rea-agents 2.3.0 → 2.5.0

package/dist/browser/V8InspectorCaptureProjection.js

@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { authorizeRuntimeLocation } from "./JavaScriptRuntimeScope.js";
+/** Empty durable-location exclusion counters. */
+export const createInspectorExclusionCounts = () => ({
+    outside_file_roots: 0,
+    outside_origins: 0,
+    unsupported_location: 0,
+});
+/** Stable safety and protocol limitations shared by target-list Evidence. */
+export const describeInspectorTargetLimitations = () => [
+    "REA attaches to an already-running exact target and never launches, resumes, evaluates, pauses, or mutates it.",
+    "Only Runtime.enable and Debugger.enable are sent; source text, object values, EventEmitter activity, and Electron IPC are not inspected.",
+    "Target IDs and locations are authorized, but the Inspector protocol does not authenticate an operating-system process ID or Electron role.",
+    "No runtime graph depth is traversed because passive Inspector events do not establish require/import caller edges.",
+];
+/** Canonically authorize, deduplicate, and sort one bounded raw capture. */
+export const finalizeInspectorCapture = async ({ input, runtime, target, roots, state, }) => {
+    const exclusions = createInspectorExclusionCounts();
+    const scripts = new Map();
+    for (const draft of state.scripts) {
+        const decision = await authorizeRuntimeLocation(draft.rawUrl, roots, input.allowed_origins);
+        if (!decision.allowed) {
+            exclusions[decision.reason] += 1;
+            continue;
+        }
+        const script = scriptFromDraft(draft, decision.location);
+        scripts.set(script.script_key, script);
+    }
+    const items = [...scripts.values()].sort((left, right) => left.script_key < right.script_key
+        ? -1
+        : left.script_key > right.script_key
+            ? 1
+            : 0);
+    const contexts = [...state.contexts.values()]
+        .map((context) => ({
+        context_key: context.contextKey,
+        state: context.state,
+        name: null,
+        origin: context.origin,
+    }))
+        .sort((left, right) => left.context_key < right.context_key
+        ? -1
+        : left.context_key > right.context_key
+            ? 1
+            : 0);
+    return {
+        schema_version: 1,
+        runtime,
+        target: {
+            target_id: target.id,
+            protocol_type: target.type,
+            attached: target.attached,
+            location: target.location,
+            runtime_kind: input.runtime_kind,
+            runtime_kind_authority: "caller-declared-unverified",
+        },
+        capture: {
+            observation_ms: input.observation_ms,
+            events_observed: state.eventsObserved,
+            events_retained: state.eventsRetained,
+            events_dropped: state.eventsDropped,
+            metadata_bytes_retained: state.metadataBytes,
+            truncated: state.truncated,
+            truncation_reasons: [...state.truncationReasons].sort(),
+        },
+        scripts: {
+            items,
+            observed_total: state.scriptsObserved,
+            excluded: {
+                ...exclusions,
+                invalid_protocol_value: state.invalidScripts,
+            },
+        },
+        execution_contexts: contexts,
+        directly_observed: [
+            "Debugger.scriptParsed established script presence within the bounded capture window.",
+            "Runtime execution-context lifecycle events established context creation, destruction, or clearing.",
+        ],
+        unavailable_without_instrumentation: [
+            "require/import caller-to-callee edges",
+            "EventEmitter emissions and listener invocation",
+            "Electron IPC messages and handlers",
+            "script unload events",
+        ],
+        unknowns: [
+            "Scripts collected before attachment may have been garbage-collected and therefore omitted.",
+            "A bounded observation window cannot establish that an unobserved script or behavior never occurs.",
+            "The declared Node/Electron process role is not authenticated by the Inspector protocol.",
+        ],
+        limitations: describeInspectorTargetLimitations(),
+    };
+};
+const scriptFromDraft = (draft, location) => {
+    const stable = JSON.stringify({
+        location,
+        execution_context_key: draft.executionContextKey,
+        cdp_hash: draft.cdpHash,
+        length: draft.length,
+        is_module: draft.isModule,
+    });
+    return {
+        script_key: `v8_script_${createHash("sha256").update(stable).digest("hex")}`,
+        location,
+        execution_context_key: draft.executionContextKey,
+        cdp_hash: draft.cdpHash,
+        length: draft.length,
+        is_module: draft.isModule,
+        status: "observed-loaded",
+    };
+};

