rea-agents 2.4.0 → 3.0.0

package/dist/application/EnhancedTools.js

@@ -1,10 +1,14 @@
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
 import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
-import { addressDistance, parseAddressedPage, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
+import { addressDistance, functionDossierSchema, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, discoverSwiftClasses, } from "../domain/symbolAnalysis.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
 import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
 import { readAllAddressed } from "./EnhancedToolPagination.js";
+import { traceCallPath } from "./CallPathTracing.js";
+import { traceLiteralFeature } from "./EnhancedLiteralTracing.js";
+import { projectNativeApiInspection } from "./NativeApiInspection.js";
 /**
  * Composes direct provider operations into bounded reverse-engineering tools.
  * Direct callers use `execute`; adapters that own validation use
@@ -17,6 +21,12 @@ export class EnhancedTools {
     }
     /** Parse an untrusted direct-call input once, then dispatch exhaustively. */
     execute(name, input, signal) {
+        if (name === "trace_feature" ||
+            name === "find_code_for_string" ||
+            name === "trace_call_path")
+            return this.#executeTracing(name, input, signal);
+        if (name === "analyze_function" || name === "inspect_native_api")
+            return this.#executeFunctionAnalysis(name, input, signal);
         switch (name) {
             case "swift_classes": {
                 const parsed = enhancedInputSchemas.swift_classes.safeParse(input);
@@ -58,18 +68,6 @@ export class EnhancedTools {
                     ? this.executeValidated({ name, input: parsed.data }, signal)
                     : invalidEnhancedInput(name, parsed.error);
             }
-            case "analyze_function": {
-                const parsed = enhancedInputSchemas.analyze_function.safeParse(input);
-                return parsed.success
-                    ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidEnhancedInput(name, parsed.error);
-            }
-            case "trace_feature": {
-                const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
-                return parsed.success
-                    ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidEnhancedInput(name, parsed.error);
-            }
         }
     }
     /** Dispatch input already parsed by a trusted adapter boundary. */
@@ -93,14 +91,64 @@ export class EnhancedTools {
                 return this.#binaryOverview(call.input, signal);
             case "analyze_function":
                 return this.#analyzeFunction(call.input, signal);
+            case "inspect_native_api":
+                return this.#inspectNativeApi(call.input, signal);
             case "trace_feature":
-                return this.#traceFeature(call.input, signal);
+                return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "feature", signal);
+            case "find_code_for_string":
+                return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "string", signal);
+            case "trace_call_path":
+                return traceCallPath((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, signal);
         }
     }
+    #executeTracing(name, input, signal) {
+        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (!parsed.success)
+            return invalidEnhancedInput(name, parsed.error);
+        if (name === "trace_call_path")
+            return this.executeValidated({
+                name,
+                input: enhancedInputSchemas.trace_call_path.parse(parsed.data),
+            }, signal);
+        return this.executeValidated({
+            name,
+            input: enhancedInputSchemas[name].parse(parsed.data),
+        }, signal);
+    }
+    #executeFunctionAnalysis(name, input, signal) {
+        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (!parsed.success)
+            return invalidEnhancedInput(name, parsed.error);
+        if (name === "analyze_function")
+            return this.executeValidated({
+                name,
+                input: enhancedInputSchemas.analyze_function.parse(parsed.data),
+            }, signal);
+        return this.executeValidated({
+            name,
+            input: enhancedInputSchemas.inspect_native_api.parse(parsed.data),
+        }, signal);
+    }
     async #analyzeFunction(input, signal) {
         const result = await this.#call("analyze_function", input, signal);
         return result.ok ? parseFunctionDossier(result.value) : result;
     }
+    async #inspectNativeApi(input, signal) {
+        const analysisInput = enhancedInputSchemas.analyze_function.parse({
+            procedure: input.procedure,
+            include_assembly: true,
+            max_pseudocode_chars: input.max_pseudocode_chars,
+            max_instructions: input.max_instructions,
+        });
+        const result = await this.#call("analyze_function", analysisInput, signal);
+        if (!result.ok)
+            return result;
+        const parsed = parseFunctionDossier(result.value);
+        if (!parsed.ok)
+            return parsed;
+        const dossier = functionDossierSchema.parse(parsed.value);
+        return ok(jsonValueSchema.parse(projectNativeApiInspection(dossier)));
+    }
     async #swiftClasses(pattern, signal) {
         const procedures = await this.#allAddressed("list_procedures", signal);
         return procedures.ok
@@ -217,18 +265,18 @@ export class EnhancedTools {
         });
     }
     async #binaryOverview(input, signal) {
-        const [segmentsResult, documentsResult, procedures, stringsResult] = await Promise.all([
+        const [segmentsResult, documentsResult, proceduresResult, stringsResult] = await Promise.all([
             this.#call("list_segments", {}, signal),
             this.#call("list_documents", {}, signal),
-            this.#allAddressed("list_procedures", signal),
-            this.#call("list_strings", {}, signal),
+            this.#call("list_procedures", { offset: 0, limit: 1 }, signal),
