rea-agents 2.4.0 → 3.0.0

package/dist/domain/javascriptSemanticResources.js

@@ -0,0 +1,136 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyName } from "./javascriptSemanticProjection.js";
+import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { dataEffectLimitReached, outerDataEffectBinding, traverseDataEffects, } from "./javascriptSemanticDataEffectHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
+const ACQUIRE_METHODS = [
+    "open",
+    "openSync",
+    "createReadStream",
+    "createWriteStream",
+    "connect",
+    "createConnection",
+];
+const RELEASE_METHODS = ["close", "destroy", "end"];
+/** Recover built-in filesystem/network acquisition and local release handles. */
+export const collectJavaScriptSemanticResources = (program, state, callables) => {
+    const context = {
+        state,
+        callableIds: new Set(callables.map(({ callableId }) => callableId)),
+        callableStack: [],
+        ancestors: [],
+    };
+    const acquisitions = collectAcquisitions(program, context);
+    return [
+        ...acquisitions.map(immutableAcquisition),
+        ...collectReleases(program, context, acquisitions),
+    ];
+};
+const collectAcquisitions = (program, context) => {
+    const output = [];
+    traverseDataEffects(program, context, (node) => {
+        if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
+            return;
+        const method = acquisitionMethod(node.callee, context.state);
+        if (method === null)
+            return;
+        if (resourceLimitReached(output.length, context.state))
+            return;
+        output.push({
+            node,
+            method,
+            ownerCallableId: context.callableStack.at(-1) ?? null,
+            resultBindingId: outerDataEffectBinding(node, context),
+        });
+    });
+    return output;
+};
+const collectReleases = (program, context, acquisitions) => {
+    const byBinding = new Map();
+    for (const acquisition of acquisitions) {
+        if (acquisition.resultBindingId === null)
+            continue;
+        const existing = byBinding.get(acquisition.resultBindingId) ?? [];
+        existing.push(acquisition);
+        byBinding.set(acquisition.resultBindingId, existing);
+    }
+    const output = [];
+    traverseDataEffects(program, context, (node) => {
+        if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
+            return;
+        const member = memberCallee(node);
+        if (member === null || !t.isIdentifier(member.object))
+            return;
+        const method = RELEASE_METHODS.find((candidate) => candidate ===
+            semanticStaticPropertyName(member.property, member.computed));
+        if (method === undefined)
+            return;
+        const binding = resolveSemanticBindingState(context.state, member.object, member.object.name);
+        const linked = binding === undefined ? [] : (byBinding.get(binding.bindingId) ?? []);
+        if (linked.length === 0)
+            return;
+        if (resourceLimitReached(acquisitions.length + output.length, context.state))
+            return;
+        output.push({
+            resourceId: `resource:release:${String(node.start ?? -1)}:${String(node.end ?? -1)}`,
+            kind: "release",
+            method,
+            location: range(node),
+            ownerCallableId: context.callableStack.at(-1) ?? null,
+            resultBindingId: binding?.bindingId ?? null,
+            linkedResourceIds: linked.map(resourceCandidateId).sort(),
+            resolution: linked.length === 1 ? "complete" : "partial",
+        });
+    });
+    return output;
+};
+const immutableAcquisition = (candidate) => ({
+    resourceId: resourceCandidateId(candidate),
+    kind: "acquire",
+    method: candidate.method,
+    location: range(candidate.node),
+    ownerCallableId: candidate.ownerCallableId,
+    resultBindingId: candidate.resultBindingId,
+    linkedResourceIds: [],
+    resolution: "complete",
+});
+const acquisitionMethod = (callee, state) => {
+    if (t.isIdentifier(callee)) {
+        const binding = resolveSemanticBindingState(state, callee, callee.name);
+        return methodFromBinding(binding);
+    }
+    if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
+        return null;
+    const method = ACQUIRE_METHODS.find((candidate) => candidate ===
+        semanticStaticPropertyName(callee.property, callee.computed));
+    if (method === undefined || !t.isIdentifier(callee.object))
+        return null;
+    const binding = resolveSemanticBindingState(state, callee.object, callee.object.name);
+    return resourceNamespace(binding) ? method : null;
+};
+const methodFromBinding = (binding) => {
+    for (const { specifier, importedPath } of binding?.directOrigins ?? []) {
+        if (!resourceModule(specifier))
+            continue;
+        const method = ACQUIRE_METHODS.find((candidate) => candidate === importedPath.at(-1));
+        if (method !== undefined)
+            return method;
+    }
+    return null;
+};
+const resourceNamespace = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => resourceModule(specifier) && importedPath.length === 0) ?? false;
+const resourceModule = (specifier) => [
+    "fs",
+    "fs/promises",
+    "net",
+    "node:fs",
+    "node:fs/promises",
+    "node:net",
+    "node:tls",
+    "tls",
+].includes(specifier);
+const resourceLimitReached = (retained, state) => dataEffectLimitReached(retained, state.limits.maxResourceOperations, "maxResourceOperations", state);
+const resourceCandidateId = (candidate) => `resource:acquire:${String(candidate.node.start ?? -1)}:${String(candidate.node.end ?? -1)}`;
+const memberCallee = (node) => t.isMemberExpression(node.callee) || t.isOptionalMemberExpression(node.callee)
+    ? node.callee
+    : null;

