rea-agents 4.1.0 → 5.0.0

package/dist/composition/firmware.js

@@ -0,0 +1,3 @@
+import { FirmwareProvider } from "../firmware/FirmwareProvider.js";
+/** Construct one firmware provider without launching or acquiring an engine. */
+export const createFirmwareAnalysisProvider = (environment = process.env, launcher) => new FirmwareProvider(environment, launcher);

package/dist/composition/javascriptRecovery.js

@@ -0,0 +1,3 @@
+import { WakaruProvider } from "../javascript/recovery/WakaruProvider.js";
+/** Construct optional recovery without acquiring tools, processes or workspaces. */
+export const createJavaScriptRecoveryProvider = (environment = process.env, launcher) => new WakaruProvider(environment, launcher);

package/dist/composition/javascriptRuntimeObservation.js

@@ -0,0 +1,3 @@
+import { V8InspectorProvider } from "../inspector/V8InspectorProvider.js";
+/** Construct a fresh provider without opening a target or acquiring an engine. */
+export const createJavaScriptRuntimeObservationProvider = () => new V8InspectorProvider();

package/dist/composition/optionalObservationProviders.js

@@ -0,0 +1,49 @@
+import { CDP_BROWSER_PROVIDER_IDENTITY, PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY, CDP_ELECTRON_PROVIDER_IDENTITY, PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY, } from "../browser/providerIdentities.js";
+import { V8_INSPECTOR_PROVIDER_IDENTITY } from "../inspector/providerIdentity.js";
+import { err, ok } from "../domain/result.js";
+const productionFactories = {
+    browserObservation: async () => (await import("./browserObservation.js")).createBrowserObservationProvider(),
+    browserScenarioCapture: async () => (await import("./browserScenario.js")).createBrowserScenarioProvider(),
+    electronObservation: async () => (await import("./electronObservation.js")).createElectronObservationProvider(),
+    electronActiveObservation: async () => (await import("./electronScenario.js")).createElectronScenarioProvider(),
+    javascriptRuntimeObservation: async () => (await import("./javascriptRuntimeObservation.js")).createJavaScriptRuntimeObservationProvider(),
+};
+const loadPort = async (factory, providerId) => {
+    try {
+        return ok(await factory());
+    }
+    catch (cause) {
+        return err({
+            providerId,
+            reason: cause instanceof Error ? cause.message : String(cause),
+        });
+    }
+};
+/** Load each adapter independently, retaining healthy peers and exact failures. */
+export const loadOptionalObservationProviders = async (factories = productionFactories) => {
+    const [browser, scenario, electron, electronActive, runtime] = await Promise.all([
+        loadPort(factories.browserObservation, CDP_BROWSER_PROVIDER_IDENTITY.id),
+        loadPort(factories.browserScenarioCapture, PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY.id),
+        loadPort(factories.electronObservation, CDP_ELECTRON_PROVIDER_IDENTITY.id),
+        loadPort(factories.electronActiveObservation, PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY.id),
+        loadPort(factories.javascriptRuntimeObservation, V8_INSPECTOR_PROVIDER_IDENTITY.id),
+    ]);
+    return {
+        ...(browser.ok ? { browserObservation: browser.value } : {}),
+        ...(scenario.ok ? { browserScenarioCapture: scenario.value } : {}),
+        ...(electron.ok ? { electronObservation: electron.value } : {}),
+        ...(electronActive.ok
+            ? { electronActiveObservation: electronActive.value }
+            : {}),
+        ...(runtime.ok ? { javascriptRuntimeObservation: runtime.value } : {}),
+        optionalProviderLoadFailures: {
+            ...(browser.ok ? {} : { browserObservation: browser.error }),
+            ...(scenario.ok ? {} : { browserScenarioCapture: scenario.error }),
+            ...(electron.ok ? {} : { electronObservation: electron.error }),
+            ...(electronActive.ok
+                ? {}
+                : { electronActiveObservation: electronActive.error }),
+            ...(runtime.ok ? {} : { javascriptRuntimeObservation: runtime.error }),
+        },
+    };
+};

package/dist/composition/webModules.js

@@ -0,0 +1,5 @@
+import { WebModuleTraceService } from "../application/WebModuleTraceService.js";
+import { LocalWebModuleArtifacts } from "../browser/modules/WebModuleArtifacts.js";
+import { NativeModuleResolver } from "../browser/modules/NativeModuleResolver.js";
+/** Assemble optional module tracing without acquiring a browser or reading files. */
+export const createWebModuleTraceService = (environment = process.env) => new WebModuleTraceService(new LocalWebModuleArtifacts(), new NativeModuleResolver(environment));

