rea-agents 4.1.0 → 6.0.0

package/dist/config/parseConfig.js

@@ -1,10 +1,29 @@
+import { accessSync, constants } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { ConfigurationError } from "../domain/configurationErrors.js";
 import { ok } from "../domain/result.js";
 import { parseEnvironment } from "./environment.js";
 import { parseStringArray, parseLoaderArgs } from "./parsers.js";
-const defaultHopperLauncherPath = () => process.platform === "linux"
-    ? "/opt/hopper/bin/Hopper"
-    : "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
+const DEFAULT_HOPPER_LAUNCHER_PATH = "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
+const SYSTEM_LINUX_HOPPER = "/opt/hopper/bin/Hopper";
+const executableAvailable = (path) => {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const defaultHopperLauncherPath = (platform = process.platform, homeDirectory = homedir(), executable = executableAvailable) => {
+    if (platform !== "linux")
+        return DEFAULT_HOPPER_LAUNCHER_PATH;
+    if (executable(SYSTEM_LINUX_HOPPER))
+        return SYSTEM_LINUX_HOPPER;
+    const userLocal = join(homeDirectory, ".local/share/rea/hopper/bin/Hopper");
+    return executable(userLocal) ? userLocal : SYSTEM_LINUX_HOPPER;
+};
 /** Parse provider configuration and runtime prerequisites at the composition root. */
 export const parseConfig = (environment) => {
     const parsed = parseEnvironment(environment);

package/dist/contracts/{androidToolContracts.js → android/androidToolContracts.js}

@@ -1,12 +1,12 @@
-import { androidInputSchemas, androidResultSchemas, } from "../domain/androidAnalysis.js";
-import { evidenceResultOf } from "./toolOutputSchemaPrimitives.js";
-import { toolContractMetadata } from "./toolEffects.js";
+import { androidInputSchemas, androidResultSchemas, } from "../../domain/android/androidAnalysis.js";
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { toolContractMetadata } from "../toolEffects.js";
 /** Static APK operations backed by a separately supplied headless engine. */
 export const ANDROID_TOOL_CONTRACTS = [
     {
         name: "inspect_android_package",
         ...toolContractMetadata("inspect_android_package"),
-        description: "Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and Java; uses one worker in an isolated temporary workspace.",
+        description: "Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and JDK; uses one worker in an isolated temporary workspace.",
         kind: "android-provider",
         inputSchema: androidInputSchemas.inspect_android_package,
         outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_package),
@@ -31,7 +31,7 @@ export const ANDROID_TOOL_CONTRACTS = [
     {
         name: "inspect_android_class",
         ...toolContractMetadata("inspect_android_class"),
-        description: "Inspect one exact Android class's methods, fields and inner classes. Returns display signatures and explicit unknown DEX descriptors without materializing the whole application source.",
+        description: "Inspect one exact Android class's parsed methods, fields and inner classes, including synthetic members. Returns display signatures and explicit unknown DEX descriptors without generating source. Overload indices remain consistent within the artifact and engine session.",
         kind: "android-provider",
         inputSchema: androidInputSchemas.inspect_android_class,
         outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_class),