package/dist/domain/javascriptSourceParser.js

@@ -0,0 +1,15 @@
+import { parse } from "@babel/parser";
+/** Parse JavaScript or TypeScript once without retaining unused comment nodes. */
+export const parseJavaScriptSource = (source) => {
+    try {
+        return parse(source, {
+            sourceType: "unambiguous",
+            errorRecovery: true,
+            attachComment: false,
+            plugins: ["jsx", "typescript"],
+        });
+    }
+    catch {
+        return null;
+    }
+};

package/dist/domain/javascriptStaticAnalysis.js

@@ -1,24 +1,20 @@
-import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
 import { detectVendors, failedJavaScriptStaticAnalysis, registrationKey, sortedUnique, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty, inspectRoleProperty, } from "./javascriptStaticAnalysisCalls.js";
-import { inspectBundlerRegistration } from "./javascriptStaticAnalysisBundler.js";
+import { inspectBundlerRegistration, inspectEsbuildWrapper, } from "./javascriptStaticAnalysisBundler.js";
 import { finalizeLocatedFindings } from "./javascriptStaticAnalysisFindings.js";
 import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
+import { parseJavaScriptSource, } from "./javascriptSourceParser.js";
 /** Parse one bounded JavaScript artifact and recover static structure only. */
 export const analyzeJavaScriptStaticSource = (source, limits) => {
-    let file;
-    try {
-        file = parse(source, {
-            sourceType: "unambiguous",
-            errorRecovery: true,
-            plugins: ["jsx", "typescript"],
-        });
-    }
-    catch {
-        return failedJavaScriptStaticAnalysis();
-    }
+    const file = parseJavaScriptSource(source);
+    return file === null
+        ? failedJavaScriptStaticAnalysis()
+        : analyzeParsedJavaScriptStaticSource(source, file, limits);
+};
+/** Recover static structure from an already parsed JavaScript artifact. */
+export const analyzeParsedJavaScriptStaticSource = (source, file, limits) => {
     const accumulator = createJavaScriptAnalysisAccumulator();
     traverseStaticSource(source, file, accumulator, limits);
     addSourceMapDirectives(source, accumulator, limits.maxFindings);
@@ -100,10 +96,11 @@ const inspectNode = (source, node, accumulator, limits) => {
     inspectElectronStaticNode(node, findings);
     if (t.isCallExpression(node)) {
         inspectBundlerRegistration(source, node, accumulator, limits);
-        inspectCall(node, findings);
+        inspectEsbuildWrapper(source, node, accumulator, limits);
+        inspectCall(source, node, findings);
     }
     else if (t.isNewExpression(node))
-        inspectCall(node, findings);
+        inspectCall(source, node, findings);
     if ((t.isImportDeclaration(node) || t.isExportAllDeclaration(node)) &&
         node.source !== undefined)
         addReference(findings, {

