rea-agents 6.4.0 → 6.5.0

package/dist/application/binary/BinarySessionStatus.js

@@ -1,8 +1,11 @@
+import { binaryTargetSummary } from "./BinaryTargetSummary.js";
+import { PROVIDER_EFFECT_NAMES, } from "../../contracts/toolOutputSchemaPrimitives.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Project internal provider routing state into the caller-visible session status. */
 export const binarySessionStatus = ({ target, route, router, runtimeUnavailability, runId, runtimeLineageSnapshots, requestActivitySnapshots, providerOperationHealth, }) => {
-    const capabilities = [...route.capabilities.values()]
+    const routeCapabilities = [...route.capabilities.values()]
         .filter(({ operation }) => operation !== "inventory_artifact")
-        .sort((left, right) => left.operation.localeCompare(right.operation))
+        .sort((left, right) => compareUnicodeCodePoints(left.operation, right.operation))
         .map((descriptor) => {
         const unavailable = runtimeUnavailability.get(descriptor.operation);
         return unavailable === undefined
@@ -12,8 +15,8 @@ export const binarySessionStatus = ({ target, route, router, runtimeUnavailabili
                 available: false,
                 reason: unavailable.reason,
             };
-    })
-        .map(capabilityStatus);
+    });
+    const capabilities = providerCapabilitySets(routeCapabilities);
     const analysisProviderBinding = route.binding === null
         ? null
         : {
@@ -28,11 +31,10 @@ export const binarySessionStatus = ({ target, route, router, runtimeUnavailabili
         availability: structuredClone(candidate.availability),
         target_support: structuredClone(candidate.targetSupport),
         selected: candidate.selected,
-        capabilities: candidate.capabilities
+        capabilities: providerCapabilitySets(candidate.capabilities
             .slice()
             .filter(({ operation }) => operation !== "inventory_artifact")
-            .sort((left, right) => left.operation.localeCompare(right.operation))
-            .map(capabilityStatus),
+            .sort((left, right) => compareUnicodeCodePoints(left.operation, right.operation))),
     }));
     const common = {
         capabilities,
@@ -52,17 +54,13 @@ export const binarySessionStatus = ({ target, route, router, runtimeUnavailabili
         : {
             open: true,
             ...common,
-            path: target.path,
-            sha256: target.sha256,
-            format: target.format,
-            kind: target.kind,
-            architecture: target.architecture ?? null,
+            ...binaryTargetSummary(target),
         };
 };
 const requestActivityStatus = (snapshots) => {
     const providers = snapshots
         .slice()
-        .sort((left, right) => left.provider.id.localeCompare(right.provider.id))
+        .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id))
         .map(({ provider, active, queuedRequests }) => ({
         provider: providerSummary(provider),
         active: active === null
@@ -92,7 +90,7 @@ const processLineageStatus = (snapshots) => snapshots.length === 0
         status: "snapshots",
         snapshots: snapshots
             .slice()
-            .sort((left, right) => left.provider.id.localeCompare(right.provider.id))
+            .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id))
             .map(({ provider, observation }) => ({
             provider: providerSummary(provider),
             observation: observation.status === "unavailable"
@@ -117,12 +115,84 @@ const processLineageStatus = (snapshots) => snapshots.length === 0
                 },
         })),
     };
-const capabilityStatus = (descriptor) => ({
-    operation: descriptor.operation,
-    available: descriptor.available,
-    reason: descriptor.reason,
