rea-agents 6.3.0 → 6.5.0

package/dist/application/binary/BinarySessionStatus.js

@@ -1,8 +1,11 @@
+import { binaryTargetSummary } from "./BinaryTargetSummary.js";
+import { PROVIDER_EFFECT_NAMES, } from "../../contracts/toolOutputSchemaPrimitives.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Project internal provider routing state into the caller-visible session status. */
 export const binarySessionStatus = ({ target, route, router, runtimeUnavailability, runId, runtimeLineageSnapshots, requestActivitySnapshots, providerOperationHealth, }) => {
-    const capabilities = [...route.capabilities.values()]
+    const routeCapabilities = [...route.capabilities.values()]
         .filter(({ operation }) => operation !== "inventory_artifact")
-        .sort((left, right) => left.operation.localeCompare(right.operation))
+        .sort((left, right) => compareUnicodeCodePoints(left.operation, right.operation))
         .map((descriptor) => {
         const unavailable = runtimeUnavailability.get(descriptor.operation);
         return unavailable === undefined
@@ -12,8 +15,8 @@ export const binarySessionStatus = ({ target, route, router, runtimeUnavailabili
                 available: false,
                 reason: unavailable.reason,
             };
-    })
-        .map(capabilityStatus);
+    });
+    const capabilities = providerCapabilitySets(routeCapabilities);
     const analysisProviderBinding = route.binding === null
         ? null
         : {
@@ -28,11 +31,10 @@ export const binarySessionStatus = ({ target, route, router, runtimeUnavailabili
         availability: structuredClone(candidate.availability),
         target_support: structuredClone(candidate.targetSupport),
         selected: candidate.selected,
-        capabilities: candidate.capabilities
+        capabilities: providerCapabilitySets(candidate.capabilities
             .slice()
             .filter(({ operation }) => operation !== "inventory_artifact")
-            .sort((left, right) => left.operation.localeCompare(right.operation))
-            .map(capabilityStatus),
+            .sort((left, right) => compareUnicodeCodePoints(left.operation, right.operation))),
     }));
     const common = {
         capabilities,
@@ -52,17 +54,13 @@ export const binarySessionStatus = ({ target, route, router, runtimeUnavailabili
         : {
             open: true,
             ...common,
-            path: target.path,
-            sha256: target.sha256,
-            format: target.format,
-            kind: target.kind,
-            architecture: target.architecture ?? null,
+            ...binaryTargetSummary(target),
         };
 };
 const requestActivityStatus = (snapshots) => {
     const providers = snapshots
         .slice()
-        .sort((left, right) => left.provider.id.localeCompare(right.provider.id))
+        .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id))
         .map(({ provider, active, queuedRequests }) => ({
         provider: providerSummary(provider),
         active: active === null
@@ -92,7 +90,7 @@ const processLineageStatus = (snapshots) => snapshots.length === 0
         status: "snapshots",
         snapshots: snapshots
             .slice()
-            .sort((left, right) => left.provider.id.localeCompare(right.provider.id))
+            .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id))
             .map(({ provider, observation }) => ({
             provider: providerSummary(provider),
             observation: observation.status === "unavailable"
@@ -117,12 +115,84 @@ const processLineageStatus = (snapshots) => snapshots.length === 0
                 },
         })),
     };
-const capabilityStatus = (descriptor) => ({
-    operation: descriptor.operation,
-    available: descriptor.available,
-    reason: descriptor.reason,