package/dist/domain/javascriptStaticAnalysisBundler.js

@@ -61,6 +61,44 @@ export const inspectBundlerRegistration = (source, call, accumulator, limits) =>
     };
     addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
 };
+/** Inspect esbuild helper wrappers and recover their literal module tables. */
+export const inspectEsbuildWrapper = (source, call, accumulator, limits) => {
+    const name = calleeName(call.callee);
+    const wrapperKind = name === "__commonJS" || name.endsWith(".__commonJS")
+        ? "commonjs"
+        : name === "__esm" || name.endsWith(".__esm")
+            ? "esm"
+            : null;
+    const table = call.arguments[0];
+    if (wrapperKind === null || !t.isObjectExpression(table))
+        return;
+    const recovered = recoverBundlerModules(source, table, accumulator, limits);
+    if (recovered.modules.length === 0)
+        return;
+    if (recovered.omittedAsyncChunkKeys > 0) {
+        accumulator.droppedFindings += recovered.omittedAsyncChunkKeys;
+        accumulator.structuralTruncation = true;
+    }
+    accumulator.unknownFindings += recovered.unknownAsyncChunkKeys;
+    const registration = {
+        bundler: "esbuild",
+        runtime: `esbuild-${wrapperKind}`,
+        chunk_keys: [`${wrapperKind}@${String(call.start ?? 0)}`],
+        omitted_chunk_keys: 0,
+        unknown_chunk_keys: 0,
+        runtime_require_name: null,
+        runtime_module_cache_status: "not-observed",
+        entry_module_keys: [],
+        omitted_entry_module_keys: 0,
+        unknown_entry_module_keys: 0,
+        async_chunk_keys: recovered.asyncChunkKeys,
+        omitted_async_chunk_keys: recovered.omittedAsyncChunkKeys,
+        unknown_async_chunk_keys: recovered.unknownAsyncChunkKeys,
+        modules: recovered.modules.sort((left, right) => compareCodePoints(left.module_key, right.module_key)),
+        location: range(call),
+    };
+    addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
+};
 const recoverBundlerModules = (source, table, accumulator, limits) => {
     const modules = [];
     const asyncChunkKeys = [];

package/dist/domain/javascriptStaticAnalysisCalls.js

@@ -2,7 +2,7 @@ import * as t from "@babel/types";
 import { addBoundedFinding, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
 import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, propertyName, range, rangeForOffsets, sanitizeCandidate, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
-export const inspectCall = (node, context) => {
+export const inspectCall = (source, node, context) => {
     const { accumulator } = context;
     const name = calleeName(node.callee);
     const first = stringValue(node.arguments[0]);
@@ -22,6 +22,8 @@ export const inspectCall = (node, context) => {
             kind: "dynamic-import",
             specifier: chunkLoad.specifier,
         });
+    for (const specifier of vitePreloadDependencySpecifiers(source, node, name))
+        addReference(context, { node, kind: "dynamic-import", specifier });
     if (name === "Worker" || name.endsWith(".Worker"))
         addReference(context, { node, kind: "worker", specifier: first });
     if (name.endsWith("serviceWorker.register"))
@@ -73,6 +75,26 @@ const chunkLoadSpecifier = (node, name, moduleRequireName) => {
         return null;
     return { specifier: prefixedArgument("chunk:", node.arguments[0]) };
 };
+const vitePreloadDependencySpecifiers = (source, node, name) => {
+    if (name !== "__vite__mapDeps" || !t.isArrayExpression(node.arguments[0]))
+        return [];
+    const indexes = node.arguments[0].elements.flatMap((element) => t.isNumericLiteral(element) ? [element.value] : []);
+    if (indexes.length !== node.arguments[0].elements.length)
+        return [];
+    const table = vitePreloadDependencyTable(source);
+    return indexes.flatMap((index) => table[index] ?? []);
+};
+const vitePreloadDependencyTable = (source) => {
+    const match = /\.\s*f\s*\|\|\s*\(\s*[^)]*?\.f\s*=\s*\[([\s\S]*?)\]\s*\)/u.exec(source);
+    const body = match?.[1];
+    if (body === undefined)
+        return [];
+    return [
+        ...body.matchAll(/"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gu),
+    ]
+        .map((literal) => (literal[1] ?? literal[2] ?? "").slice(0, 4_096))
+        .slice(0, 256);
+};
 const inspectEndpointCall = (node, name, first, context) => {
     const route = STATIC_ROUTE_CALL_NAMES.some((candidate) => name === candidate || name.endsWith(`.${candidate}`));
     if (route && first !== undefined)