package/dist/contracts/applicationToolContracts.js

@@ -1,15 +1,18 @@
-import { applicationVersionComparisonResultSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
-import { applicationFeatureTraceResultSchema } from "../domain/javascriptFeatureTraceSchemas.js";
-import { javaScriptSemanticTraceResultSchema } from "../domain/javascriptSemanticTraceSchemas.js";
-import { javaScriptExportShapeComparisonResultSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
-import { sourceToBundleComparisonResultSchema } from "../domain/sourceToBundleComparisonSchemas.js";
-import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, compareSourceToBundleRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "./applicationWorkflowInputContracts.js";
-import { reconstructionCoverageEvaluationInputSchema } from "../application/ReconstructionCoverageService.js";
+import { applicationVersionComparisonResultSchema } from "../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
+import { applicationFeatureTraceResultSchema } from "../domain/javascript/javascriptFeatureTraceSchemas.js";
+import { javaScriptSemanticTraceResultSchema } from "../domain/javascript/javascriptSemanticTraceSchemas.js";
+import { javaScriptExportShapeComparisonResultSchema } from "../domain/javascript/javascriptExportShapeComparisonSchemas.js";
+import { sourceToBundleComparisonResultSchema } from "../domain/javascript/sourceToBundleComparisonSchemas.js";
+import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, compareSourceToBundleRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "./javascript/applicationWorkflowInputContracts.js";
+import { reconstructionCoverageEvaluationInputSchema } from "../domain/reconstructionCoverageInput.js";
 import { reconstructionClosureResultSchema } from "../domain/reconstructionCoverage.js";
 import { reconstructionObligationLedgerInputSchema, reconstructionObligationLedgerSchema, } from "../domain/reconstructionObligationLedgerSchemas.js";
+import { androidApplicationProjectionInputSchema, androidApplicationProjectionResultSchema, } from "../domain/android/androidApplication.js";
+import { appleApplicationProjectionInputSchema, appleApplicationProjectionResultSchema, } from "../domain/apple/appleApplication.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { evidenceResultOf } from "./toolOutputSchemas.js";
-import { JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE, } from "./javascriptApplicationWorkflowExamples.js";
+import { JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE, } from "./javascript/javascriptApplicationWorkflowExamples.js";
+import { ANDROID_APPLICATION_GRAPH_EXAMPLE, APPLE_APPLICATION_GRAPH_EXAMPLE, MACOS_APPLICATION_GRAPH_EXAMPLE, } from "./mobileApplicationGraphExamples.js";
 const traceOutputSchema = evidenceResultOf(applicationFeatureTraceResultSchema);
 const semanticTraceOutputSchema = evidenceResultOf(javaScriptSemanticTraceResultSchema);
 const comparisonOutputSchema = evidenceResultOf(applicationVersionComparisonResultSchema);
@@ -201,6 +204,38 @@ export const APPLICATION_TOOL_CONTRACTS = [
             },
         ],
     },
+    {
+        name: "project_android_application_graph",
+        ...toolContractMetadata("project_android_application_graph"),
+        description: "Project authenticated APK inventory_artifact Evidence into an execution-free Android application inventory. Reports exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without decoding DEX, executing the APK, or claiming observed runtime calls.",
+        kind: "application",
+        inputSchema: androidApplicationProjectionInputSchema,
+        outputSchema: evidenceResultOf(androidApplicationProjectionResultSchema),
+        examples: [
+            {
+                title: "Project APK inventory Evidence into an Android application graph",
+                input: ANDROID_APPLICATION_GRAPH_EXAMPLE,
+            },
+        ],
+    },
+    {
+        name: "project_apple_application_graph",
+        ...toolContractMetadata("project_apple_application_graph"),
+        description: "Project authenticated IPA, macOS .app directory, ZIP, or DMG inventory Evidence into an execution-free Apple application inventory. Reports application roots, nested bundles with path-convention roles (app extensions, XPC services, login items, privileged helpers, system extensions, frameworks), launchd plists, exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without parsing plist/CMS semantics or claiming observed runtime calls.",
+        kind: "application",
+        inputSchema: appleApplicationProjectionInputSchema,
+        outputSchema: evidenceResultOf(appleApplicationProjectionResultSchema),
+        examples: [
+            {
+                title: "Project IPA inventory Evidence into an Apple application graph",
+                input: APPLE_APPLICATION_GRAPH_EXAMPLE,
+            },
+            {
+                title: "Project a macOS .app directory inventory into its bundle anatomy",
+                input: MACOS_APPLICATION_GRAPH_EXAMPLE,
+            },
+        ],
+    },
 ];
 export function applicationToolContract(name) {
     const contract = APPLICATION_TOOL_CONTRACTS.find(({ name: candidate }) => candidate === name);

