rea-agents 6.3.0 → 6.5.0

package/dist/cli-runtime/toolContracts-D2FOG_Nb.js

@@ -0,0 +1,3721 @@
+import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
+import { analysisProviderSelectorSchema, analyzeJavaScriptSemantics, androidApplicationProjectionInputSchema, androidApplicationProjectionResultSchema, appleApplicationProjectionInputSchema, appleApplicationProjectionResultSchema, browserScenarioCaptureSchema, browserTargetListSchema, captureWebScreenshotInputSchema, compareWebScreenshotsInputSchema, createEvidence, createWebTextArtifact, digestCanonicalValue, electronActiveObservationInputSchema, electronActiveObservationResultSchema, electronPageInspectionSchema, electronTargetListSchema, evidenceResultOf, evidenceSchema, functionComparisonInputSchema, harmonyApplicationProjectionInputSchema, harmonyApplicationProjectionResultSchema, init_androidApplication, init_appleApplication, init_browserObservation, init_browserObservationSchemas, init_browserScenarioCapture, init_canonicalDigest, init_electronActiveObservation, init_electronObservation, init_evidence, init_functionComparisonSchemas, init_harmonyApplication, init_javascriptRuntimeObservation, init_javascriptSemanticAnalysis, init_localPath, init_processScenario, init_providerSelection, init_reconstructionCoverage, init_reconstructionCoverageInput, init_reconstructionObligationLedgerSchemas, init_residualUnknown, init_toolOutputSchemaPrimitives, init_webContentArtifact, init_webScreenshot, inspectElectronPageInputSchema, inspectWebPageInputSchema, javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listBrowserTargetsInputSchema, listElectronTargetsInputSchema, listJavaScriptRuntimeTargetsInputSchema, localPathStringSchema, observeJavaScriptRuntimeInputSchema, processScenarioSchema, reconstructionClosureResultSchema, reconstructionCoverageEvaluationInputSchema, reconstructionObligationLedgerInputSchema, reconstructionObligationLedgerSchema, recordUnknownInputSchema, requireOutputSchema, updateUnknownInputSchema, webPageInspectionSchema, webScreenshotDiffSchema, webScreenshotSchema } from "./reconstructionObligationLedgerSchemas-Bao0xMr-.js";
+import { CUTTER_TOOL_CONTRACTS, EVM_TOOL_CONTRACTS, FRIDA_TOOL_CONTRACTS, NATIVE_TOOL_CONTRACTS, WASM_TOOL_CONTRACTS, adbInputSchemas, adbResultSchemas, addressContextInputSchema, analyzeWebBundleInputSchema, apktoolInputSchemas, apktoolResultSchemas, browserCaptureComparisonInputSchema, browserCaptureComparisonSchema, browserScenarioInputSchema, decodeSignalRecordingInputSchema, discoverWebMcpToolsInputSchema, evidenceInputSchema, exportWebScriptsInputSchema, firmwareInputSchemas, firmwareResultSchemas, getEvidenceBundleInputSchema, goBinarySchema, importEvidenceBundleInputSchema, init_adbDeviceAnalysis, init_apktoolResourceAnalysis, init_browserCaptureComparison, init_browserScenario, init_browserSession, init_cutterToolContracts, init_evidenceInputContracts, init_evmToolContracts, init_firmwareAnalysis, init_fridaToolContracts, init_goBinary, init_javascriptRecovery, init_jebAnalysis, init_nativeToolContracts, init_packetCapture, init_packetFields, init_peResources, init_recordedCrash, init_reverseEngineering, init_rustBinary, init_sessionToolSchemas, init_signalDecoders, init_signalRecording, init_sqliteDatabase, init_wasmToolContracts, init_webBundleAnalysis, init_webEventListeners, init_webExecution, init_webMcpDiscovery, init_webModuleTrace, init_webScriptExport, init_webSourceLocation, inspectGoBinaryInputSchema, inspectPacketCaptureInputSchema, inspectPacketFieldsInputSchema, inspectPeResourcesInputSchema, inspectRecordedCrashInputSchema, inspectRustBinaryInputSchema, inspectSignalDecodersInputSchema, inspectSqliteDatabaseInputSchema, inspectWebEventListenersInputSchema, javascriptRecoveryInputSchema, javascriptRecoveryResultSchema, jebInputSchemas, jebResultSchemas, listUnknownsInputSchema, navigationContextInputSchema, objdumpInputSchema, observeWebExecutionInputSchema, observeWebSessionInputSchema, packetCaptureSchema, packetFieldsCatalogSchema, peResourcesSchema, processComparisonInputSchema, recordedCrashSchema, rizinInputSchema, rustBinarySchema, signalDecodersSchema, signalRecordingSchema, sqliteDatabaseSchema, verifyUnknownResolutionInputSchema, webBundleAnalysisSchema, webEventListenersSchema, webExecutionSchema, webMcpDiscoverySchema, webModuleTraceInputSchema, webModuleTraceResultSchema, webObservationSessionSchema, webScriptExportResultSchema, webSourceLocationInputSchema, webSourceLocationResultSchema } from "./cutterToolContracts-TZH9EHr5.js";
+import { init_jsonValue, jsonObjectSchema, jsonValueSchema } from "./errorSchemas-CTRmvMl3.js";
+import { analysisDetailOutputSchemaOf, analysisDetailSchema, analysisViewResultSchema, androidInputSchemas, androidPackageInspectionInputSchema, androidPackageSummaryViewResultSchema, androidResultSchemas, artifactComparisonInputSchema, binaryArchitectureSchema, binaryLayoutSchema, binaryLayoutSummaryViewResultSchema, bundleComparisonInputSchema, callPathInputSchema, changedBehaviorInputSchema, dartAotInspectionInputSchema, dartAotSummaryViewResultSchema, electronFuseOutputSchemas, enhancedOutputSchemas, flutterInputSchemas, flutterResultSchemas, init_analysisDetail, init_analysisView, init_androidAnalysis, init_artifactComparison, init_binaryLayout, init_bundleComparison, init_callPathSchemas, init_changedBehavior, init_electronFuses, init_flutterBuildAnalysis, init_managedNativeVerificationSchemas, init_managedReconstruction, init_pcapAnalysis, init_rawBinary, init_reconstructionVerificationSchemas, init_staticRuntimeCorrelation, init_toolEffects, init_toolOutputSchemaGroups, init_webNetworkCapture, inspectAnalysisViewInputSchema, inspectBinaryLayoutInputSchema, inspectElectronFusesInputSchema, inspectWebNetworkCaptureInputSchema, javascriptApplicationSummaryViewResultSchema, managedNativeVerificationInputSchema, managedReconstructionImportInputSchema, managedWorkflowOutputSchemas, pcapCaptureSummaryViewResultSchema, pcapInputSchemas, pcapResultSchemas, rawBinaryEntryPointSchema, rawBinarySelectionError, reconstructionVerificationInputSchema, sessionOutputSchemas, staticRuntimeCorrelationInputSchema, toolContractMetadata, webNetworkCaptureSchema, webNetworkCaptureSummaryViewResultSchema } from "./toolOutputSchemaGroups-DRiYs1je.js";
+import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES, JavaScriptSemanticEvidenceContextRegistry, analyzeJavaScriptApplicationInputSchema, completeApplicationCoverage, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, init_javascriptApplicationAnalysis, init_javascriptApplicationEvidenceSchemas, init_javascriptApplicationGraph, init_javascriptSemanticGraph, init_javascriptSemanticGraphSchemas, javascriptApplicationAnalysisResultSchema, partialApplicationCoverage } from "./javascriptApplicationAnalysis-HgMzVMQw.js";
+import { MANAGED_TOOL_CONTRACTS, executableFormatHintSchema, init_dosCom, init_managedToolContracts } from "./managedToolContracts-D60QmIYj.js";
+import { applicationFeatureTraceResultSchema, applicationVersionComparisonResultSchema, compareApplicationVersionsInputSchema, compareJavaScriptExportShapesInputSchema, compareSourceToBundleInputSchema, createHistoricalSourceGraph, init_javascriptApplicationVersionComparisonSchemas, init_javascriptExportShapeComparisonSchemas, init_javascriptFeatureTraceSchemas, init_referenceSourceGraph, init_sourceToBundleComparisonSchemas, javaScriptExportShapeComparisonResultSchema, sourceToBundleComparisonResultSchema, traceApplicationFeatureInputSchema } from "./javascriptExportShapeComparisonSchemas-BYnoIqIk.js";
+import { init_javascriptSemanticQuerySchemas, init_javascriptSemanticTraceSchemas, javaScriptSemanticQueryInputSchema, javaScriptSemanticTraceResultSchema } from "./javascriptSemanticTraceSchemas-BTCNcvbc.js";
+import { ARTIFACT_TOOL_CONTRACTS, OFFICIAL_TOOL_CONTRACTS, TOOL_EXAMPLE_OVERRIDES, enhancedInputSchemas, examplesFor, init_artifactToolContracts, init_enhancedInputs, init_officialToolContracts, init_toolContractExamples, init_toolContractHelpers } from "./officialToolContracts-CCFF0an9.js";
+import { init_javascriptRuntimeReconciliationSchemas, javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema } from "./javascriptRuntimeReconciliationSchemas-BWpGWNcI.js";
+import { init_javascriptRuntimeReconciliation, parseRuntimeReconciliationInput, reconcileJavaScriptRuntime } from "./javascriptRuntimeReconciliation-DNjDoL3S.js";
+import { init_javascriptExportReturnShapeProjection, projectJavaScriptExportReturnShapes } from "./javascriptExportReturnShapeProjection-Dg00g35t.js";
+import { z } from "zod";
+import { isAbsolute } from "node:path";
+
+//#region dist/contracts/captures/captureToolContracts.js
+var CAPTURE_TOOL_CONTRACTS;
+function init_captureToolContracts() {
+	return (init_captureToolContracts = __esmMin((() => {
+		init_packetFields();
+		init_packetCapture();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		CAPTURE_TOOL_CONTRACTS = [{
+			name: "inspect_packet_fields",
+			...toolContractMetadata("inspect_packet_fields"),
+			kind: "artifact-provider",
+			description: "Discover protocols or field names/types registered in the installed TShark 4.x. kind defaults to protocols; use fields and optional exact protocol abbreviation to select field definitions. query searches name/abbreviation/description by case-insensitive literal substring. Return 50 matches by default with offset/limit paging; null requests all remaining within resource limits. Preserve type/base/bitmask/description, duplicate registrations, source line numbers, coverage, tool identity and diagnostics. Linux, REA_TSHARK_COMMAND and prlimit required. No capture file, interface or binary target needed. Registrations describe tool capabilities, not observed traffic. Each call rereads the glossary; use selected fields with inspect_packet_capture.",
+			inputSchema: inspectPacketFieldsInputSchema,
+			outputSchema: evidenceResultOf(packetFieldsCatalogSchema),
+			examples: [{
+				title: "Find USB protocol registrations",
+				input: { query: "usb" }
+			}, {
+				title: "Find the installed USB vendor-ID field",
+				input: {
+					kind: "fields",
+					protocol: "usb",
+					query: "idVendor"
+				}
+			}]
+		}, {
+			name: "inspect_packet_capture",
+			...toolContractMetadata("inspect_packet_capture"),
+			kind: "artifact-provider",
+			description: "Inspect caller-selected fields in an existing local packet capture with TShark 4.x. Return 50 matching frames by default, with match_offset/match_limit paging and coverage counts; match_limit:null requests all remaining matches. Preserve repeated values, frame numbers, display filter, decode-as rules and pass mode in inline Evidence with source/tool identity and diagnostics. Optional packet_limit counts input packets before filtering; output paging does not shorten dissection or two-pass reassembly. Requires Linux, util-linux prlimit, and absolute REA_TSHARK_COMMAND. File-only analysis; no live capture or device communication. Missing fields or no matches do not establish absence of device traffic.",
+			inputSchema: inspectPacketCaptureInputSchema,
+			outputSchema: evidenceResultOf(packetCaptureSchema),
+			examples: [{
+				title: "Inspect UDP exchanges in a recording",
+				input: {
+					path: "/artifacts/device.pcapng",
+					fields: [
+						"ip.addr",
+						"udp.port",
+						"data.data"
+					],
+					display_filter: "udp",
+					decode_as: [],
+					packet_limit: null,
+					two_pass: true
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/signals/signalToolContracts.js
+var SIGNAL_TOOL_CONTRACTS;
+function init_signalToolContracts() {
+	return (init_signalToolContracts = __esmMin((() => {
+		init_signalDecoders();
+		init_signalRecording();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		SIGNAL_TOOL_CONTRACTS = [{
+			name: "inspect_signal_decoders",
+			...toolContractMetadata("inspect_signal_decoders"),
+			kind: "artifact-provider",
+			description: "Discover installed sigrok protocol decoders or inspect one decoder's channel/option help on Linux. Omit decoder to list ID/name pairs; supply its exact ID for literal help lines with source line numbers. query is a case-insensitive literal substring. Page matches with offset/limit (default 50; null returns all remaining). Reports tool identity, version, diagnostics and examined/matching coverage. Uses configured REA_SIGROK_COMMAND and prlimit; no recording, binary target, hardware scan or acquisition. Each call probes again; decoder modules are trusted, not fully fingerprinted. Use returned IDs/options with decode_signal_recording.",
+			inputSchema: inspectSignalDecodersInputSchema,
+			outputSchema: evidenceResultOf(signalDecodersSchema),
+			examples: [{
+				title: "Find installed UART decoders",
+				input: { query: "uart" }
+			}, {
+				title: "Read the installed UART baud-rate option",
+				input: {
+					decoder: "uart",
+					query: "baud"
+				}
+			}]
+		}, {
+			name: "decode_signal_recording",
+			...toolContractMetadata("decode_signal_recording"),
+			kind: "artifact-provider",
+			description: "Decode an existing local logic/signal recording on Linux with sigrok-cli 0.7.2 and util-linux prlimit. Supply decoder stack, channels and options explicitly; optionally select input format and annotation classes. Return 50 literal output lines by default, with line_offset/line_limit paging; line_limit:null requests all remaining lines. Output windows count display lines, not annotations or samples, and do not shorten decoding. Preserve selected text, sample ranges, stderr, source/tool identity and coverage inline. Configure absolute REA_SIGROK_COMMAND. File-only analysis; no hardware acquisition or device communication. Empty output does not prove absence of traffic.",
+			inputSchema: decodeSignalRecordingInputSchema,
+			outputSchema: evidenceResultOf(signalRecordingSchema),
+			examples: [{
+				title: "Decode recorded UART RX bytes",
+				input: {
+					path: "/artifacts/uart.vcd",
+					input_format: "vcd",
+					decoders: "uart:rx=RX:baudrate=9600",
+					annotations: "uart=rx-data"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/go/goToolContracts.js
+var GO_TOOL_CONTRACTS;
+function init_goToolContracts() {
+	return (init_goToolContracts = __esmMin((() => {
+		init_goBinary();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		GO_TOOL_CONTRACTS = [{
+			name: "inspect_go_binary",
+			...toolContractMetadata("inspect_go_binary"),
+			kind: "artifact-provider",
+			description: "Inspect embedded Go compiler version, main module, dependency/replacement versions and build settings in an explicit local ELF, PE or thin Mach-O image. Returns original artifact SHA-256, exact build-info source ranges, raw framed module bytes and unparsed module-text lines inline as observed Evidence. Supports inline and historical pointer encodings without installing Go, opening a disassembler, executing the target, writing temporary files or accessing the network. Missing metadata is reported as unknown, not proof that an image is not Go. Does not recover functions, source mappings, types or runtime behavior. Resource guards bound files to 256 MiB, aggregate embedded strings to 1 MiB, structural table decoding to 16 MiB and complete inline metadata to 8 MiB; malformed, unsupported and oversized inputs receive typed failures rather than partial success.",
+			inputSchema: inspectGoBinaryInputSchema,
+			outputSchema: evidenceResultOf(goBinarySchema),
+			examples: [{
+				title: "Inspect embedded build provenance",
+				input: { path: "/artifacts/application" }
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/rust/rustToolContracts.js
+var RUST_TOOL_CONTRACTS;
+function init_rustToolContracts() {
+	return (init_rustToolContracts = __esmMin((() => {
+		init_rustBinary();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		RUST_TOOL_CONTRACTS = [{
+			name: "inspect_rust_binary",
+			...toolContractMetadata("inspect_rust_binary"),
+			kind: "artifact-provider",
+			description: "Inspect the cargo-auditable crate dependency list embedded in an explicit local ELF, PE or thin Mach-O image. Returns the artifact SHA-256, the .dep-v0 section file offset and size, compressed and uncompressed sizes, format version, packages in their original order, the root package index, and dependency edges by index. Reads zlib-compressed JSON without installing Rust, opening a disassembler, executing the target, writing temporary files or accessing the network. A missing section is null metadata with a limitation and is not proof that the binary has no dependencies. A rustc commit hash is reported only as an inference when a /rustc/<40-hex>/ path is present in read-only data. Resource guards bound files to 256 MiB, dependency sections to 1 MiB, inflated JSON to the smaller of 8 MiB and 64 times the compressed size, and the complete report to 8 MiB. Malformed, unsupported and oversized inputs receive typed failures rather than partial success.",
+			inputSchema: inspectRustBinaryInputSchema,
+			outputSchema: evidenceResultOf(rustBinarySchema),
+			examples: [{
+				title: "Inspect an embedded Rust dependency list",
+				input: { path: "/artifacts/application" }
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/sqlite/sqliteToolContracts.js
+var SQLITE_TOOL_CONTRACTS;
+function init_sqliteToolContracts() {
+	return (init_sqliteToolContracts = __esmMin((() => {
+		init_sqliteDatabase();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		SQLITE_TOOL_CONTRACTS = [{
+			name: "inspect_sqlite_database",
+			...toolContractMetadata("inspect_sqlite_database"),
+			kind: "artifact-provider",
+			description: "Inspect an explicit local SQLite database snapshot and its existing sibling WAL without modifying source files or opening a native analysis provider. Requires Node.js 24.x >=24.15 or 26+ with native DatabaseSync.limits support, checked by the worker. Returns observed Evidence with database/WAL SHA-256 and a compact schema inventory. Selecting an exact ordinary table expands only its schema and samples rows (default 20, subject to byte and worker resource limits). Select exact columns in the requested order to avoid unrelated or large values; schema_scope=database explicitly expands the whole schema; returned rows retain 64-bit integers, text bytes and blobs with explicit truncation. No arbitrary SQL, view or virtual-table execution, extension loading, database repair, encryption support or live-snapshot atomicity claim. At most two inspections per provider are admitted; occupied capacity is retryable. An isolated temporary copy and owned worker enforce input, value/record, SQL-statement, JSON-reply, JavaScript-heap and deadline limits; overall native heap is not capped. Supply a quiescent snapshot for coherent database/WAL evidence.",
+			inputSchema: inspectSqliteDatabaseInputSchema,
+			outputSchema: evidenceResultOf(sqliteDatabaseSchema),
+			examples: [
+				{
+					title: "Inspect a compact inventory of a local SQLite snapshot",
+					input: { path: "/artifacts/application.sqlite" }
+				},
+				{
+					title: "Read selected rows from an ordinary table",
+					input: {
+						path: "/artifacts/application.sqlite",
+						table: "settings",
+						columns: ["key", "value"],
+						row_limit: 20
+					}
+				},
+				{
+					title: "Expand the complete stored schema",
+					input: {
+						path: "/artifacts/application.sqlite",
+						schema_scope: "database"
+					}
+				}
+			]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/analysisViewApiSurfaceExample.js
+var API_SURFACE_EXAMPLE;
+function init_analysisViewApiSurfaceExample() {
+	return (init_analysisViewApiSurfaceExample = __esmMin((() => {
+		API_SURFACE_EXAMPLE = {
+			input: {
+				source: {
+					kind: "retained-evidence",
+					evidence_id: "ev_9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097"
+				},
+				view: {
+					kind: "api-surface",
+					offset: 0,
+					limit: 50
+				}
+			},
+			output: {
+				parent_evidence_id: "ev_9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097",
+				parent_operation: "inspect_web_network_capture",
+				parent_digest: "9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097",
+				view_digest: "47c1859b7a86dd10770061767300bdb6ec177a9254e8dc7863d5ea8603343da6",
+				artifact: {
+					path: "/fixtures/api-surface.har",
+					sha256: "bf58e2c06e55bfe7e0628157c4ad027ce0aeb81a10e8edef8a7f95b8e5f14225"
+				},
+				coverage: {
+					status: "page",
+					examined: 1,
+					total: 1,
+					next_offset: null,
+					exhausted: true
+				},
+				limitations: ["Grouping does not establish handler identity, URL-space schemas or causality.", "HAR text is producer-decoded Unicode. Original body bytes remain unknown unless content explicitly uses valid base64; declared sizes are preserved independently of retained bytes. mitmproxy 12.2.3 SaveHar may report null optional postData.text; that null is retained and omitted only from the upstream validation copy."],
+				unknowns: [],
+				records: {
+					examined: 2,
+					total: 2,
+					excluded: 0
+				},
+				templated_groups: 1,
+				groups: [{
+					method: "GET",
+					origin: "https://api.example.test",
+					path_template: "/users/{numeric}",
+					templated_segments: [{
+						segment_index: 1,
+						rule: "numeric",
+						basis: "inferred",
+						observed_values: ["8812", "9031"]
+					}],
+					record_ordinals: [0, 1],
+					statuses: [200, 404],
+					content_types: ["application/json", "text/plain"],
+					flags: ["mixed-statuses", "mixed-content-types"]
+				}],
+				excluded_records: [],
+				kind: "api-surface",
+				view: {
+					kind: "api-surface",
+					offset: 0,
+					limit: 50
+				}
+			}
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/analysisViewToolContracts.js
+var RETAINED_EXAMPLE_ID, ANALYSIS_VIEW_TOOL_CONTRACTS;
+function init_analysisViewToolContracts() {
+	return (init_analysisViewToolContracts = __esmMin((() => {
+		init_analysisViewApiSurfaceExample();
+		init_analysisView();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		RETAINED_EXAMPLE_ID = `ev_${"a".repeat(64)}`;
+		ANALYSIS_VIEW_TOOL_CONTRACTS = [{
+			name: "inspect_analysis_view",
+			...toolContractMetadata("inspect_analysis_view"),
+			kind: "application",