package/dist/domain/javascriptStaticAnalysisHelpers.js

@@ -294,6 +294,12 @@ export const rangeForOffsets = (source, start, end) => ({
     start: pointForOffset(source, start),
     end: pointForOffset(source, end),
 });
+/** Compare two exact source ranges. */
+export const sourceRangesEqual = (left, right) => left !== null &&
+    left.start.line === right.start.line &&
+    left.start.column === right.start.column &&
+    left.end.line === right.end.line &&
+    left.end.column === right.end.column;
 const pointForOffset = (source, offset) => {
     const before = source.slice(0, offset);
     const lines = before.split("\n");
@@ -335,6 +341,8 @@ const vendorPatterns = [
     { name: "webpack", patterns: ["__webpack_require__", "webpackChunk"] },
     { name: "Rspack", patterns: ["__webpack_require__.f", "rspackChunk"] },
     { name: "Vite", patterns: ["__vite__", "import.meta.hot"] },
+    { name: "Rollup", patterns: ["ROLLUP_FILE_URL", "import.meta.ROLLUP"] },
+    { name: "esbuild", patterns: ["__commonJS", "__esm"] },
     { name: "React", patterns: ["React.createElement", "react/jsx-runtime"] },
     { name: "Vue", patterns: ["__VUE__", "createApp("] },
     { name: "Next.js", patterns: ["__NEXT_DATA__", "/_next/"] },