package/dist/contracts/artifactToolContracts.js

@@ -3,8 +3,9 @@ import { artifactOutputSchemas } from "./toolOutputSchemas.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
-import { appleAssetCatalogInputSchema } from "../domain/appleAssetCatalog.js";
-import { keyedArchiveInputSchema } from "../domain/keyedArchive.js";
+import { appleAssetCatalogInputSchema } from "../domain/apple/appleAssetCatalog.js";
+import { dylibResolutionInputSchema } from "../domain/apple/dylibResolution.js";
+import { keyedArchiveInputSchema } from "../domain/apple/keyedArchive.js";
 /** Exact caller boundary for deterministic artifact inventory. */
 export const artifactInventoryInputSchema = z.strictObject({
     integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
@@ -22,6 +23,10 @@ const examples = {
     decode_interface_builder: {},
     inspect_asset_catalog: { offset: 0, limit: 1000 },
     inspect_keyed_archive: { path: "Contents/Resources/Model.plist" },
+    trace_dylib_resolution: {
+        roots: ["Contents/MacOS/App"],
+        architecture: "arm64",
+    },
 };
 const artifact = (name, description, inputSchema) => {
     const outputSchema = requireOutputSchema(artifactOutputSchemas, name);
@@ -51,6 +56,7 @@ export const ARTIFACT_TOOL_CONTRACTS = [
     })),
     artifact("inspect_keyed_archive", "Inspect one Foundation NSKeyedArchiver plist in the active app bundle as original object-table nodes, class descriptors, named roots, and UID edges. Preserves shared and cyclic references without instantiating classes. The path is relative to the bundle; root selection and object pagination preserve original identities.", keyedArchiveInputSchema),
     artifact("inspect_asset_catalog", "Inspect compiled Assets.car metadata in an active Apple app bundle. Returns stable paginated catalog and rendition records with raw assetutil metadata and catalog digests; rendition bytes are not extracted.", appleAssetCatalogInputSchema),
+    artifact("trace_dylib_resolution", "Trace how dyld would resolve each Mach-O dylib load for the active Mach-O, or for every executable in the active .app bundle (the main app, XPC services, extensions, login items, helpers). Expands @executable_path, @loader_path, and @rpath through each process's LC_RPATH stack in dependents-first load order, and reports every candidate path with its outcome, the resolved image and digest, weak, re-export, and upward flags, and derived findings such as unresolved required loads or absent earlier @rpath candidates. Pure header parsing: nothing is executed, and absolute or system paths outside the analyzed root stay undetermined. Select roots or one architecture to narrow large bundles.", dylibResolutionInputSchema),
 ];
 /** Provider operations; inventory remains an internal primitive of inspection. */
 export const ARTIFACT_ANALYSIS_OPERATIONS = [

package/dist/contracts/browserCaptureToolInputSchema.js

@@ -0,0 +1,43 @@
+import { browserCaptureComparisonInputSchema } from "../domain/browserCaptureComparison.js";
+import { browserScenarioCaptureSchema } from "../domain/browserScenarioCapture.js";
+import { captureSnapshotSchema } from "../domain/webCaptureDiffSchemas.js";
+// Captures are complete producer results to pass back unchanged, rather than
+// analyst-authored options. Describe that boundary without embedding the entire
+// inspection result schema in every comparison input. The cloned parser still
+// validates every nested field using the canonical domain schemas.
+const passiveCaptureInputSchema = captureSnapshotSchema.clone(captureSnapshotSchema.def);
+passiveCaptureInputSchema._zod.toJSONSchema = () => ({
+    type: "object",
+    properties: {
+        inspection: {
+            type: "object",
+            description: "Complete result object returned by inspect_web_page. Pass the entire result unchanged, including capture identity, observations, completeness, and limitations. Every nested field is validated by REA.",
+        },
+        webmcp: {
+            anyOf: [{ type: "object" }, { type: "null" }],
+            default: null,
+            description: "Complete result object returned by discover_webmcp_tools for this capture, or null when it was not recorded. Pass the entire result unchanged. Every nested field is validated by REA.",
+        },
+    },
+    required: ["inspection"],
+});
+const scenarioCaptureInputSchema = browserScenarioCaptureSchema.clone(browserScenarioCaptureSchema.def);
+scenarioCaptureInputSchema._zod.toJSONSchema = () => ({
+    type: "object",
+    description: "Complete result object returned by capture_browser_scenario. Pass the entire result unchanged, including browser and scenario identity, steps, events, artifact contents and digests, completeness, and limitations. Every nested field is validated by REA.",
+});
+/** Advertise capture round trips while retaining full runtime validation. */
+export const browserCaptureToolInputSchema = browserCaptureComparisonInputSchema.safeExtend({
+    before: passiveCaptureInputSchema
+        .optional()
+        .describe("Earlier passive web-page capture with complete producer results."),
+    after: passiveCaptureInputSchema
+        .optional()
+        .describe("Later passive web-page capture with complete producer results."),
+    before_scenario: scenarioCaptureInputSchema
+        .optional()
+        .describe("Earlier complete result object returned by capture_browser_scenario."),
+    after_scenario: scenarioCaptureInputSchema
+        .optional()
+        .describe("Later complete result object returned by capture_browser_scenario."),
+});