-    availability_code: descriptor.availabilityCode ?? null,
-    effects: {
+/** Group inline capability facts without merging distinct providers or states. */
+/** Project provider descriptors once for binary and target-free status consumers. */
+export const providerCapabilitySets = (descriptors) => {
+    const providers = new Map();
+    for (const descriptor of descriptors) {
+        const key = JSON.stringify([
+            descriptor.provider.id,
+            descriptor.provider.name,
+            descriptor.provider.version,
+        ]);
+        const provider = providers.get(key);
+        if (provider === undefined)
+            providers.set(key, {
+                identity: descriptor.provider,
+                descriptors: [descriptor],
+            });
+        else
+            provider.descriptors.push(descriptor);
+    }
+    return [...providers.values()].map(({ identity, descriptors: owned }) => {
+        const sharedLimitations = commonLimitationsPrefix(owned);
+        const groups = new Map();
+        for (const descriptor of owned) {
+            const effects = enabledCapabilityEffects(descriptor);
+            const limitations = descriptor.limitations.slice(sharedLimitations.length);
+            const availabilityCode = descriptor.availabilityCode ?? null;
+            const status = descriptor.available
+                ? {
+                    available: true,
+                    reason: null,
+                    availability_code: null,
+                }
+                : {
+                    available: false,
+                    reason: descriptor.reason,
+                    availability_code: availabilityCode,
+                };
+            const key = JSON.stringify([
+                effects,
+                limitations,
+                status.available,
+                status.reason,
+                status.availability_code,
+            ]);
+            const group = groups.get(key);
+            if (group === undefined)
+                groups.set(key, {
+                    operations: [descriptor.operation],
+                    effects,
+                    limitations,
+                    ...status,
+                });
+            else
+                group.operations.push(descriptor.operation);
+        }
+        return {
+            provider: providerSummary(identity),
+            shared_limitations: sharedLimitations,
+            groups: [...groups.values()],
+        };
+    });
+};
+const commonLimitationsPrefix = (descriptors) => {
+    const first = descriptors[0]?.limitations;
+    if (first === undefined)
+        return [];
+    let length = first.length;
+    for (const descriptor of descriptors.slice(1)) {
+        length = Math.min(length, descriptor.limitations.length);
+        let index = 0;
+        while (index < length && first[index] === descriptor.limitations[index])
+            index++;
+        length = index;
+    }
+    return first.slice(0, length);
+};
+const enabledCapabilityEffects = (descriptor) => {
+    const effectValues = {
         mutates_artifact: descriptor.effects.mutatesArtifact,
         launches_process: descriptor.effects.launchesProcess,
         may_show_ui: descriptor.effects.mayShowUi,
@@ -130,9 +200,9 @@ const capabilityStatus = (descriptor) => ({
         may_write_filesystem: descriptor.effects.mayWriteFilesystem,
         changes_permissions: descriptor.effects.changesPermissions,
         requires_root: descriptor.effects.requiresRoot,
-    },
-    limitations: [...descriptor.limitations],
-});
+    };
+    return PROVIDER_EFFECT_NAMES.filter((name) => effectValues[name]);
+};
 const providerOperationHealthStatus = (health) => {
     if (health === undefined || health === null)
         return null;