package/dist/domain/mobileApplicationInvestigation.js

@@ -0,0 +1,159 @@
+import { z } from "zod";
+/** Supported mobile artifact formats. */
+export const mobileArtifactFormatSchema = z.enum([
+    "apk",
+    "aab",
+    "ipa",
+    "dex",
+    "native_lib",
+]);
+/** Mobile platform. */
+export const mobilePlatformSchema = z.enum([
+    "android",
+    "ios",
+    "cross_platform",
+]);
+/** Android manifest entry. */
+export const androidManifestSchema = z.strictObject({
+    package_name: z.string().min(1),
+    version_name: z.string().nullable(),
+    version_code: z.number().int().nullable(),
+    min_sdk: z.number().int().nullable(),
+    target_sdk: z.number().int().nullable(),
+    permissions: z.array(z.string()).default([]),
+    activities: z.array(z.string()).default([]),
+    services: z.array(z.string()).default([]),
+    receivers: z.array(z.string()).default([]),
+    providers: z.array(z.string()).default([]),
+});
+/** iOS app manifest (Info.plist). */
+export const iosManifestSchema = z.strictObject({
+    bundle_identifier: z.string().min(1),
+    bundle_version: z.string().nullable(),
+    short_version: z.string().nullable(),
+    minimum_os_version: z.string().nullable(),
+    supported_platforms: z.array(z.string()).default([]),
+    ui_required_device_capabilities: z.array(z.string()).default([]),
+    app_permissions: z.array(z.string()).default([]),
+});
+/** Signing information. */
+export const signingInfoSchema = z.strictObject({
+    is_signed: z.boolean().default(false),
+    signer_identity: z.string().nullable(),
+    certificate_fingerprint: z.string().nullable(),
+    signature_scheme: z.string().nullable(),
+    is_debuggable: z.boolean().default(false),
+});
+/** Native library entry. */
+export const nativeLibrarySchema = z.strictObject({
+    path: z.string().min(1),
+    architecture: z.string().nullable(),
+    size: z.number().int().nonnegative(),
+    digest: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/u)
+        .nullable(),
+});
+/** Resource entry within a mobile artifact. */
+export const mobileResourceSchema = z.strictObject({
+    path: z.string().min(1),
+    type: z.enum([
+        "layout",
+        "drawable",
+        "string",
+        "asset",
+        "raw",
+        "native_lib",
+        "manifest",
+        "entitlements",
+        "provisioning",
+        "other",
+    ]),
+    size: z.number().int().nonnegative(),
+});
+/** Static analysis result for a mobile artifact. */
+export const mobileArtifactManifestSchema = z.strictObject({
+    format: mobileArtifactFormatSchema,
+    platform: mobilePlatformSchema,
+    app_name: z.string().nullable(),
+    android_manifest: androidManifestSchema.nullable(),
+    ios_manifest: iosManifestSchema.nullable(),
+    signing: signingInfoSchema,
+    resources: z.array(mobileResourceSchema).default([]),
+    native_libraries: z.array(nativeLibrarySchema).default([]),
+    total_size: z.number().int().nonnegative(),
+    architectures: z.array(z.string()).default([]),
+});
+/** Detect mobile artifact format from file extension. */
+export function detectMobileFormat(path) {
+    const lower = path.toLowerCase();
+    if (lower.endsWith(".apk"))
+        return "apk";
+    if (lower.endsWith(".aab"))
+        return "aab";
+    if (lower.endsWith(".ipa"))
+        return "ipa";
+    if (lower.endsWith(".dex"))
+        return "dex";
+    if (lower.endsWith(".so") || lower.endsWith(".dylib") || lower.endsWith(".a"))
+        return "native_lib";
+    return null;
+}
+/** Detect platform from format. */
+export function detectPlatform(format) {
+    switch (format) {
+        case "apk":
+        case "aab":
+        case "dex":
+            return "android";
+        case "ipa":
+            return "ios";
+        case "native_lib":
+            return "cross_platform";
+    }
+}
+/** Classify a resource by its path. */
+export function classifyMobileResource(path) {
+    const lower = path.toLowerCase();
+    if (lower.includes("androidmanifest.xml"))
+        return "manifest";
+    if (lower.includes(".entitlements"))
+        return "entitlements";
+    if (lower.includes("provisioning") || lower.includes(".mobileprovision"))
+        return "provisioning";
+    if (lower.includes("/layout/"))
+        return "layout";
+    if (lower.includes("/drawable/") || lower.includes("/mipmap/"))
+        return "drawable";
+    if (lower.includes("/values/"))
+        return "string";
+    if (lower.includes("assets/") || lower.includes("raw/"))
+        return "asset";
+    if (lower.endsWith(".so") || lower.endsWith(".dylib"))
+        return "native_lib";
+    if (lower.endsWith(".xml"))
+        return "layout";
+    return "other";
+}
+/** Get all native libraries for a specific architecture. */
+export function nativeLibsByArchitecture(manifest, arch) {
+    return manifest.native_libraries.filter((l) => l.architecture === arch);
+}
+/** Check if an Android artifact has internet permission. */
+export function hasInternetPermission(manifest) {
+    if (!manifest.android_manifest)
+        return false;
+    return manifest.android_manifest.permissions.some((p) => p.includes("INTERNET") || p.includes("android.permission.INTERNET"));
+}
+/** Get all unique architectures across native libraries. */
+export function getAllArchitectures(manifest) {
+    const archs = new Set();
+    for (const lib of manifest.native_libraries) {
+        if (lib.architecture)
+            archs.add(lib.architecture);
+    }
+    for (const arch of manifest.architectures) {
+        archs.add(arch);
+    }
+    return [...archs];
+}

