rea-agents 2.0.0 → 2.1.0

package/dist/server/registerManagedWorkflowTools.js

@@ -1,277 +1,13 @@
-import { compareManagedMembersEvidenceValidated } from "../application/ManagedMemberComparisonService.js";
-import { projectManagedApplicationGraphEvidence } from "../application/ManagedApplicationGraphService.js";
-import { verifyManagedNativeBoundariesEvidence } from "../application/ManagedNativeVerificationService.js";
-import { importManagedReconstructionEvidenceValidated } from "../application/ManagedReconstructionService.js";
-import { planManagedRuntimeCorrelationEvidenceValidated, } from "../application/ManagedRuntimeCorrelationService.js";
-import { compareManagedMembersReferenceInputSchema, managedApplicationGraphReferenceInputSchema, managedNativeVerificationReferenceInputSchema, managedReconstructionReferenceInputSchema, managedRuntimeCorrelationReferenceInputSchema, MANAGED_WORKFLOW_TOOL_CONTRACTS, } from "../contracts/managedWorkflowToolContracts.js";
-import { managedMemberComparisonResultSchema } from "../domain/managedMemberComparison.js";
-import { managedNativeVerificationResultSchema } from "../domain/managedNativeVerification.js";
-import { logToolExecution } from "./toolLogging.js";
-import { toCallToolResult } from "./toolResult.js";
-import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
-import { safeParseToolInput } from "./toolInputValidation.js";
-import { resolveSessionEvidenceIds } from "./sessionEvidence.js";
+import { registerCompareManagedMembers } from "./registerManagedWorkflowTools/compareManagedMembers.js";
+import { registerVerifyManagedNativeBoundaries } from "./registerManagedWorkflowTools/verifyManagedNativeBoundaries.js";
+import { registerImportManagedReconstruction } from "./registerManagedWorkflowTools/importManagedReconstruction.js";
+import { registerPlanManagedRuntimeCorrelation } from "./registerManagedWorkflowTools/planManagedRuntimeCorrelation.js";
+import { registerProjectManagedApplicationGraph } from "./registerManagedWorkflowTools/projectManagedApplicationGraph.js";
 /** Register provider-neutral managed-code workflows. */
 export const registerManagedWorkflowTools = (server, options) => {
-    const compareContract = contract("compare_managed_members");
-    const nativeVerificationContract = contract("verify_managed_native_boundaries");
-    const reconstructionContract = contract("import_managed_reconstruction");
-    const runtimeContract = contract("plan_managed_runtime_correlation");
-    const graphContract = contract("project_managed_application_graph");
-    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
-        const parsedInput = safeParseToolInput(compareManagedMembersReferenceInputSchema, input, compareContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, compareContract);
-        const resolved = resolveManagedEvidence(options.session, [
-            parsedInput.value.left_evidence_id,
-            parsedInput.value.right_evidence_id,
-        ]);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, compareContract);
-        const [left, right] = resolved.value;
-        if (left === undefined || right === undefined)
-            throw new TypeError("Managed comparison Evidence resolution failed");
-        const { left_evidence_id: _leftEvidenceId, right_evidence_id: _rightEvidenceId, ...referencedInput } = parsedInput.value;
-        const parsed = { ...referencedInput, left, right };
-        const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareManagedMembersEvidenceValidated(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, compareContract);
-        const recorded = recordSources(options.recordEvidence, [
-            parsed.left,
-            parsed.right,
-        ]);
-        if (!recorded.ok)
-            return toCallToolResult(recorded, compareContract);
-        const comparison = managedMemberComparisonResultSchema.parse(result.value.normalized_result);
-        const unknown = comparison.summary.unknown > 0;
-        const output = parsed.unknown_registry_approved === true && unknown
-            ? options.recordEvidenceWithUnknown?.(result.value, {
-                approved: true,
-                question: "Which managed members remain unmatched or ambiguous across these versions?",
-                severity: "medium",
-                domain: "managed-member-comparison",
-                supporting_evidence_ids: [result.value.evidence_id],
-                contradicting_evidence_ids: [],
-                required_authority: "shipped-artifact",
-                required_confidence: "observed",
-                required_environment: null,
-                recommended_probes: [
-                    {
-                        operation: "inspect_managed_members",
-                        rationale: "Repeat static member inspection with complete pages and method bodies.",
-                    },
-                ],
-                relationships: [],
-            })
-            : options.recordEvidence?.(result.value);
-        if (output !== undefined && !output.ok)
