rea-agents 6.4.0 → 6.5.0

package/dist/application/managed/ManagedMemberComparisonService.js

@@ -1,16 +1,15 @@
-import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
 import { z } from "zod";
 import { compareManagedMembers, managedMemberComparisonResultSchema, } from "../../domain/managed/managedMemberComparison.js";
 import { parseManagedMemberEvidence } from "../../domain/managed/managedMemberComparisonMatch.js";
 import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
-import {} from "../../domain/analysisErrorBase.js";
+import { AnalysisError } from "../../domain/analysisErrorBase.js";
 import { createEvidence } from "../../domain/evidence.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
-import { parseBinaryTarget } from "../BinaryTargetResolver.js";
+import { classifyBinaryTargetFilesystemFailure, parseBinaryTarget, } from "../BinaryTargetResolver.js";
 import { err, ok } from "../../domain/result.js";
 import { inspectManagedMembersBytes } from "../../dotnet/ManagedMemberInspector.js";
+import { readManagedSnapshot } from "../../dotnet/ManagedSnapshot.js";
 import { MANAGED_STATIC_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "../InvestigationProviders.js";
 import { workflowInputError } from "../workflowInputError.js";
 /** Compare managed members from input parsed by a trusted adapter. */
@@ -26,17 +25,16 @@ export const compareManagedMembersEvidenceValidated = (input) => {
         return workflowFailure(operation, cause);
     }
 };
-const DEFAULT_PATH_DEPENDENCIES = {
-    resolveTarget: parseBinaryTarget,
-    readBytes: readFile,
-};
 /** Inspect two local PE artifacts and return one derived comparison Evidence. */
-export const compareManagedMemberPaths = async (input, dependencies = DEFAULT_PATH_DEPENDENCIES) => {
+export const compareManagedMemberPaths = async (input, dependencies = {}, resources) => {
     const operation = "compare_managed_members";
+    const resolveTarget = dependencies.resolveTarget ?? parseBinaryTarget;
+    const readSnapshot = dependencies.readSnapshot ?? readManagedSnapshot;
+    let partialEvidence;
     try {
         const [leftTarget, rightTarget] = await Promise.all([
-            dependencies.resolveTarget(input.leftPath),
-            dependencies.resolveTarget(input.rightPath),
+            resolveTarget(input.leftPath),
+            resolveTarget(input.rightPath),
         ]);
         // Report an unopenable path like every other path-based command does,
         // with the failed path and constraint, rather than a bare input error.
@@ -44,59 +42,66 @@ export const compareManagedMemberPaths = async (input, dependencies = DEFAULT_PA
             return err(leftTarget.error);
         if (!rightTarget.ok)
             return err(rightTarget.error);
-        const [leftBytes, rightBytes] = await Promise.all([
-            dependencies.readBytes(leftTarget.value.path),
-            dependencies.readBytes(rightTarget.value.path),
-        ]);
-        for (const [target, bytes] of [
-            [leftTarget.value, leftBytes],
-            [rightTarget.value, rightBytes],
-        ]) {
-            const observedSha256 = createHash("sha256").update(bytes).digest("hex");
-            if (observedSha256 !== target.sha256)
-                return err(new EvidenceIntegrityError(`Managed artifact digest changed after open: expected ${target.sha256}, observed ${observedSha256} at ${target.path}`));
-        }
-        const leftInspection = inspectManagedMembersBytes(leftBytes, leftTarget.value);
-        const rightInspection = inspectManagedMembersBytes(rightBytes, rightTarget.value);
-        const leftEvidence = createEvidence(leftTarget.value, MANAGED_STATIC_PROVIDER, {
-            operation: "inspect_managed_members",
-            parameters: {},
-            result: jsonValueSchema.parse(leftInspection),
-            rawResult: null,
-            limitations: leftInspection.limitations,
-            locations: [{ kind: "artifact-path", path: leftTarget.value.path }],
-        });
-        const rightEvidence = createEvidence(rightTarget.value, MANAGED_STATIC_PROVIDER, {
-            operation: "inspect_managed_members",
-            parameters: {},
-            result: jsonValueSchema.parse(rightInspection),
-            rawResult: null,
-            limitations: rightInspection.limitations,
-            locations: [{ kind: "artifact-path", path: rightTarget.value.path }],
-        });
+        const inspectTarget = async (target, selectedPath) => {
+            const { path } = target;
+            let snapshot;
+            try {