+            this.#call("list_strings", { offset: 0, limit: 1 }, signal),
         ]);
         if (!segmentsResult.ok)
             return segmentsResult;
         if (!documentsResult.ok)
             return documentsResult;
-        if (!procedures.ok)
-            return procedures;
+        if (!proceduresResult.ok)
+            return proceduresResult;
         if (!stringsResult.ok)
             return stringsResult;
         const segments = parseSegments(segmentsResult.value);
@@ -237,6 +285,9 @@ export class EnhancedTools {
         const documents = parseDocuments(documentsResult.value);
         if (!documents.ok)
             return documents;
+        const procedureCount = parseListCount(proceduresResult.value, "procedures");
+        if (!procedureCount.ok)
+            return procedureCount;
         const stringCount = parseListCount(stringsResult.value, "strings");
         if (!stringCount.ok)
             return stringCount;
@@ -249,117 +300,10 @@ export class EnhancedTools {
                 ? { name, start, end, length: addressDistance(start, end) }
                 : { name, start, end }),
             segment_count: segments.value.length,
-            procedure_count: procedures.value.length,
+            procedure_count: procedureCount.value,
             string_count: stringCount.value,
         });
     }
-    async #traceFeature(input, signal) {
-        const searched = await this.#literalMatches(input, signal);
-        if (!searched.ok)
-            return searched;
-        const residual = new Set();
-        const traced = await this.#traceReferences(searched.value.matches, input.limit, input.max_operations - searched.value.operations, signal);
-        if (!traced.ok)
-            return traced;
-        for (const reason of traced.value.residual)
-            residual.add(reason);
-        const operations = searched.value.operations + traced.value.operations;
-        if (operations >= input.max_operations)
-            residual.add("Investigation reached the operation budget.");
-        if (searched.value.matches.length >= input.limit)
-            residual.add("Literal matches reached the configured limit.");
-        return ok({
-            query: input.query,
-            search_mode: "literal",
-            operations_used: operations,
-            operation_budget: input.max_operations,
-            matches: searched.value.matches,
-            references: traced.value.references,
-            truncated: residual.size > 0,
-            residual_unknowns: [...residual],
-        });
-    }
-    async #literalMatches(input, signal) {
-        let operations = 0;
-        const matches = [];
-        const needle = input.case_sensitive
-            ? input.query
-            : input.query.toLowerCase();
-        for (const [tool, type] of [
-            ["list_strings", "string"],
-            ["list_procedures", "procedure"],
-        ]) {
-            let offset = 0;
-            while (operations < input.max_operations &&
-                matches.length < input.limit) {
-                operations += 1;
-                const result = await this.#call(tool, { offset, limit: 500 }, signal);
-                if (!result.ok)
-                    return result;
-                const page = parseAddressedPage(result.value);
-                if (!page.ok)
-                    return page;
-                for (const item of page.value.items) {
-                    const haystack = input.case_sensitive
-                        ? item.name
-                        : item.name.toLowerCase();
-                    if (haystack.includes(needle))
-                        matches.push({ type, address: item.address, value: item.name });
-                    if (matches.length >= input.limit)
-                        break;
-                }
-                if (!page.value.hasMore || page.value.nextOffset === null)
-                    break;
-                offset = page.value.nextOffset;
-            }
-        }
-        return ok({ matches, operations });
-    }
-    async #traceReferences(matches, limit, operationBudget, signal) {
-        let operations = 0;
-        const references = [];
-        const residual = new Set();
-        for (const match of matches) {
-            if (operations >= operationBudget) {
-                residual.add("Reference traversal stopped at the operation budget.");
-                break;
-            }
-            operations += 1;
-            const xrefs = await this.#call("xrefs", { address: match.address }, signal);
-            if (!xrefs.ok)
-                return xrefs;
-            if (!Array.isArray(xrefs.value))
-                return err(new AnalysisOutputError("xrefs", "provider returned a non-array result"));
-            for (const source of xrefs.value) {
-                if (typeof source !== "string")
-                    return err(new AnalysisOutputError("xrefs", "provider returned a non-address value"));
-                if (operations >= operationBudget) {
-                    residual.add("Containing-procedure resolution stopped at the operation budget.");
-                    break;
-                }
-                operations += 1;
-                const resolved = await this.#call("resolve_containing_procedure", { address: source }, signal);
-                if (!resolved.ok)
-                    return resolved;
-                references.push({
-                    target_address: match.address,
-                    source_address: source,
-                    containing_procedure: resolved.value,
-                });
-                if (references.length >= limit) {
-                    residual.add("Reference results reached the configured limit.");
-                    break;
-                }
-            }
-            if (references.length >= limit)
-                break;
-        }
-        return ok({
-            references,
-            operations,
-            residual: [...residual],
-        });
-    }
     async #allAddressed(tool, signal) {
         return readAllAddressed({
             call: (name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal),

