, recordContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, recordContract);
+        const result = session.recordUnknown(parsed.value);
+        if (result.ok)
+            server.sendResourceListChanged();
+        return toCallToolResult(result, recordContract);
+    });
+    server.registerTool(updateContract.name, toolRegistrationOptions(updateContract), (input) => {
+        const parsed = safeParseToolInput(updateUnknownInputSchema, input, updateContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, updateContract);
+        const result = session.updateUnknown(parsed.value);
+        if (result.ok)
+            server.sendResourceListChanged();
+        return toCallToolResult(result, updateContract);
+    });
+    server.registerTool(verifyContract.name, toolRegistrationOptions(verifyContract), (input) => {
+        const parsed = safeParseToolInput(verifyUnknownResolutionInputSchema, input, verifyContract.name);
+        return parsed.ok
+            ? toCallToolResult(session.verifyUnknownResolution(parsed.value.unknown_id), verifyContract)
+            : toCallToolResult(parsed, verifyContract);
+    });
+};
+const permissionFailure = (failure) => {
+    if (failure.ok)
+        return err(new AnalysisProtocolError("Expected a denied permission"));
+    return err(failure.error instanceof PermissionRequiredError
+        ? failure.error
+        : new AnalysisProtocolError(failure.error.message, {
+            cause: failure.error,
+        }));
+};

package/dist/server/registerSessionStatusTool.js

@@ -3,15 +3,16 @@ import { toCallToolResult } from "./toolResult.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { createServerIdentity } from "../serverIdentity.js";
 import { buildCapabilityInventory } from "../application/CapabilityInventory.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register the read-only provider and target status operation. */
-export const registerSessionStatusTool = (server, session, contract, startedAt, availabilityPolicy) => {
-    server.registerTool(contract.name, {
-        description: contract.description,
-        inputSchema: contract.inputSchema,
-        outputSchema: contract.outputSchema,
-        annotations: contract.annotations,
-    }, (input) => {
-        const parsed = binarySessionInputSchema.parse(input);
+export const registerSessionStatusTool = (options) => {
+    const { server, session, contract, startedAt, availabilityPolicy } = options;
+    server.registerTool(contract.name, toolRegistrationOptions(contract), (input) => {
+        const parsedInput = safeParseToolInput(binarySessionInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const client = server.server.getClientVersion();
         const clientCapabilities = server.server.getClientCapabilities();
         const status = session.status();

package/dist/server/registerSessionTools.js

@@ -5,8 +5,7 @@ import { logToolExecution } from "./toolLogging.js";
 import { err, ok } from "../domain/result.js";
 import { processScenarioSchema } from "../domain/processCapture.js";
 import { captureProcessScenario } from "../application/ProcessHarness.js";
-import { recordUnknownInputSchema, updateUnknownInputSchema, } from "../domain/residualUnknown.js";
-import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
+import { processCapturePermissionRequest } from "../application/ProcessCapturePermission.js";
 import { readAnalysisSnapshot, writeAnalysisSnapshot, } from "../application/AnalysisSnapshotFiles.js";
 import { AnalysisProtocolError, PermissionRequiredError, UnknownRegistryError, } from "../domain/errors.js";
 import { DENY_EVIDENCE_FILE_POLICY, DENY_PROCESS_POLICY, } from "./sessionToolPolicies.js";
@@ -14,11 +13,17 @@ import { createProcessCaptureEvidence } from "../application/ProcessEvidence.js"
 import { registerProcessComparisonTool } from "./registerProcessComparisonTool.js";
 import { registerArtifactComparisonTool } from "./registerArtifactComparisonTool.js";
 import { registerFunctionComparisonTool } from "./registerFunctionComparisonTool.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { registerBundleComparisonTool } from "./registerBundleComparisonTool.js";
 import { registerInvestigationTools } from "./registerInvestigationTools.js";
 import { closeBinaryInputSchema, openBinaryInputSchema, } from "../contracts/sessionLifecycleInputs.js";
 import { registerSessionStatusTool } from "./registerSessionStatusTool.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
+import { authorizeProcessCaptureWithElicitation, } from "./ProcessCaptureElicitation.js";
+import { isInputRequiredResult } from "@modelcontextprotocol/server";
+import { registerEvidenceTools, registerUnknownTools, } from "./registerSessionRecordTools.js";
+import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
 const permissionFailure = (failure) => {
     if (failure.ok)
         return err(new AnalysisProtocolError("Expected a denied permission"));
@@ -57,27 +62,19 @@ const recordProcessResidualUnknowns = (session, scenario, evidence, residuals) =
     }
     return ok(null);
 };
-const registerProcessTools = ({ server, session, logger, processPolicy, captureContract, permissionAuthority, }) => {