-            return toCallToolResult(output, compareContract);
-        return toCallToolResult({ ok: true, value: result.value }, compareContract, {
-            evidenceResourcesAvailable: output !== undefined,
-        });
-    });
-    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedNativeVerificationReferenceInputSchema, input, nativeVerificationContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, nativeVerificationContract);
-        const managedBoundaries = resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_boundaries_evidence_id);
-        if (!managedBoundaries.ok)
-            return toCallToolResult(managedBoundaries, nativeVerificationContract);
-        const nativeObservations = resolveNativeEvidence(options.session, parsedInput.value.native_observation_evidence_ids);
-        if (!nativeObservations.ok)
-            return toCallToolResult(nativeObservations, nativeVerificationContract);
-        const managedBoundary = managedBoundaries.value[0];
-        if (managedBoundary === undefined)
-            throw new TypeError("Managed boundary Evidence resolution failed");
-        const { managed_boundaries_evidence_id: _managedBoundariesEvidenceId, native_observation_evidence_ids: _nativeObservationEvidenceIds, ...referencedInput } = parsedInput.value;
-        const parsed = {
-            ...referencedInput,
-            managed_boundaries: managedBoundary,
-            native_observations: nativeObservations.value,
-        };
-        const result = await logToolExecution(options.logger, nativeVerificationContract.name, () => Promise.resolve(verifyManagedNativeBoundariesEvidence(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, nativeVerificationContract);
-        const recordedSources = recordSources(options.recordEvidence, [
-            parsed.managed_boundaries,
-            ...parsed.native_observations,
-        ]);
-        if (!recordedSources.ok)
-            return toCallToolResult(recordedSources, nativeVerificationContract);
-        const verification = managedNativeVerificationResultSchema.parse(result.value.normalized_result);
-        const unknown = verification.summary.unresolved > 0 ||
-            verification.summary.contradicted > 0 ||
-            verification.summary.native_body_unresolved > 0;
-        const output = parsed.unknown_registry_approved === true && unknown
-            ? options.recordEvidenceWithUnknown?.(result.value, {
-                approved: true,
-                question: "Which managed/native boundaries remain unresolved or contradicted by the supplied native Evidence?",
-                severity: "medium",
-                domain: "managed-native-verification",
-                supporting_evidence_ids: [result.value.evidence_id],
-                contradicting_evidence_ids: [],
-                required_authority: "shipped-artifact",
-                required_confidence: "observed",
-                required_environment: null,
-                recommended_probes: [
-                    {
-                        operation: "inspect_managed_native_boundaries",
-                        rationale: "Repeat managed boundary inspection with complete ModuleRef, ImplMap, and native implementation pages.",
-                    },
-                    {
-                        operation: "analyze_function",
-                        rationale: "Analyze the provider-resolved native function candidate for the declared export.",
-                    },
-                ],
-                relationships: [],
-            })
-            : options.recordEvidence?.(result.value);
-        if (output !== undefined && !output.ok)
-            return toCallToolResult(output, nativeVerificationContract);
-        return toCallToolResult(result, nativeVerificationContract, {
-            evidenceResourcesAvailable: output !== undefined,
-        });
-    });
-    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedReconstructionReferenceInputSchema, input, reconstructionContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, reconstructionContract);
-        const resolved = resolveManagedEvidence(options.session, [
-            parsedInput.value.static_members_evidence_id,
-        ]);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, reconstructionContract);
-        const staticMembers = resolved.value[0];
-        if (staticMembers === undefined)
-            throw new TypeError("Managed reconstruction Evidence resolution failed");
-        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
-        const parsed = { ...referencedInput, static_members: staticMembers };
-        const result = await logToolExecution(options.logger, reconstructionContract.name, () => Promise.resolve(importManagedReconstructionEvidenceValidated(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, reconstructionContract);
-        const recordedSource = options.recordEvidence?.(parsed.static_members);
-        if (recordedSource !== undefined && !recordedSource.ok)