-    availability_code: descriptor.availabilityCode ?? null,
-    effects: {
+/** Group inline capability facts without merging distinct providers or states. */
+/** Project provider descriptors once for binary and target-free status consumers. */
+export const providerCapabilitySets = (descriptors) => {
+    const providers = new Map();
+    for (const descriptor of descriptors) {
+        const key = JSON.stringify([
+            descriptor.provider.id,
+            descriptor.provider.name,
+            descriptor.provider.version,
+        ]);
+        const provider = providers.get(key);
+        if (provider === undefined)
+            providers.set(key, {
+                identity: descriptor.provider,
+                descriptors: [descriptor],
+            });
+        else
+            provider.descriptors.push(descriptor);
+    }
+    return [...providers.values()].map(({ identity, descriptors: owned }) => {
+        const sharedLimitations = commonLimitationsPrefix(owned);
+        const groups = new Map();
+        for (const descriptor of owned) {
+            const effects = enabledCapabilityEffects(descriptor);
+            const limitations = descriptor.limitations.slice(sharedLimitations.length);
+            const availabilityCode = descriptor.availabilityCode ?? null;
+            const status = descriptor.available
+                ? {
+                    available: true,
+                    reason: null,
+                    availability_code: null,
+                }
+                : {
+                    available: false,
+                    reason: descriptor.reason,
+                    availability_code: availabilityCode,
+                };
+            const key = JSON.stringify([
+                effects,
+                limitations,
+                status.available,
+                status.reason,
+                status.availability_code,
+            ]);
+            const group = groups.get(key);
+            if (group === undefined)
+                groups.set(key, {
+                    operations: [descriptor.operation],
+                    effects,
+                    limitations,
+                    ...status,
+                });
+            else
+                group.operations.push(descriptor.operation);
+        }
+        return {
+            provider: providerSummary(identity),
+            shared_limitations: sharedLimitations,
+            groups: [...groups.values()],
+        };
+    });
+};
+const commonLimitationsPrefix = (descriptors) => {
+    const first = descriptors[0]?.limitations;
+    if (first === undefined)
+        return [];
+    let length = first.length;
+    for (const descriptor of descriptors.slice(1)) {
+        length = Math.min(length, descriptor.limitations.length);
+        let index = 0;
+        while (index < length && first[index] === descriptor.limitations[index])
+            index++;
+        length = index;
+    }
+    return first.slice(0, length);
+};
+const enabledCapabilityEffects = (descriptor) => {
+    const effectValues = {
         mutates_artifact: descriptor.effects.mutatesArtifact,
         launches_process: descriptor.effects.launchesProcess,
         may_show_ui: descriptor.effects.mayShowUi,
@@ -130,9 +200,9 @@ const capabilityStatus = (descriptor) => ({
         may_write_filesystem: descriptor.effects.mayWriteFilesystem,
         changes_permissions: descriptor.effects.changesPermissions,
         requires_root: descriptor.effects.requiresRoot,
-    },
-    limitations: [...descriptor.limitations],
-});
+    };
+    return PROVIDER_EFFECT_NAMES.filter((name) => effectValues[name]);
+};
 const providerOperationHealthStatus = (health) => {
     if (health === undefined || health === null)
         return null;