package/dist/domain/nativeApiBoundary.js

@@ -0,0 +1,130 @@
+import { z } from "zod";
+const inferenceConfidenceSchema = z.enum(["low", "medium", "high"]);
+const inferenceEvidenceSchema = z
+    .object({
+    kind: z.enum([
+        "signature-source",
+        "decompiler-type",
+        "type-lock",
+        "calling-convention",
+        "jump-table",
+    ]),
+    source: z.string().min(1),
+    detail: z.string().min(1),
+})
+    .strict();
+const inferredBoundaryTypeSchema = z
+    .object({
+    role: z.enum(["return", "parameter"]),
+    ordinal: z.number().int().min(0).nullable(),
+    name: z.string().min(1).nullable(),
+    data_type: z.string().min(1),
+    size_bytes: z.number().int().min(0).nullable(),
+    storage: z.string().min(1).nullable(),
+    confidence: inferenceConfidenceSchema,
+    evidence: z.array(inferenceEvidenceSchema).min(1),
+    decompiler_artifacts: z.array(z.enum([
+        "recovered-signature",
+        "register-or-stack-storage",
+        "compiler-generated-variable",
+    ])),
+})
+    .strict();
+const jumpTableDataSourceSchema = z
+    .object({
+    address: z.string().min(1),
+    provenance: z.enum([
+        "ghidra-decompiler-load-table",
+        "ghidra-dispatch-block-data-reference",
+    ]),
+    entry_size_bytes: z.number().int().min(1).nullable(),
+    entry_count: z.number().int().min(0).nullable(),
+    confidence: inferenceConfidenceSchema,
+    evidence: z.array(inferenceEvidenceSchema).min(1),
+})
+    .strict();
+const jumpTableMappingSchema = z
+    .object({
+    case_value: z.number().int().nullable(),
+    target_address: z.string().min(1),
+    data_addresses: z.array(z.string().min(1)),
+    confidence: inferenceConfidenceSchema,
+    evidence: z.array(inferenceEvidenceSchema).min(1),
+})
+    .strict();
+const inferredJumpTableSchema = z
+    .object({
+    dispatch_address: z.string().min(1),
+    data_sources: z.array(jumpTableDataSourceSchema),
+    data_sources_truncated: z.boolean(),
+    mappings: z.array(jumpTableMappingSchema),
+    mappings_truncated: z.boolean(),
+    limitations: z.array(z.string()),
+})
+    .strict();
+const availableNativeApiBoundarySchema = z
+    .object({
+    available: z.literal(true),
+    provenance: z.string().min(1),
+    signature_source: z.string().min(1),
+    calling_convention: z.string().min(1),
+    return_type: inferredBoundaryTypeSchema,
+    parameters: z.array(inferredBoundaryTypeSchema),
+    parameters_truncated: z.boolean(),
+    jump_tables: z.array(inferredJumpTableSchema),
+    jump_tables_truncated: z.boolean(),
+    pseudocode: z
+        .object({
+        classification: z.literal("decompiler-generated-non-source"),
+        compilable: z.literal(false),
+    })
+        .strict(),
+    decompiler_artifacts: z.array(z.enum([
+        "recovered-signature",
+        "register-and-stack-variables",
+        "compiler-generated-control-flow",
+        "pointer-arithmetic",
+        "pseudocode",
+    ])),
+    limitations: z.array(z.string()),
+})
+    .strict();
+const unavailableNativeApiBoundarySchema = z
+    .object({
+    available: z.literal(false),
+    reason: z.string().min(1),
+    residual_unknowns: z.array(z.string().min(1)).min(1),
+})
+    .strict();
+/** Provider-neutral native API boundary observations attached to a function dossier. */
+export const nativeApiBoundarySchema = z.discriminatedUnion("available", [
+    unavailableNativeApiBoundarySchema,
+    availableNativeApiBoundarySchema,
+]);
+const nativeApiInspectionSubstepSchema = z
+    .object({
+    operation: z.enum([
+        "analyze_function",
+        "project_native_api_boundary",
+        "preserve_residual_unknowns",
+    ]),
+    status: z.enum(["completed", "unsupported"]),
+    observations: z.array(z.string().min(1)),
+})
+    .strict();
+/** Agent-facing projection of structured native API reconstruction substeps. */
+export const nativeApiInspectionResultSchema = z
+    .object({
+    schema_version: z.literal(1),
+    procedure: z
+        .object({
+        address: z.string().min(1),
+        name: z.string().min(1),
+    })
+        .strict(),
+    boundary: nativeApiBoundarySchema,
+    substeps: z.array(nativeApiInspectionSubstepSchema).min(3).max(3),
+    unsupported_branches: z.array(z.string().min(1)),
+    residual_unknowns: z.array(z.string().min(1)),
+})
+    .strict();