package/dist/application/EvidenceLedger.js

@@ -1,5 +1,5 @@
 import canonicalize from "canonicalize";
-import { createEvidenceBundle, parseEvidenceBundle, } from "../domain/evidenceBundle.js";
+import { createEvidenceBundle, parseEvidenceBundle, validateResidualUnknownAddition, } from "../domain/evidenceBundle.js";
 import { EvidenceIntegrityError, EvidenceLimitError, UnknownRegistryError, } from "../domain/errors.js";
 import { parseEvidence } from "../domain/evidence.js";
 import { createResidualUnknown, updateResidualUnknown, } from "../domain/residualUnknown.js";
@@ -142,26 +142,19 @@ export class EvidenceLedger {
         catch (cause) {
             return err(new UnknownRegistryError("invalid-transition", { cause }));
         }
-        const pendingRecords = new Map(this.#records);
-        pendingRecords.set(evidence.evidence_id, evidence);
         const existingUnknown = this.#unknownHeads.get(unknown.unknown_id);
         if (existingUnknown !== undefined) {
             if (existingUnknown.revision !== 1 ||
                 existingUnknown.revision_digest !== unknown.revision_digest)
                 return err(new UnknownRegistryError("already-exists"));
-            const checked = this.#validateCandidate(pendingRecords, this.#unknownRevisions);
+            const checked = this.#appendIncremental([evidence]);
             if (!checked.ok)
                 return checked;
-            this.#commit(pendingRecords, this.#unknownRevisions, checked.value);
             return ok(null);
         }
-        pendingRecords.set(mutation.evidence_id, mutation);
-        const pendingUnknowns = new Map(this.#unknownRevisions);
-        pendingUnknowns.set(unknownRevisionKey(unknown), unknown);
-        const checked = this.#validateCandidate(pendingRecords, pendingUnknowns);
+        const checked = this.#appendIncremental([evidence, mutation], unknown);
         if (!checked.ok)
             return checked;
-        this.#commit(pendingRecords, pendingUnknowns, checked.value);
         return ok(structuredClone(unknown));
     }
     /** Apply one approved full-state update using optimistic revision matching. */
@@ -218,16 +211,52 @@ export class EvidenceLedger {
                 cause,
             }));
         }
-        const pendingRecords = new Map(this.#records);
-        pendingRecords.set(mutationEvidence.evidence_id, mutationEvidence);
-        const pendingUnknowns = new Map(this.#unknownRevisions);
-        pendingUnknowns.set(unknownRevisionKey(unknown), unknown);
-        const checked = this.#validateCandidate(pendingRecords, pendingUnknowns);
+        const checked = this.#appendIncremental([mutationEvidence], unknown);
         if (!checked.ok)
             return checked;
-        this.#commit(pendingRecords, pendingUnknowns, checked.value);
         return ok(structuredClone(unknown));
     }
+    #appendIncremental(records, unknown) {
+        const additions = new Map();
+        let addedBytes = 0;
+        for (const evidence of records) {
+            const existing = additions.get(evidence.evidence_id) ??
+                this.#records.get(evidence.evidence_id);
+            if (existing !== undefined) {
+                if (!recordsAgree(existing, evidence))
+                    return err(new EvidenceIntegrityError("Conflicting evidence record"));
+                continue;
+            }
+            additions.set(evidence.evidence_id, evidence);
+            addedBytes += serializedBytes(evidence);
+        }
+        const unknownKey = unknown === undefined ? undefined : unknownRevisionKey(unknown);
+        if (unknownKey !== undefined && this.#unknownRevisions.has(unknownKey))
+            return err(new UnknownRegistryError("integrity"));
+        const unknownBytes = unknown === undefined ? 0 : serializedBytes(unknown);
+        if (this.#exceedsRecordLimit(this.#records.size + additions.size, this.#unknownRevisions.size + (unknown === undefined ? 0 : 1)))
+            return err(new EvidenceLimitError("records", this.limits.maxRecords));
+        if (this.#bytes + addedBytes + unknownBytes > this.limits.maxBytes)
+            return err(new EvidenceLimitError("bytes", this.limits.maxBytes));
+        if (unknown !== undefined)
+            try {
+                validateResidualUnknownAddition(unknown, {
+                    get: (id) => additions.get(id) ?? this.#records.get(id),
+                    has: (id) => additions.has(id) || this.#records.has(id),
+                }, this.#unknownHeads);
+            }
+            catch (cause) {
+                return err(new UnknownRegistryError("integrity", { cause }));
+            }
+        for (const [id, evidence] of additions)
+            this.#records.set(id, evidence);
+        if (unknown !== undefined && unknownKey !== undefined) {
+            this.#unknownRevisions.set(unknownKey, unknown);
+            this.#unknownHeads.set(unknown.unknown_id, unknown);
+        }
+        this.#bytes += addedBytes + unknownBytes;
+        return ok(undefined);
+    }
     #validateCandidate(records, unknowns) {
         if (this.#exceedsRecordLimit(records.size, unknowns.size))
             return err(new EvidenceLimitError("records", this.limits.maxRecords));

