rea-agents 2.0.0 → 2.1.0

package/dist/cli/coreAnalysisCommands.js

@@ -0,0 +1,232 @@
+import { z } from "incur";
+import { runDirectAnalysis } from "../application/DirectAnalysis.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { logCliCommand } from "../cliLogging.js";
+import { directAnalysisOptions, providerSelectionOption } from "./options.js";
+export const registerCoreAnalysisCommands = (cli, logger) => {
+    registerCoreCommands(cli, logger);
+    registerFunctionCommand(cli, logger);
+    registerSearchCommand(cli, logger);
+    registerXrefsCommand(cli, logger);
+    registerTraceCommand(cli, logger);
+};
+const registerCoreCommands = (cli, logger) => {
+    const overviewOptions = z.object({
+        detail: z
+            .enum(["concise", "detailed"])
+            .default("concise")
+            .describe("Overview detail level"),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(50)
+            .default(10)
+            .describe("Maximum overview items to return"),
+        snapshot: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Load and update a local analysis snapshot"),
+        provider: providerSelectionOption,
+    });
+    cli.command(CLI_COMMANDS.analyze, {
+        description: "Get an overview of an app",
+        args: z.object({
+            path: z.string().describe("App, program, or analysis database path"),
+        }),
+        options: overviewOptions,
+        run: ({ args, options }) => logCliCommand(logger, "analyze", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+    cli.command(CLI_COMMANDS.inspect, {
+        description: "Inspect an app overview with evidence",
+        args: z.object({
+            path: z.string().describe("App, program, or analysis database path"),
+        }),
+        options: overviewOptions,
+        run: ({ args, options }) => logCliCommand(logger, "inspect", () => runDirectAnalysis(args.path, "binary_overview", { detail: options.detail, limit: options.limit }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+    cli.command(CLI_COMMANDS.decompile, {
+        description: "Read one part of an app as code",
+        args: z.object({
+            path: z.string().describe("App or program path"),
+            address: z.string().describe("Procedure address"),
+        }),
+        options: z.object({
+            snapshot: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Load and update a local analysis snapshot"),
+            provider: providerSelectionOption,
+        }),
+        run: ({ args, options }) => logCliCommand(logger, "decompile", () => runDirectAnalysis(args.path, "procedure_pseudo_code", { procedure: args.address }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+};
+const registerXrefsCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.xrefs, {
+        description: "List bounded references to an analyzed address",
+        args: z.object({
+            path: z.string().describe("App or program path"),
+            address: z.string().describe("Hexadecimal address"),
+        }),
+        options: z.object({
+            snapshot: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Load and update a local analysis snapshot"),
+            provider: providerSelectionOption,
+        }),
+        run: ({ args, options }) => logCliCommand(logger, "xrefs", () => runDirectAnalysis(args.path, "xrefs", { address: args.address }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+};
+const registerTraceCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.trace, {
+        description: "Trace a bounded literal feature through analyzed references",
+        args: z.object({
+            path: z.string().describe("App or program path"),
+            query: z.string().min(1).describe("Literal feature query"),
+        }),
+        options: z.object({
+            caseSensitive: z
+                .boolean()
+                .default(false)
+                .describe("Match the query with exact letter case"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(100)
+                .default(20)
+                .describe("Maximum matching roots to examine"),
+            maxOperations: z
+                .number()
+                .int()
+                .min(1)
+                .max(100)
+                .default(20)
+                .describe("Maximum analysis operations in the trace"),
+            snapshot: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Load and update a local analysis snapshot"),
+            provider: providerSelectionOption,
+        }),
+        alias: {
+            caseSensitive: "case-sensitive",
+            maxOperations: "max-operations",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "trace", () => runDirectAnalysis(args.path, "trace_feature", {
+            query: args.query,
+            case_sensitive: options.caseSensitive,
+            limit: options.limit,
+            max_operations: options.maxOperations,
+        }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+};
+const registerFunctionCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.function, {
+        description: "Analyze one bounded function with evidence",
+        args: z.object({
+            path: z.string().describe("App or program path"),
+            address: z.string().describe("Procedure name or address"),
+        }),
+        options: z.object({