package/dist/composition/webRuntime.js

@@ -0,0 +1,4 @@
+import { WebRuntimeService } from "../application/WebRuntimeService.js";
+import { CdpWebRuntimeProvider } from "../browser/execution/CdpWebRuntimeProvider.js";
+/** Construct the live attribution workflow without opening a browser connection. */
+export const createWebRuntimeService = () => new WebRuntimeService(new CdpWebRuntimeProvider());

package/dist/composition/webSourceLocations.js

@@ -0,0 +1,5 @@
+import { WebSourceLocationService } from "../application/WebSourceLocationService.js";
+import { LocalWebSourceLocationArtifacts } from "../browser/assets/WebSourceLocationArtifacts.js";
+import { SourceMapDecoder } from "../javascript/sourceMaps/SourceMapDecoder.js";
+/** Compose local source/map analysis without import-time reads or process acquisition. */
+export const createWebSourceLocationService = (environment = process.env) => new WebSourceLocationService(new LocalWebSourceLocationArtifacts(), new SourceMapDecoder({ environment }));

package/dist/config/parseConfig.js

@@ -1,10 +1,29 @@
+import { accessSync, constants } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { ConfigurationError } from "../domain/configurationErrors.js";
 import { ok } from "../domain/result.js";
 import { parseEnvironment } from "./environment.js";
 import { parseStringArray, parseLoaderArgs } from "./parsers.js";
-const defaultHopperLauncherPath = () => process.platform === "linux"
-    ? "/opt/hopper/bin/Hopper"
-    : "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
+const DEFAULT_HOPPER_LAUNCHER_PATH = "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
+const SYSTEM_LINUX_HOPPER = "/opt/hopper/bin/Hopper";
+const executableAvailable = (path) => {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const defaultHopperLauncherPath = (platform = process.platform, homeDirectory = homedir(), executable = executableAvailable) => {
+    if (platform !== "linux")
+        return DEFAULT_HOPPER_LAUNCHER_PATH;
+    if (executable(SYSTEM_LINUX_HOPPER))
+        return SYSTEM_LINUX_HOPPER;
+    const userLocal = join(homeDirectory, ".local/share/rea/hopper/bin/Hopper");
+    return executable(userLocal) ? userLocal : SYSTEM_LINUX_HOPPER;
+};
 /** Parse provider configuration and runtime prerequisites at the composition root. */
 export const parseConfig = (environment) => {
     const parsed = parseEnvironment(environment);

package/dist/contracts/{androidToolContracts.js → android/androidToolContracts.js}

@@ -1,12 +1,12 @@
-import { androidInputSchemas, androidResultSchemas, } from "../domain/androidAnalysis.js";
-import { evidenceResultOf } from "./toolOutputSchemaPrimitives.js";
-import { toolContractMetadata } from "./toolEffects.js";
+import { androidInputSchemas, androidResultSchemas, } from "../../domain/android/androidAnalysis.js";
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { toolContractMetadata } from "../toolEffects.js";
 /** Static APK operations backed by a separately supplied headless engine. */
 export const ANDROID_TOOL_CONTRACTS = [
     {
         name: "inspect_android_package",
         ...toolContractMetadata("inspect_android_package"),
-        description: "Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and Java; uses one worker in an isolated temporary workspace.",
+        description: "Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and JDK; uses one worker in an isolated temporary workspace.",
         kind: "android-provider",
         inputSchema: androidInputSchemas.inspect_android_package,
         outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_package),
@@ -31,7 +31,7 @@ export const ANDROID_TOOL_CONTRACTS = [
     {
         name: "inspect_android_class",
         ...toolContractMetadata("inspect_android_class"),
-        description: "Inspect one exact Android class's methods, fields and inner classes. Returns display signatures and explicit unknown DEX descriptors without materializing the whole application source.",
+        description: "Inspect one exact Android class's parsed methods, fields and inner classes, including synthetic members. Returns display signatures and explicit unknown DEX descriptors without generating source. Overload indices remain consistent within the artifact and engine session.",
         kind: "android-provider",
         inputSchema: androidInputSchemas.inspect_android_class,
         outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_class),