package/dist/browser/V8InspectorEndpoint.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+import { BrowserObservationError, } from "../domain/errors.js";
+import { parseCdpEndpointValue, readBoundedCdpJson } from "./CdpEndpoint.js";
+const MAX_VERSION_BYTES = 64 * 1_024;
+const MAX_TARGET_LIST_BYTES = 2 * 1_024 * 1_024;
+const versionSchema = z
+    .object({
+    Browser: z.string().min(1).max(1_024),
+    "Protocol-Version": z.string().min(1).max(100),
+    "V8-Version": z.string().max(1_024).optional(),
+})
+    .passthrough();
+const targetSchema = z
+    .object({
+    id: z.string().min(1).max(256),
+    type: z.string().min(1).max(100),
+    url: z.string().max(65_536),
+    attached: z.boolean().default(false),
+    webSocketDebuggerUrl: z.string().min(1).max(2_048),
+})
+    .passthrough();
+const targetsSchema = z.array(targetSchema).max(1_000);
+/** Discover bounded Node/Electron Inspector targets from one loopback endpoint. */
+export const discoverV8Inspector = async (endpoint, operation, signal) => {
+    const [versionInput, targetsInput] = await Promise.all([
+        readBoundedCdpJson(new URL("/json/version", endpoint), MAX_VERSION_BYTES, operation, signal),
+        readBoundedCdpJson(new URL("/json/list", endpoint), MAX_TARGET_LIST_BYTES, operation, signal),
+    ]);
+    const version = parseCdpEndpointValue(versionSchema, versionInput, operation);
+    const targets = parseCdpEndpointValue(targetsSchema, targetsInput, operation);
+    return {
+        runtime: {
+            product: version.Browser,
+            protocol_version: version["Protocol-Version"],
+            v8_version: version["V8-Version"] ?? null,
+        },
+        targets: targets.map((target) => ({
+            id: target.id,
+            type: target.type,
+            url: target.url,
+            attached: target.attached,
+            webSocketUrl: validatedInspectorWebSocket(endpoint, target.id, target.webSocketDebuggerUrl, operation),
+        })),
+    };
+};
+const validatedInspectorWebSocket = (endpoint, targetId, reported, operation) => {
+    let socket;
+    try {
+        socket = new URL(reported);
+    }
+    catch (cause) {
+        throw new BrowserObservationError(operation, "invalid_endpoint_response", {
+            cause,
+        });
+    }
+    const trusted = new URL(endpoint);
+    const allowedPaths = new Set([
+        `/${targetId}`,
+        `/devtools/node/${targetId}`,
+        `/devtools/page/${targetId}`,
+    ]);
+    if (socket.protocol !== "ws:" ||
+        socket.port !== trusted.port ||
+        socket.username !== "" ||
+        socket.password !== "" ||
+        socket.search !== "" ||
+        socket.hash !== "" ||
+        !allowedPaths.has(socket.pathname))
+        throw new BrowserObservationError(operation, "invalid_endpoint_response");
+    socket.hostname = trusted.hostname;
+    return socket.href;
+};