package/dist/application/binary/BinaryTargetSummary.js

@@ -0,0 +1,9 @@
+/** Preserve the admitted target interpretation in public lifecycle results. */
+export const binaryTargetSummary = (target) => ({
+    path: target.path,
+    format: target.format,
+    kind: target.kind,
+    sha256: target.sha256,
+    architecture: target.architecture ?? null,
+    ...(target.format === "raw-binary" ? { entry_point: target.entryPoint } : {}),
+});

package/dist/application/binary/CompositeProvider.js

@@ -1,6 +1,9 @@
 import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { err, ok } from "../../domain/result.js";
 import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Synthetic identity for a deterministic provider set. */
 const compositeProviderIdentity = (identities) => ({
     id: `composite:${identities
@@ -10,6 +13,57 @@ const compositeProviderIdentity = (identities) => ({
     name: "REA composite analysis provider",
     version: null,
 });
+const closeCompositeClients = (identity, clients) => async (options) => {
+    const outcomes = await Promise.all([...clients.entries()].map(([provider, client]) => closeAnalysisClient(client, provider.identity().id, options).then((result) => ({ providerId: provider.identity().id, result }))));
+    const failures = outcomes.flatMap(({ providerId, result }) => result.ok ? [] : [{ providerId, error: result.error }]);
+    if (failures.length === 0)
+        return ok(null);
+    if (failures.length === 1) {
+        const failure = failures[0];
+        if (failure !== undefined)
+            return err(failure.error);
+    }
+    const resources = [
+        ...new Set(failures.flatMap(({ error }) => error.cleanupResources)),
+    ];
+    return err(new ProviderCleanupError(identity.id, resources, {
+        reason: "Multiple composed provider clients could not be confirmed closed.",
+        failures: failures.map(({ providerId, error }) => ({
+            provider_id: providerId,
+            message: error.message,
+            resources: [...error.cleanupResources],
+            ...(error.diagnostics === undefined
+                ? {}
+                : { diagnostics: error.diagnostics }),
+        })),
+    }, {
+        cause: new AggregateError(failures.map(({ error }) => error), "Composed provider cleanup failed."),
+    }));
+};
+const executeCompositeHealth = async (identity, clients, options) => {
+    for (const [provider, client] of clients) {
+        const health = client.operationHealthSnapshot?.();
+        if (health !== undefined &&
+            health.state !== "idle" &&
+            health.state !== "busy")
+            return err(new ProviderAdapterError(provider.identity().id, "health", {
+                diagnostics: {
+                    reason: `instantiated provider client is ${health.state}`,
+                },
+            }));
+        const checked = await client.execute("health", {}, options);
+        if (!checked.ok)
+            return checked;
+    }
+    return ok({
+        result: null,
+        rawResult: null,
+        provider: identity,
+        limitations: [],
+        locations: [],
+        subject: null,
+    });
+};
 /** Deterministically route disjoint operations without eagerly starting children. */
 export class CompositeProvider {
     providers;
@@ -32,8 +86,8 @@ export class CompositeProvider {
             }
         }
         this.#providerByOperation = routes;
-        this.#capabilities = Object.freeze(capabilities.sort((left, right) => left.operation.localeCompare(right.operation) ||
-            left.provider.id.localeCompare(right.provider.id)));
+        this.#capabilities = Object.freeze(capabilities.sort((left, right) => compareUnicodeCodePoints(left.operation, right.operation) ||
+            compareUnicodeCodePoints(left.provider.id, right.provider.id)));
     }
     identity() {
         return this.#identity;
@@ -51,21 +105,17 @@ export class CompositeProvider {
             clients.set(provider, created);
             return created;
         };
-        const close = async (options) => {
-            const outcomes = await Promise.all([...clients.entries()].map(([provider, client]) => closeAnalysisClient(client, provider.identity().id, options)));
-            return outcomes.find((outcome) => !outcome.ok) ?? ok(null);
-        };
+        const close = closeCompositeClients(this.#identity, clients);
         return {
-            execute: (operation, parameters, options) => {
+            executeIfReady: (operation, parameters, options) => {
+                const provider = this.#providerByOperation.get(operation);
+                const client = provider === undefined ? undefined : clients.get(provider);
+                return (client?.executeIfReady?.(operation, parameters, options) ??
+                    Promise.resolve(undefined));
+            },
+            execute: async (operation, parameters, options) => {
                 if (operation === "health")
-                    return Promise.resolve(ok({
-                        result: null,
-                        rawResult: null,
-                        provider: this.#identity,
-                        limitations: [],
-                        locations: [],
-                        subject: null,
-                    }));
+                    return executeCompositeHealth(this.#identity, clients, options);
                 const provider = this.#providerByOperation.get(operation);
                 return provider === undefined
                     ? Promise.resolve(err(new AnalysisCapabilityUnavailableError(this.#identity.id, operation, "operation is not declared by this provider set")))
@@ -73,22 +123,15 @@ export class CompositeProvider {
             },
             runtimeLineageSnapshots: () => [...clients.values()]
                 .flatMap((client) => client.runtimeLineageSnapshots?.() ?? [])
-                .sort((left, right) => left.provider.id.localeCompare(right.provider.id)),
+                .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id)),
             requestActivitySnapshots: () => [...clients.values()]
                 .flatMap((client) => client.requestActivitySnapshots?.() ?? [])
-                .sort((left, right) => left.provider.id.localeCompare(right.provider.id)),
+                .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id)),
             operationHealthSnapshot: () => {
-                for (const client of clients.values()) {
-                    const snapshot = client.operationHealthSnapshot?.();
-                    if (snapshot !== undefined && snapshot.state !== "idle")
-                        return snapshot;
-                }
-                for (const client of clients.values()) {
-                    const snapshot = client.operationHealthSnapshot?.();
-                    if (snapshot !== undefined)
-                        return snapshot;
-                }
-                return undefined;
+                const snapshots = [...clients.values()].map((client) => client.operationHealthSnapshot?.());
+                if (snapshots.some((snapshot) => snapshot === undefined))
+                    return undefined;
+                return (snapshots.find((snapshot) => snapshot !== undefined && snapshot.state !== "idle") ?? snapshots[0]);
             },
             close,
         };