-    server.registerTool(captureContract.name, {
-        description: captureContract.description,
-        inputSchema: captureContract.inputSchema,
-        outputSchema: captureContract.outputSchema,
-        annotations: captureContract.annotations,
-    }, async (input, context) => {
-        const scenario = processScenarioSchema.parse(input);
+const registerProcessTools = ({ server, session, logger, processPolicy, captureContract, permissionAuthority, processCaptureElicitation, }) => {
+    server.registerTool(captureContract.name, toolRegistrationOptions(captureContract), async (input, context) => {
+        const parsedInput = safeParseToolInput(processScenarioSchema, input, captureContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, captureContract);
+        const scenario = parsedInput.value;
         if (permissionAuthority !== undefined) {
-            const authorized = await permissionAuthority.authorize({
-                capability: "process_capture",
-                roots: [scenario.working_directory, ...scenario.filesystem_roots],
-                executables: [scenario.executable],
-                environment_names: [
-                    ...Object.keys(scenario.environment),
-                    ...scenario.inherit_environment,
-                ],
-                network: scenario.network_access === "host" ? "external" : "none",
-                mount: false,
-                operation_identity: `capture_process_scenario:${scenario.executable}`,
-            }, "read");
+            const request = processCapturePermissionRequest(scenario);
+            const authorized = processCaptureElicitation === undefined
+                ? await permissionAuthority.authorize(request, "read")
+                : await authorizeProcessCaptureWithElicitation(permissionAuthority, request, context, processCaptureElicitation);
+            if (isInputRequiredResult(authorized))
+                return authorized;
             if (!authorized.ok)
                 return toCallToolResult(permissionFailure(authorized), captureContract);
         }
@@ -108,151 +105,24 @@ const registerProcessTools = ({ server, session, logger, processPolicy, captureC
         return toCallToolResult(ok(evidence), captureContract);
     });
 };
-const registerEvidenceTools = ({ server, session, exportContract, importContract, filePolicy, permissionAuthority, }) => {
-    server.registerTool(exportContract.name, {
-        description: exportContract.description,
-        inputSchema: exportContract.inputSchema,
-        outputSchema: exportContract.outputSchema,
-        annotations: exportContract.annotations,
-    }, async (input) => {
-        const parsed = z
-            .object({
-            path: z.string().min(1).optional(),
-            overwrite: z.boolean().default(false),
-        })
-            .parse(input);
-        const bundle = session.exportEvidenceBundle();
-        if (parsed.path === undefined)
-            return toCallToolResult(ok(bundle), exportContract);
-        if (permissionAuthority !== undefined) {
-            const authorized = await permissionAuthority.authorize({
-                capability: "evidence_write",
-                roots: [parsed.path],
-                executables: [],
-                environment_names: [],
-                network: "none",
-                mount: false,
-                operation_identity: `export_evidence:${parsed.path}`,
-            }, "write");
-            if (!authorized.ok)
-                return toCallToolResult(permissionFailure(authorized), exportContract);
-        }
-        const written = await writeEvidenceBundle(bundle, parsed.path, parsed.overwrite, filePolicy);
-        return written.ok
-            ? toCallToolResult(ok({
-                path: written.value.path,
-                bytes: written.value.bytes,
-                records: bundle.records.length,
-            }), exportContract)
-            : toCallToolResult(written, exportContract);
-    });
-    server.registerTool(importContract.name, {
-        description: importContract.description,
-        inputSchema: importContract.inputSchema,
-        outputSchema: importContract.outputSchema,
-        annotations: importContract.annotations,
-    }, async (input) => {
-        const path = z.object({ path: z.string().min(1) }).parse(input).path;
-        if (permissionAuthority !== undefined) {
-            const authorized = await permissionAuthority.authorize({
-                capability: "evidence_read",
-                roots: [path],
-                executables: [],
-                environment_names: [],
-                network: "none",
-                mount: false,
-                operation_identity: `import_evidence:${path}`,
-            }, "read");
-            if (!authorized.ok)
-                return toCallToolResult(permissionFailure(authorized), importContract);
-        }
-        const loaded = await readEvidenceBundle(path, filePolicy);
-        if (!loaded.ok)
-            return toCallToolResult(loaded, importContract);
-        const imported = session.importEvidenceBundle(loaded.value);
-        if (imported.ok && imported.value > 0)