package/dist/contracts/browserScenarioToolContracts.js

@@ -21,7 +21,7 @@ export const BROWSER_SCENARIO_TOOL_CONTRACTS = [
     {
         name: "capture_browser_scenario",
         ...toolContractMetadata("capture_browser_scenario"),
-        description: "Run a controlled browser scenario when passive observation cannot exercise the application. Launch the selected executable or connect to a loopback CDP target, provide a start URL and actions, and select storage or artifacts when needed. Environment, empty storage, and a URL-only final capture are defaults; provide initial storage or additional artifacts when needed. Agents can run their own local fixture servers to control application responses. Actions run until completion or cancellation unless timeout_ms is set. Results are returned inline.",
+        description: "Run a controlled browser scenario when passive observation cannot exercise the application. Launch the selected executable or connect to a loopback CDP target, provide a start URL and actions, and select storage or artifacts when needed. Environment, empty storage, and a URL-only final capture are defaults. capture.network selects request_body, response_body, and header_values independently; selected content is returned inline with transaction and event references, byte digests, and explicit unavailable states. Credentials and declared secrets are redacted. Agents can run their own local fixture servers to control application responses. Actions run until completion or cancellation unless timeout_ms is set. Results are returned inline.",
         kind: "browser-provider",
         inputSchema: browserScenarioInputSchema,
         outputSchema: evidenceResultOf(browserScenarioCaptureSchema),

package/dist/contracts/browserToolContracts.js

@@ -2,10 +2,11 @@ import { browserTargetListSchema, inspectWebPageInputSchema, listBrowserTargetsI
 import { analyzeWebBundleInputSchema, webBundleAnalysisSchema, } from "../domain/webBundleAnalysis.js";
 import { observeWebSessionInputSchema, webObservationSessionSchema, } from "../domain/browserSession.js";
 import { discoverWebMcpToolsInputSchema, webMcpDiscoverySchema, } from "../domain/webMcpDiscovery.js";
-import { browserCaptureComparisonInputSchema, browserCaptureComparisonSchema, } from "../domain/browserCaptureComparison.js";
+import { browserCaptureComparisonSchema } from "../domain/browserCaptureComparison.js";
 import { captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, webScreenshotDiffSchema, webScreenshotSchema, } from "../domain/webScreenshot.js";
 import { toolContractMetadata } from "./toolEffects.js";
 import { evidenceResultOf } from "./toolOutputSchemas.js";
+import { browserCaptureToolInputSchema } from "./browserCaptureToolInputSchema.js";
 const evidenceResult = evidenceResultOf;
 const listOutputSchema = evidenceResult(browserTargetListSchema);
 const inspectionOutputSchema = evidenceResult(webPageInspectionSchema);
@@ -181,9 +182,9 @@ export const BROWSER_TOOL_CONTRACTS = [
     {
         name: "compare_web_captures",
         ...toolContractMetadata("compare_web_captures"),
-        description: "Compare passive web captures by providing before and after, or compare recorded scenarios by providing before_scenario and after_scenario with an optional normalization policy. Use exactly one input group. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and returns every artifact-level difference plus alignment failures inline. Missing or truncated evidence never proves equality.",
+        description: "Compare passive web captures by providing before and after, each with the complete inspect_web_page result in inspection and an optional complete discover_webmcp_tools result in webmcp; or compare recorded scenarios by passing complete capture_browser_scenario results in before_scenario and after_scenario with an optional normalization policy. Use exactly one input group. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and returns every artifact-level difference plus alignment failures inline. Missing or truncated evidence never proves equality.",
         kind: "browser-provider",
-        inputSchema: browserCaptureComparisonInputSchema,
+        inputSchema: browserCaptureToolInputSchema,
         outputSchema: captureDiffOutputSchema,
         examples: [
             {