package/dist/application/binary/BinaryTargetSummary.js

@@ -0,0 +1,9 @@
+/** Preserve the admitted target interpretation in public lifecycle results. */
+export const binaryTargetSummary = (target) => ({
+    path: target.path,
+    format: target.format,
+    kind: target.kind,
+    sha256: target.sha256,
+    architecture: target.architecture ?? null,
+    ...(target.format === "raw-binary" ? { entry_point: target.entryPoint } : {}),
+});

package/dist/application/binary/CompositeProvider.js

@@ -1,6 +1,9 @@
 import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { err, ok } from "../../domain/result.js";
 import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Synthetic identity for a deterministic provider set. */
 const compositeProviderIdentity = (identities) => ({
     id: `composite:${identities
@@ -10,6 +13,57 @@ const compositeProviderIdentity = (identities) => ({
     name: "REA composite analysis provider",
     version: null,
 });
+const closeCompositeClients = (identity, clients) => async (options) => {
+    const outcomes = await Promise.all([...clients.entries()].map(([provider, client]) => closeAnalysisClient(client, provider.identity().id, options).then((result) => ({ providerId: provider.identity().id, result }))));
+    const failures = outcomes.flatMap(({ providerId, result }) => result.ok ? [] : [{ providerId, error: result.error }]);
+    if (failures.length === 0)
+        return ok(null);
+    if (failures.length === 1) {
+        const failure = failures[0];
+        if (failure !== undefined)
+            return err(failure.error);
+    }
+    const resources = [
+        ...new Set(failures.flatMap(({ error }) => error.cleanupResources)),
+    ];
+    return err(new ProviderCleanupError(identity.id, resources, {
+        reason: "Multiple composed provider clients could not be confirmed closed.",
+        failures: failures.map(({ providerId, error }) => ({
+            provider_id: providerId,
+            message: error.message,
+            resources: [...error.cleanupResources],
+            ...(error.diagnostics === undefined
+                ? {}
+                : { diagnostics: error.diagnostics }),
+        })),
+    }, {
+        cause: new AggregateError(failures.map(({ error }) => error), "Composed provider cleanup failed."),
+    }));
+};
+const executeCompositeHealth = async (identity, clients, options) => {
+    for (const [provider, client] of clients) {
+        const health = client.operationHealthSnapshot?.();
+        if (health !== undefined &&
+            health.state !== "idle" &&
+            health.state !== "busy")
+            return err(new ProviderAdapterError(provider.identity().id, "health", {
+                diagnostics: {
+                    reason: `instantiated provider client is ${health.state}`,
+                },
+            }));
+        const checked = await client.execute("health", {}, options);
+        if (!checked.ok)
+            return checked;
+    }
+    return ok({
+        result: null,
+        rawResult: null,
+        provider: identity,
+        limitations: [],
+        locations: [],
+        subject: null,
+    });
+};
 /** Deterministically route disjoint operations without eagerly starting children. */
 export class CompositeProvider {
     providers;
@@ -32,8 +86,8 @@ export class CompositeProvider {
             }
         }
         this.#providerByOperation = routes;
-        this.#capabilities = Object.freeze(capabilities.sort((left, right) => left.operation.localeCompare(right.operation) ||
-            left.provider.id.localeCompare(right.provider.id)));
+        this.#capabilities = Object.freeze(capabilities.sort((left, right) => compareUnicodeCodePoints(left.operation, right.operation) ||
+            compareUnicodeCodePoints(left.provider.id, right.provider.id)));
     }
     identity() {
         return this.#identity;
@@ -51,21 +105,17 @@ export class CompositeProvider {
             clients.set(provider, created);
             return created;
         };
-        const close = async (options) => {
-            const outcomes = await Promise.all([...clients.entries()].map(([provider, client]) => closeAnalysisClient(client, provider.identity().id, options)));
-            return outcomes.find((outcome) => !outcome.ok) ?? ok(null);
-        };
+        const close = closeCompositeClients(this.#identity, clients);
         return {
-            execute: (operation, parameters, options) => {
+            executeIfReady: (operation, parameters, options) => {
+                const provider = this.#providerByOperation.get(operation);
+                const client = provider === undefined ? undefined : clients.get(provider);
+                return (client?.executeIfReady?.(operation, parameters, options) ??
+                    Promise.resolve(undefined));
+            },
+            execute: async (operation, parameters, options) => {
                 if (operation === "health")
-                    return Promise.resolve(ok({
-                        result: null,
-                        rawResult: null,
-                        provider: this.#identity,
-                        limitations: [],
-                        locations: [],
-                        subject: null,
-                    }));
+                    return executeCompositeHealth(this.#identity, clients, options);
                 const provider = this.#providerByOperation.get(operation);
                 return provider === undefined
                     ? Promise.resolve(err(new AnalysisCapabilityUnavailableError(this.#identity.id, operation, "operation is not declared by this provider set")))
@@ -73,22 +123,15 @@ export class CompositeProvider {
             },
             runtimeLineageSnapshots: () => [...clients.values()]
                 .flatMap((client) => client.runtimeLineageSnapshots?.() ?? [])
-                .sort((left, right) => left.provider.id.localeCompare(right.provider.id)),
+                .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id)),
             requestActivitySnapshots: () => [...clients.values()]
                 .flatMap((client) => client.requestActivitySnapshots?.() ?? [])
-                .sort((left, right) => left.provider.id.localeCompare(right.provider.id)),
+                .sort((left, right) => compareUnicodeCodePoints(left.provider.id, right.provider.id)),
             operationHealthSnapshot: () => {
-                for (const client of clients.values()) {
-                    const snapshot = client.operationHealthSnapshot?.();
-                    if (snapshot !== undefined && snapshot.state !== "idle")
-                        return snapshot;
-                }
-                for (const client of clients.values()) {
-                    const snapshot = client.operationHealthSnapshot?.();
-                    if (snapshot !== undefined)
-                        return snapshot;
-                }
-                return undefined;
+                const snapshots = [...clients.values()].map((client) => client.operationHealthSnapshot?.());
+                if (snapshots.some((snapshot) => snapshot === undefined))
+                    return undefined;
+                return (snapshots.find((snapshot) => snapshot !== undefined && snapshot.state !== "idle") ?? snapshots[0]);
             },
             close,
         };