-            return toCallToolResult(recordedSource, reconstructionContract);
-        const recorded = options.recordEvidence?.(result.value);
-        if (recorded !== undefined && !recorded.ok)
-            return toCallToolResult(recorded, reconstructionContract);
-        return toCallToolResult(result, reconstructionContract, {
-            evidenceResourcesAvailable: recorded !== undefined,
-        });
-    });
-    server.registerTool(runtimeContract.name, toolRegistrationOptions(runtimeContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedRuntimeCorrelationReferenceInputSchema, input, runtimeContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, runtimeContract);
-        const resolved = resolveManagedEvidence(options.session, [
-            parsedInput.value.static_members_evidence_id,
-        ]);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, runtimeContract);
-        const staticMembers = resolved.value[0];
-        if (staticMembers === undefined)
-            throw new TypeError("Managed runtime Evidence resolution failed");
-        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
-        const parsed = { ...referencedInput, static_members: staticMembers };
-        const result = await logToolExecution(options.logger, runtimeContract.name, () => planManagedRuntimeCorrelationEvidenceValidated(options.runtime, parsed));
-        if (!result.ok)
-            return toCallToolResult(result, runtimeContract);
-        const recordedSource = options.recordEvidence?.(parsed.static_members);
-        if (recordedSource !== undefined && !recordedSource.ok)
-            return toCallToolResult(recordedSource, runtimeContract);
-        const recorded = options.recordEvidence?.(result.value);
-        if (recorded !== undefined && !recorded.ok)
-            return toCallToolResult(recorded, runtimeContract);
-        return toCallToolResult(result, runtimeContract, {
-            evidenceResourcesAvailable: recorded !== undefined,
-        });
-    });
-    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedApplicationGraphReferenceInputSchema, input, graphContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, graphContract);
-        const managedArtifact = parsedInput.value.managed_artifact_evidence_id === undefined
-            ? undefined
-            : resolveManagedArtifactEvidence(options.session, parsedInput.value.managed_artifact_evidence_id);
-        if (managedArtifact !== undefined && !managedArtifact.ok)
-            return toCallToolResult(managedArtifact, graphContract);
-        const managedMembers = parsedInput.value.managed_members_evidence_id === undefined
-            ? undefined
-            : resolveManagedEvidence(options.session, [
-                parsedInput.value.managed_members_evidence_id,
-            ]);
-        if (managedMembers !== undefined && !managedMembers.ok)
-            return toCallToolResult(managedMembers, graphContract);
-        const managedBoundaries = parsedInput.value.managed_native_boundaries_evidence_id === undefined
-            ? undefined
-            : resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_native_boundaries_evidence_id);
-        if (managedBoundaries !== undefined && !managedBoundaries.ok)
-            return toCallToolResult(managedBoundaries, graphContract);
-        const parsed = {
-            limits: parsedInput.value.limits,
-            managed_artifact: managedArtifact?.value[0],
-            managed_members: managedMembers?.value[0],
-            managed_native_boundaries: managedBoundaries?.value[0],
-        };
-        const result = await logToolExecution(options.logger, graphContract.name, () => Promise.resolve(projectManagedApplicationGraphEvidence(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, graphContract);
-        const recordedSources = recordSources(options.recordEvidence, sourceEvidence(parsed));
-        if (!recordedSources.ok)
-            return toCallToolResult(recordedSources, graphContract);
-        const recorded = options.recordEvidence?.(result.value);
-        if (recorded !== undefined && !recorded.ok)
-            return toCallToolResult(recorded, graphContract);
-        return toCallToolResult(result, graphContract, {
-            evidenceResourcesAvailable: recorded !== undefined,
-        });
-    });
+    registerCompareManagedMembers(server, options);
+    registerVerifyManagedNativeBoundaries(server, options);
+    registerImportManagedReconstruction(server, options);
+    registerPlanManagedRuntimeCorrelation(server, options);
+    registerProjectManagedApplicationGraph(server, options);
 };
-const contract = (name) => {
-    const found = MANAGED_WORKFLOW_TOOL_CONTRACTS.find((candidate) => candidate.name === name);
-    if (found === undefined)
-        throw new Error(`Missing ${name} contract`);
-    return found;
-};
-const resolveManagedEvidence = (session, evidenceIds) => resolveSessionEvidenceIds(session, evidenceIds, {
-    operation: "inspect_managed_members",
-    predicate: "rea.analysis/v2",
-});
