rea-agents 3.2.1 → 4.0.1

package/dist/domain/managedReconstruction.js

@@ -3,15 +3,16 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { cliMetadataGuidSchema, managedMemberInspectionSchema, } from "./managedArtifact.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const textSchema = z.string().min(1);
 const decompilerSchema = z.strictObject({
     name: textSchema,
-    version: textSchema.nullable(),
+    version: textSchema.nullable().default(null),
     family: z.enum(["ilspy", "dnspy", "dnlib", "mono-cecil", "other"]),
-    executable_sha256: digestSchema.nullable(),
+    executable_sha256: digestSchema.nullable().default(null),
     options: z.array(z.string()).default([]),
 });
 const managedReconstructionMethodInputSchema = z.strictObject({
@@ -61,7 +62,7 @@ const importedMethodSchema = z.strictObject({
     }),
 });
 export const managedReconstructionImportResultSchema = z.strictObject({
-    reconstruction_id: z.string().regex(/^mre_[a-f0-9]{64}$/u),
+    reconstruction_id: prefixedDigestSchema("mre"),
     phase: z.literal("reconstruction-import"),
     executed: z.literal(false),
     static_observation: z.strictObject({

package/dist/domain/nativeApiBoundary.js

@@ -45,6 +45,7 @@ const jumpTableDataSourceSchema = z
         "ghidra-decompiler-load-table",
         "ghidra-dispatch-block-data-reference",
         "ghidra-aarch64-byte-table",
+        "ghidra-aarch64-halfword-table",
     ]),
     entry_size_bytes: z.number().int().min(1).nullable(),
     entry_count: z.number().int().min(0).nullable(),
@@ -60,11 +61,17 @@ const jumpTableMappingSchema = z
     evidence: z.array(inferenceEvidenceSchema).min(1),
 })
     .strict();
+const jumpTableDefaultTargetSchema = z.strictObject({
+    target_address: z.string().min(1),
+    confidence: inferenceConfidenceSchema,
+    evidence: z.array(inferenceEvidenceSchema).min(1),
+});
 const inferredJumpTableSchema = z
     .object({
     dispatch_address: z.string().min(1),
     data_sources: z.array(jumpTableDataSourceSchema),
     mappings: z.array(jumpTableMappingSchema),
+    default_targets: z.array(jumpTableDefaultTargetSchema).default([]),
     limitations: z.array(z.string()),
 })
     .strict();

package/dist/domain/nativeDataType.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+/** Select a database type by exact category path or a defined typed data address. */
+export const nativeDataTypeInputSchema = z
+    .strictObject({
+    type: z.string().min(1).optional(),
+    address: z.string().min(1).optional(),
+    document: z.string().optional(),
+})
+    .refine((value) => (value.type === undefined) !== (value.address === undefined), "Supply exactly one of type or address");
+/** Types remain analysis database observations; child identities can be inspected separately. */
+export const nativeDataTypeSchema = z.strictObject({
+    status: z.enum(["available", "unavailable"]),
+    reason: z.string().nullable(),
+    id: z.string().nullable(),
+    name: z.string().nullable(),
+    kind: z.enum([
+        "struct",
+        "union",
+        "enum",
+        "pointer",
+        "array",
+        "typedef",
+        "scalar",
+        "unsupported",
+        "unavailable",
+    ]),
+    source: z.literal("analysis-database"),
+    source_archive: z.string().nullable(),
+    address: z.string().nullable(),
+    size_bytes: z.number().int().nonnegative().nullable(),
+    alignment_bytes: z.number().int().positive().nullable(),
+    packing_enabled: z.boolean().nullable(),
+    referenced_type: z.string().nullable(),
+    array_count: z.number().int().nonnegative().nullable(),
+    array_stride_bytes: z.number().int().nonnegative().nullable(),
+    fields: z.array(z.strictObject({
+        ordinal: z.number().int().nonnegative(),
+        name: z.string().nullable(),
+        offset_bytes: z.number().int().nonnegative(),
+        size_bytes: z.number().int().nonnegative().nullable(),
+        type_id: z.string(),
+        bit_size: z.number().int().nonnegative().nullable(),
+        bit_offset: z.number().int().nonnegative().nullable(),
+        status: z.enum(["observed", "unsupported"]),
+        flexible_tail: z.literal("unknown"),
+    })),
+    members: z.array(z.strictObject({ name: z.string(), value: z.string() })),
+    total_fields: z.number().int().nonnegative(),
+    truncated: z.boolean(),
+    limitations: z.array(z.string()),
+});