package/dist/application/JavaScriptApplicationWorkflowEvidence.js

@@ -40,6 +40,19 @@ export const createApplicationVersionComparisonEvidence = (parameters, result) =
     limitations: result.limitations,
     evidenceLinks: result.evidence_links,
 });
+/** Create derived Evidence for one historical-source to bundle comparison. */
+export const createSourceToBundleComparisonEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.source-to-bundle-comparison/v1",
+    operation: "compare_source_to_bundle",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});
 /** Create derived Evidence for one bounded static export-shape comparison. */
 export const createJavaScriptExportShapeComparisonEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
     predicateType: "rea.javascript-export-shape-comparison/v1",

package/dist/application/JavaScriptApplicationWorkflowService.js

@@ -8,8 +8,10 @@ import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptEx
 import { traceApplicationFeature } from "../domain/javascriptFeatureTrace.js";
 import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
 import { err, ok } from "../domain/result.js";
+import { compareSourceToBundle } from "../domain/sourceToBundleComparison.js";
+import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
 import { parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
-import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, createJavaScriptExportShapeComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
+import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, createJavaScriptExportShapeComparisonEvidence, createSourceToBundleComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
 /** Authenticate Evidence and derive one bounded cross-layer feature trace. */
 export const traceApplicationFeatureEvidence = (rawInput) => {
     const operation = "trace_application_feature";
@@ -87,6 +89,30 @@ export const compareApplicationVersionsEvidenceValidated = (input) => {
         return workflowFailure(operation, cause);
     }
 };
+/** Compare source and bundle inputs already parsed by a trusted adapter. */
+export const compareSourceToBundleEvidenceValidated = (input) => {
+    const operation = "compare_source_to_bundle";
+    try {
+        const application = parseApplicationGraphEvidence(input.application);
+        const result = compareSourceToBundle({
+            reference: input.reference,
+            application: {
+                evidenceId: application.evidence.evidence_id,
+                rootArtifactSha256: application.rootArtifactSha256,
+                graph: application.graph,
+            },
+            limits: input.limits,
+        });
+        return ok(createSourceToBundleComparisonEvidence({
+            reference_root_sha256: input.reference.root_sha256,
+            application_evidence_id: application.evidence.evidence_id,
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
 /**
  * Authenticate both graphs and compare one exact export return shape.
  * @public