package/dist/contracts/enhancedInputs.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { nativeValueTraceInputSchema } from "../domain/nativeValueTrace.js";
+import { nativeValueTraceInputSchema } from "../domain/native/nativeValueTrace.js";
 const traceLiteralInputSchema = z.strictObject({
     query: z.string().min(1),
     case_sensitive: z.boolean().default(false),

package/dist/contracts/errorSchemas.js

@@ -1,11 +1,14 @@
 import { z } from "zod";
+import { jsonValueSchema } from "../domain/jsonValue.js";
 const categorySchema = z.enum([
     "invalid_input",
     "unsupported_provider",
+    "unsupported_target",
     "integrity_mismatch",
     "truncated",
     "cancelled",
     "timeout",
+    "resource_constraint",
     "unavailable",
     "execution_failure",
 ]);
@@ -20,17 +23,21 @@ const common = {
     retryable: z.boolean(),
     remediation: remediationSchema,
 };
-const genericDetails = z.record(z.string(), z.json()).optional();
+const genericDetails = z.record(z.string(), jsonValueSchema).optional();
 const generic = (code) => z
     .object({ code: z.literal(code), ...common, details: genericDetails })
     .strict();
 /** Stable discriminated schema shared by every CLI and MCP error surface. */
 export const analysisErrorProjectionSchema = z.discriminatedUnion("code", [
     generic("invalid_request"),
+    generic("access_denied"),
+    generic("artifact_changed"),
     generic("unreadable_output"),
     generic("capability_unavailable"),
+    generic("unsupported_target"),
     generic("provider_unavailable"),
     generic("provider_timeout"),
+    generic("resource_constraint"),
     generic("cancelled"),
     z
         .object({

package/dist/contracts/evm/evmToolContracts.js

@@ -0,0 +1,20 @@
+import { inspectEvmInterfaceInputSchema, evmInterfaceSchema, } from "../../domain/evm/evmInterface.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemas.js";
+/** Target-free EVM capabilities are independent of archive/Apple artifact providers. */
+export const EVM_TOOL_CONTRACTS = [
+    {
+        name: "inspect_evm_interface",
+        ...toolContractMetadata("inspect_evm_interface"),
+        kind: "artifact-provider",
+        description: "Inspect an explicit local flat EVM bytecode carrier and infer dispatch selectors, argument strings and mutability without executing the target or accessing a chain/RPC endpoint. Choose raw or hex encoding explicitly. Returns original carrier and decoded-byte SHA-256, full bytecode and interface candidates inline as inferred Evidence; bytecode kind, hardfork, deployed authenticity and discovery completeness remain unknown. Initial real-verified Linux x64 profile uses unchanged bundled EVMole 0.9.3/WASM in a bounded owned worker; EOF-style EF00 containers are unsupported. No signature lookup, wallet action or transaction broadcast.",
+        inputSchema: inspectEvmInterfaceInputSchema,
+        outputSchema: evidenceResultOf(evmInterfaceSchema),
+        examples: [
+            {
+                title: "Inspect a local runtime bytecode hex carrier",
+                input: { path: "/artifacts/runtime.hex", encoding: "hex" },
+            },
+        ],
+    },
+];

package/dist/contracts/{firmwareToolContracts.js → firmware/firmwareToolContracts.js}