package/dist/contracts/applicationToolContracts.js

@@ -1,15 +1,18 @@
-import { applicationVersionComparisonResultSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
-import { applicationFeatureTraceResultSchema } from "../domain/javascriptFeatureTraceSchemas.js";
-import { javaScriptSemanticTraceResultSchema } from "../domain/javascriptSemanticTraceSchemas.js";
-import { javaScriptExportShapeComparisonResultSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
-import { sourceToBundleComparisonResultSchema } from "../domain/sourceToBundleComparisonSchemas.js";
-import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, compareSourceToBundleRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "./applicationWorkflowInputContracts.js";
-import { reconstructionCoverageEvaluationInputSchema } from "../application/ReconstructionCoverageService.js";
+import { applicationVersionComparisonResultSchema } from "../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
+import { applicationFeatureTraceResultSchema } from "../domain/javascript/javascriptFeatureTraceSchemas.js";
+import { javaScriptSemanticTraceResultSchema } from "../domain/javascript/javascriptSemanticTraceSchemas.js";
+import { javaScriptExportShapeComparisonResultSchema } from "../domain/javascript/javascriptExportShapeComparisonSchemas.js";
+import { sourceToBundleComparisonResultSchema } from "../domain/javascript/sourceToBundleComparisonSchemas.js";
+import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, compareSourceToBundleRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "./javascript/applicationWorkflowInputContracts.js";
+import { reconstructionCoverageEvaluationInputSchema } from "../domain/reconstructionCoverageInput.js";
 import { reconstructionClosureResultSchema } from "../domain/reconstructionCoverage.js";
 import { reconstructionObligationLedgerInputSchema, reconstructionObligationLedgerSchema, } from "../domain/reconstructionObligationLedgerSchemas.js";
+import { androidApplicationProjectionInputSchema, androidApplicationProjectionResultSchema, } from "../domain/android/androidApplication.js";
+import { appleApplicationProjectionInputSchema, appleApplicationProjectionResultSchema, } from "../domain/apple/appleApplication.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { evidenceResultOf } from "./toolOutputSchemas.js";
-import { JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE, } from "./javascriptApplicationWorkflowExamples.js";
+import { JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE, } from "./javascript/javascriptApplicationWorkflowExamples.js";
+import { ANDROID_APPLICATION_GRAPH_EXAMPLE, APPLE_APPLICATION_GRAPH_EXAMPLE, MACOS_APPLICATION_GRAPH_EXAMPLE, } from "./mobileApplicationGraphExamples.js";
 const traceOutputSchema = evidenceResultOf(applicationFeatureTraceResultSchema);
 const semanticTraceOutputSchema = evidenceResultOf(javaScriptSemanticTraceResultSchema);
 const comparisonOutputSchema = evidenceResultOf(applicationVersionComparisonResultSchema);
@@ -201,6 +204,38 @@ export const APPLICATION_TOOL_CONTRACTS = [
             },
         ],
     },
+    {
+        name: "project_android_application_graph",
+        ...toolContractMetadata("project_android_application_graph"),
+        description: "Project authenticated APK inventory_artifact Evidence into an execution-free Android application inventory. Reports exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without decoding DEX, executing the APK, or claiming observed runtime calls.",
+        kind: "application",
+        inputSchema: androidApplicationProjectionInputSchema,
+        outputSchema: evidenceResultOf(androidApplicationProjectionResultSchema),
+        examples: [
+            {
+                title: "Project APK inventory Evidence into an Android application graph",
+                input: ANDROID_APPLICATION_GRAPH_EXAMPLE,
+            },
+        ],
+    },
+    {
+        name: "project_apple_application_graph",
+        ...toolContractMetadata("project_apple_application_graph"),
+        description: "Project authenticated IPA, macOS .app directory, ZIP, or DMG inventory Evidence into an execution-free Apple application inventory. Reports application roots, nested bundles with path-convention roles (app extensions, XPC services, login items, privileged helpers, system extensions, frameworks), launchd plists, exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without parsing plist/CMS semantics or claiming observed runtime calls.",
+        kind: "application",
+        inputSchema: appleApplicationProjectionInputSchema,
+        outputSchema: evidenceResultOf(appleApplicationProjectionResultSchema),
+        examples: [
+            {
+                title: "Project IPA inventory Evidence into an Apple application graph",
+                input: APPLE_APPLICATION_GRAPH_EXAMPLE,
+            },
+            {
+                title: "Project a macOS .app directory inventory into its bundle anatomy",
+                input: MACOS_APPLICATION_GRAPH_EXAMPLE,
+            },
+        ],
+    },
 ];
 export function applicationToolContract(name) {
     const contract = APPLICATION_TOOL_CONTRACTS.find(({ name: candidate }) => candidate === name);