+            includeAssembly: z
+                .boolean()
+                .default(false)
+                .describe("Include bounded assembly instructions"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(500)
+                .default(100)
+                .describe("Maximum referenced items to return"),
+            maxPseudocodeChars: z
+                .number()
+                .int()
+                .min(1)
+                .max(100_000)
+                .default(20_000)
+                .describe("Maximum pseudocode characters to return"),
+            maxInstructions: z
+                .number()
+                .int()
+                .min(1)
+                .max(5_000)
+                .default(500)
+                .describe("Maximum assembly instructions to return"),
+            snapshot: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Load and update a local analysis snapshot"),
+            provider: providerSelectionOption,
+        }),
+        alias: {
+            includeAssembly: "include-assembly",
+            maxPseudocodeChars: "max-pseudocode-chars",
+            maxInstructions: "max-instructions",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "function", () => runDirectAnalysis(args.path, "analyze_function", {
+            procedure: args.address,
+            include_assembly: options.includeAssembly,
+            limit: options.limit,
+            max_pseudocode_chars: options.maxPseudocodeChars,
+            max_instructions: options.maxInstructions,
+        }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+};
+const registerSearchCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.search, {
+        description: "Search bounded analyzed strings or procedure names",
+        args: z.object({
+            path: z.string().describe("App or program path"),
+            pattern: z.string().min(1).describe("Literal text or regex pattern"),
+        }),
+        options: z.object({
+            kind: z
+                .enum(["strings", "procedures"])
+                .default("strings")
+                .describe("Analyzed item kind to search"),
+            mode: z
+                .enum(["literal", "regex"])
+                .default("literal")
+                .describe("Interpret the pattern as literal text or a regex"),
+            caseSensitive: z
+                .boolean()
+                .default(false)
+                .describe("Match the pattern with exact letter case"),
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .default(0)
+                .describe("Zero-based matching-item offset"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(100)
+                .default(100)
+                .describe("Maximum matching items to return"),
+            snapshot: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Load and update a local analysis snapshot"),
+            provider: providerSelectionOption,
+        }),
+        alias: { caseSensitive: "case-sensitive" },
+        run: ({ args, options }) => logCliCommand(logger, "search", () => runDirectAnalysis(args.path, options.kind === "strings" ? "search_strings" : "search_procedures", {
+            pattern: args.pattern,
+            mode: options.mode,
+            case_sensitive: options.caseSensitive,
+            offset: options.offset,
+            limit: options.limit,
+        }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+};

package/dist/cli/managedCommands.js

@@ -0,0 +1,397 @@
+import { z } from "incur";
+import { compareManagedMemberPaths, } from "../application/ManagedMemberComparisonService.js";
+import { verifyManagedNativeBoundariesEvidence } from "../application/ManagedNativeVerificationService.js";
+import { importManagedReconstructionEvidence } from "../application/ManagedReconstructionService.js";
+import { planManagedRuntimeCorrelationEvidence } from "../application/ManagedRuntimeCorrelationService.js";
+import { runProviderAnalysis } from "../application/DirectAnalysis.js";
+import { parseConfig } from "../config.js";
+import { loadConfiguredPermissionAuthority } from "../application/PermissionConfiguration.js";
+import { parseCliJsonInput } from "../cliJsonInput.js";
+import { projectAnalysisError } from "../domain/errors.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { logCliCommand } from "../cliLogging.js";
+import { registerProjectManagedApplicationGraph } from "./managedProjectGraphCommand.js";
+const managedOffset = (subject) => z.number().int().min(0).default(0).describe(`Zero-based ${subject} offset`);
+const managedLimit = (subject, maximum, fallback) => z
+    .number()
+    .int()
+    .min(1)
+    .max(maximum)
+    .default(fallback)
+    .describe(`Maximum ${subject} to return`);
+const managedInspectionLimits = {
+    maxFileBytes: z
+        .number()
+        .int()
+        .min(4_096)
+        .max(1_073_741_824)
+        .default(268_435_456)
+        .describe("Maximum managed artifact file size accepted for inspection"),
+    maxMetadataBytes: z
+        .number()
+        .int()
+        .min(256)
+        .max(268_435_456)
+        .default(67_108_864)
+        .describe("Maximum CLI metadata region size accepted for inspection"),
+    maxTableRows: z
+        .number()
+        .int()
+        .min(1)
+        .max(1_000_000)
+        .default(100_000)
+        .describe("Maximum rows accepted in any CLI metadata table"),