package/dist/application/binary/LazyAnalysisProvider.js

@@ -2,7 +2,7 @@ import { AnalysisCancelledError } from "../../domain/analysisErrorCore.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { err, ok } from "../../domain/result.js";
-import { ABORTED, waitForAbortable } from "./AbortablePromise.js";
+import { ABORTED, waitForAbortable } from "../../process/AbortablePromise.js";
 const isAborted = (signal) => signal?.aborted === true;
 /**
  * Preserve synchronous provider discovery while loading implementation modules
@@ -47,6 +47,8 @@ class LazyAnalysisClient {
     #client;
     #loading;
     #closed = false;
+    executeIfReady = (operation, parameters, options) => this.#client?.executeIfReady?.(operation, parameters, options) ??
+        Promise.resolve(undefined);
     constructor(loadClient, providerId) {
         this.#loadClient = loadClient;
         this.#providerId = providerId;

package/dist/application/binary/SessionProviderRouter.js

@@ -1,6 +1,5 @@
 import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
 import { ProviderSelectionError } from "../../domain/providerSelectionError.js";
-import {} from "../../domain/analysisErrorBase.js";
 import { err, ok } from "../../domain/result.js";
 import { AnalysisProviderRegistry, } from "./AnalysisProviderRegistry.js";
 import { CompositeProvider } from "./CompositeProvider.js";
@@ -65,7 +64,11 @@ const selectableRoute = (auxiliaryProviders, selection) => {
             ? undefined
             : new CompositeProvider(providers);
     const identity = provider?.identity() ?? emptyProviderIdentity();
-    const capabilities = capabilityMap(provider?.capabilities() ?? []);
+    // The binding attributes deep-provider capabilities to the resolved version.
+    const capabilities = capabilityMap([
+        ...auxiliaryProviders.flatMap((auxiliary) => auxiliary.capabilities()),
+        ...(binding?.capabilities ?? []),
+    ]);
     return {
         identity,
         capabilities,

package/dist/application/binaryDiagnostics/BinaryLayoutService.js

@@ -11,8 +11,18 @@ export class BinaryLayoutService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Bind complete observations to the caller-selected artifact before creating Evidence. */
     async inspect(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspect(input, options));
+    }
+    /** Complete the owned one-shot lifecycle before validating and publishing Evidence. */
+    inspectAndClose(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspectAndClose(input, options));
+    }
+    async #inspect(rawInput, options, inspect) {
         if (options?.signal?.aborted)
             return err(new AnalysisCancelledError(OPERATION));
         const input = inspectBinaryLayoutInputSchema.safeParse(rawInput);
@@ -28,7 +38,7 @@ export class BinaryLayoutService {
                     message: "Expected an absolute filesystem path on this host.",
                 },
             ]));
-        const inspected = await this.provider.inspect(input.data, options);
+        const inspected = await inspect(input.data);
         if (!inspected.ok)
             return inspected;
         const diagnostics = binaryLayoutSchema.shape.diagnostics.safeParse(inspected.value.diagnostics);
@@ -50,7 +60,8 @@ export class BinaryLayoutService {
             operation: OPERATION,
             parameters: input.data,
             result: value,
-            rawResult: value,
+            // The decoded report is the only representation; do not repeat it.
+            rawResult: null,
             confidence: "observed",
             limitations: value.limitations,
             locations: [{ kind: "artifact-path", path: value.artifact.path }],

package/dist/application/binaryDiagnostics/PeResourcesPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/binaryDiagnostics/PeResourcesService.js