package/dist/contracts/artifactToolContracts.js

@@ -3,8 +3,8 @@ import { artifactOutputSchemas } from "./toolOutputSchemas.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
-import { appleAssetCatalogInputSchema } from "../domain/appleAssetCatalog.js";
-import { keyedArchiveInputSchema } from "../domain/keyedArchive.js";
+import { appleAssetCatalogInputSchema } from "../domain/apple/appleAssetCatalog.js";
+import { keyedArchiveInputSchema } from "../domain/apple/keyedArchive.js";
 /** Exact caller boundary for deterministic artifact inventory. */
 export const artifactInventoryInputSchema = z.strictObject({
     integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),

package/dist/contracts/browserScenarioToolContracts.js

@@ -21,7 +21,7 @@ export const BROWSER_SCENARIO_TOOL_CONTRACTS = [
     {
         name: "capture_browser_scenario",
         ...toolContractMetadata("capture_browser_scenario"),
-        description: "Run a controlled browser scenario when passive observation cannot exercise the application. Launch the selected executable or connect to a loopback CDP target, provide a start URL and actions, and select storage or artifacts when needed. Environment, empty storage, and a URL-only final capture are defaults; provide initial storage or additional artifacts when needed. Agents can run their own local fixture servers to control application responses. Actions run until completion or cancellation unless timeout_ms is set. Results are returned inline.",
+        description: "Run a controlled browser scenario when passive observation cannot exercise the application. Launch the selected executable or connect to a loopback CDP target, provide a start URL and actions, and select storage or artifacts when needed. Environment, empty storage, and a URL-only final capture are defaults. capture.network selects request_body, response_body, and header_values independently; selected content is returned inline with transaction and event references, byte digests, and explicit unavailable states. Credentials and declared secrets are redacted. Agents can run their own local fixture servers to control application responses. Actions run until completion or cancellation unless timeout_ms is set. Results are returned inline.",
         kind: "browser-provider",
         inputSchema: browserScenarioInputSchema,
         outputSchema: evidenceResultOf(browserScenarioCaptureSchema),

package/dist/contracts/enhancedInputs.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { nativeValueTraceInputSchema } from "../domain/nativeValueTrace.js";
+import { nativeValueTraceInputSchema } from "../domain/native/nativeValueTrace.js";
 const traceLiteralInputSchema = z.strictObject({
     query: z.string().min(1),
     case_sensitive: z.boolean().default(false),

package/dist/contracts/{firmwareToolContracts.js → firmware/firmwareToolContracts.js}

@@ -1,13 +1,13 @@
-import { firmwareInputSchemas, firmwareResultSchemas, } from "../domain/firmwareAnalysis.js";
-import { evidenceResultOf } from "./toolOutputSchemaPrimitives.js";
-import { toolContractMetadata } from "./toolEffects.js";
+import { firmwareInputSchemas, firmwareResultSchemas, } from "../../domain/firmware/firmwareAnalysis.js";
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { toolContractMetadata } from "../toolEffects.js";
 /** Explicit local firmware observations and extraction, backed by caller-supplied tools. */
 export const FIRMWARE_TOOL_CONTRACTS = [
     {
         name: "inspect_firmware_regions",
         ...toolContractMetadata("inspect_firmware_regions"),
         kind: "firmware-provider",
-        description: "Inspect signature candidates in a local firmware file with Binwalk 3.1.0. Returns offsets, reported lengths, descriptions and raw confidence values. Length validation and runtime addresses remain unknown. No extraction or target execution. Linux, caller-supplied tool and util-linux prlimit required; 128 MiB input limit, one worker and 120-second deadline.",
+        description: "Inspect signature candidates in a local firmware file with Binwalk 3.1.x (verified with 3.1.0). Returns offsets, reported lengths, descriptions and raw confidence values. Length validation and runtime addresses remain unknown. No extraction or target execution. Linux, caller-supplied tool and util-linux prlimit required; 128 MiB input limit, one worker and 120-second deadline.",
         inputSchema: firmwareInputSchemas.inspect_firmware_regions,
         outputSchema: evidenceResultOf(firmwareResultSchemas.inspect_firmware_regions),
         examples: [
@@ -21,7 +21,7 @@ export const FIRMWARE_TOOL_CONTRACTS = [
         name: "extract_firmware",
         ...toolContractMetadata("extract_firmware"),
         kind: "firmware-provider",
-        description: "Extract caller-selected firmware bytes with Unblob 26.6.4 into an absent output directory. Returns verified child paths/digests, task derivations, unknown chunks and extraction diagnostics inline. Preserves the default sandbox; publishes regular files only. Linux, caller-supplied tool, format-specific extractors and util-linux prlimit required. No mounts or extracted-code execution. Select a returned native file with open_binary for Ghidra analysis; decompressed offsets are not original-file addresses.",
+        description: "Extract caller-selected firmware bytes with Unblob 26.6.x (verified with 26.6.4) into an absent output directory. Returns verified child paths/digests, task derivations, unknown chunks and extraction diagnostics inline. Preserves the default sandbox; publishes regular files only. Linux, caller-supplied tool, format-specific extractors and util-linux prlimit required. No mounts or extracted-code execution. Select a returned native file with open_binary for Ghidra analysis; decompressed offsets are not original-file addresses.",
         inputSchema: firmwareInputSchemas.extract_firmware,
         outputSchema: evidenceResultOf(firmwareResultSchemas.extract_firmware),
         examples: [