package/dist/domain/nativeInspection.js

@@ -69,7 +69,6 @@ const dependencySchema = z.object({
 const loadCommandSchema = z.object({
     index: z.number().int().min(0),
     kind: z.string(),
-    file_offset: z.number().int().min(0).nullable(),
     fields: z.record(z.string(), z.union([z.string(), z.number(), z.null()])),
 });
 const buildMetadataSchema = z.object({

package/dist/domain/nativeInstruction.js

@@ -0,0 +1,82 @@
+import { z } from "zod";
+/** Exact instruction location within the active analysis program. */
+export const nativeInstructionInputSchema = z.strictObject({
+    address: z.string().min(1),
+    document: z.string().optional(),
+});
+const reference = z.strictObject({
+    target_address: z.string(),
+    type: z.string(),
+    call: z.boolean(),
+    jump: z.boolean(),
+    indirect: z.boolean(),
+    computed: z.boolean(),
+    operand_index: z.number().int(),
+});
+/** Provider-decoded facts for one instruction; operand tokens preserve their native ordering. */
+export const nativeInstructionSchema = z.strictObject({
+    address: z.string(),
+    status: z.enum([
+        "decoded",
+        "not-instruction-boundary",
+        "data",
+        "undecodable",
+        "outside-memory",
+    ]),
+    procedure: z.string().nullable(),
+    architecture: z.string(),
+    mode: z.string(),
+    bytes: z.string().nullable(),
+    length: z.number().int().positive().nullable(),
+    mnemonic: z.string().nullable(),
+    raw_disassembly: z.string().nullable(),
+    operands: z.array(z.strictObject({
+        index: z.number().int().nonnegative(),
+        raw: z.string(),
+        provider_type: z.number().int(),
+        components: z.array(z.strictObject({
+            kind: z.enum(["register", "immediate", "address", "unknown"]),
+            text: z.string(),
+            value: z.string().nullable(),
+            bit_width: z.number().int().nonnegative().nullable(),
+        })),
+        memory_addressing: z.literal("unavailable"),
+    })),
+    flow: z.strictObject({
+        kind: z.enum([
+            "call",
+            "jump",
+            "return",
+            "fallthrough",
+            "terminal",
+            "unavailable",
+        ]),
+        conditional: z.boolean(),
+        computed: z.boolean(),
+        direct_destinations: z.array(z.string()),
+    }),
+    references: z.array(reference),
+    limitations: z.array(z.string()),
+});
+/** Static target resolution preserves provider references as evidence, never runtime certainty. */
+export const nativeCallTargetsSchema = z.strictObject({
+    call_site: z.string(),
+    procedure: z.string().nullable(),
+    status: z.enum([
+        "direct",
+        "resolved-indirect",
+        "ambiguous",
+        "unresolved",
+        "not-call",
+        "unavailable",
+    ]),
+    mechanism: z.enum(["direct", "computed", "indirect", "unavailable"]),
+    targets: z.array(z.strictObject({
+        address: z.string(),
+        procedure: z.string().nullable(),
+        status: z.enum(["direct", "resolved-indirect", "candidate"]),
+        basis: z.literal("provider-reference"),
+        references: z.array(reference),
+    })),
+    limitations: z.array(z.string()),
+});