@@ -0,0 +1,114 @@
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { inspectPeResourcesInputSchema, peResourcesSchema, } from "../../domain/native/peResources.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+/** Shared caller validation, output parsing and Evidence provenance for CLI/MCP. */
+export class PeResourcesService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
+    async inspect(rawInput, options) {
+        const operation = "inspect_pe_resources";
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const input = inspectPeResourcesInputSchema.safeParse(rawInput);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(operation, input.error.issues, rawInput, {
+                cause: input.error,
+            }));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(operation, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        const result = await this.provider.inspect(input.data, options);
+        if (!result.ok)
+            return result;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const report = peResourcesSchema.safeParse(result.value);
+        if (!report.success ||
+            report.data.artifact.path !== input.data.path ||
+            !validReport(report.data, input.data.max_entries, input.data.max_file_bytes))
+            return err(new AnalysisOutputError(operation, "PE resource provider returned malformed output or changed artifact identity."));
+        const value = report.data;
+        return ok(createEvidence({
+            path: value.artifact.path,
+            format: "pe",
+            sha256: value.artifact.sha256,
+        }, this.provider.identity, {
+            operation,
+            parameters: input.data,
+            result: value,
+            confidence: "observed",
+            limitations: value.limitations,
+            locations: [{ kind: "artifact-path", path: value.artifact.path }],
+        }));
+    }
+}
+/** Check cross-field invariants before provider output becomes public Evidence. */
+const validReport = (report, maxEntries, maxBytes) => {
+    const inside = ({ offset, bytes }) => offset <= report.artifact.bytes - bytes;
+    if (report.artifact.bytes > maxBytes ||
+        report.coverage.resources !== report.resources.length ||
+        report.coverage.examined_entries > maxEntries ||
+        report.coverage.examined_entries !==
+            report.directories.reduce((sum, item) => sum + item.named_entries + item.id_entries, 0))
+        return false;
+    if (report.directory === null &&
+        (report.directories.length > 0 || report.resources.length > 0))
+        return false;
+    if (report.directory !== null &&
+        (!inside(report.directory.location) ||
+            !inside(report.directory.data_directory_location)))
+        return false;
+    if (!report.directories.every((item) => inside(item.location)))
+        return false;
+    if (!report.resources.every((item, index) => item.index === index &&
+        inside(item.data_entry_location) &&
+        inside(item.payload.location) &&
+        item.entry_locations.every(inside) &&
+        [item.type, item.name, item.language].every((identity) => identity.kind === "id" || inside(identity.location))))
+        return false;
+    return report.icon_groups.every((group) => {
+        const resource = report.resources[group.resource_index];
+        if (resource === undefined ||
+            resource.type.kind !== "id" ||
+            resource.type.id !== 14)
+            return false;
+        return group.images.every((image) => inside(image.location) &&
+            image.location.offset >= resource.payload.location.offset &&
+            image.location.offset + image.location.bytes <=
+                resource.payload.location.offset + resource.payload.location.bytes &&
+            image.candidate_resource_indices.every((index) => {
+                const icon = report.resources[index];
+                return (icon !== undefined &&
+                    icon.type.kind === "id" &&
+                    icon.type.id === 3 &&
+                    icon.name.kind === "id" &&
+                    icon.name.id === image.resource_id);
+            }) &&
+            (image.same_language_resource_index === null
+                ? image.size_matches === null
+                : image.candidate_resource_indices.includes(image.same_language_resource_index) &&
+                    sameIdentity(report.resources[image.same_language_resource_index]?.language, resource.language) &&
+                    image.size_matches ===
+                        (report.resources[image.same_language_resource_index]?.payload
+                            .location.bytes ===
+                            image.declared_bytes)));
+    });
+};
+const sameIdentity = (left, right) => left?.kind === "id" && right.kind === "id"
+    ? left.id === right.id
+    : left?.kind === "name" &&
+        right.kind === "name" &&
+        left.utf16le_hex === right.utf16le_hex;

package/dist/application/binaryDiagnostics/RecordedCrashService.js

@@ -1,7 +1,7 @@
 import { isAbsolute } from "node:path";
 import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
 import { createEvidence } from "../../domain/evidence.js";
-import { inspectRecordedCrashInputSchema, recordedCrashSchema, } from "../../domain/native/recordedCrash.js";
+import { inspectRecordedCrashInputSchema, RECORDED_LINUX_CORE_PROFILES, recordedCrashSchema, } from "../../domain/native/recordedCrash.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { err, ok } from "../../domain/result.js";
 const OPERATION = "inspect_recorded_crash";
@@ -11,8 +11,18 @@ export class RecordedCrashService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Bind complete observations to the caller-selected artifact before creating Evidence. */
     async inspect(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspect(input, options));
+    }
+    /** Complete the owned one-shot lifecycle before validating and publishing Evidence. */
+    inspectAndClose(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspectAndClose(input, options));
+    }
+    async #inspect(rawInput, options, inspect) {
         if (options?.signal?.aborted)
             return err(new AnalysisCancelledError(OPERATION));
         const input = inspectRecordedCrashInputSchema.safeParse(rawInput);
@@ -28,7 +38,7 @@ export class RecordedCrashService {
                     message: "Expected an absolute filesystem path on this host.",
                 },
             ]));
-        const inspected = await this.provider.inspect(input.data, options);
+        const inspected = await inspect(input.data);
         if (!inspected.ok)
             return inspected;
         const diagnostics = recordedCrashSchema.shape.diagnostics.safeParse(inspected.value.diagnostics);
@@ -47,13 +57,15 @@ export class RecordedCrashService {
         return ok(createEvidence({
             path: value.artifact.path,
             format: "elf",
-            architecture: "x86_64",
+            architecture: RECORDED_LINUX_CORE_PROFILES[value.architecture]
+                .evidenceArchitecture,
             sha256: value.artifact.sha256,
         }, this.provider.identity, {
             operation: OPERATION,
             parameters: input.data,
             result: value,
-            rawResult: value,
+            // The decoded report is the only representation; do not repeat it.
+            rawResult: null,
             confidence: value.debugger.status === "available" ? "derived" : "observed",
             limitations: value.limitations,
             locations: [{ kind: "artifact-path", path: value.artifact.path }],