@@ -1,13 +1,13 @@
-import { firmwareInputSchemas, firmwareResultSchemas, } from "../domain/firmwareAnalysis.js";
-import { evidenceResultOf } from "./toolOutputSchemaPrimitives.js";
-import { toolContractMetadata } from "./toolEffects.js";
+import { firmwareInputSchemas, firmwareResultSchemas, } from "../../domain/firmware/firmwareAnalysis.js";
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { toolContractMetadata } from "../toolEffects.js";
 /** Explicit local firmware observations and extraction, backed by caller-supplied tools. */
 export const FIRMWARE_TOOL_CONTRACTS = [
     {
         name: "inspect_firmware_regions",
         ...toolContractMetadata("inspect_firmware_regions"),
         kind: "firmware-provider",
-        description: "Inspect signature candidates in a local firmware file with Binwalk 3.1.0. Returns offsets, reported lengths, descriptions and raw confidence values. Length validation and runtime addresses remain unknown. No extraction or target execution. Linux, caller-supplied tool and util-linux prlimit required; 128 MiB input limit, one worker and 120-second deadline.",
+        description: "Inspect signature candidates in a local firmware file with Binwalk 3.1.x (verified with 3.1.0). Returns offsets, reported lengths, descriptions and raw confidence values. Length validation and runtime addresses remain unknown. No extraction or target execution. Linux, caller-supplied tool and util-linux prlimit required; 128 MiB input limit, one worker and 120-second deadline.",
         inputSchema: firmwareInputSchemas.inspect_firmware_regions,
         outputSchema: evidenceResultOf(firmwareResultSchemas.inspect_firmware_regions),
         examples: [
@@ -21,7 +21,7 @@ export const FIRMWARE_TOOL_CONTRACTS = [
         name: "extract_firmware",
         ...toolContractMetadata("extract_firmware"),
         kind: "firmware-provider",
-        description: "Extract caller-selected firmware bytes with Unblob 26.6.4 into an absent output directory. Returns verified child paths/digests, task derivations, unknown chunks and extraction diagnostics inline. Preserves the default sandbox; publishes regular files only. Linux, caller-supplied tool, format-specific extractors and util-linux prlimit required. No mounts or extracted-code execution. Select a returned native file with open_binary for Ghidra analysis; decompressed offsets are not original-file addresses.",
+        description: "Extract caller-selected firmware bytes with Unblob 26.6.x (verified with 26.6.4) into an absent output directory. Returns verified child paths/digests, task derivations, unknown chunks and extraction diagnostics inline. Preserves the default sandbox; publishes regular files only. Linux, caller-supplied tool, format-specific extractors and util-linux prlimit required. No mounts or extracted-code execution. Select a returned native file with open_binary for Ghidra analysis; decompressed offsets are not original-file addresses.",
         inputSchema: firmwareInputSchemas.extract_firmware,
         outputSchema: evidenceResultOf(firmwareResultSchemas.extract_firmware),
         examples: [

package/dist/contracts/investigationExamples.js

@@ -1,9 +1,9 @@
 import { compareFunctions } from "../domain/functionComparison.js";
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { compareProcessCaptures, parseProcessCapture, } from "../domain/processCapture.js";
+import { compareProcessCaptures, parseProcessCapture, } from "../domain/process/processCapture.js";
 import { FUNCTION_COMPARISON_EXAMPLE } from "./functionComparisonExample.js";
-import { EMPTY_PROCESS_CAPTURE_EXAMPLE } from "./processCaptureExample.js";
+import { EMPTY_PROCESS_CAPTURE_EXAMPLE } from "./process/processCaptureExample.js";
 const comparison = compareFunctions(FUNCTION_COMPARISON_EXAMPLE.left, FUNCTION_COMPARISON_EXAMPLE.right);
 export const FUNCTION_COMPARISON_EVIDENCE = createEvidence(undefined, {
     id: "rea-function-comparison",

package/dist/contracts/{applicationWorkflowInputContracts.js → javascript/applicationWorkflowInputContracts.js}