package/dist/browser/V8InspectorProvider.js

@@ -0,0 +1,267 @@
+import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, } from "../domain/javascriptRuntimeObservation.js";
+import { AnalysisError, BrowserObservationError, ProviderAdapterError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { boundedText, numberValue, recordValue, stringValue, delayWithCancellation, } from "./CdpCaptureValues.js";
+import { CdpConnection } from "./CdpConnection.js";
+import { authorizeRuntimeLocation, canonicalRuntimeRoots, } from "./JavaScriptRuntimeScope.js";
+import { createInspectorExclusionCounts, describeInspectorTargetLimitations, finalizeInspectorCapture, } from "./V8InspectorCaptureProjection.js";
+import { discoverV8Inspector, } from "./V8InspectorEndpoint.js";
+/** Public identity committed by passive V8 Inspector observations. */
+export const V8_INSPECTOR_PROVIDER_IDENTITY = Object.freeze({
+    id: "rea-v8-inspector",
+    name: "REA passive Node/Electron V8 Inspector provider",
+    version: "1",
+});
+/** Attach-only provider; sends only Runtime.enable and Debugger.enable. */
+export class V8InspectorProvider {
+    identity() {
+        return V8_INSPECTOR_PROVIDER_IDENTITY;
+    }
+    async listTargets(input, options = {}) {
+        try {
+            const roots = await canonicalRuntimeRoots(input.allowed_file_roots);
+            const discovery = await discoverV8Inspector(input.inspector_endpoint, "list_javascript_runtime_targets", options.signal);
+            const allowed = [];
+            const excluded = createInspectorExclusionCounts();
+            for (const target of discovery.targets) {
+                const decision = await authorizeRuntimeLocation(target.url, roots, input.allowed_origins);
+                if (!decision.allowed) {
+                    excluded[decision.reason] += 1;
+                    continue;
+                }
+                if (decision.location.kind === "builtin") {
+                    excluded.unsupported_location += 1;
+                    continue;
+                }
+                allowed.push({ ...target, location: decision.location });
+            }
+            allowed.sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
+            const items = allowed
+                .slice(input.offset, input.offset + input.limit)
+                .map(projectTarget);
+            const nextOffset = input.offset + items.length;
+            return ok(javascriptRuntimeTargetListSchema.parse({
+                schema_version: 1,
+                runtime: discovery.runtime,
+                targets: {
+                    items,
+                    offset: input.offset,
+                    limit: input.limit,
+                    total: allowed.length,
+                    next_offset: nextOffset < allowed.length ? nextOffset : null,
+                    has_more: nextOffset < allowed.length,
+                },
+                excluded: { ...excluded, unconnectable: 0 },
+                limitations: describeInspectorTargetLimitations(),
+            }));
+        }
+        catch (cause) {
+            return err(providerError(cause, "list_javascript_runtime_targets"));
+        }
+    }
+    async observe(input, options = {}) {
+        let connection;
+        try {
+            const roots = await canonicalRuntimeRoots(input.allowed_file_roots);
+            const discovery = await discoverV8Inspector(input.inspector_endpoint, "observe_javascript_runtime", options.signal);
+            const target = await authorizedTarget(discovery.targets, input, roots);
+            assertRuntimeKind(target, input.runtime_kind);
+            connection = await CdpConnection.connect(target.webSocketUrl, "observe_javascript_runtime", options.signal);
+            const state = emptyCaptureState();
+            const removeListener = connection.onEvent((event) => ingestEvent(event, input, state));
+            try {
+                await connection.send("Runtime.enable", {}, undefined, options.signal);
+                await connection.send("Debugger.enable", {}, undefined, options.signal);
+                await waitForCapture(connection, input.observation_ms, options.signal);
+            }
+            finally {
+                removeListener();
+            }
+            const result = await finalizeInspectorCapture({
+                input,
+                runtime: discovery.runtime,
+                target,
+                roots,
+                state,
+            });
+            return ok(javascriptRuntimeObservationSchema.parse(result));
+        }
+        catch (cause) {
+            return err(providerError(cause, "observe_javascript_runtime"));
+        }
+        finally {
+            await connection?.close();
+        }
+    }
+}
+const projectTarget = (target) => ({
+    target_id: target.id,
+    protocol_type: target.type,
+    attached: target.attached,
+    location: target.location,
+});
+const authorizedTarget = async (targets, input, roots) => {
+    const target = targets.find(({ id }) => id === input.target_id);
+    if (target === undefined)
+        throw new BrowserObservationError("observe_javascript_runtime", "target_not_found");
+    const decision = await authorizeRuntimeLocation(target.url, roots, input.allowed_origins);
+    if (target.attached ||
+        !decision.allowed ||
+        decision.location.kind === "builtin")
+        throw new BrowserObservationError("observe_javascript_runtime", "target_not_allowed");