package/dist/domain/nativeInvestigationGraph.js

@@ -51,6 +51,8 @@ export const nativeInvestigationRelationSchema = z.enum([
     "swift_vtable_dispatch",
     "thunk_to",
     "direct_call",
+    "indirect_call",
+    "provider_call",
     "reads",
     "writes",
     "flows_to",
@@ -63,7 +65,7 @@ export const nativeInvestigationEdgeSchema = z.discriminatedUnion("resolution",
         from: z.string().min(1),
         to: z.string().min(1),
         relation: nativeInvestigationRelationSchema,
-        resolution: z.enum(["observed", "inferred"]),
+        resolution: z.enum(["observed", "inferred", "resolved", "ambiguous"]),
         evidence: z.array(nativeMetadataEvidenceSchema).min(1),
         limitations: z.array(z.string()),
     }),
@@ -275,7 +277,7 @@ export const joinInterfaceBuilderDispatch = (graph, metadata) => {
                 resolution: "unresolved",
                 reason: candidates.length > 1
                     ? "selector_has_multiple_candidate_implementations"
-                    : "implementation_not_resolved_from_provider_symbols",
+                    : "implementation_not_resolved_from_binary_metadata_or_provider_symbols",
                 evidence: [
                     ...action.evidence,
                     ...candidates.flatMap(({ evidence }) => evidence),
@@ -308,14 +310,16 @@ export const joinInterfaceBuilderDispatch = (graph, metadata) => {
             from: selectorNodeId,
             to: functionId,
             relation: "objc_dispatch",
-            resolution: "inferred",
+            resolution: className !== null && implementation.decode.status === "decoded"
+                ? "resolved"
+                : "inferred",
             evidence: [...action.evidence, ...implementation.evidence],
             limitations: className === null
                 ? [
-                    "The selector uniquely matches a symbolized method, but the Interface Builder receiver is an unresolved placeholder; runtime dispatch was not observed.",
+                    "The selector uniquely matches a encoded or symbolized method, but the Interface Builder receiver is an unresolved placeholder; runtime dispatch was not observed.",
                 ]
                 : [
-                    "The Interface Builder target and symbolized method agree on class and selector; runtime dispatch and dynamically supplied targets were not observed.",
+                    "The Interface Builder target and encoded or symbolized method agree on class and selector; runtime dispatch and dynamically supplied targets were not observed.",
                 ],
         });
         resolved += 1;

package/dist/domain/nativeUiObservation.js

@@ -0,0 +1,123 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { decodeCanonicalBase64 } from "./webScreenshot.js";
+const scope = {
+    pid: z.number().int().positive(),
+    window_id: z.number().int().positive(),
+    screenshot: z.boolean().default(true),
+    accessibility: z.boolean().default(true),
+    max_nodes: z
+        .number()
+        .int()
+        .positive()
+        .safe()
+        .default(500)
+        .describe("Maximum accessibility nodes per capture; increase for large windows."),
+};
+/** Opt-in passive observation binds one already-running process and window. */
+export const nativeUiObservationInputSchema = z.strictObject(scope);
+/** Active scenarios use explicit actions and leave application state as-is. */
+export const nativeUiScenarioInputSchema = z.strictObject({
+    ...scope,
+    steps: z
+        .array(z.discriminatedUnion("kind", [
+        z.strictObject({
+            kind: z.literal("click"),
+            path: z.array(z.number().int().nonnegative()).max(32),
+        }),
+        z.strictObject({
+            kind: z.literal("scroll"),
+            path: z.array(z.number().int().nonnegative()).max(32),
+            direction: z.enum(["increment", "decrement"]),
+        }),
+        z.strictObject({
+            kind: z.literal("key-entry"),
+            path: z.array(z.number().int().nonnegative()).max(32),
+            text: z.string(),
+        }),
+        z.strictObject({
+            kind: z.literal("wait"),
+            milliseconds: z
+                .number()
+                .int()
+                .min(0)
+                .max(180_000)
+                .describe("Wait duration in milliseconds, within the 180-second operation deadline."),
+        }),
+    ]))
+        .min(1),
+});
+/** Ordered captures and failures distinguish missing observation from a failed action. */
+const nativeUiScreenshotSchema = z
+    .strictObject({
+    mime_type: z.literal("image/png"),
+    base64: z.string().min(4),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    width: z.number().int().positive(),
+    height: z.number().int().positive(),
+})
+    .superRefine((screenshot, context) => {
+    const bytes = decodeCanonicalBase64(screenshot.base64);
+    if (bytes === undefined) {
+        context.addIssue({
+            code: "custom",
+            message: "Invalid canonical PNG base64",
+        });
+        return;
+    }
+    if (createHash("sha256").update(bytes).digest("hex") !== screenshot.sha256)
+        context.addIssue({
+            code: "custom",
+            message: "PNG screenshot digest mismatch",
+        });
+    if (bytes.byteLength < 24 ||
+        !bytes.subarray(0, 8).equals(PNG_SIGNATURE) ||
+        bytes.subarray(12, 16).toString("ascii") !== "IHDR") {
+        context.addIssue({
+            code: "custom",
+            message: "Screenshot bytes are not a PNG image",
+        });
+        return;
+    }
+    if (bytes.readUInt32BE(16) !== screenshot.width ||
+        bytes.readUInt32BE(20) !== screenshot.height)
+        context.addIssue({
+            code: "custom",
+            message: "PNG screenshot dimensions mismatch",
+        });
+});
+const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+export const nativeUiSnapshotSchema = z.strictObject({
+    window: z.strictObject({
+        pid: z.number().int().positive(),
+        window_id: z.number().int().positive(),
+        executable: z.string(),
+        launch_time: z.number(),
+        title: z.string(),
+    }),
+    nodes: z.array(z.strictObject({
+        path: z.array(z.number().int().nonnegative()),
+        role: z.string().nullable(),
+        title: z.string().nullable(),
+        value: z.string().nullable(),
+        actions: z.array(z.string()),
+        children_count: z.number().int().nonnegative(),
+    })),
+    truncated: z.boolean(),
+    screenshot: nativeUiScreenshotSchema.nullable(),
+    gaps: z.array(z.string()),
+});
+export const nativeUiResultSchema = z.strictObject({
+    target_sha256: z.string(),
+    initial: nativeUiSnapshotSchema,
+    steps: z.array(z.strictObject({
+        index: z.number().int().nonnegative(),
+        kind: z.string(),
+        before: nativeUiSnapshotSchema,
+        after: nativeUiSnapshotSchema.nullable(),
+        outcome: z.enum(["completed", "failed", "cancelled"]),
+        reason: z.string().nullable(),
+    })),
+    restore: z.literal("leave-as-is"),
+    limitations: z.array(z.string()),
+});