package/dist/contracts/{applicationWorkflowInputContracts.js → javascript/applicationWorkflowInputContracts.js}

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { evidenceInputSchema } from "./evidenceInputContracts.js";
-import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
-import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
-import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
-import { javaScriptSemanticQueryInputSchema } from "../domain/javascriptSemanticQuerySchemas.js";
-import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
+import { evidenceInputSchema } from "../evidenceInputContracts.js";
+import { compareApplicationVersionsInputSchema } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
+import { compareJavaScriptExportShapesInputSchema } from "../../domain/javascript/javascriptExportShapeComparisonSchemas.js";
+import { traceApplicationFeatureInputSchema } from "../../domain/javascript/javascriptFeatureTraceSchemas.js";
+import { javaScriptSemanticQueryInputSchema } from "../../domain/javascript/javascriptSemanticQuerySchemas.js";
+import { compareSourceToBundleInputSchema } from "../../domain/javascript/sourceToBundleComparisonSchemas.js";
 const traceApplicationFeatureFacts = {
     native_observations: traceApplicationFeatureInputSchema.shape.native_observations,
     seed: traceApplicationFeatureInputSchema.shape.seed,

package/dist/contracts/{electronToolContracts.js → javascript/electronToolContracts.js}

@@ -1,9 +1,9 @@
-import { toolContractMetadata } from "./toolEffects.js";
-import { evidenceResultOf } from "./toolOutputSchemas.js";
-import { electronPageInspectionSchema, electronTargetListSchema, inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../domain/electronObservation.js";
-import { electronActiveObservationInputSchema, electronActiveObservationResultSchema, } from "../domain/electronActiveObservation.js";
-import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
-import { javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeReconciliationSchemas.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemas.js";
+import { electronPageInspectionSchema, electronTargetListSchema, inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../../domain/javascript/electronObservation.js";
+import { electronActiveObservationInputSchema, electronActiveObservationResultSchema, } from "../../domain/javascript/electronActiveObservation.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
+import { javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema, } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE } from "./javascriptRuntimeReconciliationExample.js";
 const listOutputSchema = evidenceResultOf(electronTargetListSchema);
 const inspectionOutputSchema = evidenceResultOf(electronPageInspectionSchema);

package/dist/contracts/{javascriptApplicationWorkflowExamples.js → javascript/javascriptApplicationWorkflowExamples.js}

@@ -1,7 +1,7 @@
-import { createEvidence } from "../domain/evidence.js";
-import { reconcileJavaScriptRuntime } from "../domain/javascriptRuntimeReconciliation.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { reconcileJavaScriptRuntime } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
 import { JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE, } from "./javascriptRuntimeReconciliationExample.js";
-import { createHistoricalSourceGraph } from "../domain/referenceSourceGraph.js";
+import { createHistoricalSourceGraph } from "../../domain/referenceSourceGraph.js";
 const reconciliation = reconcileJavaScriptRuntime(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE);
 const reconciliationEvidence = createEvidence(undefined, {
     id: "rea-javascript-runtime-reconciliation",

package/dist/contracts/javascript/javascriptRecoveryToolContracts.js

@@ -0,0 +1,23 @@
+import { javascriptRecoveryInputSchema, javascriptRecoveryResultSchema, } from "../../domain/javascript/javascriptRecovery.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+/** Derived script artifacts from optional upstream recovery adapters. */
+export const JAVASCRIPT_RECOVERY_TOOL_CONTRACTS = [
+    {
+        name: "recover_javascript_sources",
+        ...toolContractMetadata("recover_javascript_sources"),
+        kind: "application",
+        description: "Recover readable modules from one local UTF-8 JavaScript script/bundle into an absent directory, using caller-supplied Wakaru 1.13.0 on Linux x64. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
+        inputSchema: javascriptRecoveryInputSchema,
+        outputSchema: evidenceResultOf(javascriptRecoveryResultSchema),
+        examples: [
+            {
+                title: "Recover a captured production bundle",
+                input: {
+                    path: "/tmp/web-scripts/app.js",
+                    output_directory: "/tmp/recovered-app",
+                },
+            },
+        ],
+    },
+];

package/dist/contracts/{javascriptRuntimeObservationToolContracts.js → javascript/javascriptRuntimeObservationToolContracts.js}