+			description: "Inspect selected views of completed binary-layout, JavaScript application, native analyze_function, inspect_artifact, inventory_artifact, inspect_wasm_artifact, inspect_macho, decode_interface_builder, inspect_evm_interface, inspect_managed_artifact, inspect_managed_members, inspect_android_package, inspect_dart_aot or inspect_web_network_capture Evidence without repeating analysis. Historical capture summaries return identity and counts without bodies or archive inventories. Capture views page retained records: view {kind: \"capture\", detail: \"preview\" | \"complete\", offset: 0, limit: 20}; preview selects recorded headline fields and binary descriptors, complete returns exact records with all sidecars. Offsets follow the selected parent record order, preserving original producer ordinals. Paging never reopens the source or reruns the decoder. For inspect_pcap_capture parents, kind pcap pages endpoints, dns-queries, tls-sni, protocols, http-uris or unattributed-addresses. Select an exact query for dns-addresses, or a tshark/capinfos stream for UTF-16 diagnostics text. Page totals count retained facts; source coverage remains explicit. Qlog summaries keep profile/scope and counts; kind qlog pages traces, streams, loss-declarations, incomplete-records, contributions, ranges or final-sizes. Except traces, select trace_index; stream-specific facets also require exact stream_id and direction. Facts retain all-recorded-events-before-selection scope, and interval overlap or endpoint loss declarations do not prove retransmission or network loss. The api-surface view groups retained HAR requests by method, origin and format-rule path template; templated segments are inferences. It reads no headers or bodies and reports no query values. For a retained record use source: {kind: \"retained-evidence\", evidence_id: \"<parent_evidence_id>\"}. Use normalized_result.parent_evidence_id from a summary receipt. Source kind is required. Portable source uses {kind: \"inline\", evidence: <complete Evidence>}. For layout, JavaScript, inventory, WASM, Mach-O, Interface Builder, EVM, managed artifact, Android package and Dart AOT sources, request a summary with view: {kind: \"summary\"}; summary is a view kind and has no facet. The WASM summary gives validation, counts, WAT digest/length, tool profile and execution/network states without reading WAT text. Select a layout mitigations/linkage facet, one section/symbol/module, or a stable page. Module pages include assets, bundled and source modules; use node_id for ambiguous or unavailable paths. Inventory uses view: {kind: \"inventory\", collection: \"occurrences\", logical_paths: [\"package.json\"], offset: 0, limit: 64}. Inventory views page nodes, occurrences, edges or integrity contradictions; occurrence logical_paths matches exact recorded strings (omitted means all available, [] means none). source_complete distinguishes complete inventories from partial source records; page exhaustion does not prove absence in a partial source. WASM views use kind wasm and facet sections/imports/exports/candidates/glue/wat/headers/details/tool_profile; text facets use UTF-16 code units and source forms remain exact. Mach-O views use kind macho and facet entrypoints/architectures/build_metadata/load_commands/dependencies/imports/exports/segments/provenance; source_exhaustive false means unreturned rows may exist. Interface Builder views use kind interface-builder and collection documents/nodes/edges/coverage; nodes and edges accept an exact document relative_path. EVM summary returns all inferred interface candidates, carrier/decoded identities and explicit unknowns without hex or duplicate stdout. EVM views use kind evm and facet functions/bytecode_hex/stdout/stderr; function pages preserve the original candidate rows, and text offsets/limits count UTF-16 code units (hex has two characters per decoded byte). Exhausting candidate pages does not establish global interface completeness. Managed artifact summaries preserve complete identity/classification, metadata status, module/MVID, frameworks, coverage and limitations without unrelated inventories. Managed pages use kind managed and collection references/resources/attributes, retaining source coverage and build-local token scope; page exhaustion does not establish complete metadata. Managed member summaries keep identity, selection with unmatched names, coverage and per-collection counts; managed-members pages use collection types/exported_types/fields/methods/member_refs/call_edges/field_accesses/user_strings and carry the source selection and coverage. Android package summaries retain all declarations, engine identity and counts without decoded manifest text. Android manifest pages use kind android, facet manifest, offset and limit in UTF-16 code units; source_status preserves partial decoded coverage even when the retained text page is exhausted. Dart AOT summary preserves target/ABI/library identity, snapshot headers and pool lower bounds. String pages use kind dart-aot, collection package_uris/dart_uris/class_like_tokens; source coverage remains partial when the producer says partial. Native function Evidence requires kind native: view: {kind: \"native\", facet: \"procedure\"}. Facets select procedure, pseudocode, assembly, basic blocks, comments, callers/callees, references, unresolved calls, referenced strings/names, native API and high-pcode. Use nonnegative offset and a positive caller-selected limit (defaults 0 and 64); pseudocode uses UTF-16 code units, other native pages use rows. Returns artifact identity, parent Evidence ID, a distinct view digest, coverage, limitations and unknowns. Actual serialized size determines MCP transport admission; choose a smaller page or export the complete retained Evidence if needed.",
+			inputSchema: inspectAnalysisViewInputSchema,
+			outputSchema: evidenceResultOf(analysisViewResultSchema),
+			examples: [
+				{
+					title: "Read exact inventory paths from retained inspection Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: {
+							kind: "inventory",
+							collection: "occurrences",
+							logical_paths: ["package.json", "main.js"],
+							offset: 0,
+							limit: 32
+						}
+					}
+				},
+				{
+					title: "Group requests from retained HAR Evidence",
+					input: API_SURFACE_EXAMPLE.input
+				},
+				{
+					title: "Summarize retained analysis Evidence, including WASM",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: { kind: "summary" }
+					}
+				},
+				{
+					title: "Read one ELF section from retained layout Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: {
+							kind: "item",
+							collection: "sections",
+							selector: { name: ".text" }
+						}
+					}
+				},
+				{
+					title: "Page native high-pcode operations from retained Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: {
+							kind: "native",
+							facet: "value_flow_operations",
+							offset: 0,
+							limit: 32
+						}
+					}
+				},
+				{
+					title: "Page module identities from retained application Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: {
+							kind: "page",
+							collection: "modules",
+							offset: 0,
+							limit: 32
+						}
+					}
+				}
+			]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/native/binaryDiagnosticsToolContracts.js
+var inspectBinaryLayoutRequestSchema, BINARY_DIAGNOSTICS_TOOL_CONTRACTS;
+function init_binaryDiagnosticsToolContracts() {
+	return (init_binaryDiagnosticsToolContracts = __esmMin((() => {
+		init_recordedCrash();
+		init_binaryLayout();
+		init_analysisView();
+		init_analysisDetail();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_peResources();
+		inspectBinaryLayoutRequestSchema = inspectBinaryLayoutInputSchema.extend({ detail: analysisDetailSchema });
+		BINARY_DIAGNOSTICS_TOOL_CONTRACTS = [
+			{
+				name: "inspect_pe_resources",
+				...toolContractMetadata("inspect_pe_resources"),
+				kind: "native-provider",
+				description: "Inspect one explicit local PE32/PE32+ image's complete bounded type/name/language resource tree without executing it or opening a disassembler. Returns numeric IDs versus original UTF-16 names, directory/data-entry file locations, payload RVA/file ranges, complete SHA-256 hashes and static RT_GROUP_ICON image-resource candidates. Language fallback, image decoding and actual shell/window loading remain unobserved. Reads a stable regular file; malformed or ambiguous mappings, non-identical overlapping ranges and exhausted budgets return no partial success. Portable on supported Node hosts; no Windows SDK or engine installation required.",
+				inputSchema: inspectPeResourcesInputSchema,
+				outputSchema: evidenceResultOf(peResourcesSchema),
+				examples: [{
+					title: "Inspect PE resource identities and icon relationships",
+					input: { path: "/artifacts/application.exe" }
+				}]
+			},
+			{
+				name: "inspect_binary_layout",
+				...toolContractMetadata("inspect_binary_layout"),
+				kind: "native-provider",
+				description: "Inspect an explicit local binary without launching it as a host process. Returns file-backed section/segment ranges, linked addresses, original symbol/REL/RELA table identities, complete encoded RELR tables and upstream-derived offsets with unknown per-word locations/addends, raw name bytes, dependency/interpreter names and static mitigation inferences inline with artifact SHA-256 Evidence. Initial profile: ELF64 x86-64 little-endian EXEC/DYN/REL on Linux x64 via caller-supplied Python with unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Runtime addresses/library paths, overall relocation inventory completeness and complete derived GOT/PLT coverage remain unknown. Zero executable entry values mean absence; relocatable entries are not applicable. Upstream can emulate PLT instructions with Unicorn for derived static maps. Uses bounded complete output and owned temporary files/processes; malformed, unsupported or oversized objects return no partial success. Select detail summary to retain the complete layout Evidence in this session and receive only its summary view, then inspect sections, symbols, mitigations or linkage with inspect_analysis_view.",
+				inputSchema: inspectBinaryLayoutRequestSchema,
+				outputSchema: analysisDetailOutputSchemaOf(binaryLayoutSchema, binaryLayoutSummaryViewResultSchema),
+				examples: [{
+					title: "Inspect ELF linked and file layout",
+					input: { path: "/artifacts/application.elf" }
+				}, {
+					title: "Retain the complete layout and return its summary view",
+					input: {
+						path: "/artifacts/application.elf",
+						detail: "summary"
+					}
+				}]
+			},
+			{
+				name: "inspect_recorded_crash",
+				...toolContractMetadata("inspect_recorded_crash"),
+				kind: "native-provider",
+				description: "Inspect a supplied Linux ELF64 amd64 or AArch64 little-endian core without launching its target or attaching to any live PID. Returns all recorded segments, raw note owners/descriptors and source ranges, every Linux CORE PRSTATUS thread/register and SIGINFO fields inline with SHA-256 Evidence. Historical PID is recorded metadata; current process/file identity, note coverage and signal-thread associations stay unknown. Optionally add derived core-only GDB/pwndbg mapping candidates through explicit BYO configuration; zero map flags mean unknown permissions. Uses the same stable snapshot for both stages, bounded complete output and owned cleanup. Linux x64 host profile: unchanged pwntools 4.15.0/pyelftools 0.33/Unicorn 2.1.2; optional unchanged pwndbg 2026.09.15. No implicit executable/library pairing, GDB command language, host configuration changes or dependency installation.",
+				inputSchema: inspectRecordedCrashInputSchema,
+				outputSchema: evidenceResultOf(recordedCrashSchema),
+				examples: [{
+					title: "Inspect recorded registers and signal evidence",
+					input: { path: "/artifacts/crash.core" }
+				}, {
+					title: "Add core-only debugger mapping candidates",
+					input: {
+						path: "/artifacts/crash.core",
+						include_debugger_context: true
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/firmware/firmwareToolContracts.js
+var FIRMWARE_TOOL_CONTRACTS;
+function init_firmwareToolContracts() {
+	return (init_firmwareToolContracts = __esmMin((() => {
+		init_firmwareAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		FIRMWARE_TOOL_CONTRACTS = [{
+			name: "inspect_firmware_regions",
+			...toolContractMetadata("inspect_firmware_regions"),
+			kind: "firmware-provider",
+			description: "Inspect signature candidates in a local firmware file with Binwalk 3.1.x (verified with 3.1.0). Returns offsets, reported lengths, descriptions and raw confidence values. Length validation and runtime addresses remain unknown. No extraction or target execution. Linux, caller-supplied tool and util-linux prlimit required; 128 MiB input limit, one worker and 120-second deadline.",
+			inputSchema: firmwareInputSchemas.inspect_firmware_regions,
+			outputSchema: evidenceResultOf(firmwareResultSchemas.inspect_firmware_regions),
+			examples: [{
+				title: "Inspect firmware regions",
+				input: { path: "/tmp/firmware.bin" }
+			}]
+		}, {
+			name: "extract_firmware",
+			...toolContractMetadata("extract_firmware"),
+			kind: "firmware-provider",
+			description: "Extract caller-selected firmware bytes with Unblob 26.6.x (verified with 26.6.4) into an absent output directory. Returns verified child paths/digests, task derivations, unknown chunks, extraction diagnostics and explicit extraction_gaps rows naming unextracted regions, missing extractor dependencies and a continuation_id referencing shared extraction_continuations recovery instructions. Preserves the default sandbox; publishes regular files only. Linux, caller-supplied tool, format-specific extractors and util-linux prlimit required. No mounts or extracted-code execution. Select a returned native file with open_binary for Ghidra analysis; decompressed offsets are not original-file addresses.",
+			inputSchema: firmwareInputSchemas.extract_firmware,
+			outputSchema: evidenceResultOf(firmwareResultSchemas.extract_firmware),
+			examples: [{
+				title: "Extract selected firmware",
+				input: {
+					path: "/tmp/firmware.bin",
+					output_directory: "/tmp/firmware-output",
+					range: {
+						offset: 64,
+						length: 4096
+					}
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/android/androidToolContracts.js
+var ANDROID_TOOL_CONTRACTS;
+function init_androidToolContracts() {
+	return (init_androidToolContracts = __esmMin((() => {
+		init_androidAnalysis();
+		init_analysisView();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		ANDROID_TOOL_CONTRACTS = [
+			{
+				name: "inspect_android_package",
+				...toolContractMetadata("inspect_android_package"),
+				description: "Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Omitted or complete detail preserves the complete result. Select detail: \"summary\" for all declarations, engine identity and counts without decoded manifest text or duplicate raw calls; retains the complete source and returns a distinct linked inspect_analysis_view summary. Read the exact retained manifest with view kind android, facet manifest, offset and limit (UTF-16 code units), using normalized_result.parent_evidence_id. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and JDK; uses one worker in an isolated temporary workspace.",
+				kind: "android-provider",
+				inputSchema: androidPackageInspectionInputSchema,
+				outputSchema: evidenceResultOf(z.union([androidResultSchemas.inspect_android_package, androidPackageSummaryViewResultSchema])),
+				examples: [{
+					title: "Inspect an APK",
+					input: { path: "/tmp/Example.apk" }
+				}, {
+					title: "Inspect APK declarations with retained manifest",
+					input: {
+						path: "/tmp/Example.apk",
+						detail: "summary"
+					}
+				}]
+			},
+			{
+				name: "search_android_classes",
+				...toolContractMetadata("search_android_classes"),
+				description: "Search complete decompiler class-name rows in an explicit local APK by case-sensitive substring. Empty query inventories all rows. Repeated names remain repeated and appear in duplicate_names; the provider accepts only class names for lookup, so these rows do not identify which same-name class node a later lookup selects. Retains artifact and engine identity; no APK execution.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.search_android_classes,
+				outputSchema: evidenceResultOf(androidResultSchemas.search_android_classes),
+				examples: [{
+					title: "Find activity classes",
+					input: {
+						path: "/tmp/Example.apk",
+						query: "Activity"
+					}
+				}]
+			},
+			{
+				name: "inspect_android_class",
+				...toolContractMetadata("inspect_android_class"),
+				description: "Inspect one exact Android class's parsed methods, fields and inner classes, including synthetic members. Returns display signatures and exact DEX prototypes without generating source. A prototype is not a complete raw method ID; overload indices remain consistent within the artifact and engine session.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.inspect_android_class,
+				outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_class),
+				examples: [{
+					title: "Inspect a class",
+					input: {
+						path: "/tmp/Example.apk",
+						class_name: "example.MainActivity"
+					}
+				}]
+			},
+			{
+				name: "inspect_android_method",
+				...toolContractMetadata("inspect_android_method"),
+				description: "Decompile one Android method with smali fallback. Requires explicit overload_index when multiple methods share a name. Reports its DEX prototype, representation, fallback markers and source truncation; display signatures may be aliases.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.inspect_android_method,
+				outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_method),
+				examples: [{
+					title: "Decompile a method",
+					input: {
+						path: "/tmp/Example.apk",
+						class_name: "example.MainActivity",
+						method_name: "onCreate"
+					}
+				}]
+			},
+			{
+				name: "trace_android_references",
+				...toolContractMetadata("trace_android_references"),
+				description: "Trace incoming static using nodes to an exact Android class or selected method overload. The total counts containing nodes, not individual invoke instructions. Use inspect_android_class to choose an overload_index when names collide. Source lines and the containing node dex_offset remain unknown. direct_invokes carries exact DEX code-unit instruction offsets when available; direct_invokes_exhaustive false marks byte-bounded partial instruction evidence, and null means coverage is unknown. Using-node coverage remains separate; no runtime calls are inferred.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.trace_android_references,
+				outputSchema: evidenceResultOf(androidResultSchemas.trace_android_references),
+				examples: [{
+					title: "Find references to a class",
+					input: {
+						path: "/tmp/Example.apk",
+						class_name: "example.MainActivity"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/apktool/apktoolToolContracts.js
+var APKTOOL_TOOL_CONTRACTS;
+function init_apktoolToolContracts() {
+	return (init_apktoolToolContracts = __esmMin((() => {
+		init_apktoolResourceAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		APKTOOL_TOOL_CONTRACTS = [{
+			name: "inspect_apktool_client",
+			...toolContractMetadata("inspect_apktool_client"),
+			description: "Inspect the caller-selected apktool launcher: resolved command, selection source, and version. Decodes nothing. REA never installs Apktool or Java; select a launcher with REA_APKTOOL_COMMAND (absolute) or apktool on PATH.",
+			kind: "apktool-provider",
+			inputSchema: apktoolInputSchemas.inspect_apktool_client,
+			outputSchema: evidenceResultOf(apktoolResultSchemas.inspect_apktool_client),
+			examples: [{
+				title: "Check the Apktool launcher",
+				input: {}
+			}]
+		}, {
+			name: "decode_android_resources",
+			...toolContractMetadata("decode_android_resources"),
+			description: "Decode one local APK's resources with `apktool d --no-src` in a provider-owned workspace that is removed after projection: the readable AndroidManifest.xml, apktool.yml version and SDK facts, the app's string resources (default or one locale, bounded to 2000 entries), available string locales, and the decoded file count. The target APK is digest with SHA-256 before decoding; smali is skipped because Java-source recovery belongs to the JADX family.",
+			kind: "apktool-provider",
+			inputSchema: apktoolInputSchemas.decode_android_resources,
+			outputSchema: evidenceResultOf(apktoolResultSchemas.decode_android_resources),
+			examples: [{
+				title: "Decode an APK's resources",
+				input: { path: "/targets/Example.apk" }
+			}, {
+				title: "Decode one locale's strings",
+				input: {
+					path: "/targets/Example.apk",
+					locale: "de"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/pcap/pcapToolContracts.js
+var PCAP_TOOL_CONTRACTS;
+function init_pcapToolContracts() {
+	return (init_pcapToolContracts = __esmMin((() => {
+		init_pcapAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		init_analysisDetail();
+		init_analysisView();
+		PCAP_TOOL_CONTRACTS = [{
+			name: "inspect_pcap_client",
+			...toolContractMetadata("inspect_pcap_client"),
+			description: "Inspect the caller-selected tshark and capinfos binaries: selected commands, selection sources, and versions. Both tools must be usable. Reads no capture file. REA never installs the Wireshark suite; select binaries with REA_TSHARK_COMMAND and REA_CAPINFOS_COMMAND (absolute) or from PATH.",
+			kind: "pcap-provider",
+			inputSchema: pcapInputSchemas.inspect_pcap_client,
+			outputSchema: evidenceResultOf(pcapResultSchemas.inspect_pcap_client),
+			examples: [{
+				title: "Check the analysis tools",
+				input: {}
+			}]
+		}, {
+			name: "inspect_pcap_capture",
+			...toolContractMetadata("inspect_pcap_capture"),
+			description: "Request detail summary for capture identity/counts, then page retained facts with inspect_analysis_view kind pcap. Default detail complete preserves inline delivery. Inspect one saved pcap or pcapng capture through an owned snapshot: metadata, exact packet count, SHA-256, IPv4/IPv6 address counts, DNS questions and address values from the same single-question response, TLS SNI, protocol distribution and HTTP URIs. All derived inventories are retained within declared resource budgets; unknown DNS attribution and excluded credentials remain explicit. Linux requires util-linux prlimit; Windows uses owned Job Objects. Requires caller-supplied capinfos and tshark; REA never captures traffic.",
+			kind: "pcap-provider",
+			inputSchema: pcapInputSchemas.inspect_pcap_capture.extend({ detail: analysisDetailSchema }),
+			outputSchema: analysisDetailOutputSchemaOf(pcapResultSchemas.inspect_pcap_capture, pcapCaptureSummaryViewResultSchema),
+			examples: [{
+				title: "Inspect a capture file",
+				input: { path: "/captures/session.pcap" }
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/flutter/flutterToolContracts.js
+var FLUTTER_TOOL_CONTRACTS;
+function init_flutterToolContracts() {
+	return (init_flutterToolContracts = __esmMin((() => {
+		init_flutterBuildAnalysis();
+		init_analysisView();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		FLUTTER_TOOL_CONTRACTS = [{
+			name: "identify_flutter_build",
+			...toolContractMetadata("identify_flutter_build"),
+			description: "Identify a Flutter app's build facts by pure parsing: the Dart VM snapshot hash from every lib/<abi>/libapp.so AOT section (vm and isolate, cross-checked), per-ABI library digests, the engine library's GNU build-id, and any labeled Dart version or toolchain strings libflutter.so carries. The snapshot hash is the artifact that maps to a Dart SDK release through an external dataset; REA performs no lookup. No engine, no execution, no external tools.",
+			kind: "flutter-provider",
+			inputSchema: flutterInputSchemas.identify_flutter_build,
+			outputSchema: evidenceResultOf(flutterResultSchemas.identify_flutter_build),
+			examples: [{
+				title: "Identify a Flutter build",
+				input: { path: "/targets/Example.apk" }
+			}]
+		}, {
+			name: "inspect_dart_aot",
+			...toolContractMetadata("inspect_dart_aot"),
+			description: "Inspect one ABI's Dart AOT snapshot inside an APK: the four snapshot symbols located through the ELF dynamic symbol table with their offsets, sizes, and section headers (magic, kind, length), the snapshot hash, and a bounded string-pool projection from the isolate data section (package: source URIs, dart: SDK URIs, identifier-like tokens) exposing the app's dependency structure. String-pool entries are byte-pattern observations, not deserialized cluster semantics; typed class and function recovery needs an SDK-specific parser. Omitted or complete detail returns the full observation. Select detail: \"summary\" for target/ABI/library identity, all snapshot headers, coverage and original lower-bound counts without string lists. The complete source stays retained; read returned strings via inspect_analysis_view with parent_evidence_id and kind dart-aot, collection package_uris/dart_uris/class_like_tokens, offset and limit. Exhausting pages does not imply complete pool coverage. No engine, no execution.",
+			kind: "flutter-provider",
+			inputSchema: dartAotInspectionInputSchema,
+			outputSchema: evidenceResultOf(z.union([flutterResultSchemas.inspect_dart_aot, dartAotSummaryViewResultSchema])),
+			examples: [
+				{
+					title: "Inspect the preferred ABI's AOT snapshot",
+					input: { path: "/targets/Example.apk" }
+				},
+				{
+					title: "Inspect one ABI explicitly",
+					input: {
+						path: "/targets/Example.apk",
+						abi: "arm64-v8a"
+					}
+				},
+				{
+					title: "Inspect snapshot identity with retained string lists",
+					input: {
+						path: "/targets/Example.apk",
+						detail: "summary"
+					}
+				}
+			]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/jeb/jebToolContracts.js
+var JEB_TOOL_CONTRACTS;
+function init_jebToolContracts() {
+	return (init_jebToolContracts = __esmMin((() => {
+		init_jebAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		JEB_TOOL_CONTRACTS = [
+			{
+				name: "inspect_jeb_client",
+				...toolContractMetadata("inspect_jeb_client"),