-            server.sendResourceListChanged();
-        return imported.ok
-            ? toCallToolResult(ok({
-                imported: imported.value,
-                total: session.exportEvidenceBundle().records.length,
-            }), importContract)
-            : toCallToolResult(imported, importContract);
-    });
-};
-const registerUnknownTools = ({ server, session, contracts: [listContract, recordContract, updateContract, verifyContract], }) => {
-    server.registerTool(listContract.name, {
-        description: listContract.description,
-        inputSchema: listContract.inputSchema,
-        outputSchema: listContract.outputSchema,
-        annotations: listContract.annotations,
-    }, (input) => {
-        const filters = z
-            .object({
-            status: z
-                .enum([
-                "open",
-                "investigating",
-                "blocked",
-                "contradicted",
-                "resolved",
-            ])
-                .optional(),
-            severity: z.enum(["low", "medium", "high", "critical"]).optional(),
-            domain: z.string().trim().min(1).max(100).optional(),
-        })
-            .parse(input);
-        return toCallToolResult(ok(session.listUnknowns({
-            ...(filters.status === undefined ? {} : { status: filters.status }),
-            ...(filters.severity === undefined
-                ? {}
-                : { severity: filters.severity }),
-            ...(filters.domain === undefined ? {} : { domain: filters.domain }),
-        })), listContract);
-    });
-    server.registerTool(recordContract.name, {
-        description: recordContract.description,
-        inputSchema: recordContract.inputSchema,
-        outputSchema: recordContract.outputSchema,
-        annotations: recordContract.annotations,
-    }, (input) => {
-        const recorded = session.recordUnknown(recordUnknownInputSchema.parse(input));
-        if (recorded.ok)
-            server.sendResourceListChanged();
-        return toCallToolResult(recorded, recordContract);
-    });
-    server.registerTool(updateContract.name, {
-        description: updateContract.description,
-        inputSchema: updateContract.inputSchema,
-        outputSchema: updateContract.outputSchema,
-        annotations: updateContract.annotations,
-    }, (input) => {
-        const updated = session.updateUnknown(updateUnknownInputSchema.parse(input));
-        if (updated.ok)
-            server.sendResourceListChanged();
-        return toCallToolResult(updated, updateContract);
-    });
-    server.registerTool(verifyContract.name, {
-        description: verifyContract.description,
-        inputSchema: verifyContract.inputSchema,
-        outputSchema: verifyContract.outputSchema,
-        annotations: verifyContract.annotations,
-    }, (input) => {
-        const unknownId = z
-            .object({ unknown_id: z.string().regex(/^unk_[a-f0-9]{64}$/u) })
-            .parse(input).unknown_id;
-        return toCallToolResult(session.verifyUnknownResolution(unknownId), verifyContract);
+const registerLifecycleTools = (registration) => {
+    const { server, session, contracts, startedAt, availabilityPolicy } = registration;
+    registerOpenLifecycleTool(registration);
+    registerCloseLifecycleTool(registration);
+    registerSessionStatusTool({
+        server,
+        session,
+        contract: contracts[2],
+        startedAt,
+        availabilityPolicy,
     });
 };
-const registerLifecycleTools = ({ server, session, logger, contracts, snapshotFilePolicy, startedAt, availabilityPolicy, permissionAuthority, }) => {
-    const [openContract, closeContract, statusContract] = contracts;
-    server.registerTool(openContract.name, {
-        description: openContract.description,
-        inputSchema: openContract.inputSchema,
-        outputSchema: openContract.outputSchema,
-        annotations: openContract.annotations,
-    }, async (input, context) => {
-        const parsed = openBinaryInputSchema.parse(input);
+const registerOpenLifecycleTool = ({ server, session, logger, contracts: [openContract], snapshotFilePolicy, permissionAuthority, }) => {
+    server.registerTool(openContract.name, toolRegistrationOptions(openContract), async (input, context) => {
+        const parsedInput = safeParseToolInput(openBinaryInputSchema, input, openContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, openContract);
+        const parsed = parsedInput.value;
         let snapshot;
         if (parsed.snapshot_path !== undefined) {
             if (permissionAuthority !== undefined) {
@@ -298,56 +168,55 @@ const registerLifecycleTools = ({ server, session, logger, contracts, snapshotFi
             }, openContract)
             : toCallToolResult(opened, openContract);
     });
-    server.registerTool(closeContract.name, {
-        description: closeContract.description,
-        inputSchema: closeContract.inputSchema,
-        outputSchema: closeContract.outputSchema,
-        annotations: closeContract.annotations,
-    }, async (input) => {
-        const parsed = closeBinaryInputSchema.parse(input);