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -1,7 +1,9 @@
 import { createHash } from "node:crypto";
-import { analyzeJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
-import { analyzeJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
+import { analyzeParsedJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
+import { analyzeParsedJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
 import { DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS, } from "../domain/javascriptSemanticIr.js";
+import { parseJavaScriptSource } from "../domain/javascriptSourceParser.js";
+import { failedJavaScriptStaticAnalysis } from "../domain/javascriptStaticAnalysisHelpers.js";
 import { analyzeJavaScriptJsonModule } from "./JavaScriptJsonModules.js";
 /** Analyze selected text files under one shared AST, finding, module, and time budget. */
 export const analyzeJavaScriptArtifactFiles = (fileSet, input, now) => {
@@ -70,7 +72,14 @@ const analyzeArtifactFile = (file, context) => {
         state.truncatedScopes += 1;
         return;
     }
-    const analysis = analyzeJavaScriptStaticSource(file.text.value, {
+    const parsed = parseJavaScriptSource(file.text.value);
+    if (parsed === null) {
+        const analysis = failedJavaScriptStaticAnalysis();
+        state.files.push({ file, javascript: analysis, semantic: null });
+        state.parseFailures += 1;
+        return;
+    }
+    const analysis = analyzeParsedJavaScriptStaticSource(file.text.value, parsed, {
         maxAstNodes: remainingNodes,
         maxFindings: remainingFindings,
         maxModules: remainingModules,
@@ -88,7 +97,7 @@ const analyzeArtifactFile = (file, context) => {
         maxModuleLinks: semanticFindingBudget,
     };
     const semantics = analysis.parse_status === "complete" || analysis.parse_status === "partial"
-        ? analyzeJavaScriptSemantics(file.text.value, semanticLimits)
+        ? analyzeParsedJavaScriptSemantics(parsed, semanticLimits)
         : null;
     state.files.push({
         file,

package/dist/application/JavaScriptRuntimeObservationEvidence.js

@@ -0,0 +1,34 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+/** Create deterministic Evidence v2 for one passive Inspector operation. */
+export const createJavaScriptRuntimeObservationEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: operation === "list_javascript_runtime_targets"
+        ? "rea.javascript-runtime-target-list/v1"
+        : "rea.javascript-runtime-observation/v1",
+    operation,
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "observed",
+    authority: "external-service",
+    environment: {
+        id: `${result.runtime.product}@${result.runtime.protocol_version}`,
+        platform: process.platform,
+        architecture: process.arch,
+        isolation: "none",
+    },
+    limitations: result.limitations,
+});
+const parameters = (input) => ({
+    inspector_endpoint: input.inspector_endpoint,
+    allowed_file_roots: input.allowed_file_roots,
+    allowed_origins: input.allowed_origins,
+    ...("target_id" in input
+        ? {
+            target_id: input.target_id,
+            runtime_kind: input.runtime_kind,
+            observation_ms: input.observation_ms,
+            limits: input.limits,
+        }
+        : { offset: input.offset, limit: input.limit }),
+});

package/dist/application/JavaScriptRuntimeObservationPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/JavaScriptRuntimeObservationService.js

@@ -0,0 +1,46 @@
+import { createJavaScriptRuntimeObservationEvidence } from "./JavaScriptRuntimeObservationEvidence.js";
+import { AnalysisCapabilityUnavailableError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+/** Authorize and list attachable Node/Electron Inspector targets. */
+export const listJavaScriptRuntimeTargets = async (provider, authority, input, options = {}) => {
+    const ready = await prepare(provider, authority, input, "list_javascript_runtime_targets");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.listTargets(input, options);
+    return result.ok
+        ? ok(createJavaScriptRuntimeObservationEvidence("list_javascript_runtime_targets", input, result.value, ready.value.identity()))
+        : result;
+};
+/** Authorize one bounded attach-only Inspector observation. */
+export const observeJavaScriptRuntime = async (provider, authority, input, options = {}) => {
+    const ready = await prepare(provider, authority, input, "observe_javascript_runtime");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.observe(input, options);
+    return result.ok
+        ? ok(createJavaScriptRuntimeObservationEvidence("observe_javascript_runtime", input, result.value, ready.value.identity()))
+        : result;
+};
+const prepare = async (provider, authority, input, operation) => {
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "v8_inspector_observe",
+        roots: input.allowed_file_roots,
+        executables: [],
+        environment_names: [],
+        origins: [input.inspector_endpoint, ...input.allowed_origins],
+        network: "loopback",
+        mount: false,
+        operation_identity: `${operation}:${"target_id" in input ? input.target_id : input.inspector_endpoint}`,
+    }, "read");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+    return provider === undefined
+        ? err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation provider is not configured"))
+        : ok(provider);
+};