+				description: "Inspect the running JEB client serving MCP: engine version, GUI or headless mode, and startup time. Does not open a target. Requires a caller-started JEB client reachable at REA_JEB_MCP_URL (default http://127.0.0.1:8425/mcp); REA never installs or launches JEB.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.inspect_jeb_client,
+				outputSchema: evidenceResultOf(jebResultSchemas.inspect_jeb_client),
+				examples: [{
+					title: "Check the engine",
+					input: {}
+				}]
+			},
+			{
+				name: "open_jeb_project",
+				...toolContractMetadata("open_jeb_project"),
+				description: "Open or create a JEB project from an artifact file or existing .jdb2 database on the engine host. Returns the project's input-file digests and top-level units. The engine analyzes the target itself; REA does not read the file or execute it. Fails when a project is already open.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.open_jeb_project,
+				outputSchema: evidenceResultOf(jebResultSchemas.open_jeb_project),
+				examples: [{
+					title: "Open a target for analysis",
+					input: { path: "/tmp/Example.apk" }
+				}]
+			},
+			{
+				name: "list_jeb_units",
+				...toolContractMetadata("list_jeb_units"),
+				description: "List project units by stable unit path and type, with optional wildcard filter, parent restriction, and pagination. The engine caps pages at 100 units; a full page reports partial coverage because more units may exist. Read-only.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.list_jeb_units,
+				outputSchema: evidenceResultOf(jebResultSchemas.list_jeb_units),
+				examples: [{
+					title: "List units",
+					input: {}
+				}, {
+					title: "Find DEX units",
+					input: { filter: "*.dex" }
+				}]
+			},
+			{
+				name: "decompile_jeb_item",
+				...toolContractMetadata("decompile_jeb_item"),
+				description: "Decompile one type or method to engine pseudo-code using its decompiler (Dalvik, Java, or native). item_address comes from the engine's code item listing; unit_path defaults to the engine's first code unit and stays unknown when omitted. Read-only with respect to the target file.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.decompile_jeb_item,
+				outputSchema: evidenceResultOf(jebResultSchemas.decompile_jeb_item),
+				examples: [{
+					title: "Decompile a method",
+					input: {
+						item_address: "Lcom/example/Main;->onCreate()V",
+						item_kind: "method"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/adb/adbToolContracts.js
+var ADB_TOOL_CONTRACTS;
+function init_adbToolContracts() {
+	return (init_adbToolContracts = __esmMin((() => {
+		init_adbDeviceAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		ADB_TOOL_CONTRACTS = [
+			{
+				name: "inspect_adb_client",
+				...toolContractMetadata("inspect_adb_client"),
+				description: "Inspect the caller-selected adb client: resolved binary, version, and install path. Never contacts devices and never starts the adb server. REA never installs platform tools; select a binary with REA_ADB_PATH (absolute) or adb on PATH.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_client,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_client),
+				examples: [{
+					title: "Check the adb client",
+					input: {}
+				}]
+			},
+			{
+				name: "list_adb_devices",
+				...toolContractMetadata("list_adb_devices"),
+				description: "List attached devices exactly as `adb devices -l` reports them: serial, state, transport, model metadata, and an inferred emulator/physical kind with its evidence basis. Emulators and USB or network devices appear alike; REA neither starts nor manages them. May start the local adb server on first use.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_devices,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_devices),
+				examples: [{
+					title: "List attached devices",
+					input: {}
+				}]
+			},
+			{
+				name: "inspect_adb_device",
+				...toolContractMetadata("inspect_adb_device"),
+				description: "Inspect one device's build identity through a fixed `getprop` whitelist: Android and SDK versions, security patch, fingerprint, product identity, CPU ABIs, and debuggable flag, plus the observed emulator indicator ro.kernel.qemu. Read-only with respect to the device.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_device,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_device),
+				examples: [{
+					title: "Inspect one device",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "list_adb_packages",
+				...toolContractMetadata("list_adb_packages"),
+				description: "List installed packages on one device with each base APK's device path, optionally scoped to third-party or system packages. Paths are device filesystem paths, not host-local. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_packages,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_packages),
+				examples: [{
+					title: "List third-party packages",
+					input: {
+						serial: "emulator-5554",
+						scope: "third_party"
+					}
+				}]
+			},
+			{
+				name: "pull_adb_package",
+				...toolContractMetadata("pull_adb_package"),
+				description: "Pull one installed package's complete APK set (base plus every split, as `pm path` reports) from the device into a caller-selected output directory, creating a package-named subdirectory that must not already exist. Every pulled file is digested with SHA-256; partial pulls keep successful artifacts and per-file failure reasons. The device keeps the originals.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.pull_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.pull_adb_package),
+				examples: [{
+					title: "Pull a package APK set",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app",
+						output_directory: "/tmp/rea-pulls"
+					}
+				}]
+			},
+			{
+				name: "read_adb_logcat",
+				...toolContractMetadata("read_adb_logcat"),
+				description: "Read a bounded dump of the device log (`logcat -d -t`) for one buffer, optionally restricted to a process id. No streaming, no clearing; the newest lines are kept when the count cap trims. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.read_adb_logcat,
+				outputSchema: evidenceResultOf(adbResultSchemas.read_adb_logcat),
+				examples: [{
+					title: "Read the last 200 main-buffer lines",
+					input: {
+						serial: "emulator-5554",
+						count: 200,
+						buffer: "main"
+					}
+				}]
+			},
+			{
+				name: "inspect_adb_package",
+				...toolContractMetadata("inspect_adb_package"),
+				description: "Inspect one installed package through `dumpsys package`: version name/code, install and update times, installer, user id, flags, and the requested-permission count. A fixed projection of version-dependent output; unknown sections are ignored rather than guessed. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_package),
+				examples: [{
+					title: "Inspect an installed package",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			},
+			{
+				name: "pull_adb_file",
+				...toolContractMetadata("pull_adb_file"),
+				description: "Pull one absolute device path (a database, shared-preferences XML, or any readable file) into a caller-selected output directory, digesting it with SHA-256. The local copy must not already exist. Read-only with respect to the device.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.pull_adb_file,
+				outputSchema: evidenceResultOf(adbResultSchemas.pull_adb_file),
+				examples: [{
+					title: "Pull an app database",
+					input: {
+						serial: "emulator-5554",
+						device_path: "/data/data/com.example.app/databases/app.db",
+						output_directory: "/tmp/rea-pulls"
+					}
+				}]
+			},
+			{
+				name: "push_adb_file",
+				...toolContractMetadata("push_adb_file"),
+				description: "Push one local file to an absolute device path. A device-mutating tool: checks for an existing device file before transfer and refuses it unless overwrite is explicitly requested; this check is not an atomic create and another process can create the path before adb writes. When the device provides sha256sum, the transfer is verified by comparing it with the local digest.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.push_adb_file,
+				outputSchema: evidenceResultOf(adbResultSchemas.push_adb_file),
+				examples: [{
+					title: "Push a script to tmp",
+					input: {
+						serial: "emulator-5554",
+						local_path: "/tmp/frida-server",
+						device_path: "/data/local/tmp/frida-server"
+					}
+				}]
+			},
+			{
+				name: "capture_adb_screen",
+				...toolContractMetadata("capture_adb_screen"),
+				description: "Capture one frame of the device screen as a PNG (`screencap -p` through exec-out, no device-side file) into a caller-selected output directory, digesting it and reporting its dimensions. No recording or interaction.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.capture_adb_screen,
+				outputSchema: evidenceResultOf(adbResultSchemas.capture_adb_screen),
+				examples: [{
+					title: "Capture the current screen",
+					input: {
+						serial: "emulator-5554",
+						output_directory: "/tmp/rea-captures"
+					}
+				}]
+			},
+			{
+				name: "list_adb_processes",
+				...toolContractMetadata("list_adb_processes"),
+				description: "List running processes exactly as `ps -A` reports them: user, pid, ppid, rss, state, and name. Useful for pairing with instrumentation lanes. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_processes,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_processes),
+				examples: [{
+					title: "List processes",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "list_adb_directory",
+				...toolContractMetadata("list_adb_directory"),
+				description: "List the immediate children of one absolute device directory, including hidden entries: names, kinds, permissions, owner, group, sizes, dates, and symlink targets. Names and targets preserve embedded newlines. Recognizes the standard errors for absent paths and denied reads. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_directory,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_directory),
+				examples: [{
+					title: "List an app's data directory",
+					input: {
+						serial: "emulator-5554",
+						device_path: "/data/data/com.example.app"
+					}
+				}]
+			},
+			{
+				name: "list_adb_features",
+				...toolContractMetadata("list_adb_features"),
+				description: "List the device's declared hardware and software features (`pm list features`) for device fingerprinting. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_features,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_features),
+				examples: [{
+					title: "List features",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "list_adb_services",
+				...toolContractMetadata("list_adb_services"),
+				description: "List the device's binder services with their interfaces (`service list`). Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_services,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_services),
+				examples: [{
+					title: "List services",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "inspect_adb_display",
+				...toolContractMetadata("inspect_adb_display"),
+				description: "Report the display's physical and any overridden size (`wm size`) and density (`wm density`) as the device declares them. Read-only; setting values is not exposed.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_display,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_display),
+				examples: [{
+					title: "Inspect the display",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "inspect_adb_window",
+				...toolContractMetadata("inspect_adb_window"),
+				description: "Report the window manager's current focus declarations (mCurrentFocus and mFocusedApp from `dumpsys window windows`, or from `dumpsys window displays` when the windows section declares neither, as on Android 16) — what is on screen at read time without any interaction. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_window,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_window),
+				examples: [{
+					title: "Inspect window focus",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "read_adb_setting",
+				...toolContractMetadata("read_adb_setting"),
+				description: "Read one settings value (`settings get`) from the system, secure, or global namespace. Absent keys report the device's own null observation. Read-only; writing settings is not exposed.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.read_adb_setting,
+				outputSchema: evidenceResultOf(adbResultSchemas.read_adb_setting),
+				examples: [{
+					title: "Read the ADB-enabled setting",
+					input: {
+						serial: "emulator-5554",
+						namespace: "secure",
+						key: "adb_enabled"
+					}
+				}]
+			},
+			{
+				name: "collect_adb_bugreport",
+				...toolContractMetadata("collect_adb_bugreport"),
+				description: "Collect one device-generated bugreport archive (`adb bugreport`) into a caller-selected output directory, digesting the zip. The archive contains the device's own dumpstate, dumpsys, and logcat report; collection can take minutes. Read-only with respect to configuration.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.collect_adb_bugreport,
+				outputSchema: evidenceResultOf(adbResultSchemas.collect_adb_bugreport),
+				examples: [{
+					title: "Collect a bugreport",
+					input: {
+						serial: "emulator-5554",
+						output_directory: "/tmp/rea-bugreports"
+					}
+				}]
+			},
+			{
+				name: "resolve_adb_packages",
+				...toolContractMetadata("resolve_adb_packages"),
+				description: "Find installed packages by case-insensitive substring of the package name (e.g. `whatsapp` → `com.whatsapp`), returning each match's base APK device path. The first step of an easy get: resolve, then pull_adb_package the exact name. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.resolve_adb_packages,
+				outputSchema: evidenceResultOf(adbResultSchemas.resolve_adb_packages),
+				examples: [{
+					title: "Find a package by partial name",
+					input: {
+						serial: "emulator-5554",
+						query: "whatsapp"
+					}
+				}]
+			},
+			{
+				name: "install_adb_package",
+				...toolContractMetadata("install_adb_package"),
+				description: "Install one local APK on the device (`adb install [-r]`), recording the APK's host digest and byte size. A device-mutating tool: `replace_requested` records whether `-r` was selected; `replaced` is null because install success does not establish prior package state. The device's own Success/Failure verdict is preserved with its reason.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.install_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.install_adb_package),
+				examples: [{
+					title: "Install an APK",
+					input: {
+						serial: "emulator-5554",
+						apk_path: "/tmp/app.apk"
+					}
+				}, {
+					title: "Request reinstall mode to keep existing app data",
+					input: {
+						serial: "emulator-5554",
+						apk_path: "/tmp/app.apk",
+						replace: true
+					}
+				}]
+			},
+			{
+				name: "uninstall_adb_package",
+				...toolContractMetadata("uninstall_adb_package"),
+				description: "Uninstall one package from the device (`adb uninstall`), removing its data for user 0. A device-mutating tool; absent packages report the device's own refusal reason.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.uninstall_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.uninstall_adb_package),
+				examples: [{
+					title: "Uninstall a package",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			},
+			{
+				name: "start_adb_app",
+				...toolContractMetadata("start_adb_app"),
+				description: "Start one installed app's resolved launcher activity with `am start -W -n`. A device-mutating tool for dynamic analysis. The full wait report determines success; failures retain launch-attempt facts and raw output. Pair with `read_adb_logcat` (pid filter) and `list_adb_processes` to observe the app, and `stop_adb_app` to end the run.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.start_adb_app,
+				outputSchema: evidenceResultOf(adbResultSchemas.start_adb_app),
+				examples: [{
+					title: "Start an app",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			},
+			{
+				name: "start_adb_activity",
+				...toolContractMetadata("start_adb_activity"),
+				description: "Start an intent with `am start -W`: one action, optional data URI, optional explicit component, and up to 16 typed extras (string, boolean, int, long, float). A device-mutating tool; the full wait report determines success, with failed-attempt facts and raw output retained.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.start_adb_activity,
+				outputSchema: evidenceResultOf(adbResultSchemas.start_adb_activity),
+				examples: [{
+					title: "Open a deep link",
+					input: {
+						serial: "emulator-5554",
+						action: "android.intent.action.VIEW",
+						data_uri: "https://example.com/path"
+					}
+				}, {
+					title: "Start with typed extras",
+					input: {
+						serial: "emulator-5554",
+						action: "com.example.APP_ACTION",
+						extras: [{
+							key: "level",
+							type: "int",
+							value: "3"
+						}]
+					}
+				}]
+			},
+			{
+				name: "stop_adb_app",
+				...toolContractMetadata("stop_adb_app"),
+				description: "Force-stop every process of one package (`am force-stop`), ending a dynamic-analysis run. A device-mutating tool; it succeeds whether or not the package had running processes.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.stop_adb_app,
+				outputSchema: evidenceResultOf(adbResultSchemas.stop_adb_app),
+				examples: [{
+					title: "Stop an app",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/managed/managedWorkflowExamples.js
+var MANAGED_STATIC_EXAMPLE_PROVIDER, NATIVE_EXAMPLE_PROVIDER, emptyManagedMembers, evidence, runtimeMembers, MANAGED_MEMBER_COMPARISON_EXAMPLE, runtimeExampleEvidence, MANAGED_APPLICATION_GRAPH_EXAMPLE, boundaryEvidence, nativeExportEvidence, coverage, MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE, MANAGED_NATIVE_VERIFICATION_EXAMPLE;
+function init_managedWorkflowExamples() {
+	return (init_managedWorkflowExamples = __esmMin((() => {
+		init_evidence();
+		MANAGED_STATIC_EXAMPLE_PROVIDER = {
+			id: "rea-dotnet-static",
+			name: "REA managed static analysis provider",
+			version: "1"
+		};
+		NATIVE_EXAMPLE_PROVIDER = {
+			id: "native-macos",
+			name: "REA native macOS provider",
+			version: "1"
+		};
+		emptyManagedMembers = (sha256, mvid) => ({
+			artifact: {
+				path: `/examples/${sha256.slice(0, 8)}.dll`,
+				sha256,
+				byte_length: 4096,
+				format: "pe"
+			},
+			module: {
+				name: "Example.dll",
+				generation: 0,
+				mvid,
+				enc_id: null,
+				enc_base_id: null,
+				token: "0x00000001",
+				row_offset: 0
+			},
+			metadata: {
+				status: "complete",
+				version: "v4.0.30319",
+				table_row_counts: {}
+			},
+			identity_scope: {
+				token_identity: "build-local",
+				requires_artifact_sha256: sha256,
+				requires_mvid: mvid
+			},
+			types: [],
+			exported_types: [],
+			fields: [],
+			methods: [],
+			member_refs: [],
+			call_edges: [],
+			field_accesses: [],
+			user_strings: {
+				state: "complete",
+				literals: [],
+				issues: []
+			},
+			selection: null,
+			coverage: {
+				state: "complete",
+				issues: []
+			},
+			limitations: []
+		});
+		evidence = (result) => createEvidence(undefined, MANAGED_STATIC_EXAMPLE_PROVIDER, {
+			operation: "inspect_managed_members",
+			parameters: {},
+			result,
+			rawResult: null,
+			limitations: result.limitations
+		});
+		runtimeMembers = () => {
+			const result = emptyManagedMembers("2".repeat(64), "11112222-3333-4444-9555-666677778888");
+			return {
+				...result,
+				methods: [{
+					token: "0x06000001",
+					row_offset: 128,
+					declaring_type_token: "0x02000001",
+					declaring_type: "Example.Program",
+					name: "Main",
+					rva: 8192,
+					impl_flags: 0,
+					flags: 22,
+					signature: {
+						raw_length: 3,
+						raw_sha256: "3".repeat(64),
+						kind: "method",
+						parse_status: "decoded",
+						calling_convention: "default",
+						generic_parameter_count: 0,
+						parameter_count: 0,
+						return_type: "void",
+						parameter_types: [],
+						field_type: null,
+						issue: null
+					},
+					body: {
+						status: "present",
+						header_format: "tiny",
+						rva: 8192,
+						file_offset: 512,
+						max_stack: 8,
+						init_locals: false,
+						local_var_sig_token: null,
+						il_size: 1,
+						il_sha256: "4".repeat(64),
+						normalized_il_sha256: "5".repeat(64),
+						instruction_count: 1,
+						decoded_instruction_count: 1,
+						truncated_instructions: 0,
+						opcode_counts: { ret: 1 },
+						anchors: [],
+						exception_regions: [],
+						issue: null
+					}
+				}]
+			};
+		};
+		MANAGED_MEMBER_COMPARISON_EXAMPLE = {
+			left: evidence(emptyManagedMembers("0".repeat(64), "00112233-4455-6677-8899-aabbccddeeff")),
+			right: evidence(emptyManagedMembers("1".repeat(64), "ffeeddcc-bbaa-4988-9766-554433221100"))
+		};
+		runtimeExampleEvidence = evidence(runtimeMembers());
+		MANAGED_APPLICATION_GRAPH_EXAMPLE = { managed_members: runtimeExampleEvidence };
+		boundaryEvidence = () => {
+			const result = {
+				artifact: {
+					path: "/examples/ManagedInterop.exe",
+					sha256: "6".repeat(64),
+					byte_length: 8192,
+					format: "pe"
+				},
+				module: {
+					name: "ManagedInterop.exe",
+					generation: 0,
+					mvid: "00112233-4455-4677-8899-aabbccddeeff",
+					enc_id: null,
+					enc_base_id: null,
+					token: "0x00000001",
+					row_offset: 0
+				},
+				metadata: {
+					status: "complete",
+					version: "v4.0.30319",
+					table_row_counts: {}
+				},
+				identity_scope: {
+					token_identity: "build-local",
+					requires_artifact_sha256: "6".repeat(64),
+					requires_mvid: "00112233-4455-4677-8899-aabbccddeeff"
+				},
+				cli_native: {
+					il_only: true,
+					requires_32bit: false,
+					strong_name_signed: false,
+					native_entry_point: false,
+					ready_to_run_signature: false,
+					managed_native_header_rva: 0,
+					managed_native_header_size: 0
+				},
+				module_refs: [{
+					token: "0x1a000001",
+					row_offset: 256,
+					name: "nativehelper.dll"
+				}],
+				pinvoke_imports: [{
+					token: "0x1c000001",
+					row_offset: 288,
+					mapping_flags: 0,
+					mapping_flags_hex: "0x0000",
+					member_token: "0x06000001",
+					member_kind: "method",
+					member_name: "OpenNative",
+					import_name: "open_native",
+					import_scope_token: "0x1a000001",
+					import_scope_name: "nativehelper.dll",
+					no_mangle: true,
+					char_set: "not-specified",
+					call_convention: "cdecl",
+					supports_last_error: false,
+					best_fit: "assembly-default",
+					throw_on_unmappable_char: "assembly-default",
+					verification: "managed-declaration-only"
+				}],
+				native_implementations: [],
+				summary: {
+					module_ref_count: 1,
+					pinvoke_import_count: 1,
+					native_implementation_count: 0,
+					ready_to_run: false,
+					mixed_mode_or_native_header: false
+				},
+				coverage: {
+					state: "complete",
+					issues: []
+				},
+				limitations: []
+			};
+			return createEvidence(undefined, MANAGED_STATIC_EXAMPLE_PROVIDER, {
+				operation: "inspect_managed_native_boundaries",
+				parameters: {},
+				result,
+				rawResult: null,
+				limitations: result.limitations
+			});
+		};
+		nativeExportEvidence = () => {
+			const result = {
+				format: "mach-o",
+				selected_architecture: {
+					name: "x86_64",
+					container_file_offset: null
+				},
+				endian: "little",
+				word_size: 64,
+				file_type: "dylib",
+				flags: [],
+				uuid: null,
+				entrypoints: coverage([]),
+				architectures: coverage([]),
+				build_metadata: coverage([]),
+				load_commands: coverage([]),
+				dependencies: coverage([]),
+				imports: coverage([]),
+				exports: coverage([{
+					name: "open_native",
+					address: "0x1000",
+					weak: false,
+					reexport: false,
+					source: "nm"
+				}]),
+				segments: coverage([]),
+				provenance: [],
+				limitations: ["Selected Mach-O slice container offset is unknown in this synthetic example."]