@@ -1,6 +1,6 @@
-import { toolContractMetadata } from "./toolEffects.js";
-import { evidenceResultOf } from "./toolOutputSchemas.js";
-import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeObservation.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemas.js";
+import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "../../domain/javascript/javascriptRuntimeObservation.js";
 const endpoint = "http://127.0.0.1:9229";
 /** Passive Node/Electron V8 Inspector discovery and observation contracts. */
 export const JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS = [

package/dist/contracts/{javascriptRuntimeReconciliationExample.js → javascript/javascriptRuntimeReconciliationExample.js}

@@ -1,8 +1,8 @@
-import { createEvidence } from "../domain/evidence.js";
-import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../domain/javascriptApplicationGraph.js";
-import { createWebTextArtifact } from "../domain/webContentArtifact.js";
-import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../domain/javascriptSemanticGraph.js";
-import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../domain/javascriptSemanticGraphSchemas.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
+import { createWebTextArtifact } from "../../domain/webContentArtifact.js";
+import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../../domain/javascript/javascriptSemanticGraph.js";
+import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 const applicationSha256 = "1".repeat(64);
 const script = createWebTextArtifact("export const example = true;\n", "text/javascript");
 const inputPath = "/Applications/Example.app/Contents/Resources/app";

package/dist/contracts/{managedToolContracts.js → managed/managedToolContracts.js}

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { managedOutputSchemas } from "./toolOutputSchemas.js";
-import { toolContractMetadata } from "./toolEffects.js";
-import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
+import { managedOutputSchemas } from "../toolOutputSchemas.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
 /** Exact caller boundary for execution-free PE/CLI triage and identity. */
 const managedTargetInputSchema = z.object({
     path: z

package/dist/contracts/{managedWorkflowExamples.js → managed/managedWorkflowExamples.js}

@@ -1,4 +1,4 @@
-import { createEvidence } from "../domain/evidence.js";
+import { createEvidence } from "../../domain/evidence.js";
 const MANAGED_STATIC_EXAMPLE_PROVIDER = {
     id: "rea-dotnet-static",
     name: "REA managed static analysis provider",

package/dist/contracts/{managedWorkflowToolContracts.js → managed/managedWorkflowToolContracts.js}

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { evidenceSchema } from "../domain/evidence.js";
-import { managedReconstructionImportInputSchema } from "../domain/managedReconstruction.js";
-import { managedWorkflowOutputSchemas } from "./toolOutputSchemas.js";
+import { evidenceSchema } from "../../domain/evidence.js";
+import { managedReconstructionImportInputSchema } from "../../domain/managed/managedReconstruction.js";
+import { managedWorkflowOutputSchemas } from "../toolOutputSchemas.js";
 import { MANAGED_MEMBER_COMPARISON_EXAMPLE, MANAGED_NATIVE_VERIFICATION_EXAMPLE, MANAGED_APPLICATION_GRAPH_EXAMPLE, MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE, } from "./managedWorkflowExamples.js";
-import { toolContractMetadata } from "./toolEffects.js";
-import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
 /** Inputs for comparing two managed observations carried inline. */
 export const compareManagedMembersReferenceInputSchema = z
     .strictObject({
@@ -96,7 +96,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     {
         name: "compare_managed_members",
         ...toolContractMetadata("compare_managed_members"),
-        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
+        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact CIL/signature, exact declared type, name, and raw signature (decoded or not), and decoded structural method shape. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
         kind: "application",
         inputSchema: compareManagedMembersReferenceInputSchema,
         outputSchema: comparisonOutputSchema,