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { evidenceInputSchema } from "./evidenceInputContracts.js";
-import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
-import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
-import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
-import { javaScriptSemanticQueryInputSchema } from "../domain/javascriptSemanticQuerySchemas.js";
-import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
+import { evidenceInputSchema } from "../evidenceInputContracts.js";
+import { compareApplicationVersionsInputSchema } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
+import { compareJavaScriptExportShapesInputSchema } from "../../domain/javascript/javascriptExportShapeComparisonSchemas.js";
+import { traceApplicationFeatureInputSchema } from "../../domain/javascript/javascriptFeatureTraceSchemas.js";
+import { javaScriptSemanticQueryInputSchema } from "../../domain/javascript/javascriptSemanticQuerySchemas.js";
+import { compareSourceToBundleInputSchema } from "../../domain/javascript/sourceToBundleComparisonSchemas.js";
 const traceApplicationFeatureFacts = {
     native_observations: traceApplicationFeatureInputSchema.shape.native_observations,
     seed: traceApplicationFeatureInputSchema.shape.seed,

package/dist/contracts/{electronToolContracts.js → javascript/electronToolContracts.js}

@@ -1,9 +1,9 @@
-import { toolContractMetadata } from "./toolEffects.js";
-import { evidenceResultOf } from "./toolOutputSchemas.js";
-import { electronPageInspectionSchema, electronTargetListSchema, inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../domain/electronObservation.js";
-import { electronActiveObservationInputSchema, electronActiveObservationResultSchema, } from "../domain/electronActiveObservation.js";
-import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
-import { javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeReconciliationSchemas.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemas.js";
+import { electronPageInspectionSchema, electronTargetListSchema, inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../../domain/javascript/electronObservation.js";
+import { electronActiveObservationInputSchema, electronActiveObservationResultSchema, } from "../../domain/javascript/electronActiveObservation.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
+import { javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema, } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE } from "./javascriptRuntimeReconciliationExample.js";
 const listOutputSchema = evidenceResultOf(electronTargetListSchema);
 const inspectionOutputSchema = evidenceResultOf(electronPageInspectionSchema);

package/dist/contracts/{javascriptApplicationWorkflowExamples.js → javascript/javascriptApplicationWorkflowExamples.js}

@@ -1,7 +1,7 @@
-import { createEvidence } from "../domain/evidence.js";
-import { reconcileJavaScriptRuntime } from "../domain/javascriptRuntimeReconciliation.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { reconcileJavaScriptRuntime } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
 import { JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE, } from "./javascriptRuntimeReconciliationExample.js";
-import { createHistoricalSourceGraph } from "../domain/referenceSourceGraph.js";
+import { createHistoricalSourceGraph } from "../../domain/referenceSourceGraph.js";
 const reconciliation = reconcileJavaScriptRuntime(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE);
 const reconciliationEvidence = createEvidence(undefined, {
     id: "rea-javascript-runtime-reconciliation",

package/dist/contracts/javascript/javascriptRecoveryToolContracts.js

@@ -0,0 +1,23 @@
+import { javascriptRecoveryInputSchema, javascriptRecoveryResultSchema, } from "../../domain/javascript/javascriptRecovery.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+/** Derived script artifacts from optional upstream recovery adapters. */
+export const JAVASCRIPT_RECOVERY_TOOL_CONTRACTS = [
+    {
+        name: "recover_javascript_sources",
+        ...toolContractMetadata("recover_javascript_sources"),
+        kind: "application",
+        description: "Recover readable modules from one local UTF-8 JavaScript script/bundle into an absent directory, using caller-supplied Wakaru 1.13.0 on Linux x64. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
+        inputSchema: javascriptRecoveryInputSchema,
+        outputSchema: evidenceResultOf(javascriptRecoveryResultSchema),
+        examples: [
+            {
+                title: "Recover a captured production bundle",
+                input: {
+                    path: "/tmp/web-scripts/app.js",
+                    output_directory: "/tmp/recovered-app",
+                },
+            },
+        ],
+    },
+];

package/dist/contracts/{javascriptRuntimeObservationToolContracts.js → javascript/javascriptRuntimeObservationToolContracts.js}

@@ -1,6 +1,6 @@
-import { toolContractMetadata } from "./toolEffects.js";
-import { evidenceResultOf } from "./toolOutputSchemas.js";
-import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeObservation.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { evidenceResultOf } from "../toolOutputSchemas.js";
+import { javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema, } from "../../domain/javascript/javascriptRuntimeObservation.js";
 const endpoint = "http://127.0.0.1:9229";
 /** Passive Node/Electron V8 Inspector discovery and observation contracts. */
 export const JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS = [

package/dist/contracts/{javascriptRuntimeReconciliationExample.js → javascript/javascriptRuntimeReconciliationExample.js}