package/dist/application/captures/PacketCaptureService.js

@@ -0,0 +1,83 @@
+import { inspectPacketFieldsInputSchema, packetFieldsCatalogSchema, } from "../../domain/captures/packetFields.js";
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { inspectPacketCaptureInputSchema, packetCaptureSchema, } from "../../domain/captures/packetCapture.js";
+import { err, ok } from "../../domain/result.js";
+/** One shared validation and Evidence owner for CLI and MCP. */
+export class PacketCaptureService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    close() {
+        return this.provider.close();
+    }
+    async inspect(raw, options) {
+        const operation = "inspect_packet_capture";
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const input = inspectPacketCaptureInputSchema.safeParse(raw);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(operation, input.error.issues, raw, {
+                cause: input.error,
+            }));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(operation, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute local path.",
+                },
+            ]));
+        const decoded = await this.provider.inspect(input.data, options);
+        if (!decoded.ok)
+            return decoded;
+        const execution = decoded.value;
+        const report = packetCaptureSchema.safeParse(execution.result);
+        if (!report.success ||
+            report.data.artifact.path !== input.data.path ||
+            execution.subject?.path !== input.data.path ||
+            execution.subject.sha256 !== report.data.artifact.sha256 ||
+            JSON.stringify(report.data.selection) !== JSON.stringify(input.data))
+            return err(new AnalysisOutputError(operation, "Capture analyzer returned malformed data or changed the selected artifact identity/options."));
+        return this.#evidence(operation, input.data, execution, options);
+    }
+    async inspectFields(raw, options) {
+        const operation = "inspect_packet_fields";
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const input = inspectPacketFieldsInputSchema.safeParse(raw);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(operation, input.error.issues, raw, {
+                cause: input.error,
+            }));
+        const decoded = await this.provider.inspectFields(input.data, options);
+        if (!decoded.ok)
+            return decoded;
+        const execution = decoded.value;
+        const report = packetFieldsCatalogSchema.safeParse(execution.result);
+        if (!report.success ||
+            JSON.stringify(report.data.selection) !== JSON.stringify(input.data) ||
+            execution.subject?.path !== report.data.tool.path ||
+            execution.subject.sha256 !== report.data.tool.sha256)
+            return err(new AnalysisOutputError(operation, "Field discovery returned malformed data or changed the selected installation/options."));
+        return this.#evidence(operation, input.data, execution, options);
+    }
+    #evidence(operation, parameters, execution, options) {
+        const evidence = createEvidence(execution.subject ?? undefined, execution.provider, {
+            operation,
+            parameters,
+            result: execution.result,
+            confidence: "observed",
+            locations: execution.locations,
+            limitations: execution.limitations,
+        });
+        return options?.signal?.aborted
+            ? err(new AnalysisCancelledError(operation, {
+                partialObservation: evidence,
+            }))
+            : ok(evidence);
+    }
+}

package/dist/application/closeOwnedWebResources.js

@@ -0,0 +1,7 @@
+/** Attempt every web workflow cleanup owner and report all failures. */
+export const closeOwnedWebResources = async (close, message) => {
+    const results = await Promise.allSettled(close.flatMap((owner) => owner === undefined ? [] : [Promise.resolve().then(owner)]));
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    if (failures.length > 0)
+        throw new AggregateError(failures, message);
+};

package/dist/application/electron/ElectronFusePort.js

@@ -0,0 +1 @@
+export {};