+    maxHeapItemBytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(16_777_216)
+        .default(1_048_576)
+        .describe("Maximum bytes accepted for one CLI metadata heap item"),
+};
+export const registerManagedCommands = (cli, logger) => {
+    registerInspectManagedArtifact(cli, logger);
+    registerInspectManagedMembers(cli, logger);
+    registerInspectManagedNativeBoundaries(cli, logger);
+    registerCompareManagedMembers(cli, logger);
+    registerImportManagedReconstruction(cli, logger);
+    registerVerifyManagedNativeBoundaries(cli, logger);
+    registerPlanManagedRuntimeCorrelation(cli, logger);
+    registerProjectManagedApplicationGraph(cli, logger);
+};
+const registerInspectManagedArtifact = (cli, logger) => {
+    cli.command(CLI_COMMANDS.inspectManagedArtifact, {
+        description: "Inspect PE/CLI identity without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            referenceOffset: managedOffset("assembly-reference"),
+            referenceLimit: managedLimit("assembly references", 500, 100),
+            resourceOffset: managedOffset("manifest-resource"),
+            resourceLimit: managedLimit("manifest resources", 500, 100),
+            attributeOffset: managedOffset("assembly-attribute"),
+            attributeLimit: managedLimit("assembly attributes", 500, 100),
+            ...managedInspectionLimits,
+        }),
+        alias: {
+            referenceOffset: "reference-offset",
+            referenceLimit: "reference-limit",
+            resourceOffset: "resource-offset",
+            resourceLimit: "resource-limit",
+            attributeOffset: "attribute-offset",
+            attributeLimit: "attribute-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-artifact", () => runProviderAnalysis(args.path, "inspect_managed_artifact", {
+            reference_offset: options.referenceOffset,
+            reference_limit: options.referenceLimit,
+            resource_offset: options.resourceOffset,
+            resource_limit: options.resourceLimit,
+            attribute_offset: options.attributeOffset,
+            attribute_limit: options.attributeLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+        }, logger)),
+    });
+};
+const registerInspectManagedMembers = (cli, logger) => {
+    cli.command(CLI_COMMANDS.inspectManagedMembers, {
+        description: "Inspect PE/CLI metadata members, signatures, and CIL anchors without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            typeOffset: managedOffset("type definition"),
+            typeLimit: managedLimit("type definitions", 500, 100),
+            methodOffset: managedOffset("method definition"),
+            methodLimit: managedLimit("method definitions", 500, 100),
+            fieldOffset: managedOffset("field definition"),
+            fieldLimit: managedLimit("field definitions", 500, 100),
+            memberRefOffset: managedOffset("member reference"),
+            memberRefLimit: managedLimit("member references", 500, 100),
+            edgeOffset: managedOffset("member edge"),
+            edgeLimit: managedLimit("member edges", 1_000, 250),
+            instructionAnchorLimit: z
+                .number()
+                .int()
+                .min(0)
+                .max(500)
+                .default(100)
+                .describe("Maximum CIL instruction anchors per method"),
+            ...managedInspectionLimits,
+            maxMethodBodyBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576)
+                .describe("Maximum CIL method body size accepted for inspection"),
+            maxMethodInstructions: z
+                .number()
+                .int()
+                .min(1)
+                .max(100_000)
+                .default(10_000)
+                .describe("Maximum decoded CIL instructions per method"),
+        }),
+        alias: {
+            typeOffset: "type-offset",
+            typeLimit: "type-limit",
+            methodOffset: "method-offset",
+            methodLimit: "method-limit",
+            fieldOffset: "field-offset",
+            fieldLimit: "field-limit",
+            memberRefOffset: "member-ref-offset",
+            memberRefLimit: "member-ref-limit",
+            edgeOffset: "edge-offset",
+            edgeLimit: "edge-limit",
+            instructionAnchorLimit: "instruction-anchor-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+            maxMethodBodyBytes: "max-method-body-bytes",
+            maxMethodInstructions: "max-method-instructions",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-members", () => runProviderAnalysis(args.path, "inspect_managed_members", {
+            type_offset: options.typeOffset,
+            type_limit: options.typeLimit,
+            method_offset: options.methodOffset,
+            method_limit: options.methodLimit,
+            field_offset: options.fieldOffset,
+            field_limit: options.fieldLimit,
+            member_ref_offset: options.memberRefOffset,
+            member_ref_limit: options.memberRefLimit,
+            edge_offset: options.edgeOffset,
+            edge_limit: options.edgeLimit,
+            instruction_anchor_limit: options.instructionAnchorLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+            max_method_body_bytes: options.maxMethodBodyBytes,