package/dist/application/binary/LazyAnalysisProvider.js

@@ -2,7 +2,7 @@ import { AnalysisCancelledError } from "../../domain/analysisErrorCore.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { err, ok } from "../../domain/result.js";
-import { ABORTED, waitForAbortable } from "./AbortablePromise.js";
+import { ABORTED, waitForAbortable } from "../../process/AbortablePromise.js";
 const isAborted = (signal) => signal?.aborted === true;
 /**
  * Preserve synchronous provider discovery while loading implementation modules
@@ -47,6 +47,8 @@ class LazyAnalysisClient {
     #client;
     #loading;
     #closed = false;
+    executeIfReady = (operation, parameters, options) => this.#client?.executeIfReady?.(operation, parameters, options) ??
+        Promise.resolve(undefined);
     constructor(loadClient, providerId) {
         this.#loadClient = loadClient;
         this.#providerId = providerId;

package/dist/application/binary/SessionProviderRouter.js

@@ -1,6 +1,5 @@
 import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
 import { ProviderSelectionError } from "../../domain/providerSelectionError.js";
-import {} from "../../domain/analysisErrorBase.js";
 import { err, ok } from "../../domain/result.js";
 import { AnalysisProviderRegistry, } from "./AnalysisProviderRegistry.js";
 import { CompositeProvider } from "./CompositeProvider.js";
@@ -65,7 +64,11 @@ const selectableRoute = (auxiliaryProviders, selection) => {
             ? undefined
             : new CompositeProvider(providers);
     const identity = provider?.identity() ?? emptyProviderIdentity();
-    const capabilities = capabilityMap(provider?.capabilities() ?? []);
+    // The binding attributes deep-provider capabilities to the resolved version.
+    const capabilities = capabilityMap([
+        ...auxiliaryProviders.flatMap((auxiliary) => auxiliary.capabilities()),
+        ...(binding?.capabilities ?? []),
+    ]);
     return {
         identity,
         capabilities,

package/dist/application/binaryDiagnostics/BinaryLayoutService.js

@@ -11,8 +11,18 @@ export class BinaryLayoutService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Bind complete observations to the caller-selected artifact before creating Evidence. */
     async inspect(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspect(input, options));
+    }
+    /** Complete the owned one-shot lifecycle before validating and publishing Evidence. */
+    inspectAndClose(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspectAndClose(input, options));
+    }
+    async #inspect(rawInput, options, inspect) {
         if (options?.signal?.aborted)
             return err(new AnalysisCancelledError(OPERATION));
         const input = inspectBinaryLayoutInputSchema.safeParse(rawInput);
@@ -28,7 +38,7 @@ export class BinaryLayoutService {
                     message: "Expected an absolute filesystem path on this host.",
                 },
             ]));
-        const inspected = await this.provider.inspect(input.data, options);
+        const inspected = await inspect(input.data);
         if (!inspected.ok)
             return inspected;
         const diagnostics = binaryLayoutSchema.shape.diagnostics.safeParse(inspected.value.diagnostics);

package/dist/application/binaryDiagnostics/PeResourcesService.js

@@ -10,6 +10,9 @@ export class PeResourcesService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     async inspect(rawInput, options) {
         const operation = "inspect_pe_resources";
         if (options?.signal?.aborted)

package/dist/application/binaryDiagnostics/RecordedCrashService.js

@@ -1,7 +1,7 @@
 import { isAbsolute } from "node:path";
 import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
 import { createEvidence } from "../../domain/evidence.js";
-import { inspectRecordedCrashInputSchema, recordedCrashSchema, } from "../../domain/native/recordedCrash.js";
+import { inspectRecordedCrashInputSchema, RECORDED_LINUX_CORE_PROFILES, recordedCrashSchema, } from "../../domain/native/recordedCrash.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { err, ok } from "../../domain/result.js";
 const OPERATION = "inspect_recorded_crash";
@@ -11,8 +11,18 @@ export class RecordedCrashService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Bind complete observations to the caller-selected artifact before creating Evidence. */
     async inspect(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspect(input, options));
+    }
+    /** Complete the owned one-shot lifecycle before validating and publishing Evidence. */
+    inspectAndClose(rawInput, options) {
+        return this.#inspect(rawInput, options, (input) => this.provider.inspectAndClose(input, options));
+    }
+    async #inspect(rawInput, options, inspect) {
         if (options?.signal?.aborted)
             return err(new AnalysisCancelledError(OPERATION));
         const input = inspectRecordedCrashInputSchema.safeParse(rawInput);
@@ -28,7 +38,7 @@ export class RecordedCrashService {
                     message: "Expected an absolute filesystem path on this host.",
                 },
             ]));
-        const inspected = await this.provider.inspect(input.data, options);
+        const inspected = await inspect(input.data);
         if (!inspected.ok)
             return inspected;
         const diagnostics = recordedCrashSchema.shape.diagnostics.safeParse(inspected.value.diagnostics);
@@ -47,7 +57,8 @@ export class RecordedCrashService {
         return ok(createEvidence({
             path: value.artifact.path,
             format: "elf",
-            architecture: "x86_64",
+            architecture: RECORDED_LINUX_CORE_PROFILES[value.architecture]
+                .evidenceArchitecture,
             sha256: value.artifact.sha256,
         }, this.provider.identity, {
             operation: OPERATION,