package/dist/domain/nativeValueFlow.js

@@ -16,6 +16,9 @@ export const nativePcodeOperationSchema = z.strictObject({
     sequence: z.number().int().nonnegative(),
     opcode: z.string().min(1),
     is_dead: z.boolean(),
+    block_membership: z
+        .enum(["member", "detached", "unavailable"])
+        .default("unavailable"),
     inputs: z.array(nativeVarnodeSchema),
     output: nativeVarnodeSchema.nullable(),
 });
@@ -47,6 +50,20 @@ export const nativeValueFlowSchema = z.discriminatedUnion("available", [
         operations: z.array(nativePcodeOperationSchema),
         def_use: z.array(nativePcodeDefUseSchema),
         effects: z.array(nativePcodeEffectSchema),
+        parameters: z
+            .array(z.strictObject({
+            ordinal: z.number().int().nonnegative(),
+            name: z.string(),
+            data_type: z.string(),
+        }))
+            .default([]),
+        parameter_uses: z
+            .array(z.strictObject({
+            ordinal: z.number().int().nonnegative(),
+            use: z.string(),
+            input_index: z.number().int().nonnegative(),
+        }))
+            .default([]),
         truncated: z.boolean(),
         omitted_operations_lower_bound: z.number().int().nonnegative(),
         known_omitted_inputs: z.number().int().nonnegative(),

package/dist/domain/nativeValueTrace.js

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import { nativePcodeOperationSchema } from "./nativeValueFlow.js";
+/** Work and output budgets for a static procedure-seeded dependency graph. */
+export const nativeValueTraceInputSchema = z.strictObject({
+    procedure: z.string().min(1),
+    max_depth: z.number().int().min(0).max(16).default(3),
+    max_functions: z.number().int().min(1).max(64).default(16),
+    max_call_sites: z.number().int().min(1).max(4096).default(256),
+    max_nodes: z.number().int().min(1).max(20_000).default(5_000),
+    max_edges: z.number().int().min(1).max(40_000).default(10_000),
+    offset: z.number().int().min(0).default(0),
+    limit: z.number().int().min(1).max(5_000).default(1_000),
+});
+/** Def-use observations and call relationships retain separate authority. */
+export const nativeValueTraceSchema = z.strictObject({
+    seed: z.string(),
+    target_sha256: z.string(),
+    nodes: z.array(z.strictObject({
+        id: z.string(),
+        procedure: z.string(),
+        evidence_id: z.string(),
+        kind: z.enum(["operation", "parameter"]),
+        operation: nativePcodeOperationSchema.nullable(),
+        parameter: z
+            .strictObject({
+            ordinal: z.number().int().nonnegative(),
+            name: z.string(),
+            data_type: z.string(),
+        })
+            .nullable(),
+    })),
+    edges: z.array(z.strictObject({
+        source: z.string(),
+        target: z.string(),
+        input_index: z.number().int().nonnegative().nullable(),
+        kind: z.enum([
+            "def-use",
+            "call",
+            "parameter-use",
+            "argument-binding",
+            "return-binding",
+        ]),
+        status: z.enum(["derived", "direct", "resolved-indirect", "candidate"]),
+        evidence_id: z.string(),
+    })),
+    procedures: z.array(z.strictObject({
+        address: z.string(),
+        depth: z.number().int().nonnegative(),
+        evidence_id: z.string(),
+        provider: z.string(),
+        analysis_profile_digest: z.string().nullable(),
+    })),
+    unknowns: z.array(z.strictObject({
+        procedure: z.string(),
+        address: z.string().nullable(),
+        reason: z.string(),
+    })),
+    total_nodes: z.number().int().nonnegative(),
+    total_edges: z.number().int().nonnegative(),
+    decompilations: z.number().int().nonnegative(),
+    next_offset: z.number().int().nonnegative().nullable(),
+    truncated: z.boolean(),
+    limitations: z.array(z.string()),
+});