+            max_method_instructions: options.maxMethodInstructions,
+        }, logger)),
+    });
+};
+const registerInspectManagedNativeBoundaries = (cli, logger) => {
+    cli.command(CLI_COMMANDS.inspectManagedNativeBoundaries, {
+        description: "Inspect PE/CLI PInvoke and native implementation boundary declarations without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            moduleRefOffset: managedOffset("module reference"),
+            moduleRefLimit: managedLimit("module references", 500, 100),
+            importOffset: managedOffset("platform import"),
+            importLimit: managedLimit("platform imports", 500, 100),
+            implementationOffset: managedOffset("native implementation"),
+            implementationLimit: managedLimit("native implementations", 500, 100),
+            ...managedInspectionLimits,
+        }),
+        alias: {
+            moduleRefOffset: "module-ref-offset",
+            moduleRefLimit: "module-ref-limit",
+            importOffset: "import-offset",
+            importLimit: "import-limit",
+            implementationOffset: "implementation-offset",
+            implementationLimit: "implementation-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-native-boundaries", () => runProviderAnalysis(args.path, "inspect_managed_native_boundaries", {
+            module_ref_offset: options.moduleRefOffset,
+            module_ref_limit: options.moduleRefLimit,
+            import_offset: options.importOffset,
+            import_limit: options.importLimit,
+            implementation_offset: options.implementationOffset,
+            implementation_limit: options.implementationLimit,
+            max_file_bytes: options.maxFileBytes,
+            max_metadata_bytes: options.maxMetadataBytes,
+            max_table_rows: options.maxTableRows,
+            max_heap_item_bytes: options.maxHeapItemBytes,
+        }, logger)),
+    });
+};
+const compareManagedMemberArgs = z.object({
+    leftPath: z.string().describe("Baseline managed PE executable or assembly"),
+    rightPath: z.string().describe("Candidate managed PE executable or assembly"),
+});
+const registerCompareManagedMembers = (cli, logger) => {
+    cli.command(CLI_COMMANDS.compareManagedMembers, {
+        description: "Compare two managed PE/CLI member inventories without name-based matching",
+        args: compareManagedMemberArgs,
+        options: z.object({
+            maxMethodMatches: z
+                .number()
+                .int()
+                .min(1)
+                .max(50_000)
+                .default(10_000)
+                .describe("Maximum exact method matches to return"),
+            maxFieldMatches: z
+                .number()
+                .int()
+                .min(0)
+                .max(50_000)
+                .default(5_000)
+                .describe("Maximum exact field matches to return"),
+            maxCandidates: z
+                .number()
+                .int()
+                .min(1)
+                .max(500)
+                .default(50)
+                .describe("Maximum ambiguous candidates per unmatched member"),
+            typeLimit: managedLimit("type definitions per artifact", 500, 500),
+            methodLimit: managedLimit("method definitions per artifact", 500, 500),
+            fieldLimit: managedLimit("field definitions per artifact", 500, 500),
+            memberRefLimit: managedLimit("member references per artifact", 500, 500),
+            edgeLimit: managedLimit("member edges per artifact", 1_000, 1_000),
+            instructionAnchorLimit: z
+                .number()
+                .int()
+                .min(0)
+                .max(500)
+                .default(500)
+                .describe("Maximum CIL instruction anchors per compared method"),
+            ...managedInspectionLimits,
+            maxMethodBodyBytes: z
+                .number()
+                .int()
+                .min(1)
+                .max(16_777_216)
+                .default(1_048_576)
+                .describe("Maximum CIL method body size accepted for comparison"),
+            maxMethodInstructions: z
+                .number()
+                .int()
+                .min(1)
+                .max(100_000)
+                .default(100_000)
+                .describe("Maximum decoded CIL instructions per compared method"),
+        }),
+        alias: {
+            maxMethodMatches: "max-method-matches",
+            maxFieldMatches: "max-field-matches",
+            maxCandidates: "max-candidates",
+            typeLimit: "type-limit",
+            methodLimit: "method-limit",
+            fieldLimit: "field-limit",
+            memberRefLimit: "member-ref-limit",
+            edgeLimit: "edge-limit",
+            instructionAnchorLimit: "instruction-anchor-limit",
+            maxFileBytes: "max-file-bytes",
+            maxMetadataBytes: "max-metadata-bytes",
+            maxTableRows: "max-table-rows",
+            maxHeapItemBytes: "max-heap-item-bytes",
+            maxMethodBodyBytes: "max-method-body-bytes",
+            maxMethodInstructions: "max-method-instructions",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "compare-managed-members", async () => {
+            const result = await compareManagedMemberPaths({
+                leftPath: args.leftPath,
+                rightPath: args.rightPath,