+    return { ...target, location: decision.location };
+};
+const assertRuntimeKind = (target, kind) => {
+    const accepted = kind === "electron-preload" || kind === "electron-renderer"
+        ? target.type === "page"
+        : target.type === "node";
+    if (!accepted)
+        throw new BrowserObservationError("observe_javascript_runtime", "target_not_allowed");
+};
+const emptyCaptureState = () => ({
+    scripts: [],
+    contexts: new Map(),
+    eventsObserved: 0,
+    eventsRetained: 0,
+    eventsDropped: 0,
+    metadataBytes: 0,
+    scriptsObserved: 0,
+    invalidScripts: 0,
+    truncated: false,
+    truncationReasons: new Set(),
+});
+const ingestEvent = (event, input, state) => {
+    if (event.method !== "Debugger.scriptParsed" &&
+        event.method !== "Debugger.scriptFailedToParse" &&
+        event.method !== "Runtime.executionContextCreated" &&
+        event.method !== "Runtime.executionContextDestroyed" &&
+        event.method !== "Runtime.executionContextsCleared")
+        return;
+    state.eventsObserved += 1;
+    if (state.eventsObserved > input.limits.max_events) {
+        drop(state, "max_events");
+        return;
+    }
+    if (event.method === "Debugger.scriptParsed") {
+        ingestScript(event, input, state);
+        return;
+    }
+    if (event.method === "Debugger.scriptFailedToParse") {
+        state.invalidScripts += 1;
+        retainEvent(state, 0, input);
+        return;
+    }
+    ingestContext(event, input, state);
+};
+const ingestScript = (event, input, state) => {
+    state.scriptsObserved += 1;
+    const value = recordValue(event.params);
+    const rawUrl = stringValue(value?.url);
+    if (rawUrl === undefined ||
+        rawUrl === "" ||
+        Buffer.byteLength(rawUrl) > input.limits.max_location_bytes) {
+        state.invalidScripts += 1;
+        retainEvent(state, 0, input);
+        return;
+    }
+    if (state.scripts.length >= input.limits.max_scripts) {
+        drop(state, "max_scripts");
+        return;
+    }
+    const draft = {
+        rawUrl,
+        executionContextKey: contextKey(value?.executionContextId),
+        cdpHash: boundedText(value?.hash, 512),
+        length: nonnegativeInteger(value?.length),
+        isModule: value?.isModule === true,
+    };
+    const bytes = metadataBytes(draft);
+    if (!retainEvent(state, bytes, input))
+        return;
+    state.scripts.push(draft);
+};
+const ingestContext = (event, input, state) => {
+    if (event.method === "Runtime.executionContextsCleared") {
+        for (const context of state.contexts.values())
+            context.state = "cleared";
+        retainEvent(state, 0, input);
+        return;
+    }
+    const parameters = recordValue(event.params);
+    const runtimeContext = event.method === "Runtime.executionContextCreated"
+        ? recordValue(parameters?.context)
+        : parameters;
+    const key = contextKey(event.method === "Runtime.executionContextCreated"
+        ? runtimeContext?.id
+        : runtimeContext?.executionContextId);
+    if (key === null) {
+        retainEvent(state, 0, input);
+        return;
+    }
+    if (state.contexts.size >= input.limits.max_execution_contexts &&
+        !state.contexts.has(key)) {
+        drop(state, "max_execution_contexts");
+        return;
+    }
+    const origin = event.method === "Runtime.executionContextCreated"
+        ? boundedText(runtimeContext?.origin, 4_096)
+        : null;
+    const draft = {
+        contextKey: key,
+        state: event.method === "Runtime.executionContextCreated"
+            ? "created"
+            : "destroyed",
+        origin: origin !== null && input.allowed_origins.includes(origin) ? origin : null,
+    };
+    const bytes = metadataBytes(draft);
+    if (!retainEvent(state, bytes, input))
+        return;
+    state.contexts.set(key, draft);
+};
+const retainEvent = (state, bytes, input) => {
+    if (state.metadataBytes + bytes > input.limits.max_total_metadata_bytes) {
+        drop(state, "max_total_metadata_bytes");
+        return false;
+    }
+    state.metadataBytes += bytes;
+    state.eventsRetained += 1;
+    return true;
+};
+const drop = (state, reason) => {
+    state.eventsDropped += 1;
+    state.truncated = true;
+    state.truncationReasons.add(reason);
+};
+const waitForCapture = async (connection, observationMs, signal) => {
+    let removeDisconnect = () => undefined;
+    const disconnected = new Promise((_resolve, reject) => {
+        removeDisconnect = connection.onDisconnect(() => reject(new BrowserObservationError("observe_javascript_runtime", "disconnected")));
+    });
+    try {
+        await Promise.race([
+            delayWithCancellation(observationMs, "observe_javascript_runtime", signal),
+            disconnected,
+        ]);
+    }
+    finally {
+        removeDisconnect();
+    }
+};
+const metadataBytes = (value) => Buffer.byteLength(JSON.stringify(value));
+const nonnegativeInteger = (value) => {
+    const parsed = numberValue(value);
+    return parsed === undefined ? 0 : Math.max(0, Math.trunc(parsed));
+};
+const contextKey = (value) => {
+    const identifier = numberValue(value);
+    return identifier !== undefined && Number.isSafeInteger(identifier)
+        ? String(identifier)
+        : null;
+};
+const providerError = (cause, operation) => {
+    if (cause instanceof AnalysisError)
+        return cause;
+    return new ProviderAdapterError(V8_INSPECTOR_PROVIDER_IDENTITY.id, operation, {
+        cause,
+    });
+};