-        if (parsed.snapshot_path !== undefined) {
-            if (permissionAuthority !== undefined) {
-                const authorized = await permissionAuthority.authorize({
-                    capability: "snapshot_write",
-                    roots: [parsed.snapshot_path],
-                    executables: [],
-                    environment_names: [],
-                    network: "none",
-                    mount: false,
-                    operation_identity: `close_binary:snapshot:${parsed.snapshot_path}`,
-                }, "write");
-                if (!authorized.ok)
-                    return toCallToolResult(permissionFailure(authorized), closeContract);
-            }
-            const snapshot = session.exportAnalysisSnapshot();
-            if (!snapshot.ok)
-                return toCallToolResult(snapshot, closeContract);
-            const written = await writeAnalysisSnapshot(snapshot.value, parsed.snapshot_path, parsed.overwrite, snapshotFilePolicy);
-            if (!written.ok)
-                return toCallToolResult(written, closeContract);
+};
+const registerCloseLifecycleTool = ({ server, session, logger, contracts: [, closeContract], snapshotFilePolicy, permissionAuthority, }) => {
+    server.registerTool(closeContract.name, toolRegistrationOptions(closeContract), async (input) => {
+        const parsedInput = safeParseToolInput(closeBinaryInputSchema, input, closeContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, closeContract);
+        const parsed = parsedInput.value;
+        if (parsed.snapshot_path === undefined) {
             const closed = await logToolExecution(logger, closeContract.name, () => session.close());
             if (closed.ok)
                 server.sendToolListChanged();
-            return closed.ok
-                ? toCallToolResult(ok({
-                    path: written.value.path,
-                    bytes: written.value.bytes,
-                    entries: snapshot.value.entries.length,
-                }), closeContract)
-                : toCallToolResult(closed, closeContract);
+            return toCallToolResult(closed, closeContract);
+        }
+        if (permissionAuthority !== undefined) {
+            const authorized = await permissionAuthority.authorize({
+                capability: "snapshot_write",
+                roots: [parsed.snapshot_path],
+                executables: [],
+                environment_names: [],
+                network: "none",
+                mount: false,
+                operation_identity: `close_binary:snapshot:${parsed.snapshot_path}`,
+            }, "write");
+            if (!authorized.ok)
+                return toCallToolResult(permissionFailure(authorized), closeContract);
         }
+        const snapshot = session.exportAnalysisSnapshot();
+        if (!snapshot.ok)
+            return toCallToolResult(snapshot, closeContract);
+        const written = await writeAnalysisSnapshot(snapshot.value, parsed.snapshot_path, parsed.overwrite, snapshotFilePolicy);
+        if (!written.ok)
+            return toCallToolResult(written, closeContract);
         const closed = await logToolExecution(logger, closeContract.name, () => session.close());
         if (closed.ok)
             server.sendToolListChanged();
-        return toCallToolResult(closed, closeContract);
+        return closed.ok
+            ? toCallToolResult(ok({
+                path: written.value.path,
+                bytes: written.value.bytes,
+                entries: snapshot.value.entries.length,
+            }), closeContract)
+            : toCallToolResult(closed, closeContract);
     });
-    registerSessionStatusTool(server, session, statusContract, startedAt, availabilityPolicy);
 };
 export const registerSessionTools = (server, session, logger, options = {}) => {
     const processPolicy = options.processPolicy ?? DENY_PROCESS_POLICY;
     const evidenceFilePolicy = options.evidenceFilePolicy ?? DENY_EVIDENCE_FILE_POLICY;
     const analysisSnapshotFilePolicy = options.analysisSnapshotFilePolicy ?? DENY_EVIDENCE_FILE_POLICY;
-    const [openContract, closeContract, statusContract, exportContract, importContract, captureContract, compareContract, compareArtifactsContract, compareFunctionsContract, compareBundlesContract, changedBehaviorContract, callPathContract, staticRuntimeContract, reconstructionContract, listUnknownContract, recordUnknownContract, updateUnknownContract, verifyUnknownContract,] = SESSION_TOOL_CONTRACTS;
+    const [openContract, closeContract, statusContract, exportContract, importContract, captureContract, compareContract, compareArtifactsContract, compareFunctionsContract, compareBundlesContract, changedBehaviorContract, callPathContract, staticRuntimeContract, reconstructionContract,] = SESSION_TOOL_CONTRACTS;
     registerLifecycleTools({
         server,
         session,
@@ -355,13 +224,7 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
         contracts: [openContract, closeContract, statusContract],
         snapshotFilePolicy: analysisSnapshotFilePolicy,
         startedAt: options.startedAt ?? new Date().toISOString(),
-        availabilityPolicy: options.availabilityPolicy ??