+                comparisonLimits: {
+                    max_method_matches: options.maxMethodMatches,
+                    max_field_matches: options.maxFieldMatches,
+                    max_candidates: options.maxCandidates,
+                },
+                memberLimits: buildMemberLimits(options),
+            });
+            return result.ok
+                ? result.value
+                : {
+                    error: "Managed member comparison failed",
+                    ...projectAnalysisError(result.error),
+                };
+        }),
+    });
+};
+const buildMemberLimits = (options) => ({
+    maxFileBytes: options.maxFileBytes,
+    typeOffset: 0,
+    typeLimit: options.typeLimit,
+    methodOffset: 0,
+    methodLimit: options.methodLimit,
+    fieldOffset: 0,
+    fieldLimit: options.fieldLimit,
+    memberRefOffset: 0,
+    memberRefLimit: options.memberRefLimit,
+    edgeOffset: 0,
+    edgeLimit: options.edgeLimit,
+    instructionAnchorLimit: options.instructionAnchorLimit,
+    maxMetadataBytes: options.maxMetadataBytes,
+    maxTableRows: options.maxTableRows,
+    maxHeapItemBytes: options.maxHeapItemBytes,
+    maxMethodBodyBytes: options.maxMethodBodyBytes,
+    maxMethodInstructions: options.maxMethodInstructions,
+});
+const registerImportManagedReconstruction = (cli, logger) => {
+    cli.command(CLI_COMMANDS.importManagedReconstruction, {
+        description: "Import decompiler-produced managed reconstruction against exact static member evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed reconstruction JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "import-managed-reconstruction", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "import-managed-reconstruction");
+            if (!input.ok)
+                return input.error;
+            const result = importManagedReconstructionEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};
+const registerVerifyManagedNativeBoundaries = (cli, logger) => {
+    cli.command(CLI_COMMANDS.verifyManagedNativeBoundaries, {
+        description: "Verify managed P/Invoke declarations against authenticated native Evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed/native verification JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "verify-managed-native-boundaries", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "verify-managed-native-boundaries");
+            if (!input.ok)
+                return input.error;
+            const result = verifyManagedNativeBoundariesEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};
+const registerPlanManagedRuntimeCorrelation = (cli, logger) => {
+    cli.command(CLI_COMMANDS.planManagedRuntimeCorrelation, {
+        description: "Plan a separately authorized managed runtime-correlation experiment without executing target code",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed runtime-correlation JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "plan-managed-runtime-correlation", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "plan-managed-runtime-correlation");
+            if (!input.ok)
+                return input.error;
+            const config = parseConfig(process.env);
+            if (!config.ok)
+                return projectAnalysisError(config.error);
+            const authority = await loadConfiguredPermissionAuthority(config.value);
+            if (!authority.ok)
+                return projectAnalysisError(authority.error);
+            const result = await planManagedRuntimeCorrelationEvidence({
+                policy: config.value.managedRuntimePolicy,
+                authority: authority.value,
+            }, input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};

package/dist/cli/managedProjectGraphCommand.js

@@ -0,0 +1,24 @@
+import { z } from "incur";
+import { projectManagedApplicationGraphEvidence } from "../application/ManagedApplicationGraphService.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { parseCliJsonInput } from "../cliJsonInput.js";
+import { logCliCommand } from "../cliLogging.js";
+import { projectAnalysisError } from "../domain/errors.js";
+/** Register managed static-Evidence application graph projection. */
+export const registerProjectManagedApplicationGraph = (cli, logger) => {
+    cli.command(CLI_COMMANDS.projectManagedApplicationGraph, {
+        description: "Project authenticated managed static Evidence into an application graph",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed application graph JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "project-managed-application-graph", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "project-managed-application-graph");
+            if (!input.ok)
+                return input.error;
+            const result = projectManagedApplicationGraphEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};

package/dist/cli/options.js

@@ -0,0 +1,9 @@
+import { analysisProviderSelectorSchema } from "../contracts/providerSelection.js";
+export const providerSelectionOption = analysisProviderSelectorSchema
+    .optional()
+    .describe("Bind deep analysis to a provider ID or use deterministic auto selection");
+export const directAnalysisOptions = (logger, snapshotPath, providerId) => ({
+    logger,
+    snapshotPath,
+    ...(providerId === undefined ? {} : { providerId }),
+});