+			};
+			return createEvidence({
+				path: "/examples/nativehelper.dll",
+				sha256: "7".repeat(64),
+				format: "mach-o",
+				architecture: "x86_64"
+			}, NATIVE_EXAMPLE_PROVIDER, {
+				operation: "inspect_macho",
+				parameters: {},
+				result,
+				rawResult: null,
+				limitations: result.limitations
+			});
+		};
+		coverage = (items) => ({
+			items: [...items],
+			total: items.length,
+			exhaustive: true,
+			limitations: []
+		});
+		MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE = {
+			static_members: runtimeExampleEvidence,
+			decompiler: {
+				name: "ilspycmd",
+				version: "9.1.0.7988",
+				family: "ilspy",
+				executable_sha256: null,
+				options: [
+					"--disable-updatecheck",
+					"--type",
+					"Example.Program"
+				]
+			},
+			methods: [{
+				token: "0x06000001",
+				signature_sha256: "3".repeat(64),
+				normalized_il_sha256: "5".repeat(64),
+				reconstruction: {
+					kind: "decompiled-csharp",
+					language: "csharp",
+					text: "internal static void Main() { }",
+					source_path: "/examples/Example.Program.cs",
+					start_line: 1,
+					end_line: 1
+				}
+			}],
+			notes: ["Synthetic example only; decompiler output is imported as inference."]
+		};
+		MANAGED_NATIVE_VERIFICATION_EXAMPLE = {
+			managed_boundaries: boundaryEvidence(),
+			native_observations: [nativeExportEvidence()]
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/managed/managedWorkflowToolContracts.js
+var compareManagedMembersReferenceInputSchema, managedReconstructionReferenceInputSchema, managedApplicationGraphReferenceFacts, managedApplicationGraphReferenceShape, managedApplicationGraphReferenceInputSchema, comparisonOutputSchema$1, reconstructionOutputSchema, nativeVerificationOutputSchema, managedApplicationGraphOutputSchema, MANAGED_WORKFLOW_TOOL_CONTRACTS;
+function init_managedWorkflowToolContracts() {
+	return (init_managedWorkflowToolContracts = __esmMin((() => {
+		init_evidence();
+		init_managedNativeVerificationSchemas();
+		init_managedReconstruction();
+		init_toolOutputSchemaGroups();
+		init_managedWorkflowExamples();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		compareManagedMembersReferenceInputSchema = z.strictObject({
+			left: evidenceSchema,
+			right: evidenceSchema
+		}).superRefine((input, context) => {
+			if (input.left.evidence_id === input.right.evidence_id) context.addIssue({
+				code: "custom",
+				path: ["right"],
+				message: "Managed member Evidence must be distinct"
+			});
+		});
+		managedReconstructionReferenceInputSchema = managedReconstructionImportInputSchema.extend({ static_members: evidenceSchema });
+		managedApplicationGraphReferenceFacts = {};
+		managedApplicationGraphReferenceShape = z.strictObject({
+			...managedApplicationGraphReferenceFacts,
+			managed_artifact: evidenceSchema.optional(),
+			managed_members: evidenceSchema.optional(),
+			managed_native_boundaries: evidenceSchema.optional()
+		});
+		managedApplicationGraphReferenceInputSchema = z.union([
+			managedApplicationGraphReferenceShape.extend({ managed_artifact: evidenceSchema }),
+			managedApplicationGraphReferenceShape.extend({ managed_members: evidenceSchema }),
+			managedApplicationGraphReferenceShape.extend({ managed_native_boundaries: evidenceSchema })
+		]).superRefine((input, context) => {
+			const ids = [
+				input.managed_artifact?.evidence_id,
+				input.managed_members?.evidence_id,
+				input.managed_native_boundaries?.evidence_id
+			].filter((id) => id !== undefined);
+			if (ids.length === 0) context.addIssue({
+				code: "custom",
+				message: "Provide at least one managed Evidence source"
+			});
+			if (new Set(ids).size !== ids.length) context.addIssue({
+				code: "custom",
+				message: "Managed application graph Evidence IDs must be unique"
+			});
+		});
+		comparisonOutputSchema$1 = requireOutputSchema(managedWorkflowOutputSchemas, "compare_managed_members");
+		reconstructionOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "import_managed_reconstruction");
+		nativeVerificationOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "verify_managed_native_boundaries");
+		managedApplicationGraphOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "project_managed_application_graph");
+		MANAGED_WORKFLOW_TOOL_CONTRACTS = [
+			{
+				name: "compare_managed_members",
+				...toolContractMetadata("compare_managed_members"),
+				description: "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact declared type, name, and CIL/signature; exact declared type, name, and raw signature (decoded or not); exact declared type, name, and decoded structural method shape; then exact CIL/signature or decoded structural method shape alone, which never takes a member whose own declared type and name remain unpaired on the other side or whose declaring type is unresolved. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
+				kind: "application",
+				inputSchema: compareManagedMembersReferenceInputSchema,
+				outputSchema: comparisonOutputSchema$1,
+				examples: [{
+					title: "Compare two managed member observations",
+					input: {
+						left: MANAGED_MEMBER_COMPARISON_EXAMPLE.left,
+						right: MANAGED_MEMBER_COMPARISON_EXAMPLE.right
+					}
+				}]
+			},
+			{
+				name: "verify_managed_native_boundaries",
+				...toolContractMetadata("verify_managed_native_boundaries"),
+				description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states; a name candidate with missing managed or native module identity remains unresolved with its candidate evidence retained.",
+				kind: "application",
+				inputSchema: managedNativeVerificationInputSchema,
+				outputSchema: nativeVerificationOutputSchema,
+				examples: [{
+					title: "Verify a managed P/Invoke declaration against native Evidence",
+					input: {
+						managed_boundaries: MANAGED_NATIVE_VERIFICATION_EXAMPLE.managed_boundaries,
+						native_observations: MANAGED_NATIVE_VERIFICATION_EXAMPLE.native_observations
+					}
+				}]
+			},
+			{
+				name: "import_managed_reconstruction",
+				...toolContractMetadata("import_managed_reconstruction"),
+				description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.",
+				kind: "application",
+				inputSchema: managedReconstructionReferenceInputSchema,
+				outputSchema: reconstructionOutputSchema,
+				examples: [{
+					title: "Import a decompiler reconstruction for one managed method",
+					input: {
+						static_members: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.static_members,
+						decompiler: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.decompiler,
+						methods: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.methods,
+						notes: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.notes
+					}
+				}]
+			},
+			{
+				name: "project_managed_application_graph",
+				...toolContractMetadata("project_managed_application_graph"),
+				description: "Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.",
+				kind: "application",
+				inputSchema: managedApplicationGraphReferenceInputSchema,
+				outputSchema: managedApplicationGraphOutputSchema,
+				examples: [{
+					title: "Project static managed observations into an application graph",
+					input: { managed_members: MANAGED_APPLICATION_GRAPH_EXAMPLE.managed_members }
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/browserScenarioToolContracts.js
+var example, BROWSER_SCENARIO_TOOL_CONTRACTS;
+function init_browserScenarioToolContracts() {
+	return (init_browserScenarioToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_browserScenario();
+		init_browserScenarioCapture();
+		example = {
+			browser: {
+				mode: "launch",
+				executable_path: "/opt/chromium/chrome"
+			},
+			start_url: {
+				url: "https://app.example.test/",
+				query: []
+			},
+			actions: [{
+				step_id: "settle",
+				action: "wait_for_timeout",
+				duration_ms: 250
+			}]
+		};
+		BROWSER_SCENARIO_TOOL_CONTRACTS = [{
+			name: "capture_browser_scenario",
+			...toolContractMetadata("capture_browser_scenario"),
+			description: "Run a controlled browser scenario when passive observation cannot exercise the application. Launch the selected executable or connect to a loopback CDP target, provide a start URL and actions, and select storage or artifacts when needed. Environment, empty storage, and a URL-only final capture are defaults. capture.network selects request_body, response_body, and header_values independently; selected content is returned inline with transaction and event references, byte digests, and explicit unavailable states. Credentials and declared secrets are redacted. Agents can run their own local fixture servers to control application responses. Actions run until completion or cancellation unless timeout_ms is set. Results are returned inline.",
+			kind: "browser-provider",
+			inputSchema: browserScenarioInputSchema,
+			outputSchema: evidenceResultOf(browserScenarioCaptureSchema),
+			examples: [{
+				title: "Capture a deterministic browser scenario",
+				input: example
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/browserToolContracts.js
+function exampleScreenshot() {
+	return {
+		sha256: "153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c",
+		bytes: 70,
+		media_type: "image/png",
+		data_base64: "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PzWvWQAAAABJRU5ErkJggg=="
+	};
+}
+var listOutputSchema$1, inspectionOutputSchema$1, bundleOutputSchema, observationSessionOutputSchema, webMcpOutputSchema, captureDiffOutputSchema, screenshotOutputSchema, screenshotDiffOutputSchema, endpoint$2, origin, scenarioUrl, scenarioCompleteness, scenarioArtifacts, exampleScenarioCapture, BROWSER_TOOL_CONTRACTS;
+function init_browserToolContracts() {
+	return (init_browserToolContracts = __esmMin((() => {
+		init_browserObservation();
+		init_browserObservationSchemas();
+		init_webBundleAnalysis();
+		init_browserSession();
+		init_webMcpDiscovery();
+		init_browserCaptureComparison();
+		init_webScreenshot();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		listOutputSchema$1 = evidenceResultOf(browserTargetListSchema);
+		inspectionOutputSchema$1 = evidenceResultOf(webPageInspectionSchema);
+		bundleOutputSchema = evidenceResultOf(webBundleAnalysisSchema);
+		observationSessionOutputSchema = evidenceResultOf(webObservationSessionSchema);
+		webMcpOutputSchema = evidenceResultOf(webMcpDiscoverySchema);
+		captureDiffOutputSchema = evidenceResultOf(browserCaptureComparisonSchema);
+		screenshotOutputSchema = evidenceResultOf(webScreenshotSchema);
+		screenshotDiffOutputSchema = evidenceResultOf(webScreenshotDiffSchema);
+		endpoint$2 = "http://127.0.0.1:9222";
+		origin = "https://app.example.test";
+		scenarioUrl = {
+			url: `${origin}/`,
+			origin,
+			query_parameter_names: [],
+			redacted: false
+		};
+		scenarioCompleteness = {
+			status: "complete",
+			equality_eligible: true,
+			missing_sections: [],
+			truncated_sections: []
+		};
+		scenarioArtifacts = {
+			screenshot: { state: "not_requested" },
+			dom: { state: "not_requested" },
+			accessibility: { state: "not_requested" },
+			url: { state: "not_requested" },
+			history: { state: "not_requested" },
+			storage: { state: "not_requested" }
+		};
+		exampleScenarioCapture = () => ({
+			browser: {
+				mode: "connect",
+				process_ownership: "external",
+				cleanup: "disconnected-external",
+				product: "Chromium",
+				version: "149"
+			},
+			scenario: {
+				start_origin: origin,
+				action_count: 1,
+				secret_references: [],
+				network_content: {
+					request_body: false,
+					response_body: false,
+					header_values: false
+				},
+				event_families: []
+			},
+			duration_ms: 10,
+			steps: [{
+				step_index: 0,
+				step_id: "scenario_start",
+				action: "scenario_start",
+				status: "completed",
+				elapsed_ms: 0,
+				before_url: scenarioUrl,
+				after_url: scenarioUrl,
+				error: null,
+				event_sequence_start: 1,
+				event_sequence_end: 0,
+				artifacts: scenarioArtifacts,
+				completeness: scenarioCompleteness
+			}, {
+				step_index: 1,
+				step_id: "open-settings",
+				action: "click",
+				status: "completed",
+				elapsed_ms: 10,
+				before_url: scenarioUrl,
+				after_url: scenarioUrl,
+				error: null,
+				event_sequence_start: 1,
+				event_sequence_end: 0,
+				artifacts: scenarioArtifacts,
+				completeness: scenarioCompleteness
+			}],
+			events: {
+				retained: 0,
+				dropped: 0,
+				items: []
+			},
+			completeness: scenarioCompleteness,
+			limitations: []
+		});
+		BROWSER_TOOL_CONTRACTS = [
+			{
+				name: "list_browser_targets",
+				...toolContractMetadata("list_browser_targets"),
+				description: "List page targets exposed by the selected loopback Chrome DevTools Protocol endpoint. Optionally filter by exact origin. URLs preserve query values and fragments; only URL userinfo credentials are removed.",
+				kind: "browser-provider",
+				inputSchema: listBrowserTargetsInputSchema,
+				outputSchema: listOutputSchema$1,
+				examples: [{
+					title: "List browser page targets",
+					input: { cdp_endpoint: endpoint$2 }
+				}]
+			},
+			{
+				name: "inspect_web_page",
+				...toolContractMetadata("inspect_web_page"),
+				description: "Passively inspect one selected page target through CDP without evaluating JavaScript, navigating, clicking, closing, or mutating the page. If no origin filter is supplied, capture is scoped to the target's current origin. Returns DOM structure, accessibility, scripts, resources, attach-window network and console metadata, workers, and redacted storage inventory as Evidence.",
+				kind: "browser-provider",
+				inputSchema: inspectWebPageInputSchema,
+				outputSchema: inspectionOutputSchema$1,
+				examples: [{
+					title: "Inspect one browser page",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS"
+					}
+				}]
+			},
+			{
+				name: "analyze_web_bundle",
+				...toolContractMetadata("analyze_web_bundle"),
+				description: "Capture JavaScript source from one selected CDP page and statically derive a chunk graph, route and endpoint candidates, vendor fingerprints, page-declared WebMCP metadata, and optionally fetch source maps from the selected target origin or explicitly requested origins. JavaScript is parsed but never executed.",
+				kind: "browser-provider",
+				inputSchema: analyzeWebBundleInputSchema,
+				outputSchema: bundleOutputSchema,
+				examples: [{
+					title: "Analyze a page bundle",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+						observation_ms: 500,
+						include_accessibility_text: false,
+						include_script_sources: true,
+						include_storage_keys: false,
+						fetch_source_maps: false
+					}
+				}]
+			},
+			{
+				name: "observe_web_session",
+				...toolContractMetadata("observe_web_session"),
+				description: "Arm a CDP observation window of the requested duration while the user operates the page. By default it follows the selected target's current origin; an explicit origin list controls which origins may be retained. Records navigation, redirect, lifecycle, and failure events.",
+				kind: "browser-provider",
+				inputSchema: observeWebSessionInputSchema,
+				outputSchema: observationSessionOutputSchema,
+				examples: [{
+					title: "Observe one external user action",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+						observation_ms: 1e4
+					}
+				}]
+			},
+			{
+				name: "discover_webmcp_tools",
+				...toolContractMetadata("discover_webmcp_tools"),
+				description: "Passively inventory every page-registered WebMCP tool and its complete structural input-schema summary using the experimental CDP WebMCP domain. Metadata is page-declared-untrusted; REA never registers or invokes discovered tools.",
+				kind: "browser-provider",
+				inputSchema: discoverWebMcpToolsInputSchema,
+				outputSchema: webMcpOutputSchema,
+				examples: [{
+					title: "Discover current WebMCP declarations",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+						observation_ms: 100
+					}
+				}]
+			},
+			{
+				name: "compare_web_captures",
+				...toolContractMetadata("compare_web_captures"),
+				description: "Compare passive web captures by providing before and after, each with the complete inspect_web_page normalized_result in inspection and an optional complete discover_webmcp_tools normalized_result in webmcp; or compare recorded scenarios by passing complete capture_browser_scenario normalized_result objects in before_scenario and after_scenario with an optional normalization policy. Use exactly one input group. Network comparison includes observed HTTP requests and WebSocket frame streams; same-URL connections are compared as an unordered collection of ordered streams, retaining connection counts without claiming stable identity between individual connections. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and returns every artifact-level difference plus alignment failures inline. Missing or truncated evidence never proves equality.",
+				kind: "browser-provider",
+				inputSchema: browserCaptureComparisonInputSchema,
+				outputSchema: captureDiffOutputSchema,
+				examples: [{
+					title: "Compare two recorded browser scenarios",
+					input: {
+						before_scenario: exampleScenarioCapture(),
+						after_scenario: exampleScenarioCapture(),
+						normalization: { rules: [{
+							rule_id: "volatile-build-id",
+							artifacts: ["dom", "accessibility"],
+							match: "build-123",
+							replacement: "[BUILD_ID]"
+						}] }
+					}
+				}]
+			},
+			{
+				name: "capture_web_screenshot",
+				...toolContractMetadata("capture_web_screenshot"),
+				description: "Capture the current visible viewport of one configured page as an inline, content-addressed PNG artifact. The operation never scrolls, navigates, or evaluates page JavaScript.",
+				kind: "browser-provider",
+				inputSchema: captureWebScreenshotInputSchema,
+				outputSchema: screenshotOutputSchema,
+				examples: [{
+					title: "Capture a viewport",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS"
+					}
+				}]
+			},
+			{
+				name: "compare_web_screenshots",
+				...toolContractMetadata("compare_web_screenshots"),
+				description: "Compare two self-verifying PNG screenshot artifacts with local pixel metrics. Returns exact changed-pixel ratios and channel deltas without OCR or external services.",
+				kind: "browser-provider",
+				inputSchema: compareWebScreenshotsInputSchema,
+				outputSchema: screenshotDiffOutputSchema,
+				examples: [{
+					title: "Compare two screenshot artifacts",
+					input: {
+						before: exampleScreenshot(),
+						after: exampleScreenshot(),
+						channel_threshold: 0
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/browserProviderToolContracts.js
+var BROWSER_PROVIDER_TOOL_CONTRACTS;
+function init_browserProviderToolContracts() {
+	return (init_browserProviderToolContracts = __esmMin((() => {
+		init_browserScenarioToolContracts();
+		init_browserToolContracts();
+		BROWSER_PROVIDER_TOOL_CONTRACTS = [...BROWSER_TOOL_CONTRACTS, ...BROWSER_SCENARIO_TOOL_CONTRACTS];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptRuntimeReconciliationExample.js
+function browserCompleteness() {
+	return {
+		status: "complete_within_window",
+		conditions: ["complete_within_window"],
+		policy_filtered_sections: [],
+		attach_limited_sections: [],
+		truncated_sections: [],
+		unavailable_sections: [],
+		excluded: [],
+		dropped_events: {
+			scripts: 0,
+			network_requests: 0,
+			console_events: 0,
+			websocket_connections: 0,
+			websocket_frames: 0,
+			webmcp_tools: 0,
+			timeline_events: 0,
+			total: 0
+		}
+	};
+}
+var applicationSha256, script, inputPath, scriptPath, completeCoverage, graphEvidence, asset, graph, evidenceContexts, semanticNode, semanticGraph, JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, runtimeEvidence, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE;
+function init_javascriptRuntimeReconciliationExample() {
+	return (init_javascriptRuntimeReconciliationExample = __esmMin((() => {
+		init_evidence();
+		init_javascriptApplicationGraph();
+		init_webContentArtifact();
+		init_javascriptSemanticGraph();
+		init_javascriptSemanticGraphSchemas();
+		applicationSha256 = "1".repeat(64);
+		script = createWebTextArtifact("export const example = true;\n", "text/javascript");
+		inputPath = "/Applications/Example.app/Contents/Resources/app";
+		scriptPath = `${inputPath}/renderer.js`;
+		completeCoverage = {
+			status: "complete",
+			truncated: false,
+			omitted_count: 0,
+			limits: []
+		};
+		graphEvidence = {
+			authority: "artifact-bytes",
+			state: "observed",
+			confidence: "exact",
+			artifact: {
+				available: true,
+				artifact_id: `art_${script.sha256}`,
+				sha256: script.sha256
+			},
+			location: {
+				available: true,
+				value: {
+					kind: "artifact-path",
+					path: "renderer.js"
+				}
+			},
+			extractor: {
+				name: "rea-javascript-application",
+				version: "1",
+				operation: "inventory-relevant-file",
+				executable_sha256: null
+			},
+			coverage: completeCoverage,
+			limitations: [],
+			evidence_ids: []
+		};
+		asset = createJavaScriptApplicationNode({
+			kind: "javascript-asset",
+			identity: {
+				strategy: "content-digest",
+				stability: "global-exact",
+				sha256: script.sha256
+			},
+			observations: [{
+				label: "renderer.js",
+				properties: {
+					path: "renderer.js",
+					bytes: script.bytes
+				},
+				evidence: graphEvidence
+			}]
+		});
+		graph = createJavaScriptApplicationGraph({
+			schema: "JavaScriptApplicationGraph",
+			root_node_ids: [asset.node_id],
+			nodes: [asset],
+			edges: [],
+			coverage: completeCoverage,
+			limitations: []
+		});
+		evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
+		semanticNode = createJavaScriptSemanticGraphNode({
+			kind: "module",
+			identity: {
+				artifact_sha256: applicationSha256,
+				module_path: "renderer.js",
+				source_range: null,
+				role_key: "example-module"
+			},
+			function_node_id: null,
+			application_node_ids: [asset.node_id],
+			label: "renderer.js",
+			properties: {},
+			evidence: graphEvidence
+		}, evidenceContexts);
+		semanticGraph = createJavaScriptSemanticGraph({
+			schema: "JavaScriptSemanticRelationGraph",
+			root_artifact_sha256: applicationSha256,
+			application_graph_id: graph.graph_id,
+			root_node_ids: [semanticNode.node_id],
+			evidence_contexts: evidenceContexts.contexts,
+			nodes: [semanticNode],
+			relations: [],
+			fingerprints: [],
+			unknowns: [],
+			coverage: {
+				status: "unknown",
+				truncated: false,
+				omitted_nodes: 0,
+				omitted_relations: 0,
+				limits: [],
+				families: JAVASCRIPT_SEMANTIC_RELATION_FAMILIES.map((family) => ({
+					family,
+					status: "unknown",
+					retained_relations: 0,
+					omitted_relations: 0,
+					unknown_ids: []
+				}))
+			},
+			limitations: ["Semantic relations are unavailable in this minimal example."]