-const resolveManagedArtifactEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
-    operation: "inspect_managed_artifact",
-    predicate: "rea.analysis/v2",
-});
-const resolveManagedBoundaryEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
-    operation: "inspect_managed_native_boundaries",
-    predicate: "rea.analysis/v2",
-});
-const resolveNativeEvidence = (session, evidenceIds) => {
-    const records = [];
-    for (const evidenceId of evidenceIds) {
-        const operation = session.evidenceById(evidenceId)?.operation;
-        const expectedOperation = operation === "inspect_macho" || operation === "analyze_function"
-            ? operation
-            : "inspect_macho or analyze_function";
-        const resolved = resolveSessionEvidenceIds(session, [evidenceId], {
-            operation: expectedOperation,
-            predicate: "rea.analysis/v2",
-        });
-        if (!resolved.ok)
-            return resolved;
-        records.push(...resolved.value);
-    }
-    return { ok: true, value: records };
-};
-const recordSources = (recordEvidence, sources) => {
-    for (const source of sources) {
-        const recorded = recordEvidence?.(source);
-        if (recorded !== undefined && !recorded.ok)
-            return recorded;
-    }
-    return { ok: true, value: null };
-};
-const sourceEvidence = (input) => [
-    input.managed_artifact,
-    input.managed_members,
-    input.managed_native_boundaries,
-].filter((evidence) => evidence !== undefined);

package/dist/server/registerOfficialTools.js

@@ -25,70 +25,84 @@ const registerOfficialTool = (server, analysis, contract, registration) => {
             return toCallToolResult(parsedInput, contract);
         const arguments_ = projectOfficialArguments(contract, parsedInput.value);
         const progress = mcpProgressReporter(context);
-        await progress.report({
-            phase: contract.name,
-            completed: 0,
-            total: 1,
-            message: "started",
-        });
-        const result = await logToolExecution(registration.logger, contract.name, () => analysis.execute(contract.name, arguments_, {
+        const result = await runOfficialOperation(analysis, contract, arguments_, {
+            logger: registration.logger,
             signal: context.mcpReq.signal,
             progress,
-        }));
-        await progress.report({
-            phase: contract.name,
-            completed: 1,
-            total: 1,
-            message: result.ok ? "completed" : "failed",
-            terminal: true,
         });
-        if (result.ok) {
-            const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
-                operation: contract.name,
-                parameters: arguments_,
-                result: result.value.result,
-                ...(result.value.analysisProfile === undefined
-                    ? {}
-                    : { analysisProfile: result.value.analysisProfile }),
-                rawResult: result.value.rawResult,
-                limitations: result.value.limitations,
-                locations: result.value.locations,
-            });
-            const recorded = registration.recordEvidence?.(evidence);
-            if (recorded !== undefined && !recorded.ok)
-                return toCallToolResult(recorded, contract);
-            return toCallToolResult({ ok: true, value: evidence }, contract, {
-                evidenceResourcesAvailable: recorded !== undefined,
-            });
-        }
-        if (result.error instanceof AnalysisCapabilityUnavailableError &&
-            approvedUnknownTracking(input) &&
-            registration.recordUnknown !== undefined) {
-            const unknown = registration.recordUnknown({
-                approved: true,
-                question: "The requested analysis is unavailable for the current target.",
-                severity: "medium",
-                domain: "analysis-capability",
-                supporting_evidence_ids: [],
-                contradicting_evidence_ids: [],
-                required_authority: "shipped-artifact",
-                required_confidence: "observed",
-                required_environment: null,
-                recommended_probes: [
-                    {
-                        operation: contract.name,
-                        rationale: "Choose another analysis or target that can answer this question.",
-                    },
-                ],
-                relationships: [],
-            });
-            if (!unknown.ok &&
-                !(unknown.error instanceof UnknownRegistryError &&
-                    unknown.error.reason === "already-exists"))
-                return toCallToolResult(unknown, contract);
+        if (!result.ok) {
+            const unknownError = recordOfficialUnknown(input, result.error, contract, registration.recordUnknown);
+            if (unknownError !== undefined)
+                return toCallToolResult(unknownError, contract);
+            return toCallToolResult(result, contract);
         }
-        return toCallToolResult(result, contract);