@@ -1,8 +1,8 @@
-import { createEvidence } from "../domain/evidence.js";
-import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../domain/javascriptApplicationGraph.js";
-import { createWebTextArtifact } from "../domain/webContentArtifact.js";
-import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../domain/javascriptSemanticGraph.js";
-import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../domain/javascriptSemanticGraphSchemas.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
+import { createWebTextArtifact } from "../../domain/webContentArtifact.js";
+import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../../domain/javascript/javascriptSemanticGraph.js";
+import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 const applicationSha256 = "1".repeat(64);
 const script = createWebTextArtifact("export const example = true;\n", "text/javascript");
 const inputPath = "/Applications/Example.app/Contents/Resources/app";

package/dist/contracts/{managedToolContracts.js → managed/managedToolContracts.js}

@@ -1,14 +1,18 @@
 import { z } from "zod";
-import { managedOutputSchemas } from "./toolOutputSchemas.js";
-import { toolContractMetadata } from "./toolEffects.js";
-import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
+import { managedOutputSchemas } from "../toolOutputSchemas.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
+import { isAbsoluteLocalPath } from "../../domain/localPath.js";
 /** Exact caller boundary for execution-free PE/CLI triage and identity. */
-const managedTargetInputSchema = z.object({
+const managedTargetInputSchema = z.strictObject({
     path: z
         .string()
         .min(1)
-        .optional()
-        .describe("Explicit managed PE/CLI path; omit to reuse the previously selected managed target"),
+        .refine(isAbsoluteLocalPath, {
+        message: "path must be an absolute local filesystem path (for example /tmp/Example.dll or C:\\Example.dll)",
+    })
+        .describe("Explicit absolute managed PE/CLI path; omit to reuse the previously selected managed target")
+        .optional(),
 });
 export const managedArtifactInputSchema = managedTargetInputSchema;
 /** Exact caller boundary for execution-free metadata/signature/IL inspection. */

package/dist/contracts/{managedWorkflowExamples.js → managed/managedWorkflowExamples.js}

@@ -1,4 +1,4 @@
-import { createEvidence } from "../domain/evidence.js";
+import { createEvidence } from "../../domain/evidence.js";
 const MANAGED_STATIC_EXAMPLE_PROVIDER = {
     id: "rea-dotnet-static",
     name: "REA managed static analysis provider",

package/dist/contracts/{managedWorkflowToolContracts.js → managed/managedWorkflowToolContracts.js}

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { evidenceSchema } from "../domain/evidence.js";
-import { managedReconstructionImportInputSchema } from "../domain/managedReconstruction.js";
-import { managedWorkflowOutputSchemas } from "./toolOutputSchemas.js";
+import { evidenceSchema } from "../../domain/evidence.js";
+import { managedReconstructionImportInputSchema } from "../../domain/managed/managedReconstruction.js";
+import { managedWorkflowOutputSchemas } from "../toolOutputSchemas.js";
 import { MANAGED_MEMBER_COMPARISON_EXAMPLE, MANAGED_NATIVE_VERIFICATION_EXAMPLE, MANAGED_APPLICATION_GRAPH_EXAMPLE, MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE, } from "./managedWorkflowExamples.js";
-import { toolContractMetadata } from "./toolEffects.js";
-import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js";
+import { toolContractMetadata } from "../toolEffects.js";
+import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
 /** Inputs for comparing two managed observations carried inline. */
 export const compareManagedMembersReferenceInputSchema = z
     .strictObject({
@@ -96,7 +96,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     {
         name: "compare_managed_members",
         ...toolContractMetadata("compare_managed_members"),
-        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
+        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact CIL/signature, exact declared type, name, and raw signature (decoded or not), and decoded structural method shape. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
         kind: "application",
         inputSchema: compareManagedMembersReferenceInputSchema,
         outputSchema: comparisonOutputSchema,