+		});
+		JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE = createEvidence({
+			path: inputPath,
+			sha256: applicationSha256,
+			format: "directory"
+		}, {
+			id: "rea-javascript-application",
+			name: "REA JavaScript application analyzer",
+			version: "1"
+		}, {
+			predicateType: "rea.javascript-application-analysis",
+			operation: "analyze_javascript_application",
+			parameters: {},
+			result: {
+				input_path: inputPath,
+				format: "directory",
+				root_artifact_sha256: applicationSha256,
+				inventory_manifest_id: `agm_${"2".repeat(64)}`,
+				inventory_graph_sha256: "3".repeat(64),
+				integrity_contradictions: [],
+				graph,
+				semantic_graph: semanticGraph,
+				summary: {
+					browser_windows: 0,
+					explicit_web_preferences: 0,
+					preload_entrypoints: 0,
+					context_bridge_apis: 0,
+					exposed_api_members: 0,
+					ipc: {
+						operations: 0,
+						literal_channels: 0,
+						dynamic_channel_operations: 0,
+						renderer_transmissions: 0,
+						renderer_listeners: 0,
+						main_handlers: 0,
+						paired_renderer_transmissions: 0,
+						ambiguous_renderer_transmissions: 0,
+						unpaired_literal_renderer_transmissions: 0
+					},
+					sender_validation_observations: 0,
+					utility_processes: 0,
+					resolved_utility_entrypoints: 0,
+					native_addon_bindings: 0,
+					resolved_native_addon_bindings: 0
+				},
+				statistics: {
+					relevant_files: 1,
+					nested_asar_containers: 0,
+					text_bytes_read: script.bytes,
+					invalid_utf8_files: 0,
+					parsed_javascript_files: 1,
+					visited_ast_nodes: 1,
+					findings: 0,
+					modules: 0,
+					parse_failures: 0
+				},
+				limitations: []
+			},
+			confidence: "derived",
+			authority: "shipped-artifact"
+		});
+		runtimeEvidence = createEvidence(undefined, {
+			id: "rea-cdp-electron",
+			name: "REA Electron file-page CDP observation provider",
+			version: "1"
+		}, {
+			predicateType: "rea.electron-page-inspection",
+			operation: "inspect_electron_page",
+			parameters: {
+				cdp_endpoint: "http://127.0.0.1:9223",
+				target_id: "example-target",
+				include_script_sources: true
+			},
+			result: {
+				browser: {
+					product: "Electron/example",
+					protocol_version: "1.3",
+					revision: "example",
+					user_agent: "Electron example",
+					js_version: "1"
+				},
+				target: {
+					target_id: "example-target",
+					type: "page",
+					title: "Example",
+					file_path: `${inputPath}/index.html`,
+					attached: false
+				},
+				capture_window: {
+					started_at: "2026-07-15T00:00:00.000Z",
+					ended_at: "2026-07-15T00:00:00.100Z",
+					observation_ms: 100
+				},
+				completeness: browserCompleteness(),
+				frames: [],
+				dom: {
+					total_nodes: 0,
+					nodes: []
+				},
+				scripts: {
+					total: 1,
+					items: [{
+						script_key: `electron_script_${"4".repeat(64)}`,
+						frame_id: null,
+						file_path: scriptPath,
+						cdp_hash: "example",
+						length: script.bytes,
+						is_module: true,
+						language: "JavaScript",
+						source: {
+							included: true,
+							artifact: script
+						}
+					}]
+				},
+				resources: [],
+				workers: [],
+				limitations: ["Example passive capture."]
+			},
+			confidence: "observed",
+			authority: "external-service"
+		});
+		JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE = {
+			static_layers: [{ analysis: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE }],
+			runtime_observations: [runtimeEvidence]
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/electronToolContracts.js
+var listOutputSchema, inspectionOutputSchema, analyzeJavaScriptApplicationRequestSchema, applicationOutputSchema, reconciliationOutputSchema, endpoint$1, activeExample, ELECTRON_TOOL_CONTRACTS;
+function init_electronToolContracts() {
+	return (init_electronToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		init_electronFuses();
+		init_electronObservation();
+		init_electronActiveObservation();
+		init_analysisView();
+		init_analysisDetail();
+		init_javascriptApplicationAnalysis();
+		init_javascriptRuntimeReconciliationSchemas();
+		init_javascriptRuntimeReconciliationExample();
+		listOutputSchema = evidenceResultOf(electronTargetListSchema);
+		inspectionOutputSchema = evidenceResultOf(electronPageInspectionSchema);
+		analyzeJavaScriptApplicationRequestSchema = analyzeJavaScriptApplicationInputSchema.extend({ detail: analysisDetailSchema });
+		applicationOutputSchema = analysisDetailOutputSchemaOf(javascriptApplicationAnalysisResultSchema, javascriptApplicationSummaryViewResultSchema);
+		reconciliationOutputSchema = evidenceResultOf(javascriptRuntimeReconciliationResultSchema);
+		endpoint$1 = "http://127.0.0.1:9223";
+		activeExample = {
+			executable_path: "/Applications/Electron.app/Contents/MacOS/Electron",
+			application_path: "/Applications/Example.app/Contents/Resources/main.js",
+			args: [],
+			actions: [{
+				step_id: "exercise-ipc",
+				kind: "click",
+				selector: "#run"
+			}]
+		};
+		ELECTRON_TOOL_CONTRACTS = [
+			{
+				name: "list_electron_targets",
+				...toolContractMetadata("list_electron_targets"),
+				description: "List every Electron file:// page target from a selected loopback CDP endpoint. Local file paths are canonicalized after symlink resolution. Selecting an endpoint exposes every eligible target and its local path metadata.",
+				kind: "electron-provider",
+				inputSchema: listElectronTargetsInputSchema,
+				outputSchema: listOutputSchema,
+				examples: [{
+					title: "List Electron file pages",
+					input: { cdp_endpoint: endpoint$1 }
+				}]
+			},
+			{
+				name: "inspect_electron_page",
+				...toolContractMetadata("inspect_electron_page"),
+				description: "Passively inspect one Electron file page by supplying its loopback CDP endpoint and target ID. The provider rechecks that the target currently exists at that endpoint and is a local file page. Returns frames, DOM structure, resource paths, and scripts without evaluating renderer JavaScript or invoking Electron APIs. The selected endpoint exposes every local file page and its metadata to this tool.",
+				kind: "electron-provider",
+				inputSchema: inspectElectronPageInputSchema,
+				outputSchema: inspectionOutputSchema,
+				examples: [{
+					title: "Inspect an Electron page",
+					input: {
+						cdp_endpoint: endpoint$1,
+						target_id: "TARGET_ID_FROM_LIST_ELECTRON_TARGETS"
+					}
+				}]
+			},
+			{
+				name: "analyze_javascript_application",
+				...toolContractMetadata("analyze_javascript_application"),
+				description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Select source_paths to acquire and analyze only exact inventoried file paths; the complete artifact inventory and identity remain intact, and unselected sources remain explicit unknowns. Dependencies are not implicitly analyzed. Select detail summary to retain the complete analysis Evidence in this session and receive only its summary view, then inspect selected modules or pages with inspect_analysis_view. Summary detail reduces delivery, whereas source_paths bounds source analysis. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial.",
+				kind: "electron-provider",
+				inputSchema: analyzeJavaScriptApplicationRequestSchema,
+				outputSchema: applicationOutputSchema,
+				examples: [
+					{
+						title: "Analyze one local JavaScript application",
+						input: {
+							input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+							format: "auto",
+							integrity_policy: "fail"
+						}
+					},
+					{
+						title: "Analyze selected entry sources before unrelated vendor files",
+						input: {
+							input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+							source_paths: [
+								"package.json",
+								"main.js",
+								"preload.js"
+							],
+							detail: "summary"
+						}
+					},
+					{
+						title: "Retain the complete analysis and return its summary view",
+						input: {
+							input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+							detail: "summary"
+						}
+					}
+				]
+			},
+			{
+				name: "reconcile_javascript_runtime",
+				...toolContractMetadata("reconcile_javascript_runtime"),
+				description: "Reconcile verified static JavaScript application graphs with existing passive web/Electron CDP, passive V8 Inspector, or provider-owned active Electron Evidence. Active Electron captures contribute an explicitly partial target-only runtime record; they never invent renderer scripts, frames, workers, or execution claims. Exact captured-source digests take priority over caller-declared file/URL mappings; target, frame, script, and worker ambiguity remains explicit, and source-map authority stays separate.",
+				kind: "electron-provider",
+				inputSchema: reconcileJavaScriptRuntimeInputSchema,
+				outputSchema: reconciliationOutputSchema,
+				examples: [{
+					title: "Reconcile one passive Electron capture",
+					input: JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE
+				}]
+			},
+			{
+				name: "capture_electron_scenario",
+				...toolContractMetadata("capture_electron_scenario"),
+				description: "Use this for a provider-owned Electron run when passive CDP or Inspector observation cannot exercise application behavior. REA owns startup and teardown, accepts caller-defined click/wait actions plus window-targeted renderer reload/crash and synthetic open-url/second-instance delivery, and returns correlated window/WebContents/process/preload/session/navigation/shell/IPC evidence without retaining payload values. Actions wait for completion or request cancellation; a missing click target can keep the request pending. Results identify observed and unavailable event families, coverage status, action targets, and truncation. Cleanup failures retain collected observations with explicit cleanup uncertainty. External shell, navigation, permission, download, popup, updater, and OS-integration effects are blocked and recorded. Use passive Electron tools for observation-only work.",
+				kind: "electron-provider",
+				inputSchema: electronActiveObservationInputSchema,
+				outputSchema: evidenceResultOf(electronActiveObservationResultSchema),
+				examples: [{
+					title: "Exercise an owned Electron application",
+					input: activeExample
+				}]
+			},
+			{
+				name: "inspect_electron_fuses",
+				...toolContractMetadata("inspect_electron_fuses"),
+				kind: "artifact-provider",
+				description: "Inspect packaged Electron fuse bytes in one local macOS app bundle, Electron Framework binary, Windows PE executable, or Linux ELF executable. Returns the artifact digest, per-slice wire version, fuse index, version-1 name, state, and raw byte, plus derived implications for Inspector flags, ELECTRON_RUN_AS_NODE, embedded ASAR integrity, and app.asar-only loading. A missing sentinel is unknown fuse state. Reads artifact bytes only and does not modify the selected file or open a runtime target.",
+				inputSchema: inspectElectronFusesInputSchema,
+				outputSchema: electronFuseOutputSchemas.inspect_electron_fuses,
+				examples: [{
+					title: "Read packaged Electron fuse state",
+					input: { path: "/Applications/Example.app" }
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptRuntimeObservationToolContracts.js
+var endpoint, JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS;
+function init_javascriptRuntimeObservationToolContracts() {
+	return (init_javascriptRuntimeObservationToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_javascriptRuntimeObservation();
+		endpoint = "http://127.0.0.1:9229";
+		JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS = [{
+			name: "list_javascript_runtime_targets",
+			...toolContractMetadata("list_javascript_runtime_targets"),
+			description: "List every eligible Node/Electron V8 Inspector target from an explicit literal-loopback endpoint. Node discovery file locations that cannot be verified are preserved as unresolved reported URLs; they do not prove filesystem identity. Listing does not attach to targets.",
+			kind: "runtime-provider",
+			inputSchema: listJavaScriptRuntimeTargetsInputSchema,
+			outputSchema: evidenceResultOf(javascriptRuntimeTargetListSchema),
+			examples: [{
+				title: "List Node Inspector targets",
+				input: { inspector_endpoint: endpoint }
+			}]
+		}, {
+			name: "observe_javascript_runtime",
+			...toolContractMetadata("observe_javascript_runtime"),
+			description: "Attach passively to one Node/Electron V8 Inspector target by supplying its loopback Inspector endpoint and target ID. The provider rechecks target presence and attachability; a Node discovery file location may remain unresolved. Loaded script locations are validated independently from Debugger.scriptParsed. Captures script and Runtime execution-context metadata. REA never evaluates, pauses, resumes, reads source, or instruments the target; require/import edges, EventEmitter activity, and Electron IPC remain explicit unknowns. Reconcile the result with static Application Graph Evidence using reconcile_javascript_runtime. The selected endpoint exposes every target it serves to this tool.",
+			kind: "runtime-provider",
+			inputSchema: observeJavaScriptRuntimeInputSchema,
+			outputSchema: evidenceResultOf(javascriptRuntimeObservationSchema),
+			examples: [{
+				title: "Observe one Node runtime",
+				input: {
+					inspector_endpoint: endpoint,
+					target_id: "TARGET_ID_FROM_LIST_JAVASCRIPT_RUNTIME_TARGETS"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/applicationWorkflowInputContracts.js
+var traceApplicationFeatureFacts, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, compareApplicationVersionsFacts, compareApplicationVersionsRequestSchema, compareSourceToBundleFacts, compareSourceToBundleRequestSchema, compareJavaScriptExportShapesFacts, compareJavaScriptExportShapesRequestSchema;
+function init_applicationWorkflowInputContracts() {
+	return (init_applicationWorkflowInputContracts = __esmMin((() => {
+		init_evidenceInputContracts();
+		init_javascriptApplicationVersionComparisonSchemas();
+		init_javascriptExportShapeComparisonSchemas();
+		init_javascriptFeatureTraceSchemas();
+		init_javascriptSemanticQuerySchemas();
+		init_sourceToBundleComparisonSchemas();
+		traceApplicationFeatureFacts = {
+			native_observations: traceApplicationFeatureInputSchema.shape.native_observations,
+			seed: traceApplicationFeatureInputSchema.shape.seed,
+			direction: traceApplicationFeatureInputSchema.shape.direction
+		};
+		traceApplicationFeatureRequestSchema = z.strictObject({
+			...traceApplicationFeatureFacts,
+			application: evidenceInputSchema
+		});
+		traceJavaScriptSemanticsRequestSchema = z.strictObject({
+			application: evidenceInputSchema,
+			query: javaScriptSemanticQueryInputSchema
+		});
+		compareApplicationVersionsFacts = {
+			left_native_observations: compareApplicationVersionsInputSchema.shape.left_native_observations,
+			right_native_observations: compareApplicationVersionsInputSchema.shape.right_native_observations
+		};
+		compareApplicationVersionsRequestSchema = z.strictObject({
+			...compareApplicationVersionsFacts,
+			left: evidenceInputSchema,
+			right: evidenceInputSchema
+		});
+		compareSourceToBundleFacts = { reference: compareSourceToBundleInputSchema.shape.reference };
+		compareSourceToBundleRequestSchema = z.strictObject({
+			...compareSourceToBundleFacts,
+			application: evidenceInputSchema
+		});
+		compareJavaScriptExportShapesFacts = {
+			left_module_path: compareJavaScriptExportShapesInputSchema.shape.left_module_path,
+			left_export_name: compareJavaScriptExportShapesInputSchema.shape.left_export_name,
+			right_module_path: compareJavaScriptExportShapesInputSchema.shape.right_module_path,
+			right_export_name: compareJavaScriptExportShapesInputSchema.shape.right_export_name
+		};
+		compareJavaScriptExportShapesRequestSchema = z.strictObject({
+			...compareJavaScriptExportShapesFacts,
+			left: evidenceInputSchema,
+			right: evidenceInputSchema
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptApplicationWorkflowExamples.js
+var reconciliation, reconciliationEvidence, TRACE_SEED, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE;
+function init_javascriptApplicationWorkflowExamples() {
+	return (init_javascriptApplicationWorkflowExamples = __esmMin((() => {
+		init_evidence();
+		init_javascriptRuntimeReconciliation();
+		init_javascriptRuntimeReconciliationExample();
+		init_referenceSourceGraph();
+		init_javascriptRuntimeReconciliationSchemas();
+		reconciliation = reconcileJavaScriptRuntime(parseRuntimeReconciliationInput(reconcileJavaScriptRuntimeInputSchema.parse(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE)));
+		reconciliationEvidence = createEvidence(undefined, {
+			id: "rea-javascript-runtime-reconciliation",
+			name: "REA JavaScript runtime reconciliation",
+			version: "1"
+		}, {
+			predicateType: "rea.javascript-runtime-reconciliation",
+			operation: "reconcile_javascript_runtime",
+			parameters: {
+				static_layers: JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE.static_layers.map(({ analysis }) => ({
+					role: "application",
+					evidence_id: analysis.evidence_id,
+					runtime_mappings: []
+				})),
+				runtime_evidence_ids: JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE.runtime_observations.map(({ evidence_id: id }) => id)
+			},
+			result: reconciliation,
+			confidence: "inferred",
+			authority: "analyst-inference",
+			limitations: reconciliation.limitations,
+			evidenceLinks: reconciliation.evidence_links
+		});
+		TRACE_SEED = {
+			kind: "module",
+			value: "renderer.js",
+			match: "exact",
+			case_sensitive: false
+		};
+		JAVASCRIPT_FEATURE_TRACE_EXAMPLE = {
+			application: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE,
+			seed: TRACE_SEED,
+			direction: "both"
+		};
+		JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE = {
+			left: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE,
+			right: reconciliationEvidence
+		};
+		SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE = {
+			reference: createHistoricalSourceGraph({
+				schema: "HistoricalSourceGraph",
+				authority: "historical-reference",
+				root_alias: "$REFERENCE_ROOT",
+				inventory_state: "complete",
+				entries: [{
+					path: "src",
+					kind: "directory",
+					classifications: ["source"],
+					tree_state: "enumerated",
+					limitations: []
+				}, {
+					path: "src/main.ts",
+					kind: "file",
+					sha256: "2".repeat(64),
+					size: 128,
+					language: "TypeScript",
+					classifications: ["source"],
+					content_state: "hashed",
+					limitations: []
+				}],
+				relationships: [],
+				parse_failures: [],
+				exclusions: [],
+				languages: ["TypeScript"],
+				manifests: [],
+				vcs: {
+					kind: "none",
+					head: null,
+					dirty: null
+				},
+				provenance: {
+					importer: "rea",
+					importer_version: "1",
+					caller: "contract-example"
+				},
+				limitations: []
+			}),
+			application: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptExportShapeComparisonExample.js
+var captures, summary, statistics, modulePath, limitations, exampleEvidence, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE;
+function init_javascriptExportShapeComparisonExample() {
+	return (init_javascriptExportShapeComparisonExample = __esmMin((() => {
+		init_evidence();
+		init_webContentArtifact();
+		init_javascriptSemanticAnalysis();
+		init_javascriptExportReturnShapeProjection();
+		init_javascriptApplicationEvidenceSchemas();
+		init_javascriptApplicationGraph();
+		init_javascriptSemanticGraph();
+		init_javascriptSemanticGraphSchemas();
+		init_javascriptApplicationAnalysis();
+		captures = {
+			count: {
+				input_path: "/examples/javascript-export-presence/left",
+				root_artifact_sha256: "5005ebc2f35719a2fc014f19a81c669f3a1ab471b7245ef6985a111b6845a747",
+				inventory_manifest_id: "agm_f30ded9a83d43a3980417bbe63dfad569e83386f243c4d6a01af0166372cb9e6",
+				inventory_graph_sha256: "4b8aceaf67e43fd8317ec1f5fd1df5235f8fa402335accf011683e008c6bc62c",
+				integrity_contradictions: []
+			},
+			total: {
+				input_path: "/examples/javascript-export-presence/right",
+				root_artifact_sha256: "269ae72a601ad5ac02f1c2dda6ff9accffa2d2e4f4a9e406facee0d5a78a5377",
+				inventory_manifest_id: "agm_d3ceaa1af38fb3474070ca25c0d4644282e5fb7d5824cee3e3a81391481e9fc1",
+				inventory_graph_sha256: "3e9bc926951480c35385efe5650d9d781631bd74c37a523d543b5fbe06b01ce6",
+				integrity_contradictions: []
+			}
+		};
+		summary = {
+			browser_windows: 0,
+			explicit_web_preferences: 0,
+			preload_entrypoints: 0,
+			context_bridge_apis: 0,
+			exposed_api_members: 0,
+			ipc: {
+				operations: 0,
+				literal_channels: 0,
+				dynamic_channel_operations: 0,
+				renderer_transmissions: 0,
+				renderer_listeners: 0,
+				main_handlers: 0,
+				paired_renderer_transmissions: 0,
+				ambiguous_renderer_transmissions: 0,
+				unpaired_literal_renderer_transmissions: 0
+			},
+			sender_validation_observations: 0,
+			utility_processes: 0,
+			resolved_utility_entrypoints: 0,
+			native_addon_bindings: 0,
+			resolved_native_addon_bindings: 0
+		};
+		statistics = {
+			relevant_files: 1,
+			nested_asar_containers: 0,
+			text_bytes_read: 60,
+			invalid_utf8_files: 0,
+			parsed_javascript_files: 1,
+			visited_ast_nodes: 12,
+			findings: 1,
+			modules: 0,
+			parse_failures: 0
+		};
+		modulePath = "parser.mjs";
+		limitations = ["This example retains export and return-shape facts only; other application and semantic relationships are omitted."];
+		exampleEvidence = (property) => {
+			const metadata = captures[property];
+			const source = `export default () => ({ kind: "results", ${property}: query() });\n`;
+			const artifact = createWebTextArtifact(source, "text/javascript");
+			const ir = analyzeJavaScriptSemantics(source);
+			const link = ir.moduleLinks.find(({ exportedName }) => exportedName === "default");
+			if (link === undefined) throw new Error("Example source must define a default export");
+			const coverage = ir.coverage.status === "complete" ? completeApplicationCoverage() : partialApplicationCoverage([], ir.coverage.omittedCount);
+			const projection = projectJavaScriptExportReturnShapes({
+				ir,
+				link,
+				modulePath,
+				baseCoverage: coverage
+			});
+			if (projection === null) throw new Error("Example export must retain return shapes");
+			const evidence = {
+				artifact: {
+					available: true,
+					artifact_id: `art_${artifact.sha256}`,
+					sha256: artifact.sha256
+				},
+				location: {
+					available: true,
+					value: {
+						kind: "source-range",
+						source: modulePath,
+						...link.location
+					}
+				},
+				extractor: {
+					name: "rea-javascript-artifact-reconstruction",
+					version: "1",
+					operation: "recover-module-export",
+					executable_sha256: null
+				},
+				coverage,
+				limitations: ir.limitations,