-            (() => ({
-                processCaptureEnabled: processPolicy.enabled,
-                evidenceFileRoots: evidenceFilePolicy.roots.length,
-                browserObservationEnabled: false,
-                electronObservationEnabled: false,
-            })),
+        availabilityPolicy: sessionAvailabilityPolicy(options.availabilityPolicy, processPolicy, evidenceFilePolicy),
         ...(options.permissionAuthority === undefined
             ? {}
             : { permissionAuthority: options.permissionAuthority }),
@@ -385,11 +248,14 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
         ...(options.permissionAuthority === undefined
             ? {}
             : { permissionAuthority: options.permissionAuthority }),
+        ...(options.processCaptureElicitation === undefined
+            ? {}
+            : { processCaptureElicitation: options.processCaptureElicitation }),
     });
     registerProcessComparisonTool(server, session, compareContract);
     registerArtifactComparisonTool(server, session, compareArtifactsContract);
     registerFunctionComparisonTool(server, session, compareFunctionsContract);
-    registerBundleComparisonTool(server, session, compareBundlesContract);
+    registerBundleComparisonTool(server, session, compareBundlesContract, evidenceFilePolicy);
     const investigationContracts = [
         changedBehaviorContract,
         callPathContract,
@@ -411,11 +277,6 @@ export const registerSessionTools = (server, session, logger, options = {}) => {
     registerUnknownTools({
         server,
         session,
-        contracts: [
-            listUnknownContract,
-            recordUnknownContract,
-            updateUnknownContract,
-            verifyUnknownContract,
-        ],
+        contracts: SESSION_TOOL_CONTRACTS,
     });
 };

package/dist/server/sessionAvailabilityPolicy.js

@@ -0,0 +1,10 @@
+/** Select configured availability reporting or the target-free defaults. */
+export const sessionAvailabilityPolicy = (configured, processPolicy, evidenceFilePolicy) => configured ??
+    (() => ({
+        processCaptureEnabled: processPolicy.enabled,
+        evidenceFileRoots: evidenceFilePolicy.roots.length,
+        browserObservationEnabled: false,
+        electronObservationEnabled: false,
+        javascriptReplayEnabled: false,
+        managedRuntimeEnabled: false,
+    }));

package/dist/server/sessionEvidence.js

@@ -1,22 +1,17 @@
-import canonicalize from "canonicalize";
-import { EvidenceIntegrityError } from "../domain/errors.js";
-import { parseEvidence } from "../domain/evidence.js";
+import { EvidenceIntegrityError, EvidenceReferenceError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-/** Resolve caller-supplied records to their immutable session-owned values. */
-export const resolveSessionEvidence = (session, input) => {
-    const supplied = Array.isArray(input) ? input : [input];
-    const authoritative = [];
-    for (const item of supplied) {
-        const parsed = parseEvidence(item);
-        const owned = session.evidenceById(parsed.evidence_id);
-        if (owned === undefined || canonicalize(owned) !== canonicalize(parsed))
-            return err(new EvidenceIntegrityError("Comparison input does not match its session-owned Evidence"));
-        authoritative.push(owned);
+/** Resolve bounded IDs to authoritative records with exact semantic identity. */
+export const resolveSessionEvidenceIds = (session, evidenceIds, expected) => {
+    const records = [];
+    for (const evidenceId of evidenceIds) {
+        const record = session.evidenceById(evidenceId);
+        if (record === undefined)
+            return err(new EvidenceReferenceError(evidenceId, "missing", expected.operation, null));
+        if (record.operation !== expected.operation)
+            return err(new EvidenceReferenceError(evidenceId, "wrong_operation", expected.operation, record.operation));
+        if (record.predicate_type !== expected.predicate)
+            return err(new EvidenceReferenceError(evidenceId, "wrong_predicate", expected.predicate, record.predicate_type));
+        records.push(record);
     }
-    return ok(authoritative);
-};
-/** Check exact ownership for a single Evidence record. */
-export const isSessionEvidence = (session, input) => {
-    const owned = session.evidenceById(input.evidence_id);
-    return owned !== undefined && canonicalize(owned) === canonicalize(input);
+    return ok(records);
 };