package/dist/application/captures/PacketCaptureService.js

@@ -0,0 +1,83 @@
+import { inspectPacketFieldsInputSchema, packetFieldsCatalogSchema, } from "../../domain/captures/packetFields.js";
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { inspectPacketCaptureInputSchema, packetCaptureSchema, } from "../../domain/captures/packetCapture.js";
+import { err, ok } from "../../domain/result.js";
+/** One shared validation and Evidence owner for CLI and MCP. */
+export class PacketCaptureService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    close() {
+        return this.provider.close();
+    }
+    async inspect(raw, options) {
+        const operation = "inspect_packet_capture";
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const input = inspectPacketCaptureInputSchema.safeParse(raw);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(operation, input.error.issues, raw, {
+                cause: input.error,
+            }));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(operation, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute local path.",
+                },
+            ]));
+        const decoded = await this.provider.inspect(input.data, options);
+        if (!decoded.ok)
+            return decoded;
+        const execution = decoded.value;
+        const report = packetCaptureSchema.safeParse(execution.result);
+        if (!report.success ||
+            report.data.artifact.path !== input.data.path ||
+            execution.subject?.path !== input.data.path ||
+            execution.subject.sha256 !== report.data.artifact.sha256 ||
+            JSON.stringify(report.data.selection) !== JSON.stringify(input.data))
+            return err(new AnalysisOutputError(operation, "Capture analyzer returned malformed data or changed the selected artifact identity/options."));
+        return this.#evidence(operation, input.data, execution, options);
+    }
+    async inspectFields(raw, options) {
+        const operation = "inspect_packet_fields";
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const input = inspectPacketFieldsInputSchema.safeParse(raw);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(operation, input.error.issues, raw, {
+                cause: input.error,
+            }));
+        const decoded = await this.provider.inspectFields(input.data, options);
+        if (!decoded.ok)
+            return decoded;
+        const execution = decoded.value;
+        const report = packetFieldsCatalogSchema.safeParse(execution.result);
+        if (!report.success ||
+            JSON.stringify(report.data.selection) !== JSON.stringify(input.data) ||
+            execution.subject?.path !== report.data.tool.path ||
+            execution.subject.sha256 !== report.data.tool.sha256)
+            return err(new AnalysisOutputError(operation, "Field discovery returned malformed data or changed the selected installation/options."));
+        return this.#evidence(operation, input.data, execution, options);
+    }
+    #evidence(operation, parameters, execution, options) {
+        const evidence = createEvidence(execution.subject ?? undefined, execution.provider, {
+            operation,
+            parameters,
+            result: execution.result,
+            confidence: "observed",
+            locations: execution.locations,
+            limitations: execution.limitations,
+        });
+        return options?.signal?.aborted
+            ? err(new AnalysisCancelledError(operation, {
+                partialObservation: evidence,
+            }))
+            : ok(evidence);
+    }
+}

package/dist/application/closeOwnedWebResources.js

@@ -0,0 +1,7 @@
+/** Attempt every web workflow cleanup owner and report all failures. */
+export const closeOwnedWebResources = async (close, message) => {
+    const results = await Promise.allSettled(close.flatMap((owner) => owner === undefined ? [] : [Promise.resolve().then(owner)]));
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    if (failures.length > 0)
+        throw new AggregateError(failures, message);
+};

package/dist/application/electron/ElectronFusePort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/electron/ElectronFuseService.js