package/dist/contracts/mobileApplicationGraphExamples.js

@@ -0,0 +1,105 @@
+import { canonicalDigest } from "../domain/comparisonSemantics.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+const inventory = (format, digit) => {
+    const sha = digit.repeat(64);
+    const artifactId = `art_${canonicalDigest({ sha256: sha }, "Artifact inventory")}`;
+    const occurrenceId = `occ_${canonicalDigest({ root: artifactId }, "Artifact inventory")}`;
+    const nodes = [
+        {
+            artifact_id: artifactId,
+            kind: "resource",
+            format,
+            sha256: sha,
+            size: 1,
+            media_type: null,
+            architecture: null,
+            executable: false,
+            content_state: "materialized",
+            limitations: [],
+        },
+    ];
+    const occurrences = [
+        {
+            occurrence_id: occurrenceId,
+            artifact_id: artifactId,
+            parent_occurrence_id: null,
+            logical_path: ".",
+            entry_kind: "file",
+            declared_size: 1,
+            compressed_size: null,
+            executable: false,
+            encrypted: false,
+            hash_status: "verified",
+            source_location: null,
+            limitations: [],
+        },
+    ];
+    const graphSha256 = canonicalDigest({
+        nodes,
+        occurrences,
+        edges: [],
+        integrity_contradictions: [],
+    }, "Artifact inventory");
+    return jsonValueSchema.parse({
+        manifest: {
+            manifest_id: `agm_${canonicalDigest({
+                root_artifact_id: artifactId,
+                graph_sha256: graphSha256,
+            }, "Artifact inventory")}`,
+            root_artifact_id: artifactId,
+            root_sha256: sha,
+            root_format: format,
+            graph_sha256: graphSha256,
+            node_count: nodes.length,
+            occurrence_count: occurrences.length,
+            edge_count: 0,
+        },
+        nodes,
+        occurrences,
+        edges: [],
+        provenance: [],
+        limitations: [],
+    });
+};
+const provider = {
+    id: "rea-artifact-graph",
+    name: "REA safe artifact graph provider",
+    version: "1",
+};
+/** Catalog example for Android application inventory projection. */
+export const ANDROID_APPLICATION_GRAPH_EXAMPLE = {
+    inventory_evidence: [
+        createEvidence({ path: "Fixture.apk", sha256: "a".repeat(64), format: "apk" }, provider, {
+            operation: "inventory_artifact",
+            parameters: {},
+            result: inventory("apk", "a"),
+            confidence: "observed",
+            authority: "shipped-artifact",
+        }),
+    ],
+};
+/** Catalog example for Apple application inventory projection. */
+export const APPLE_APPLICATION_GRAPH_EXAMPLE = {
+    inventory_evidence: [
+        createEvidence({ path: "Fixture.ipa", sha256: "b".repeat(64), format: "ipa" }, provider, {
+            operation: "inventory_artifact",
+            parameters: {},
+            result: inventory("ipa", "b"),
+            confidence: "observed",
+            authority: "shipped-artifact",
+        }),
+    ],
+};
+/** Catalog example for a macOS application bundle inventoried as a directory. */
+export const MACOS_APPLICATION_GRAPH_EXAMPLE = {
+    inventory_evidence: [
+        createEvidence({ path: "Fixture.app", sha256: "c".repeat(64), format: "directory" }, provider, {
+            operation: "inventory_artifact",
+            parameters: {},
+            result: inventory("directory", "c"),
+            confidence: "observed",
+            authority: "shipped-artifact",
+        }),
+    ],
+};

package/dist/contracts/{nativeToolContracts.js → native/nativeToolContracts.js}

@@ -1,9 +1,9 @@
 import { z } from "zod";
-import { nativeUiObservationInputSchema, nativeUiScenarioInputSchema, } from "../domain/nativeUiObservation.js";
-import { nativeOutputSchemas } from "./toolOutputSchemas.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
-import { toolContractMetadata } from "./toolEffects.js";
-import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
+import { nativeUiObservationInputSchema, nativeUiScenarioInputSchema, } from "../../domain/native/nativeUiObservation.js";
+import { nativeOutputSchemas } from "../toolOutputSchemas.js";
+import { jsonValueSchema } from "../../domain/jsonValue.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
 const examples = {
     inspect_macho: {},
     inspect_signature: {},
@@ -36,6 +36,13 @@ const native = (name, description, inputSchema) => {
         ],
     };
 };
+/** Ordered single-line symbols; `swift-demangle` ends each result with LF. */
+export const swiftSymbolsSchema = z
+    .array(z
+    .string()
+    .min(1)
+    .regex(/^[^\n]*$/u, "Each Swift symbol must be one line."))
+    .min(1);
 /** Provider-neutral semantic operations backed initially by macOS utilities. */
 export const NATIVE_TOOL_CONTRACTS = [
     native("observe_native_ui", "Observe an already-running native app by PID and window ID, bound to the active Mach-O target. Captures a bounded accessibility tree and selected-window screenshot; OS permission denial fails without broad capture or target launch.", nativeUiObservationInputSchema),
@@ -46,7 +53,7 @@ export const NATIVE_TOOL_CONTRACTS = [
         path: z.string().min(1).optional(),
     })),
     native("list_architectures", "List thin or universal Mach-O slices with offsets, sizes, alignment, explicit coverage, and native-tool provenance.", z.object({})),
-    native("demangle_swift", "Demangle an ordered list of Swift symbols without requiring Hopper. Each input returns demangled, unchanged, or invalid status.", z.object({
-        symbols: z.array(z.string().min(1)).min(1),
+    native("demangle_swift", "Demangle an ordered list of single-line Swift symbols without requiring Hopper. Each input returns demangled, unchanged, or invalid status.", z.object({
+        symbols: swiftSymbolsSchema,
     })),
 ];