+				evidence_ids: []
+			};
+			const exported = createJavaScriptApplicationNode({
+				kind: "javascript-module",
+				identity: {
+					strategy: "artifact-local-key",
+					stability: "artifact-version",
+					artifact_sha256: artifact.sha256,
+					namespace: "module-export",
+					key: `${metadata.root_artifact_sha256}:${modulePath}:default`
+				},
+				observations: [{
+					label: `${modulePath}:default`,
+					properties: {
+						semantic_role: "export-binding",
+						module_path: modulePath,
+						relationship_kind: link.kind,
+						exported_name: link.exportedName,
+						local_name: link.localName,
+						imported_name: link.importedName,
+						declared_specifier: link.specifier
+					},
+					evidence: {
+						...evidence,
+						authority: "ast-static-analysis",
+						state: "observed",
+						confidence: "exact"
+					}
+				}, {
+					label: `${modulePath}:default:return-shapes`,
+					properties: projection.properties,
+					evidence: {
+						...evidence,
+						authority: "static-relationship-inference",
+						state: "inferred",
+						confidence: "high",
+						location: {
+							available: true,
+							value: {
+								kind: "source-range",
+								source: modulePath,
+								...projection.range
+							}
+						},
+						extractor: {
+							...evidence.extractor,
+							operation: "recover-export-return-shapes"
+						},
+						coverage: projection.coverage,
+						limitations: projection.limitations
+					}
+				}]
+			});
+			const graph = createJavaScriptApplicationGraph({
+				schema: "JavaScriptApplicationGraph",
+				root_node_ids: [exported.node_id],
+				nodes: [exported],
+				edges: [],
+				coverage: partialApplicationCoverage([], null),
+				limitations
+			});
+			const evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
+			const module = createJavaScriptSemanticGraphNode({
+				kind: "module",
+				identity: {
+					artifact_sha256: artifact.sha256,
+					module_path: modulePath,
+					source_range: null,
+					role_key: "example-module"
+				},
+				function_node_id: null,
+				application_node_ids: [exported.node_id],
+				label: modulePath,
+				properties: {},
+				evidence: {
+					...evidence,
+					authority: "ast-static-analysis",
+					state: "observed",
+					confidence: "exact"
+				}
+			}, evidenceContexts);
+			const semanticGraph = createJavaScriptSemanticGraph({
+				schema: "JavaScriptSemanticRelationGraph",
+				root_artifact_sha256: metadata.root_artifact_sha256,
+				application_graph_id: graph.graph_id,
+				root_node_ids: [module.node_id],
+				evidence_contexts: evidenceContexts.contexts,
+				nodes: [module],
+				relations: [],
+				fingerprints: [],
+				unknowns: [],
+				coverage: {
+					status: "unknown",
+					truncated: false,
+					omitted_nodes: null,
+					omitted_relations: null,
+					limits: [],
+					families: JAVASCRIPT_SEMANTIC_RELATION_FAMILIES.map((family) => ({
+						family,
+						status: "unknown",
+						retained_relations: 0,
+						omitted_relations: null,
+						unknown_ids: []
+					}))
+				},
+				limitations
+			});
+			const result = javascriptApplicationAnalysisResultSchema.parse({
+				...metadata,
+				format: "directory",
+				graph,
+				semantic_graph: semanticGraph,
+				summary,
+				statistics,
+				limitations
+			});
+			return createEvidence({
+				path: result.input_path,
+				sha256: result.root_artifact_sha256,
+				format: "directory"
+			}, {
+				id: "rea-javascript-application",
+				name: "REA JavaScript application analyzer",
+				version: "1"
+			}, {
+				predicateType: "rea.javascript-application-analysis",
+				operation: "analyze_javascript_application",
+				parameters: {},
+				result,
+				confidence: "derived",
+				authority: "shipped-artifact",
+				limitations
+			});
+		};
+		JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE = {
+			left: exampleEvidence("count"),
+			right: exampleEvidence("total"),
+			left_module_path: modulePath,
+			left_export_name: "default",
+			right_module_path: modulePath,
+			right_export_name: "default"
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/mobileApplicationGraphExamples.js
+var inventory, provider, ANDROID_APPLICATION_GRAPH_EXAMPLE, APPLE_APPLICATION_GRAPH_EXAMPLE, MACOS_APPLICATION_GRAPH_EXAMPLE, HARMONY_APPLICATION_GRAPH_EXAMPLE;
+function init_mobileApplicationGraphExamples() {
+	return (init_mobileApplicationGraphExamples = __esmMin((() => {
+		init_canonicalDigest();
+		init_evidence();
+		init_jsonValue();
+		inventory = (format, digit) => {
+			const sha = digit.repeat(64);
+			const artifactId = `art_${digestCanonicalValue({ sha256: sha }, "Artifact inventory")}`;
+			const occurrenceId = `occ_${digestCanonicalValue({ root: artifactId }, "Artifact inventory")}`;
+			const nodes = [{
+				artifact_id: artifactId,
+				format: format === "directory" ? "directory" : "zip",
+				sha256: sha,
+				size: 1,
+				media_type: null,
+				architecture: null,
+				content_state: "materialized",
+				limitations: []
+			}];
+			const occurrences = [{
+				occurrence_id: occurrenceId,
+				artifact_id: artifactId,
+				parent_occurrence_id: null,
+				logical_path: ".",
+				entry_kind: "file",
+				artifact_kind: "resource",
+				artifact_format: format,
+				declared_size: 1,
+				compressed_size: null,
+				executable: false,
+				encrypted: false,
+				hash_status: "verified",
+				source_location: null,
+				limitations: []
+			}];
+			const graphSha256 = digestCanonicalValue({
+				nodes,
+				occurrences,
+				edges: [],
+				integrity_contradictions: []
+			}, "Artifact inventory");
+			return jsonValueSchema.parse({
+				manifest: {
+					manifest_id: `agm_${digestCanonicalValue({
+						root_artifact_id: artifactId,
+						graph_sha256: graphSha256
+					}, "Artifact inventory")}`,
+					root_artifact_id: artifactId,
+					root_sha256: sha,
+					root_format: format,
+					graph_sha256: graphSha256,
+					node_count: nodes.length,
+					occurrence_count: occurrences.length,
+					edge_count: 0
+				},
+				nodes,
+				occurrences,
+				edges: [],
+				provenance: [],
+				limitations: []
+			});
+		};
+		provider = {
+			id: "rea-artifact-graph",
+			name: "REA safe artifact graph provider",
+			version: "1"
+		};
+		ANDROID_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.apk",
+			sha256: "a".repeat(64),
+			format: "apk"
+		}, provider, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory("apk", "a"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+		APPLE_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.ipa",
+			sha256: "b".repeat(64),
+			format: "ipa"
+		}, provider, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory("ipa", "b"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+		MACOS_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.app",
+			sha256: "c".repeat(64),
+			format: "directory"
+		}, provider, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory("directory", "c"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+		HARMONY_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.hap",
+			sha256: "d".repeat(64),
+			format: "hap"
+		}, provider, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory("hap", "d"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/applicationToolContracts.js
+function applicationToolContract(name) {
+	const contract = APPLICATION_TOOL_CONTRACTS.find(({ name: candidate }) => candidate === name);
+	if (contract === undefined) throw new Error(`Missing application tool contract: ${name}`);
+	return contract;
+}
+var traceOutputSchema, semanticTraceOutputSchema, comparisonOutputSchema, sourceToBundleOutputSchema, exportShapeComparisonOutputSchema, reconstructionObligationLedgerOutputSchema, HASH, retained, APPLICATION_TOOL_CONTRACTS;
+function init_applicationToolContracts() {
+	return (init_applicationToolContracts = __esmMin((() => {
+		init_javascriptApplicationVersionComparisonSchemas();
+		init_javascriptFeatureTraceSchemas();
+		init_javascriptSemanticTraceSchemas();
+		init_javascriptExportShapeComparisonSchemas();
+		init_sourceToBundleComparisonSchemas();
+		init_applicationWorkflowInputContracts();
+		init_reconstructionCoverageInput();
+		init_reconstructionCoverage();
+		init_reconstructionObligationLedgerSchemas();
+		init_androidApplication();
+		init_appleApplication();
+		init_harmonyApplication();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_javascriptApplicationWorkflowExamples();
+		init_javascriptExportShapeComparisonExample();
+		init_mobileApplicationGraphExamples();
+		traceOutputSchema = evidenceResultOf(applicationFeatureTraceResultSchema);
+		semanticTraceOutputSchema = evidenceResultOf(javaScriptSemanticTraceResultSchema);
+		comparisonOutputSchema = evidenceResultOf(applicationVersionComparisonResultSchema);
+		sourceToBundleOutputSchema = evidenceResultOf(sourceToBundleComparisonResultSchema);
+		exportShapeComparisonOutputSchema = evidenceResultOf(javaScriptExportShapeComparisonResultSchema);
+		reconstructionObligationLedgerOutputSchema = evidenceResultOf(reconstructionObligationLedgerSchema);
+		HASH = "0".repeat(64);
+		retained = (evidence_id) => ({
+			kind: "retained-evidence",
+			evidence_id
+		});
+		APPLICATION_TOOL_CONTRACTS = [
+			{
+				name: "trace_application_feature",
+				...toolContractMetadata("trace_application_feature"),
+				description: "Trace a typed literal seed through every reachable part of an authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.",
+				kind: "application",
+				inputSchema: traceApplicationFeatureRequestSchema,
+				outputSchema: traceOutputSchema,
+				examples: [{
+					title: "Trace one module seed through a retained application graph",
+					input: JAVASCRIPT_FEATURE_TRACE_EXAMPLE
+				}, {
+					title: "Use exact Evidence already retained in this session",
+					input: {
+						...JAVASCRIPT_FEATURE_TRACE_EXAMPLE,
+						application: retained(JAVASCRIPT_FEATURE_TRACE_EXAMPLE.application.evidence_id)
+					}
+				}]
+			},
+			{
+				name: "trace_javascript_semantics",
+				...toolContractMetadata("trace_javascript_semantics"),
+				description: "Trace static JavaScript data-flow, direct call/return, and closure relations from inline application Evidence or an exact same-session retained reference. Dynamic or unsupported semantics remain explicit unknowns; static reachability never claims runtime execution.",
+				kind: "application",
+				inputSchema: traceJavaScriptSemanticsRequestSchema,
+				outputSchema: semanticTraceOutputSchema,
+				examples: [{
+					title: "Trace backward provenance from one semantic node",
+					input: {
+						application: JAVASCRIPT_FEATURE_TRACE_EXAMPLE.application,
+						query: {
+							seed: {
+								kind: "semantic-node",
+								node_id: `jsrg_node_${HASH}`
+							},
+							direction: "backward-provenance"
+						}
+					}
+				}]
+			},
+			{
+				name: "compare_application_versions",
+				...toolContractMetadata("compare_application_versions"),
+				description: "Compare two authenticated JavaScript Application Graph versions supplied as inline Evidence or exact same-session retained references. Uses unique-only exact digest, module source digest, source-map identity, structural fingerprint, and non-module semantic-key tiers. Reports added, removed, changed, ambiguous, and unknown entities plus the complete matching changed_from graph without fuzzy or module-ordinal pairing.",
+				kind: "application",
+				inputSchema: compareApplicationVersionsRequestSchema,
+				outputSchema: comparisonOutputSchema,
+				examples: [{
+					title: "Compare authenticated static and reconciled application graphs",
+					input: JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE
+				}, {
+					title: "Use exact Evidence already retained in this session",
+					input: {
+						...JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE,
+						left: retained(JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE.left.evidence_id),
+						right: retained(JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE.right.evidence_id)
+					}
+				}]
+			},
+			{
+				name: "compare_source_to_bundle",
+				...toolContractMetadata("compare_source_to_bundle"),
+				description: "Compare a cryptographically committed HistoricalSourceGraph with authenticated JavaScript Application Graph Evidence supplied inline or by exact same-session retained reference. Uses explicit exact-digest, source-map path, current-path, suffix, and basename signals with stable weights. Classifies unchanged, modified, removed, split, merged, duplicated, and unknown; incomplete coverage and ambiguous weak signals never become absence or forced matches.",
+				kind: "application",
+				inputSchema: compareSourceToBundleRequestSchema,
+				outputSchema: sourceToBundleOutputSchema,
+				examples: [{
+					title: "Compare committed historical source with a shipped bundle graph",
+					input: SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE
+				}]
+			},
+			{
+				name: "compare_javascript_export_shapes",
+				...toolContractMetadata("compare_javascript_export_shapes"),
+				description: "Compare static return shapes for one exact module/export selector on each authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Variants pair only by reciprocal unique literal discriminants. Each retained variant lists observed return-property names even when values stay unknown. Presence (present, absent, or unknown-coverage) is separate from value resolution: a name present on only one paired shape is added or removed when parent-property coverage is complete on both sides, including when the static value is unresolved. Dynamic values, incomplete parent coverage, and unpaired variants remain unknown. Reports JSON Pointer changes without executing JavaScript; runtime behavior requires a separate agent-run probe.",
+				kind: "application",
+				inputSchema: compareJavaScriptExportShapesRequestSchema,
+				outputSchema: exportShapeComparisonOutputSchema,
+				examples: [{
+					title: "Report observed return-property presence when static values stay unknown",
+					input: JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE
+				}, {
+					title: "Use exact Evidence already retained in this session",
+					input: {
+						...JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE,
+						left: retained(JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE.left.evidence_id),
+						right: retained(JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE.right.evidence_id)
+					}
+				}]
+			},
+			{
+				name: "build_reconstruction_obligation_ledger",
+				...toolContractMetadata("build_reconstruction_obligation_ledger"),
+				description: "Generate the complete deterministic ReconstructionObligationLedger from an authenticated Evidence bundle, reviewed obligations, and an explicit reconstruction manifest. Static candidates remain candidates; duplicate ownership, missing original or reconstruction cases, missing parser/type, weak verifier authority, unenumerated claims, contradictions, dependencies, and residual unknowns fail closed. The inline result carries the full-ledger closure digest and typed per-obligation diagnostics.",
+				kind: "application",
+				inputSchema: reconstructionObligationLedgerInputSchema,
+				outputSchema: reconstructionObligationLedgerOutputSchema,
+				examples: [{
+					title: "Generate the complete obligation ledger",
+					input: {
+						evidence_bundle: {
+							artifacts: [],
+							providers: [],
+							environments: [],
+							scenarios: [],
+							captures: [],
+							unknowns: [],
+							records: []
+						},
+						reviewed_obligations: [],
+						manifest: {
+							bindings: [],
+							contradictions: []
+						}
+					}
+				}]
+			},
+			{
+				name: "evaluate_reconstruction_coverage",
+				...toolContractMetadata("evaluate_reconstruction_coverage"),
+				description: "Evaluate inline evidence-backed reconstruction coverage against one named boundary. Missing ownership or inventory is partial; stale, weak, truncated, skipped, unresolved, or conflicting tied verifier proof is unknown; contradictions, failed proof, missing owners, and authority routing fail closed.",
+				kind: "application",
+				inputSchema: reconstructionCoverageEvaluationInputSchema,
+				outputSchema: reconstructionClosureResultSchema,
+				examples: [{
+					title: "Evaluate one replacement boundary",
+					input: {
+						coverage: {
+							evidence_bundle: {
+								artifacts: [],
+								providers: [],
+								environments: [],
+								scenarios: [],
+								captures: [],
+								unknowns: [],
+								records: []
+							},
+							artifacts: [],
+							surfaces: [],
+							owners: [],
+							claims: [],
+							verifier_contracts: [],
+							verifier_results: [],
+							residual_unknown_ids: [],
+							contradictions: [],
+							package_proofs: [],
+							boundaries: [{
+								boundary_id: "replacement.cli",
+								title: "CLI replacement",
+								required_surface_ids: ["cli.help"],
+								required_claim_ids: ["claim.cli.help"],
+								required_package_proof_kinds: ["clean-install", "authority-independence"],
+								allowed_dispositions: [],
+								allowed_unknown_ids: []
+							}]
+						},
+						boundary_id: "replacement.cli"
+					}
+				}]
+			},
+			{
+				name: "project_android_application_graph",
+				...toolContractMetadata("project_android_application_graph"),
+				description: "Project authenticated APK inventory_artifact Evidence into an execution-free Android application inventory. Reports exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without decoding DEX, executing the APK, or claiming observed runtime calls.",
+				kind: "application",
+				inputSchema: androidApplicationProjectionInputSchema,
+				outputSchema: evidenceResultOf(androidApplicationProjectionResultSchema),
+				examples: [{
+					title: "Project APK inventory Evidence into an Android application graph",
+					input: ANDROID_APPLICATION_GRAPH_EXAMPLE
+				}]
+			},
+			{
+				name: "project_apple_application_graph",
+				...toolContractMetadata("project_apple_application_graph"),
+				description: "Project authenticated IPA, macOS .app directory, ZIP, or DMG inventory Evidence into an execution-free Apple application inventory. Reports application roots, nested bundles with path-convention roles (app extensions, XPC services, login items, privileged helpers, system extensions, frameworks), launchd plists, exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without parsing plist/CMS semantics or claiming observed runtime calls.",
+				kind: "application",
+				inputSchema: appleApplicationProjectionInputSchema,
+				outputSchema: evidenceResultOf(appleApplicationProjectionResultSchema),
+				examples: [{
+					title: "Project IPA inventory Evidence into an Apple application graph",
+					input: APPLE_APPLICATION_GRAPH_EXAMPLE
+				}, {
+					title: "Project a macOS .app directory inventory into its bundle anatomy",
+					input: MACOS_APPLICATION_GRAPH_EXAMPLE
+				}]
+			},
+			{
+				name: "project_harmony_application_graph",
+				...toolContractMetadata("project_harmony_application_graph"),
+				description: "Project authenticated HarmonyOS HAP, HSP, or App Pack inventory Evidence into an execution-free application inventory. Reports packaging-model hints (Stage module.json versus FA config.json), exact component paths and hashes (manifests, Ark bytecode, resources, native libraries, JavaScript, signing), App Pack child packages, runtime-family hints, and path-based N-API bridge hypotheses without decoding Ark bytecode, parsing manifest semantics, or claiming observed runtime calls.",
+				kind: "application",
+				inputSchema: harmonyApplicationProjectionInputSchema,
+				outputSchema: evidenceResultOf(harmonyApplicationProjectionResultSchema),
+				examples: [{
+					title: "Project HAP inventory Evidence into a HarmonyOS application graph",
+					input: HARMONY_APPLICATION_GRAPH_EXAMPLE
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/webScriptToolContracts.js
+var WEB_SCRIPT_TOOL_CONTRACTS;
+function init_webScriptToolContracts() {
+	return (init_webScriptToolContracts = __esmMin((() => {
+		init_webScriptExport();
+		init_webModuleTrace();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_webSourceLocation();
+		WEB_SCRIPT_TOOL_CONTRACTS = [
+			{
+				name: "trace_web_source_location",
+				...toolContractMetadata("trace_web_source_location"),
+				description: "Trace one generated position in an exported website script through an explicitly paired local source map. Verifies manifest, selected script and map SHA-256/byte identities; returns every equal-position mapping, reported source/root, resolved source URL, embedded sourcesContent and original position inline. One-based lines and zero-based UTF-16 columns; greatest generated position <= requested across lines. Duplicate sources and generated-only mappings remain distinct. Caller-selected pairing does not establish deployment authenticity or execution. Regular maps and inline indexed sections only; external section URLs are unsupported. No network access or application execution; uses the pinned upstream codec in an owned Node process with private temporary files, independent 192 MiB old-generation heap and 20-second deadline. 4 MiB map, 32 MiB reply; complete evidence or actionable resource failure. Cleanup may extend the deadline.",
+				kind: "application",
+				inputSchema: webSourceLocationInputSchema,
+				outputSchema: evidenceResultOf(webSourceLocationResultSchema),
+				examples: [{
+					title: "Trace a selected captured JavaScript point to embedded original source",
+					input: {
+						manifest_path: "/analysis/scripts/manifest.json",
+						script_index: 0,
+						source_map: {
+							path: "/analysis/app.js.map",
+							url: "https://example.test/app.js.map"
+						},
+						generated_position: {
+							line: 1,
+							column: 25
+						}
+					}
+				}]
+			},
+			{
+				name: "trace_web_module_imports",
+				...toolContractMetadata("trace_web_module_imports"),
+				description: "Trace one exported website script's outgoing native ES imports/re-exports, using exact URL and optional selected import-map context. Reads a local export_web_scripts manifest and verifies the selected source's SHA-256/size; returns source positions, native resolved URLs or exact errors, every matching captured candidate and explicit unknown execution. Query/fragment identities are preserved. Computed imports and bundler IDs remain unknown. Select importer_url for unknown inline/document-base context. Caller-supplied Chromium executes only a trusted REA resolver stub in an owned context with page requests locally fulfilled/blocked; no captured application execution or asset refetch. Requires absolute REA_BROWSER_EXECUTABLE for literal imports. 32 MiB manifest, 16 MiB source, 4 MiB map and 20-second native deadline; cleanup may extend the deadline.",
+				kind: "application",