@@ -0,0 +1,80 @@
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { BINARY_ARCHITECTURES } from "../../domain/binaryTargetTypes.js";
+import { electronFuseReportSchema, inspectElectronFusesInputSchema, } from "../../domain/electron/electronFuses.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+const OPERATION = "inspect_electron_fuses";
+/** Shared exact input validation and artifact-bound Evidence for CLI and MCP. */
+export class ElectronFuseService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Read fuse wires for one explicitly selected path without launching it. */
+    async inspect(rawInput, options) {
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const input = inspectElectronFusesInputSchema.safeParse(rawInput);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(OPERATION, input.error.issues, rawInput, {
+                cause: input.error,
+            }));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        const inspected = await this.provider.inspect(input.data, options);
+        if (!inspected.ok)
+            return inspected;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const report = electronFuseReportSchema.safeParse(inspected.value);
+        if (!report.success ||
+            report.data.artifact.selected_path !== input.data.path)
+            return err(new AnalysisOutputError(OPERATION, "Electron fuse reader returned a malformed report or changed the selected artifact identity."));
+        const value = report.data;
+        const architecture = subjectArchitecture(value);
+        return ok(createEvidence({
+            path: value.artifact.resolved_path,
+            sha256: value.artifact.sha256,
+            format: value.artifact.format,
+            ...(architecture === undefined ? {} : { architecture }),
+        }, this.provider.identity, {
+            operation: OPERATION,
+            parameters: input.data,
+            result: value,
+            confidence: "observed",
+            limitations: value.limitations,
+            locations: locationsFor(value),
+        }));
+    }
+}
+const subjectArchitecture = (report) => {
+    if (report.artifact.format === "mach-o-universal")
+        return undefined;
+    if (report.slices.length !== 1)
+        return undefined;
+    const name = report.slices[0]?.architecture;
+    return BINARY_ARCHITECTURES.find((supported) => supported === name);
+};
+const locationsFor = (report) => [
+    { kind: "artifact-path", path: report.artifact.selected_path },
+    ...(report.artifact.resolved_path === report.artifact.selected_path
+        ? []
+        : [
+            {
+                kind: "artifact-path",
+                path: report.artifact.resolved_path,
+            },
+        ]),
+    ...report.slices.flatMap((slice) => slice.sentinels.map((sentinel) => ({
+        kind: "file-offset",
+        offset: sentinel.sentinel_offset,
+    }))),
+];

package/dist/application/evm/EvmInterfaceService.js

@@ -49,6 +49,7 @@ export class EvmInterfaceService {
         if (!report.success ||
             report.data.artifact.path !== input.data.path ||
             report.data.artifact.encoding !== input.data.encoding ||
+            execution.subject?.format !== "file" ||
             execution.subject?.path !== input.data.path ||
             execution.subject.sha256 !== report.data.artifact.sha256)
             return err(new AnalysisOutputError(OPERATION, "Interface adapter returned malformed data or changed the selected carrier identity/encoding.", outputOptions));

package/dist/application/flutter/DartAotInspection.js

@@ -0,0 +1,26 @@
+import { requireAnalysisViewRetention, summarizeRetainedAnalysis, } from "../analysisView/AnalysisViewService.js";
+import { AnalysisCancelledError } from "../../domain/analysisErrorCore.js";
+import { dartAotInspectionInputSchema } from "../../domain/flutter/flutterBuildAnalysis.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { err } from "../../domain/result.js";
+/** Keep the caller's ABI choice and complete analysis; select only its delivery. */
+export const inspectDartAot = async (service, rawInput, retention, options) => {
+    const operation = "inspect_dart_aot";
+    if (options?.signal?.aborted === true)
+        return err(new AnalysisCancelledError(operation));
+    const parsed = dartAotInspectionInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(analysisInputErrorFromIssues(operation, parsed.error.issues, rawInput, {
+            cause: parsed.error,
+        }));
+    if (parsed.data.detail === "summary") {
+        const ready = requireAnalysisViewRetention(operation, retention);
+        if (!ready.ok)
+            return ready;
+    }
+    const { detail, ...providerInput } = parsed.data;
+    const executed = await service.execute(operation, providerInput, options);
+    if (!executed.ok || detail !== "summary")
+        return executed;
+    return summarizeRetainedAnalysis(executed.value, retention);
+};

package/dist/application/flutter/FlutterBuildAnalysisPort.js

@@ -0,0 +1 @@
+export {};