package/dist/catalogIdentity.js

@@ -59,6 +59,14 @@ export const MCP_RESOURCE_TEMPLATE_CATALOG = [
         name: "reconstruction-coverage-revision",
         uri_template: "rea://reconstruction-coverage/{workspaceId}/revision/{revision}",
     },
+    {
+        name: "reconstruction-obligation-ledger-page",
+        uri_template: "rea://evidence/{evidenceId}/reconstruction-obligation-ledger",
+    },
+    {
+        name: "reconstruction-readiness-report",
+        uri_template: "rea://evidence/{evidenceId}/reconstruction-readiness-report",
+    },
     {
         name: "javascript-application-graph-page",
         uri_template: "rea://evidence/{evidenceId}/application-graph/{collection}/offset/{offset}/limit/{limit}",

package/dist/cli/artifactCommands.js

@@ -3,6 +3,11 @@ import { runProviderAnalysis } from "../application/DirectAnalysis.js";
 import { logCliCommand } from "../cliLogging.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
 export const registerArtifactCommands = (cli, logger) => {
+    registerInventoryCommand(cli, logger);
+    registerInspectionCommand(cli, logger);
+    registerExtractionCommand(cli, logger);
+};
+const registerInventoryCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.inventoryArtifact, {
         description: "Build a bounded deterministic artifact graph",
         args: z.object({
@@ -61,6 +66,8 @@ export const registerArtifactCommands = (cli, logger) => {
             native_mount_approved: options.nativeMountApproved,
         }, logger)),
     });
+};
+const registerExtractionCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.extractArtifact, {
         description: "Extract explicitly selected artifact occurrences safely",
         args: z.object({
@@ -80,3 +87,35 @@ export const registerArtifactCommands = (cli, logger) => {
         }, logger)),
     });
 };
+const registerInspectionCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.inspectArtifact, {
+        description: "Inspect one artifact with bounded observations and explicit next probes",
+        args: z.object({
+            path: z.string().describe("Application or package path"),
+        }),
+        options: z.object({
+            maxObservations: z
+                .number()
+                .int()
+                .min(1)
+                .max(500)
+                .default(100)
+                .describe("Maximum retained observations"),
+            maxRelationships: z
+                .number()
+                .int()
+                .min(1)
+                .max(500)
+                .default(100)
+                .describe("Maximum retained derived relationships"),
+        }),
+        alias: {
+            maxObservations: "max-observations",
+            maxRelationships: "max-relationships",
+        },
+        run: ({ args, options }) => logCliCommand(logger, "inspect-artifact", () => runProviderAnalysis(args.path, "inspect_artifact", {
+            max_observations: options.maxObservations,
+            max_relationships: options.maxRelationships,
+        }, logger)),
+    });
+};