+        const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
+            operation: contract.name,
+            parameters: arguments_,
+            result: result.value.result,
+            ...(result.value.analysisProfile === undefined
+                ? {}
+                : { analysisProfile: result.value.analysisProfile }),
+            rawResult: result.value.rawResult,
+            limitations: result.value.limitations,
+            locations: result.value.locations,
+        });
+        const recorded = registration.recordEvidence?.(evidence);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, contract);
+        return toCallToolResult({ ok: true, value: evidence }, contract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};
+const runOfficialOperation = async (analysis, contract, arguments_, execution) => {
+    await execution.progress.report({
+        phase: contract.name,
+        completed: 0,
+        total: 1,
+        message: "started",
+    });
+    const result = await logToolExecution(execution.logger, contract.name, () => analysis.execute(contract.name, arguments_, {
+        signal: execution.signal,
+        progress: execution.progress,
+    }));
+    await execution.progress.report({
+        phase: contract.name,
+        completed: 1,
+        total: 1,
+        message: result.ok ? "completed" : "failed",
+        terminal: true,
+    });
+    return result;
+};
+const recordOfficialUnknown = (input, error, contract, recordUnknown) => {
+    if (!(error instanceof AnalysisCapabilityUnavailableError) ||
+        !approvedUnknownTracking(input) ||
+        recordUnknown === undefined)
+        return undefined;
+    const unknown = recordUnknown({
+        approved: true,
+        question: "The requested analysis is unavailable for the current target.",
+        severity: "medium",
+        domain: "analysis-capability",
+        supporting_evidence_ids: [],
+        contradicting_evidence_ids: [],
+        required_authority: "shipped-artifact",
+        required_confidence: "observed",
+        required_environment: null,
+        recommended_probes: [
+            {
+                operation: contract.name,
+                rationale: "Choose another analysis or target that can answer this question.",
+            },
+        ],
+        relationships: [],
     });
+    if (!unknown.ok &&
+        !(unknown.error instanceof UnknownRegistryError &&
+            unknown.error.reason === "already-exists"))
+        return unknown;
+    return undefined;
 };
 const projectOfficialArguments = (contract, input) => {
     const parsed = jsonObjectSchema.parse(input);

package/dist/server/registerSessionRecordTools.js

@@ -0,0 +1,137 @@
+import { readEvidenceBundle, writeEvidenceBundle, } from "../application/EvidenceBundleFiles.js";
+import { exportEvidenceBundleInputSchema, importEvidenceBundleInputSchema, listUnknownsInputSchema, SESSION_TOOL_CONTRACTS, verifyUnknownResolutionInputSchema, } from "../contracts/toolContracts.js";
+import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { recordUnknownInputSchema, updateUnknownInputSchema, } from "../domain/residualUnknown.js";
+import { err, ok } from "../domain/result.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { toCallToolResult } from "./toolResult.js";
+/** Register evidence bundle import and export tools. */
+export const registerEvidenceTools = (registration) => {
+    registerExportEvidenceTool(registration);
+    registerImportEvidenceTool(registration);
+};
+const registerExportEvidenceTool = ({ server, session, exportContract, filePolicy, permissionAuthority, }) => {
+    server.registerTool(exportContract.name, toolRegistrationOptions(exportContract), async (input) => {
+        const parsedInput = safeParseToolInput(exportEvidenceBundleInputSchema, input, exportContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, exportContract);
+        const parsed = parsedInput.value;
+        const bundle = session.exportEvidenceBundle();
+        if (parsed.path === undefined)
+            return toCallToolResult(ok(bundle), exportContract);
+        const denied = await authorizeEvidencePath({
+            authority: permissionAuthority,
+            capability: "evidence_write",
+            path: parsed.path,
+            access: "write",
+            operationIdentity: `export_evidence:${parsed.path}`,
+        });
+        if (denied !== undefined)
+            return toCallToolResult(denied, exportContract);
+        const written = await writeEvidenceBundle(bundle, parsed.path, parsed.overwrite, filePolicy);
+        return written.ok
+            ? toCallToolResult(ok({
+                path: written.value.path,
+                bytes: written.value.bytes,
+                records: bundle.records.length,
+            }), exportContract)
+            : toCallToolResult(written, exportContract);
+    });
+};
+const registerImportEvidenceTool = ({ server, session, importContract, filePolicy, permissionAuthority, }) => {