+				inputSchema: webModuleTraceInputSchema,
+				outputSchema: evidenceResultOf(webModuleTraceResultSchema),
+				examples: [{
+					title: "Trace an exported module under a selected import map",
+					input: {
+						manifest_path: "/analysis/exported-scripts/manifest.json",
+						script_index: 0,
+						import_map: {
+							path: "/analysis/import-map.json",
+							base_url: "https://example.test/app/"
+						}
+					}
+				}]
+			},
+			{
+				name: "export_web_scripts",
+				...toolContractMetadata("export_web_scripts"),
+				description: "Export JavaScript bytes already retained in one local inspect_web_page or capture_browser_scenario JSON capture (normalized result or complete Evidence). Writes scripts and a digest-verified manifest into an absent absolute output_directory. Returns all source URLs, script or transaction/event references, unavailable states, and an analysis_input for analyze_javascript_application when any bytes were exported. Include script sources in inspect_web_page or select capture.network.response_body in scenarios. No refetch or execution. Safe unambiguous URL layouts preserve relative module paths; versions, query variants, inline scripts, and path collisions are isolated with explicit resolution limitations.",
+				kind: "application",
+				inputSchema: exportWebScriptsInputSchema,
+				outputSchema: evidenceResultOf(webScriptExportResultSchema),
+				examples: [{
+					title: "Export a saved website capture for static JavaScript analysis",
+					input: {
+						capture_path: "/analysis/capture.json",
+						output_directory: "/analysis/exported-scripts"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/webRuntimeToolContracts.js
+var WEB_RUNTIME_TOOL_CONTRACTS;
+function init_webRuntimeToolContracts() {
+	return (init_webRuntimeToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_webExecution();
+		init_webEventListeners();
+		WEB_RUNTIME_TOOL_CONTRACTS = [{
+			name: "observe_web_execution",
+			...toolContractMetadata("observe_web_execution"),
+			description: "Instrument one selected CDP page for a finite, externally driven precise coverage window. Resets execution counters and prevents optimized execution until stopped. Returns complete nested UTF-16 ranges/counts, independently hashed script text and request initiator associations by session script ID. Does not navigate, click, evaluate selected code or close the externally owned page. Navigation ends document-scoped collection; workers and UI causality remain outside this claim. Emits an actual armed progress notification before external actions.",
+			kind: "browser-provider",
+			inputSchema: observeWebExecutionInputSchema,
+			outputSchema: evidenceResultOf(webExecutionSchema),
+			examples: [{
+				title: "Attribute externally triggered page execution",
+				input: {
+					cdp_endpoint: "http://127.0.0.1:9222",
+					target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+					observation_ms: 1e4
+				}
+			}]
+		}, {
+			name: "inspect_web_event_listeners",
+			...toolContractMetadata("inspect_web_event_listeners"),
+			description: "Inspect listeners registered directly on the first main-document CSS match in one selected CDP page. Returns event flags, native callback locations, source ownership and exact script text/digests inline. Does not dispatch events, evaluate JavaScript or invoke handlers. Delegated ancestor/framework listeners and execution history remain unknown. Releases REA's object group and transport, preserving the external page.",
+			kind: "browser-provider",
+			inputSchema: inspectWebEventListenersInputSchema,
+			outputSchema: evidenceResultOf(webEventListenersSchema),
+			examples: [{
+				title: "Find a selected button's callback source",
+				input: {
+					cdp_endpoint: "http://127.0.0.1:9222",
+					target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+					selector: "#submit"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/webNetworkCaptureToolContracts.js
+var WEB_NETWORK_CAPTURE_TOOL_CONTRACTS;
+function init_webNetworkCaptureToolContracts() {
+	return (init_webNetworkCaptureToolContracts = __esmMin((() => {
+		init_webNetworkCapture();
+		init_toolEffects();
+		init_analysisDetail();
+		init_analysisView();
+		WEB_NETWORK_CAPTURE_TOOL_CONTRACTS = [{
+			name: "inspect_web_network_capture",
+			...toolContractMetadata("inspect_web_network_capture"),
+			description: "Request detail summary for capture identity and counts; then page retained records with inspect_analysis_view kind capture (preview or complete), avoiding repeated decoding. Default detail complete preserves existing inline delivery. Inspect retained local HAR 1.2, native mitmproxy, Fiddler SAZ or aioquic 1.5.0 JSON qlog 0.3 events without contacting recorded URLs. Returns original ordinals, pointers/byte ranges/archive member names, preserved producer fields, precise numeric representations and exact exposed binary bytes inline. Excludes known transport credentials and explicitly marked values. Decodes every record before optional ordinal selection; malformed or oversized captures return no partial success. Duplicate JSON members are invalid; prototype-named members such as __proto__ are preserved as ordinary own JSON members without prototype mutation. Qlog reports trace-scoped STREAM interval unions and endpoint loss declarations; it does not recover bodies, prove network loss or correlate PCAP. Other qlog layouts are unsupported. Uses pinned upstream parsers, owned temporary files and bounded offline processes. SAZ preserves HTTP fields, XML metadata and encoded body/message bytes without replay or HAR conversion; encrypted archives are unsupported. Native mitmproxy requires caller-supplied mitmdump 12.2.3 on Linux. Browser transaction IDs, runtime attribution and original bytes of HAR Unicode text remain unknown.",
+			kind: "browser-provider",
+			inputSchema: inspectWebNetworkCaptureInputSchema.extend({ detail: analysisDetailSchema }),
+			outputSchema: analysisDetailOutputSchemaOf(webNetworkCaptureSchema, webNetworkCaptureSummaryViewResultSchema),
+			examples: [{
+				title: "Inspect retained aioquic qlog events",
+				input: {
+					capture_path: "/captures/origin.qlog",
+					format: "qlog",
+					record_ordinals: [0, 2]
+				}
+			}, {
+				title: "Inspect historical HAR entries",
+				input: {
+					capture_path: "/captures/session.har",
+					format: "har",
+					record_ordinals: [0, 2]
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptRecoveryToolContracts.js
+var JAVASCRIPT_RECOVERY_TOOL_CONTRACTS;
+function init_javascriptRecoveryToolContracts() {
+	return (init_javascriptRecoveryToolContracts = __esmMin((() => {
+		init_javascriptRecovery();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		JAVASCRIPT_RECOVERY_TOOL_CONTRACTS = [{
+			name: "recover_javascript_sources",
+			...toolContractMetadata("recover_javascript_sources"),
+			kind: "application",
+			description: "Recover readable modules from local UTF-8 JavaScript scripts/bundles into an absent directory, using caller-supplied Wakaru ^1.13.0 (verified with 1.14.0) on Linux x64. Use additional_paths for related chunks; each input retains its own snapshot and provenance. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB total input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
+			inputSchema: javascriptRecoveryInputSchema,
+			outputSchema: evidenceResultOf(javascriptRecoveryResultSchema),
+			examples: [{
+				title: "Recover a captured production bundle",
+				input: {
+					path: "/tmp/web-scripts/app.js",
+					output_directory: "/tmp/recovered-app"
+				}
+			}, {
+				title: "Recover a code-split bundle together",
+				input: {
+					path: "/tmp/web-scripts/main.js",
+					additional_paths: [
+						"/tmp/web-scripts/runtime.js",
+						"/tmp/web-scripts/shared.js",
+						"/tmp/web-scripts/checkout.chunk.js"
+					],
+					output_directory: "/tmp/recovered-chunks"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/functionWorkflowToolContracts.js
+var functionWorkflow, FUNCTION_WORKFLOW_TOOL_CONTRACTS;
+function init_functionWorkflowToolContracts() {
+	return (init_functionWorkflowToolContracts = __esmMin((() => {
+		init_jsonValue();
+		init_enhancedInputs();
+		init_toolContractExamples();
+		init_toolEffects();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		functionWorkflow = (name, description) => {
+			const inputSchema = enhancedInputSchemas[name];
+			const outputSchema = requireOutputSchema(enhancedOutputSchemas, name);
+			return {
+				name,
+				...toolContractMetadata(name),
+				description,
+				kind: "enhanced",
+				inputSchema,
+				outputSchema,
+				examples: [{
+					title: `Example ${name.replaceAll("_", " ")} request`,
+					input: jsonObjectSchema.parse(inputSchema.parse(TOOL_EXAMPLE_OVERRIDES[name] ?? {}))
+				}]
+			};
+		};
+		FUNCTION_WORKFLOW_TOOL_CONTRACTS = [functionWorkflow("analyze_function", "Build a dossier for one native function identified by symbol or provider-returned address. Returns identity with complete inclusive analyzed body ranges or explicit unknown, provider-specific pseudocode and assembly, comments, calls, references, referenced strings/names, local CFG blocks, and available native API boundary observations. Ghidra terminal-call assumptions that may cut the analyzed body are reported in limitations with available callee identities."), functionWorkflow("inspect_native_api", "Analyze a native API boundary in one function identified by symbol or provider-returned address. Returns confidence, evidence, jump-table dispatch/data/case mappings, separately evidenced default targets, unsupported branches, and residual unknowns. Null case values mean unresolved cases, never a known default.")];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/enhancedToolContracts.js
+var enhanced, ENHANCED_TOOL_CONTRACTS;
+function init_enhancedToolContracts() {
+	return (init_enhancedToolContracts = __esmMin((() => {
+		init_enhancedInputs();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		init_toolContractHelpers();
+		init_toolEffects();
+		init_functionWorkflowToolContracts();
+		enhanced = (name, description, inputSchema) => ({
+			name,
+			...toolContractMetadata(name),
+			description,
+			kind: "enhanced",
+			inputSchema,
+			outputSchema: requireOutputSchema(enhancedOutputSchemas, name),
+			examples: examplesFor(name, inputSchema)
+		});
+		ENHANCED_TOOL_CONTRACTS = [
+			enhanced("inspect_native_dispatch_metadata", "Inspect the bound provider's name inventory for Objective-C class/method symbols and Swift mangled symbols, returning at most max_records decoded names. Includes target SHA-256 when available, provider identity/version, analysis-profile digest, facet coverage, and per-record Evidence. This is symbol-level evidence, not runtime metadata: ivar layouts, protocol conformances, witness/class tables, and relative pointers are explicitly marked unsupported unless a provider supplies those decoders. The provider controls how its name inventory is acquired.", enhancedInputSchemas.inspect_native_dispatch_metadata),
+			enhanced("get_objc_classes", "Discover and deduplicate Objective-C class labels, optionally filtering by literal substring.", enhancedInputSchemas.get_objc_classes),
+			enhanced("get_objc_protocols", "Discover and deduplicate Objective-C and Swift protocol labels.", enhancedInputSchemas.get_objc_protocols),
+			enhanced("batch_decompile", "Decompile each explicit procedure symbol or address concurrently. Preserves each input selector in address and reports the observed canonical entry and entry label in procedure; identity or label failures remain explicit without discarding usable pseudocode. Returns ordered per-item success or error results and aggregate counts.", enhancedInputSchemas.batch_decompile),
+			enhanced("get_call_graph", "Resolve one symbol or address to its canonical procedure entry, then traverse the bound provider's caller or callee relationships until the reachable graph is exhausted. Every node uses a canonical address and has an ok/error status; failures use safe typed projections. Unresolved indirect calls may be missing and results are not a whole-program CFG.", enhancedInputSchemas.get_call_graph),
+			enhanced("analyze_swift_types", "Categorize analyzed Swift procedure names using their manglings or same-address Swift symbol aliases. Decodes legacy and literal modern nominal contexts into classes, structs, enums, protocols, and extensions. Preserves provider names and supporting mangled_names; unresolved categories appear in other and in unclassified, which remains inline even under category filters. Returns deduplicated procedure-name counts, not unique source types, plus identification limitations. Optionally select one category and/or apply a case-sensitive literal filter to provider names or supporting manglings; for example, use {category: \"structs\", pattern: \"Pair\"}.", enhancedInputSchemas.analyze_swift_types),
+			enhanced("find_xrefs_to_name", "Resolve an exact name against the bound provider's name inventory and return a resolved or unresolved result. Unresolved names use the stable name_not_found reason; this xref workflow returns address-only projections.", enhancedInputSchemas.find_xrefs_to_name),
+			enhanced("binary_overview", "Return the bound document and exhaustive procedure/string counts, plus every segment and segment_count when the provider supports segment enumeration. If segment fields are omitted, segment coverage is unavailable rather than empty. When every observed segment agrees on an analysis image base, return it as image_base so callers can relate provider addresses to their loader coordinates. Use search_procedures, list_procedures, or analyze_function directly when you already know which procedure to inspect.", enhancedInputSchemas.binary_overview),
+			...FUNCTION_WORKFLOW_TOOL_CONTRACTS,
+			enhanced("trace_feature", "Trace the complete literal query, preserving spaces, through every matching string and procedure, their xrefs, and truthful containing-procedure resolution. Returns observations, operation count, and residual unknowns without inferring reference kinds.", enhancedInputSchemas.trace_feature),
+			enhanced("trace_call_path", "Resolve start and optional goal symbols or addresses to canonical procedure entries, then trace direct callers or callees until the graph is exhausted or the goal is reached. Results use canonical addresses; Evidence preserves supplied selectors. Returns visited nodes, direct-call edges, a shortest traversal path, provider failures, and residual unknowns. A requested goal is unknown when unresolved expansions prevent proving it absent; unresolved indirect calls remain unknown.", enhancedInputSchemas.trace_call_path),
+			enhanced("trace_native_ui_action", "Trace one unique compiled UI action, object ID, native symbol or exact function address through authored connections, encoded or symbolized Objective-C handlers, and bounded static call references. Typed direct and resolved indirect calls, ambiguous candidates, inferred untyped provider callees, and targetless sites remain distinct. Runtime reachability is unknown; use trace_native_values for recovered value dependencies.", enhancedInputSchemas.trace_native_ui_action),
+			enhanced("trace_native_values", "Trace a bounded static dependency graph from one explicit native procedure. Includes high-p-code def-use, constants, operators, memory and branch operations, resolved call edges, and derived argument/parameter and return/output bindings. Missing bindings, alias semantics, persistent state and RNG roles remain unknown. Budgets bound depth, decompilations, graph size and payloads; nodes are paginated.", enhancedInputSchemas.trace_native_values)
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/sessionLifecycleInputs.js
+var snapshotPathSchema, binaryTargetPathSchema, openBinaryInputSchema, closeBinaryInputSchema;
+function init_sessionLifecycleInputs() {
+	return (init_sessionLifecycleInputs = __esmMin((() => {
+		init_dosCom();
+		init_localPath();
+		init_rawBinary();
+		init_providerSelection();
+		snapshotPathSchema = localPathStringSchema.refine(isAbsolute, { message: "snapshot_path must be an absolute local filesystem path (for example /tmp/rea/analysis.json or C:\\rea\\analysis.json)" }).describe("Absolute local filesystem path for the analysis snapshot; relative paths are rejected.");
+		binaryTargetPathSchema = localPathStringSchema.refine(isAbsolute, { message: "path must be an absolute local filesystem path (for example /tmp/fixture.bin or C:\\analysis\\fixture.bin)" }).describe("Absolute local filesystem path for the analysis target; relative paths are rejected.");
+		openBinaryInputSchema = z.strictObject({
+			path: binaryTargetPathSchema,
+			format: executableFormatHintSchema.optional().describe("Explicit headerless interpretation: dos-com or raw-binary. Omission preserves header-based detection."),
+			architecture: binaryArchitectureSchema.optional().describe("Caller-supplied CPU family. Required with format=raw-binary; rejected otherwise."),
+			entry_point: rawBinaryEntryPointSchema.optional().describe("Caller-supplied load and entry address (0xhex). File offset 0 is mapped here. Required with format=raw-binary; rejected otherwise."),
+			provider_id: analysisProviderSelectorSchema.optional(),
+			snapshot_path: snapshotPathSchema.optional()
+		}).superRefine((value, context) => {
+			const pairing = rawBinarySelectionError({
+				...value.format === undefined ? {} : { format: value.format },
+				...value.architecture === undefined ? {} : { architecture: value.architecture },
+				...value.entry_point === undefined ? {} : { entryPoint: value.entry_point }
+			});
+			if (pairing === undefined) return;
+			context.addIssue({
+				code: "custom",
+				path: value.format === "raw-binary" ? value.architecture === undefined ? ["architecture"] : ["entry_point"] : value.architecture === undefined ? ["entry_point"] : ["architecture"],
+				message: pairing
+			});
+		});
+		closeBinaryInputSchema = z.strictObject({
+			snapshot_path: snapshotPathSchema.optional(),
+			overwrite: z.boolean().default(false)
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/sessionStatusContract.js
+var binarySessionInputSchema;
+function init_sessionStatusContract() {
+	return (init_sessionStatusContract = __esmMin((() => {
+		init_localPath();
+		binarySessionInputSchema = z.strictObject({
+			expected_package_version: z.string().min(1).optional(),
+			expected_catalog_digest: z.string().regex(/^[a-f0-9]{64}$/u).optional(),
+			expected_server_path: localPathStringSchema.refine(isAbsolute, { message: "expected_server_path must be an absolute local filesystem path (for example /opt/rea/dist/main.js)" }).describe("Absolute local filesystem path expected for the running server; relative paths are rejected.").optional()
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/sessionToolContracts.js
+var session, exportEvidenceBundleInputSchema, SESSION_TOOL_CONTRACTS;
+function init_sessionToolContracts() {
+	return (init_sessionToolContracts = __esmMin((() => {
+		init_localPath();
+		init_artifactComparison();
+		init_bundleComparison();
+		init_callPathSchemas();
+		init_changedBehavior();
+		init_functionComparisonSchemas();
+		init_processScenario();
+		init_residualUnknown();
+		init_reconstructionVerificationSchemas();
+		init_staticRuntimeCorrelation();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		init_sessionLifecycleInputs();
+		init_sessionStatusContract();
+		init_sessionToolSchemas();
+		init_toolContractHelpers();
+		init_toolEffects();
+		session = (name, description, inputSchema) => ({
+			name,
+			...toolContractMetadata(name),
+			description,
+			kind: "session",
+			inputSchema,
+			outputSchema: requireOutputSchema(sessionOutputSchemas, name),
+			examples: examplesFor(name, inputSchema)
+		});
+		exportEvidenceBundleInputSchema = z.strictObject({
+			path: localPathStringSchema.refine(isAbsolute, { message: "path must be an absolute local filesystem path (for example /tmp/rea/evidence.json or C:\\rea\\evidence.json)" }).describe("Absolute local filesystem path for the exported evidence bundle; relative paths are rejected."),
+			overwrite: z.boolean().default(false)
+		});
+		SESSION_TOOL_CONTRACTS = [
+			session("open_binary", "Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. format=dos-com explicitly interprets 1..65280 headerless bytes as a DOS COM analysis image. format=raw-binary interprets headerless bytes with a required architecture and entry_point; file offset 0 maps at that address. Omission preserves header-based detection. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. Reopening the same target and profile retains its active database and metadata edits. An optional analysis snapshot is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly; importing into a session with metadata mutations requires closing and reopening it first.", openBinaryInputSchema),
+			session("close_binary", "Drain earlier provider requests, optionally write a provider-neutral analysis snapshot atomically to the caller-supplied path, then close the active target and every provider resource started for it. Later provider requests wait until this lifecycle operation finishes. Existing files require explicit overwrite; a failed save leaves the session open so cached analysis is not lost. Metadata edits prevent immutable snapshot saves until the session is recreated; export_evidence_bundle preserves mutable observations before closing without a snapshot.", closeBinaryInputSchema),
+			session("binary_session", "Report the complete current target, provider, capability availability, client-feature, analysis, and server-identity status without starting analysis.", binarySessionInputSchema),
+			session("export_evidence_bundle", "Atomically write the session's deterministic Evidence bundle to the requested local path. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering.", exportEvidenceBundleInputSchema),
+			session("import_evidence_bundle", "Read the JSON bundle at the supplied local path, validate every Evidence ID and canonical manifest, then atomically merge it. Imported content is data only and is never executed.", importEvidenceBundleInputSchema),
+			session("capture_process_scenario", "Run one caller-selected command under a PTY and return process capture Evidence with residual unknowns. The renderer admits at most 1,000,000 combined terminal cells, computed as columns × (rows + scrollback); every resize uses the selected scrollback and must fit the same budget. Supply a smaller terminal shape when that product is too large; dimensions are never clamped. A command name resolves through the inherited PATH; the working directory defaults to the caller's current directory; host environment variables are inherited with scenario overrides. Environment keys cannot contain '=' or NUL, and REA_PROCESS_RUN_ID is reserved for process ownership. Filesystem snapshots are opt-in through filesystem_observation_paths. A positive finalization_ms makes a timeout or idle deadline send SIGTERM to the captured root through its start identity, keep observing, and send SIGKILL once after the interval; exit.finalization records each attempt with its delivery result and the observed exit, and cancellation still ends the run at once. The target runs with the current user's permissions; this is not a security sandbox.", processScenarioSchema),