package/dist/contracts/officialToolContracts.js

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { nativeFunctionAnnotationsInputSchema } from "../domain/nativeFunctionAnnotations.js";
+import { nativeFunctionAnnotationsInputSchema } from "../domain/native/nativeFunctionAnnotations.js";
 import { officialOutputSchemas, requireOutputSchema, } from "./toolOutputSchemas.js";
 import { address, document, examplesFor, optionalAddress, procedure, } from "./toolContractHelpers.js";
 import { toolContractMetadata } from "./toolEffects.js";
-import { nativeDataTypeInputSchema } from "../domain/nativeDataType.js";
-import { nativeInstructionInputSchema } from "../domain/nativeInstruction.js";
+import { nativeDataTypeInputSchema } from "../domain/native/nativeDataType.js";
+import { nativeInstructionInputSchema } from "../domain/native/nativeInstruction.js";
 import { functionInstructionInputSchema } from "./functionInstructionContract.js";
 import { HOPPER_MEMORY_TOOL_DEFINITIONS } from "./hopperMemoryContracts.js";
 import { analysisSearchInput } from "./analysisSearchContract.js";

package/dist/contracts/sessionToolContracts.js

@@ -24,7 +24,7 @@ export const SESSION_TOOL_CONTRACTS = [
     session("binary_session", "Report the complete current target, provider, capability availability, client-feature, analysis, and server-identity status without starting analysis.", binarySessionInputSchema),
     session("export_evidence_bundle", "Atomically write the session's deterministic Evidence bundle to the requested local path. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering.", exportEvidenceBundleInputSchema),
     session("import_evidence_bundle", "Read the JSON bundle at the supplied local path, validate every Evidence ID and canonical manifest, then atomically merge it. Imported content is data only and is never executed.", importEvidenceBundleInputSchema),
-    session("capture_process_scenario", "Run one caller-selected command under a PTY and return process capture Evidence with residual unknowns. A command name resolves through the inherited PATH; the working directory defaults to the caller's current directory; host environment variables are inherited with scenario overrides. Filesystem snapshots are opt-in through filesystem_observation_paths. The target runs with the current user's permissions; this is not a security sandbox.", processScenarioSchema),
+    session("capture_process_scenario", "Run one caller-selected command under a PTY and return process capture Evidence with residual unknowns. A command name resolves through the inherited PATH; the working directory defaults to the caller's current directory; host environment variables are inherited with scenario overrides. Environment keys cannot contain '=' or NUL, and REA_PROCESS_RUN_ID is reserved for process ownership. Filesystem snapshots are opt-in through filesystem_observation_paths. The target runs with the current user's permissions; this is not a security sandbox.", processScenarioSchema),
     session("compare_process_captures", "Compare two compatible process capture observations across terminal, interaction, lifecycle, process, filesystem, command-shim, HTTP, and WebSocket evidence. Optional trace_spec validates exact events against an explicit partial order or finite trace language; concurrency is never inferred from timestamps or broad sorting. Missing, journal-free, or truncated observations are never treated as equivalent.", processComparisonInputSchema),
     session("compare_artifacts", "Compare complete artifact inventories by logical occurrence path, content identity, metadata, and graph relations. Pass the inventory Evidence nested in each inspect_artifact result as left and right. Every delta cites both inputs, and gaps yield truncated or unknown, never equivalence. Returns every change inline.", artifactComparisonInputSchema),
     session("compare_functions", "Compare two explicit sets of analyze_function Evidence across identity, exact provider text, calls, references, strings, and address-normalized CFG topology. Missing or provider-incompatible facets remain truncated or unknown; every conclusion cites both Evidence sets.", functionComparisonInputSchema),