+    server.registerTool(importContract.name, toolRegistrationOptions(importContract), async (input) => {
+        const parsedInput = safeParseToolInput(importEvidenceBundleInputSchema, input, importContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, importContract);
+        const path = parsedInput.value.path;
+        const denied = await authorizeEvidencePath({
+            authority: permissionAuthority,
+            capability: "evidence_read",
+            path,
+            access: "read",
+            operationIdentity: `import_evidence:${path}`,
+        });
+        if (denied !== undefined)
+            return toCallToolResult(denied, importContract);
+        const loaded = await readEvidenceBundle(path, filePolicy);
+        if (!loaded.ok)
+            return toCallToolResult(loaded, importContract);
+        const imported = session.importEvidenceBundle(loaded.value);
+        if (imported.ok && imported.value > 0)
+            server.sendResourceListChanged();
+        return imported.ok
+            ? toCallToolResult(ok({
+                imported: imported.value,
+                total: session.exportEvidenceBundle().records.length,
+            }), importContract)
+            : toCallToolResult(imported, importContract);
+    });
+};
+const authorizeEvidencePath = async (input) => {
+    if (input.authority === undefined)
+        return undefined;
+    const authorized = await input.authority.authorize({
+        capability: input.capability,
+        roots: [input.path],
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: input.operationIdentity,
+    }, input.access);
+    return authorized.ok ? undefined : permissionFailure(authorized);
+};
+/** Register residual-unknown query and mutation tools. */
+export const registerUnknownTools = ({ server, session, contracts, }) => {
+    const listContract = contracts[14];
+    const recordContract = contracts[15];
+    const updateContract = contracts[16];
+    const verifyContract = contracts[17];
+    server.registerTool(listContract.name, toolRegistrationOptions(listContract), (input) => {
+        const parsed = safeParseToolInput(listUnknownsInputSchema, input, listContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, listContract);
+        const filters = parsed.value;
+        return toCallToolResult(ok(session.listUnknowns({
+            ...(filters.status === undefined ? {} : { status: filters.status }),
+            ...(filters.severity === undefined
+                ? {}
+                : { severity: filters.severity }),
+            ...(filters.domain === undefined ? {} : { domain: filters.domain }),
+        })), listContract);
+    });
+    server.registerTool(recordContract.name, toolRegistrationOptions(recordContract), (input) => {
+        const parsed = safeParseToolInput(recordUnknownInputSchema, input, recordContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, recordContract);
+        const result = session.recordUnknown(parsed.value);
+        if (result.ok)
+            server.sendResourceListChanged();
+        return toCallToolResult(result, recordContract);
+    });
+    server.registerTool(updateContract.name, toolRegistrationOptions(updateContract), (input) => {
+        const parsed = safeParseToolInput(updateUnknownInputSchema, input, updateContract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, updateContract);
+        const result = session.updateUnknown(parsed.value);
+        if (result.ok)
+            server.sendResourceListChanged();
+        return toCallToolResult(result, updateContract);
+    });
+    server.registerTool(verifyContract.name, toolRegistrationOptions(verifyContract), (input) => {
+        const parsed = safeParseToolInput(verifyUnknownResolutionInputSchema, input, verifyContract.name);
+        return parsed.ok
+            ? toCallToolResult(session.verifyUnknownResolution(parsed.value.unknown_id), verifyContract)
+            : toCallToolResult(parsed, verifyContract);
+    });
+};
+const permissionFailure = (failure) => {
+    if (failure.ok)
+        return err(new AnalysisProtocolError("Expected a denied permission"));
+    return err(failure.error instanceof PermissionRequiredError
+        ? failure.error
+        : new AnalysisProtocolError(failure.error.message, {
+            cause: failure.error,
+        }));
+};

package/dist/server/registerSessionStatusTool.js

@@ -6,7 +6,8 @@ import { buildCapabilityInventory } from "../application/CapabilityInventory.js"
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register the read-only provider and target status operation. */
-export const registerSessionStatusTool = (server, session, contract, startedAt, availabilityPolicy) => {
+export const registerSessionStatusTool = (options) => {
+    const { server, session, contract, startedAt, availabilityPolicy } = options;
     server.registerTool(contract.name, toolRegistrationOptions(contract), (input) => {
         const parsedInput = safeParseToolInput(binarySessionInputSchema, input, contract.name);
         if (!parsedInput.ok)