+			session("compare_process_captures", "Compare two compatible process capture observations across terminal, interaction, lifecycle, process, filesystem, command-shim, HTTP, and WebSocket evidence. Optional trace_spec validates exact events against an explicit partial order or finite trace language; concurrency is never inferred from timestamps or broad sorting. Missing, journal-free, or truncated observations are never treated as equivalent.", processComparisonInputSchema),
+			session("compare_artifacts", "Compare complete artifact inventories by logical occurrence path, content identity, metadata, and graph relations. Pass the inventory Evidence nested in each inspect_artifact result as left and right. Every delta cites both inputs, and gaps yield truncated or unknown, never equivalence. Returns every change inline.", artifactComparisonInputSchema),
+			session("compare_functions", "Compare two explicit sets of analyze_function Evidence across identity, exact provider text, calls, references, strings, and address-normalized CFG topology. Missing or provider-incompatible facets remain truncated or unknown; every conclusion cites both Evidence sets.", functionComparisonInputSchema),
+			session("compare_bundles", "Compare two canonical Evidence bundles by exact record membership, explicit one-to-one observation pairs, and complete residual-unknown revision histories. Missing bundle members describe omission only, never behavioral equivalence; output is digest-anchored and returns every change inline.", bundleComparisonInputSchema),
+			session("find_changed_behavior", "Aggregate validated process and artifact comparison Evidence. Runtime observations remain distinct from static behavior candidates; missing or incomplete comparisons produce unresolved findings, never causal claims. Returns every finding inline.", changedBehaviorInputSchema),
+			session("build_call_path", "Build every shortest direct-callee path inline from complete analyze_function Evidence records using exact canonical addresses. Missing dossiers and provider mixing remain unknown; every node and edge cites source Evidence.", callPathInputSchema),
+			session("correlate_static_and_runtime", "Evaluate every explicit caller-declared hypothesis between exact static comparison findings and runtime comparison dimensions. Similar names or paths are never auto-matched, consistent cochange never proves causality, and unknown or truncated inputs remain unresolved. Returns all correlations and their complete Evidence closure inline.", staticRuntimeCorrelationInputSchema),
+			session("verify_reconstruction", "Verify a finite typed behavioral and structural specification against a canonical Evidence bundle. Pass means every declared claim has complete comparable authority—not global source equivalence; changed claims fail and missing, limited, or unresolved evidence stays unknown.", reconstructionVerificationInputSchema),
+			session("list_unknowns", "List current residual-unknown heads in deterministic ID order, with optional exact status, severity, and domain filters. Results are complete inline by default; supply offset and limit to page the filtered order. total is the matching-head count and next_offset is null when the page exhausts the result. This is read-only; unresolved, contradicted, and non-truth dispositions remain distinct.", listUnknownsInputSchema),
+			session("record_unknown", "Create one deterministic residual unknown and immutable mutation evidence. Validates all evidence and relationship references, and rejects duplicate stable identity.", recordUnknownInputSchema),
+			session("update_unknown", "Append one immutable full-state revision and mutation evidence. Requires exact expected_revision; stale concurrent writers fail instead of overwriting newer analysis.", updateUnknownInputSchema),
+			session("verify_unknown_resolution", "Revalidate the current residual-unknown head against live bundled evidence, exact authority/confidence/environment requirements, and revision integrity. Withdrawn and out-of-scope dispositions are not truth claims.", verifyUnknownResolutionInputSchema),
+			session("get_evidence_bundle", "Return every retained Evidence record and residual unknown as a complete canonical bundle by default. detail=summary discovers retained records without copying or transferring their payloads; optionally filter by exact Evidence ID, operation, target SHA-256, analysis-profile digest or canonical native procedure address. Metadata distinguishes complete record retention from native value-flow truncation or unavailable/unknown coverage. Use a discovered evidence_id with inspect_analysis_view without restarting a provider. Filters apply only to summary delivery.", getEvidenceBundleInputSchema),
+			session("get_navigation_context", "Return the selected document, current address, and containing/current procedure in one provider-neutral result. The result reflects sequential provider observations, not an atomic cursor snapshot; a cursor outside any procedure returns procedure: null.", navigationContextInputSchema),
+			session("inspect_address_context", "Inspect one explicit reproducible address for its analyzed name, containing procedure, regular and inline comments, and matching bookmarks. Each unsupported facet returns a typed unavailable outcome; use xrefs, assembly, or pseudocode for those deeper views.", addressContextInputSchema)
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/reverseEngineeringToolContracts.js
+var commandObservationSchema, REVERSE_ENGINEERING_TOOL_CONTRACTS;
+function init_reverseEngineeringToolContracts() {
+	return (init_reverseEngineeringToolContracts = __esmMin((() => {
+		init_reverseEngineering();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		commandObservationSchema = z.strictObject({
+			stdout: z.string(),
+			stderr: z.string(),
+			exit_code: z.union([
+				z.string(),
+				z.number(),
+				z.null()
+			]),
+			signal: z.string().nullable(),
+			output_truncated: z.boolean(),
+			completion_status: z.enum(["complete", "unknown"]),
+			artifact_sha256_after: z.string().regex(/^[a-f0-9]{64}$/u).nullable(),
+			artifact_changed: z.boolean().nullable()
+		});
+		REVERSE_ENGINEERING_TOOL_CONTRACTS = [{
+			name: "inspect_with_objdump",
+			...toolContractMetadata("inspect_with_objdump"),
+			kind: "native-provider",
+			description: "Run caller-selected GNU objdump inspection against a local artifact, or request operation=architectures without a path to list BFD targets advertised by the installed binary. Preserves decoded stdout and stderr inline with SHA-256 Evidence for artifact inspections, up to a shared 16 MiB combined limit; invalid UTF-8 bytes are represented by replacement characters and flagged in Evidence limitations. output_truncated reports output beyond that limit and completion_status is unknown if buffer enforcement terminated the process. The raw output is authoritative and REA does not claim a stable normalized format. DWARF does not follow local debug links by default. Set follow_debug_links to true to follow them; identities of external debug files are not bound to Evidence. REA clears DEBUGINFOD_URLS for objdump so DWARF processing does not make debuginfod network requests. Architecture output is subjectless and does not establish support for any artifact.",
+			inputSchema: objdumpInputSchema,
+			outputSchema: evidenceResultOf(commandObservationSchema),
+			examples: [{
+				title: "Disassemble code sections",
+				input: {
+					path: "/tmp/program",
+					operation: "disassemble"
+				}
+			}, {
+				title: "List advertised BFD targets",
+				input: { operation: "architectures" }
+			}]
+		}, {
+			name: "execute_rizin_command",
+			...toolContractMetadata("execute_rizin_command"),
+			kind: "native-provider",
+			description: "Execute one caller-selected Rizin command against a local artifact using the Rizin CLI profile that suppresses user settings and scripts while retaining plugins. Preserves decoded stdout and stderr inline with SHA-256 Evidence, up to a shared 16 MiB combined limit; invalid UTF-8 bytes are represented by replacement characters and flagged in Evidence limitations. output_truncated reports output beyond that limit and completion_status is unknown if buffer enforcement terminated the process. Rizin commands and retained plugins can execute foreign code, mutate files, access the network, and read files outside the selected artifact; identities and contents of those external inputs are not bound to Evidence. Command effects depend on the Rizin command and loaded plugins; JSON is command-specific and raw output remains authoritative. In a shared MCP server, this admitted command closes any active binary-analysis session; after its effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.",
+			inputSchema: rizinInputSchema,
+			outputSchema: evidenceResultOf(commandObservationSchema),
+			examples: [{
+				title: "Inspect binary information",
+				input: {
+					path: "/tmp/program",
+					command: "iI"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/gdbToolContracts.js
+var sessionId$1, gdbCommandResult, GDB_TOOL_CONTRACTS;
+function init_gdbToolContracts() {
+	return (init_gdbToolContracts = __esmMin((() => {
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		sessionId$1 = z.string().uuid();
+		gdbCommandResult = z.strictObject({
+			command: z.string(),
+			mi: z.string(),
+			records: z.array(z.string()),
+			console: z.string(),
+			target: z.string(),
+			log: z.string(),
+			process_exit_observed: z.boolean().optional(),
+			process_exit_code: z.number().int().nullable().optional(),
+			process_exit_signal: z.string().nullable().optional(),
+			output_truncated: z.boolean(),
+			output_invalid_utf8: z.literal(true).optional(),
+			completion_status: z.enum(["complete", "unknown"])
+		});
+		GDB_TOOL_CONTRACTS = [
+			{
+				name: "start_gdb_session",
+				...toolContractMetadata("start_gdb_session"),
+				kind: "native-provider",
+				description: "Start a BYO GDB process in MI3 mode when available, suppress startup files, and disable auto-loading. Persistent GDB sessions are available only on Linux, where REA can verify live inferior output descriptors through /proc before detaching; macOS descriptor verification is not implemented, and Windows Job Object cleanup can terminate debugger inferiors. Optionally set inferior_tty to a caller-selected terminal for future inferior runs; REA verifies the setting through GDB/MI before the session becomes ready. The selected terminal must remain available after GDB exits. A live inferior can be detached during close only while this durable output sink remains verified. The session persists in this REA MCP server process and receives an explicit session ID.",
+				inputSchema: z.strictObject({ inferior_tty: z.string().min(1).optional().describe("Caller-selected terminal path for future inferior runs. GDB must report the exact configured path before the session is ready.") }),
+				outputSchema: z.strictObject({
+					session_id: sessionId$1,
+					mi_version: z.enum(["mi3", "mi2"])
+				}),
+				examples: [{
+					title: "Start GDB",
+					input: {}
+				}]
+			},
+			{
+				name: "gdb_console",
+				...toolContractMetadata("gdb_console"),
+				kind: "native-provider",
+				description: "Run one unrestricted GDB CLI command through MI interpreter-exec console and return raw MI, console, target, and log records inline with Evidence. A command timeout preserves collected records with completion_status unknown and stops the owned debugger session. Commands can execute shell, alter target state, access files, and use network. Closing the debugger never implies target termination. In a shared MCP server, this admitted command closes any active binary-analysis session; after its effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.",
+				inputSchema: z.strictObject({
+					session_id: sessionId$1,
+					command: z.string().min(1)
+				}),
+				outputSchema: evidenceResultOf(gdbCommandResult),
+				examples: [{
+					title: "Inspect loaded symbols",
+					input: {
+						session_id: "00000000-0000-4000-8000-000000000001",
+						command: "info functions"
+					}
+				}]
+			},
+			{
+				name: "gdb_session_status",
+				...toolContractMetadata("gdb_session_status"),
+				kind: "native-provider",
+				description: "Return the observed lifecycle state and bounded recent MI records and process diagnostics for one persistent REA GDB session; truncation and invalid-UTF-8 fields report discarded or lossy data.",
+				inputSchema: z.strictObject({ session_id: sessionId$1 }),
+				outputSchema: z.strictObject({
+					session_id: sessionId$1,
+					mi_version: z.enum(["mi3", "mi2"]),
+					state: z.enum(["ready", "closed"]),
+					recent_mi_records: z.array(z.string()),
+					recent_mi_records_truncated: z.boolean(),
+					mi_invalid_utf8: z.boolean(),
+					stderr: z.string(),
+					stderr_observed_bytes: z.number().int().nonnegative(),
+					stderr_truncated: z.boolean(),
+					stderr_invalid_utf8: z.boolean(),
+					diagnostics_truncated: z.boolean(),
+					inferior_tty: z.string().nullable(),
+					inferior_tty_verified: z.boolean()
+				}),
+				examples: [{
+					title: "Check GDB session",
+					input: { session_id: "00000000-0000-4000-8000-000000000001" }
+				}]
+			},
+			{
+				name: "close_gdb_session",
+				...toolContractMetadata("close_gdb_session"),
+				kind: "native-provider",
+				description: "Close the owned GDB process after verifying the inferior state. When one live thread group has a verified durable output TTY, REA automatically detaches it, which may resume target execution; otherwise close reports that a disposition is required. REA never kills attached or remote targets as part of debugger cleanup. In a shared MCP server, this admitted close retires any active binary-analysis session; after target effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.",
+				inputSchema: z.strictObject({ session_id: sessionId$1 }),
+				outputSchema: z.strictObject({ target_state: z.enum(["none_observed", "unknown"]) }),
+				examples: [{
+					title: "Close GDB session",
+					input: { session_id: "00000000-0000-4000-8000-000000000001" }
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/rizinDebugToolContracts.js
+var sessionId, commandResult, RIZIN_DEBUG_TOOL_CONTRACTS;
+function init_rizinDebugToolContracts() {
+	return (init_rizinDebugToolContracts = __esmMin((() => {
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		sessionId = z.string().uuid();
+		commandResult = z.strictObject({
+			command: z.string(),
+			output: z.string(),
+			output_scope: z.literal("command_and_interleaved_session_output"),
+			output_truncated: z.boolean(),
+			output_invalid_utf8: z.literal(true).optional(),
+			completion_status: z.enum(["complete", "unknown"]),
+			backend: z.string().nullable()
+		});
+		RIZIN_DEBUG_TOOL_CONTRACTS = [
+			{
+				name: "start_rizin_debug_session",
+				...toolContractMetadata("start_rizin_debug_session"),
+				kind: "native-provider",
+				description: "Start a persistent Rizin debugger session using `-N` to suppress user settings and scripts while retaining plugins, `-0` for NUL framing, and `-d` with an optional caller-selected IO debugger backend. Requires a caller-selected Linux TTY for inferior stdout and stderr; the target may write directly to that terminal while running and after detach. REA verifies both destinations and `dbg.exitkills=false` before detaching. Backend and target capabilities depend on the installed build. The session lives in this REA MCP process. Persistent sessions require Linux `/proc` descriptor readback. In a shared MCP server, starting this session retires any active binary-analysis session; after target effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.",
+				inputSchema: z.strictObject({
+					path: z.string().min(1),
+					inferior_tty: z.string().min(1),
+					backend: z.string().min(1).optional()
+				}),
+				outputSchema: z.strictObject({
+					session_id: sessionId,
+					backend: z.string().nullable()
+				}),
+				examples: [{
+					title: "Start Rizin debugger",
+					input: {
+						path: "/tmp/program",
+						inferior_tty: "/dev/pts/7"
+					}
+				}]
+			},
+			{
+				name: "rizin_debug_command",
+				...toolContractMetadata("rizin_debug_command"),
+				kind: "native-provider",
+				description: "Execute one unrestricted command in a persistent Rizin debugger session. Returns raw output inline with Evidence, including backend output interleaved before the completion marker. If the command exceeds the output or frame limit, `output_truncated` is true and `completion_status` is `unknown`; retained partial output is returned and the owned debugger session is stopped. Unsolicited frames already queued before the command make the session unavailable because correlation is ambiguous. Commands can access local files, shell, network, plugins, and target state; effects depend on the active backend and target. In a shared MCP server, this admitted command closes any active binary-analysis session; after its effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.",
+				inputSchema: z.strictObject({
+					session_id: sessionId,
+					command: z.string().min(1).refine((value) => !/[\r\n]/u.test(value), "A single command line is required")
+				}),
+				outputSchema: evidenceResultOf(commandResult),
+				examples: [{
+					title: "Inspect debugger state",
+					input: {
+						session_id: "00000000-0000-4000-8000-000000000001",
+						command: "dr"
+					}
+				}]
+			},
+			{
+				name: "rizin_debug_session_status",
+				...toolContractMetadata("rizin_debug_session_status"),
+				kind: "native-provider",
+				description: "Return observed lifecycle state and bounded recent NUL-framed output and process diagnostics for one Rizin debugger session; truncation fields report discarded data, and output_invalid_utf8 reports whether invalid UTF-8 has been observed in session frame bytes; recent output may contain replacement characters.",
+				inputSchema: z.strictObject({ session_id: sessionId }),
+				outputSchema: z.strictObject({
+					session_id: sessionId,
+					state: z.enum(["ready", "closed"]),
+					inferior_tty: z.string(),
+					recent_output: z.array(z.string()),
+					recent_output_truncated: z.boolean(),
+					diagnostics_truncated: z.boolean(),
+					output_invalid_utf8: z.boolean()
+				}),
+				examples: [{
+					title: "Check Rizin session",
+					input: { session_id: "00000000-0000-4000-8000-000000000001" }
+				}]
+			},
+			{
+				name: "close_rizin_debug_session",
+				...toolContractMetadata("close_rizin_debug_session"),
+				kind: "native-provider",
+				description: "Close the REA-owned Rizin debugger only after verifying no inferior remains or detaching one with a verified caller-selected TTY output sink. A detached target may continue running and write to that TTY; target state is otherwise reported as unknown. REA never signals an inferior based on PID or path. In a shared MCP server, this admitted close retires any active binary-analysis session; after target effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.",
+				inputSchema: z.strictObject({ session_id: sessionId }),
+				outputSchema: z.strictObject({ target_state: z.literal("unknown") }),
+				examples: [{
+					title: "Close Rizin debugger",
+					input: { session_id: "00000000-0000-4000-8000-000000000001" }
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/toolContracts.js
+var TOOL_CONTRACTS, toolContract;
+function init_toolContracts() {
+	return (init_toolContracts = __esmMin((() => {
+		init_captureToolContracts();
+		init_signalToolContracts();
+		init_wasmToolContracts();
+		init_evmToolContracts();
+		init_goToolContracts();
+		init_rustToolContracts();
+		init_sqliteToolContracts();
+		init_analysisViewToolContracts();
+		init_binaryDiagnosticsToolContracts();
+		init_nativeToolContracts();
+		init_artifactToolContracts();
+		init_managedToolContracts();
+		init_firmwareToolContracts();
+		init_androidToolContracts();
+		init_apktoolToolContracts();
+		init_pcapToolContracts();
+		init_flutterToolContracts();
+		init_jebToolContracts();
+		init_adbToolContracts();
+		init_managedWorkflowToolContracts();
+		init_browserProviderToolContracts();
+		init_electronToolContracts();
+		init_javascriptRuntimeObservationToolContracts();
+		init_applicationToolContracts();
+		init_webScriptToolContracts();
+		init_webRuntimeToolContracts();
+		init_webNetworkCaptureToolContracts();
+		init_javascriptRecoveryToolContracts();
+		init_officialToolContracts();
+		init_enhancedToolContracts();
+		init_sessionToolContracts();
+		init_cutterToolContracts();
+		init_reverseEngineeringToolContracts();
+		init_gdbToolContracts();
+		init_rizinDebugToolContracts();
+		init_fridaToolContracts();
+		TOOL_CONTRACTS = [
+			...OFFICIAL_TOOL_CONTRACTS,
+			...ENHANCED_TOOL_CONTRACTS,
+			...NATIVE_TOOL_CONTRACTS,
+			...BINARY_DIAGNOSTICS_TOOL_CONTRACTS,
+			...ANALYSIS_VIEW_TOOL_CONTRACTS,
+			...ARTIFACT_TOOL_CONTRACTS,
+			...EVM_TOOL_CONTRACTS,
+			...GO_TOOL_CONTRACTS,
+			...RUST_TOOL_CONTRACTS,
+			...WASM_TOOL_CONTRACTS,
+			...SQLITE_TOOL_CONTRACTS,
+			...CAPTURE_TOOL_CONTRACTS,
+			...SIGNAL_TOOL_CONTRACTS,
+			...MANAGED_TOOL_CONTRACTS,
+			...ANDROID_TOOL_CONTRACTS,
+			...APKTOOL_TOOL_CONTRACTS,
+			...PCAP_TOOL_CONTRACTS,
+			...FLUTTER_TOOL_CONTRACTS,
+			...JEB_TOOL_CONTRACTS,
+			...ADB_TOOL_CONTRACTS,
+			...FIRMWARE_TOOL_CONTRACTS,
+			...MANAGED_WORKFLOW_TOOL_CONTRACTS,
+			...BROWSER_PROVIDER_TOOL_CONTRACTS,
+			...ELECTRON_TOOL_CONTRACTS,
+			...JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS,
+			...APPLICATION_TOOL_CONTRACTS,
+			...WEB_SCRIPT_TOOL_CONTRACTS,
+			...WEB_RUNTIME_TOOL_CONTRACTS,
+			...WEB_NETWORK_CAPTURE_TOOL_CONTRACTS,
+			...JAVASCRIPT_RECOVERY_TOOL_CONTRACTS,
+			...SESSION_TOOL_CONTRACTS,
+			...CUTTER_TOOL_CONTRACTS,
+			...REVERSE_ENGINEERING_TOOL_CONTRACTS,
+			...GDB_TOOL_CONTRACTS,
+			...RIZIN_DEBUG_TOOL_CONTRACTS,
+			...FRIDA_TOOL_CONTRACTS
+		];
+		toolContract = (name) => {
+			const contract = TOOL_CONTRACTS.find((candidate) => candidate.name === name);
+			if (contract === undefined) throw new Error(`Missing tool contract: ${name}`);
+			return contract;
+		};
+	})))();
+}
+
+//#endregion
+export { ENHANCED_TOOL_CONTRACTS, TOOL_CONTRACTS, init_enhancedToolContracts, init_toolContracts, toolContract };