package/dist/cli/coreAnalysisCommands.js

@@ -9,6 +9,7 @@ import { runCliJavaScriptApplicationAnalysis } from "./javascriptApplicationAnal
 export const registerCoreAnalysisCommands = (cli, logger) => {
     registerCoreCommands(cli, logger);
     registerFunctionCommand(cli, logger);
+    registerInstructionsCommand(cli, logger);
     registerSearchCommand(cli, logger);
     registerXrefsCommand(cli, logger);
     registerTraceCommand(cli, logger);
@@ -212,6 +213,42 @@ const registerFunctionCommand = (cli, logger) => {
         }, directAnalysisOptions(logger, options.snapshot, options.provider))),
     });
 };
+const registerInstructionsCommand = (cli, logger) => {
+    cli.command(CLI_COMMANDS.instructions, {
+        description: "Read one bounded raw-instruction window without decompiling",
+        args: z.object({
+            path: z.string().describe("App or program path"),
+            address: z.string().describe("Procedure name or address"),
+        }),
+        options: z.object({
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .max(100_000)
+                .default(0)
+                .describe("Zero-based instruction offset"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(500)
+                .default(64)
+                .describe("Maximum raw instructions to return"),
+            snapshot: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Load and update a local analysis snapshot"),
+            provider: providerSelectionOption,
+        }),
+        run: ({ args, options }) => logCliCommand(logger, CLI_COMMANDS.instructions, () => runDirectAnalysis(args.path, "read_function_instructions", {
+            procedure: args.address,
+            offset: options.offset,
+            limit: options.limit,
+        }, directAnalysisOptions(logger, options.snapshot, options.provider))),
+    });
+};
 const registerSearchCommand = (cli, logger) => {
     cli.command(CLI_COMMANDS.search, {
         description: "Search bounded analyzed strings or procedure names",

package/dist/cli.js

@@ -13,7 +13,9 @@ import { registerProcessCommands } from "./cliProcessCommands.js";
 import { registerPolicyCommands } from "./cliPolicyCommands.js";
 import { registerBrowserCommands } from "./cliBrowserCommands.js";
 import { registerAdvancedBrowserCommands } from "./cliBrowserAdvancedCommands.js";
+import { registerBrowserScenarioCommands } from "./cliBrowserScenarioCommands.js";
 import { registerElectronCommands } from "./cliElectronCommands.js";
+import { registerJavaScriptRuntimeObservationCommands } from "./cliJavaScriptRuntimeCommands.js";
 import { registerApplicationCommands } from "./cliApplicationCommands.js";
 /**
  * Build the one-shot Incur CLI without starting Hopper at import time.
@@ -52,7 +54,9 @@ export const createCli = () => {
     registerPolicyCommands(cli, logger);
     registerBrowserCommands(cli, logger);
     registerAdvancedBrowserCommands(cli, logger);
+    registerBrowserScenarioCommands(cli, logger);
     registerElectronCommands(cli, logger);
+    registerJavaScriptRuntimeObservationCommands(cli, logger);
     registerApplicationCommands(cli, logger);
     return cli;
 };