package/dist/domain/objcSwiftMetadata.js

@@ -50,6 +50,32 @@ export const objcClassSchema = z.strictObject({
     protocols: z.array(z.string()).default([]),
     ivar_count: z.number().int().nonnegative().default(0),
     instance_size: z.number().int().nonnegative().nullable(),
+    location: z
+        .object({
+        address: z.string().nullable(),
+        file_offset: z.number().int().nonnegative().nullable(),
+    })
+        .optional(),
+    superclass_address: z.string().nullable().optional(),
+    metaclass_address: z.string().nullable().optional(),
+    decode: z
+        .object({
+        status: z.enum(["decoded", "partial", "unsupported", "invalid"]),
+        reason: z.string().nullable(),
+    })
+        .optional(),
+    evidence: z
+        .array(z.object({
+        kind: z.literal("binary_metadata"),
+        description: z.string(),
+        location: z.object({
+            address: z.string().nullable(),
+            file_offset: z.number().int().nonnegative().nullable(),
+        }),
+        artifact_path: z.string(),
+        artifact_sha256: z.string(),
+    }))
+        .optional(),
 });
 /** Exact location of a decoded native metadata value when the provider knows it. */
 export const nativeMetadataLocationSchema = z.strictObject({
@@ -85,6 +111,18 @@ export const objcIvarSchema = z.strictObject({
     name: z.string().min(1),
     type_encoding: z.string().nullable(),
     offset: z.number().int().nonnegative().nullable(),
+    size: z.number().int().nonnegative().nullable().default(null),
+    alignment: z.number().int().positive().nullable().default(null),
+    location: nativeMetadataLocationSchema,
+    decode: nativeMetadataDecodeSchema,
+    evidence: z.array(nativeMetadataEvidenceSchema).min(1),
+});
+/** Encoded Objective-C protocol declaration with required and optional method facts. */
+export const objcProtocolRecordSchema = z.strictObject({
+    name: z.string(),
+    adopted_protocols: z.array(z.string()),
+    methods: z.array(objcMethodSchema),
+    optional_methods: z.array(objcMethodSchema),
     location: nativeMetadataLocationSchema,
     decode: nativeMetadataDecodeSchema,
     evidence: z.array(nativeMetadataEvidenceSchema).min(1),
@@ -204,6 +242,7 @@ export const objcSwiftMetadataSchema = z.strictObject({
     objc_protocols: z.array(objcProtocolSchema).default([]),
     swift_decls: z.array(swiftDeclSchema).default([]),
     objc_ivars: z.array(objcIvarSchema).default([]),
+    objc_protocol_records: z.array(objcProtocolRecordSchema).default([]),
     objc_dispatch_implementations: z
         .array(objcDispatchImplementationSchema)
         .default([]),

package/dist/domain/peInspection.js

@@ -120,6 +120,7 @@ export function parseMachineType(machine) {
         case 0x8664:
             return "x64";
         case 0x01c0:
+        case 0x01c2:
         case 0x01c4:
             return "arm";
         case 0xaa64:

package/dist/domain/processCapture.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { jsonValueSchema } from "./jsonValue.js";
 import { normalizationSchema } from "./processScenario.js";
-import { processReactiveRunSchema } from "./processCaptureReactiveSchema.js";
 import { collectProcessCaptureIssues } from "./processCaptureValidation.js";
 export * from "./processScenario.js";
 /** Capture collection whose members participate in global observation order. */
@@ -12,9 +11,6 @@ export const PROCESS_CAPTURE_EVENT_COLLECTIONS = [
     "lifecycle",
     "process_samples",
     "filesystem_checkpoints",
-    "shim_events",
-    "protocol_events",
-    "replay_transitions",
 ];
 const fileStateShape = {
     path: z.string(),
@@ -65,8 +61,8 @@ const fileEffectSchema = z.discriminatedUnion("status", [
     }),
 ]);
 /** Exact serialized shape of a process capture. */
-const processCaptureShapeSchema = z.object({
-    manifest: z.object({
+const processCaptureShapeSchema = z.strictObject({
+    manifest: z.strictObject({
         rea_version: z.string().min(1),
         provider_version: z.string().min(1),
         platform: z.string().min(1),
@@ -76,14 +72,10 @@ const processCaptureShapeSchema = z.object({
         completed_at: z.iso.datetime(),
         scenario: z.record(z.string(), jsonValueSchema),
         comparison_contract: z.record(z.string(), jsonValueSchema),
-        shim_plan: z.array(jsonValueSchema),
-        replay_plan: z.record(z.string(), jsonValueSchema),
         full_scenario_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
         comparison_contract_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
         executable_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
         normalization_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
-        shim_plan_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
-        replay_plan_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
     }),
     normalization: normalizationSchema,
     frames: z.array(z.object({
@@ -106,7 +98,7 @@ const processCaptureShapeSchema = z.object({
         sequence: z.number().int().nonnegative(),
         scheduled_at_ms: z.number().int().nonnegative(),
         dispatched_at_ms: z.number().int().nonnegative(),
-        type: z.enum(["input", "resize", "stdin_close", "signal"]),
+        type: z.enum(["input", "resize", "signal"]),
         data: z.string(),
         outcome: z.enum(["dispatched", "target_exited", "failed"]),
     })),
@@ -136,53 +128,12 @@ const processCaptureShapeSchema = z.object({
         session_id: z.number().int().nonnegative().nullable(),
     })),
     filesystem_checkpoints: z.array(z.object({
-        name: z.string(),
+        name: z.enum(["before", "after_settlement"]),
         at_ms: z.number().int().nonnegative(),
         files: z.array(fileStateSchema),
         effects: z.array(fileEffectSchema),
         truncated: z.boolean(),
     })),
-    shim_events: z.array(z.object({
-        sequence: z.number().int().nonnegative(),
-        at_ms: z.number().int().nonnegative(),
-        command: z.string(),
-        route_index: z.number().int().nonnegative().nullable(),
-        arguments: z.array(z.string()),
-        working_directory: z.string(),
-        outcome: z.enum(["matched", "unmatched", "exhausted"]),
-    })),
-    protocol_events: z.array(z.object({
-        sequence: z.number().int().nonnegative(),
-        at_ms: z.number().int().nonnegative(),
-        protocol: z.enum(["http", "websocket"]),
-        direction: z.enum(["request", "response", "received", "sent"]),
-        method: z.string().nullable(),
-        path: z.string().nullable(),
-        data: z.string(),
-        outcome: z.enum([
-            "matched",
-            "unmatched",
-            "script_exhausted",
-            "disconnected",
-            "invalid_state",
-            "guard_failed",
-            "transition_exhausted",
-            "invalid_capture",
-            "unexpected_reconnect",
-            "limit_exhausted",
-        ]),
-    })),
-    replay_transitions: z
-        .array(z.object({
-        sequence: z.number().int().nonnegative(),
-        at_ms: z.number().int().nonnegative(),
-        transition_id: z.string().min(1),
-        state_before: z.string().min(1),
-        state_after: z.string().min(1),
-        sensitive_aliases: z.array(z.string().min(1)),
-    }))
-        .default([]),
-    reactive_run: processReactiveRunSchema.nullable().default(null),
     event_journal: z
         .array(z.object({
         capture_order: z.number().int().nonnegative(),
@@ -202,10 +153,9 @@ const processCaptureShapeSchema = z.object({
             "exit",
             "process",
             "filesystem",
-            "protocol",
-            "shim",
             "cleanup",
             "network",
+            "environment",
         ]),
         reason: z.string(),
     })),