package/dist/cliApplicationCommands.js

@@ -1,11 +1,13 @@
 import { Cli, z } from "incur";
-import { compareApplicationVersionsEvidenceValidated, compareJavaScriptExportShapesEvidenceValidated, traceApplicationFeatureEvidenceValidated, } from "./application/JavaScriptApplicationWorkflowService.js";
+import { compareApplicationVersionsEvidenceValidated, compareJavaScriptExportShapesEvidenceValidated, compareSourceToBundleEvidenceValidated, traceApplicationFeatureEvidenceValidated, } from "./application/JavaScriptApplicationWorkflowService.js";
 import { traceJavaScriptSemanticsEvidenceValidated } from "./application/JavaScriptSemanticTraceService.js";
-import { resolveCompareApplicationVersionsRequest, resolveCompareJavaScriptExportShapesRequest, resolveTraceApplicationFeatureRequest, resolveTraceJavaScriptSemanticsRequest, } from "./application/ApplicationWorkflowEvidenceResolver.js";
+import { resolveCompareApplicationVersionsRequest, resolveCompareJavaScriptExportShapesRequest, resolveCompareSourceToBundleRequest, resolveTraceApplicationFeatureRequest, resolveTraceJavaScriptSemanticsRequest, } from "./application/ApplicationWorkflowEvidenceResolver.js";
 import { readEvidenceBundle } from "./application/EvidenceBundleFiles.js";
 import { runControlledReplay } from "./application/JavaScriptReplayService.js";
 import { executeNodeCharacterization, prepareNodeCharacterization, } from "./application/NodeRuntimeCharacterizationService.js";
 import { commitReconstructionCoverage, queryReconstructionCoverage, reconstructionCoverageCommitInputSchema, reconstructionCoverageQueryInputSchema, } from "./application/ReconstructionCoverageService.js";
+import { buildReconstructionObligationLedgerEvidenceValidated, resolveReconstructionObligationLedgerRequest, } from "./application/ReconstructionObligationLedgerService.js";
+import { evaluateReconstructionReadinessValidated, resolveReconstructionReadinessRequest, } from "./application/ReconstructionReadinessService.js";
 import { authorizeFileReadWithDeferredWrite, authorizeRootPermission, } from "./application/DeferredFileAuthorization.js";
 import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
@@ -41,6 +43,14 @@ export const registerApplicationCommands = (cli, logger) => {
         resolveInput: resolveCompareApplicationVersionsRequest,
         workflow: compareApplicationVersionsEvidenceValidated,
     });
+    registerJsonCommand({
+        cli,
+        logger,
+        name: CLI_COMMANDS.compareSourceToBundle,
+        description: "Compare committed historical source with authenticated application Evidence",
+        resolveInput: resolveCompareSourceToBundleRequest,
+        workflow: compareSourceToBundleEvidenceValidated,
+    });
     registerJsonCommand({
         cli,
         logger,
@@ -87,8 +97,26 @@ export const registerApplicationCommands = (cli, logger) => {
         description: "Execute one separately approved exact Node/JavaScript characterization",
         workflow: (config, authority, input) => executeNodeCharacterization(replayDependencies(config, authority), input),
     });
+    registerObligationLedgerCommand(cli, logger);
+    registerReadinessCommand(cli, logger);
     registerCoverageCommands(cli, logger);
 };
+const registerObligationLedgerCommand = (cli, logger) => registerJsonCommand({
+    cli,
+    logger,
+    name: CLI_COMMANDS.buildReconstructionObligationLedger,
+    description: "Generate a deterministic Evidence-backed reconstruction obligation ledger page",
+    resolveInput: resolveReconstructionObligationLedgerRequest,
+    workflow: buildReconstructionObligationLedgerEvidenceValidated,
+});
+const registerReadinessCommand = (cli, logger) => registerJsonCommand({
+    cli,
+    logger,
+    name: CLI_COMMANDS.evaluateReconstructionReadiness,
+    description: "Evaluate a complete Evidence-backed reconstruction readiness journey",
+    resolveInput: resolveReconstructionReadinessRequest,
+    workflow: evaluateReconstructionReadinessValidated,
+});
 const registerAuthorizedJsonCommand = ({ cli, logger, name, description, workflow, }) => {
     cli.command(name, {
         description,