+                snapshot = await readSnapshot(path, operation, resources === undefined ? {} : { resources });
+            }
+            catch (cause) {
+                const failure = classifyBinaryTargetFilesystemFailure(path, cause);
+                if (failure !== undefined)
+                    throw failure;
+                throw cause;
+            }
+            if (snapshot.sha256 !== target.sha256)
+                throw new EvidenceIntegrityError(`Managed artifact digest changed after open: expected ${target.sha256}, observed ${snapshot.sha256} at ${target.path}`);
+            // Member comparison never reads literals, so it does not spend the
+            // decode budget on them.
+            const inspection = inspectManagedMembersBytes(snapshot.bytes, target, {
+                userStrings: false,
+            });
+            const evidence = createEvidence(target, MANAGED_STATIC_PROVIDER, {
+                operation: "inspect_managed_members",
+                parameters: {},
+                result: jsonValueSchema.parse(inspection),
+                rawResult: null,
+                limitations: inspection.limitations,
+                locations: [{ kind: "artifact-path", path: selectedPath }],
+            });
+            return { inspection, evidence };
+        };
+        const left = await inspectTarget(leftTarget.value, input.leftPath);
+        partialEvidence = left.evidence;
+        const right = await inspectTarget(rightTarget.value, input.rightPath);
         const result = compareManagedMembers({
-            evidenceId: leftEvidence.evidence_id,
-            result: leftInspection,
+            evidenceId: left.evidence.evidence_id,
+            result: left.inspection,
         }, {
-            evidenceId: rightEvidence.evidence_id,
-            result: rightInspection,
+            evidenceId: right.evidence.evidence_id,
+            result: right.inspection,
         });
         return ok(createManagedMemberComparisonEvidence({
-            left: leftEvidence,
-            right: rightEvidence,
-        }, result));
+            left: left.evidence,
+            right: right.evidence,
+        }, result, { leftPath: input.leftPath, rightPath: input.rightPath }));
     }
     catch (cause) {
-        return workflowFailure(operation, cause);
+        return workflowFailure(operation, cause, partialEvidence);
     }
 };
-/** ECMA-335 representable limits for path-based member comparison. */
-const createManagedMemberComparisonEvidence = (parameters, result) => createEvidence(undefined, MANAGED_WORKFLOW_PROVIDER, {
+const createManagedMemberComparisonEvidence = (parameters, result, sourcePaths) => createEvidence(undefined, MANAGED_WORKFLOW_PROVIDER, {
     predicateType: "rea.managed-member-comparison",
     operation: "compare_managed_members",
     parameters: {
         left_evidence_id: parameters.left.evidence_id,
         right_evidence_id: parameters.right.evidence_id,
+        ...(sourcePaths === undefined
+            ? {}
+            : {
+                left_path: sourcePaths.leftPath,
+                right_path: sourcePaths.rightPath,
+            }),
     },
     result: jsonValueSchema.parse(result),
     rawResult: null,
@@ -104,8 +109,21 @@ const createManagedMemberComparisonEvidence = (parameters, result) => createEvid
     authority: "analyst-inference",
     environment: null,
     limitations: result.limitations,
+    locations: sourcePaths === undefined
+        ? []
+        : [
+            { kind: "artifact-path", path: sourcePaths.leftPath },
+            { kind: "artifact-path", path: sourcePaths.rightPath },
+        ],
     evidenceLinks: result.evidence_links,
 });
-const workflowFailure = (operation, cause) => err(cause instanceof z.ZodError || cause instanceof TypeError
-    ? workflowInputError(operation, cause)
-    : new AnalysisProtocolError("Managed member comparison produced an invalid result", { cause }));
+const workflowFailure = (operation, cause, partialEvidence) => {
+    const failure = cause instanceof AnalysisError
+        ? cause
+        : cause instanceof z.ZodError || cause instanceof TypeError
+            ? workflowInputError(operation, cause)
+            : new AnalysisProtocolError("Managed member comparison produced an invalid result", { cause });
+    return err(partialEvidence === undefined
+        ? failure
+        : failure.retainPartialObservation(partialEvidence));
+};

package/dist/application/managed/ManagedNativeVerificationService.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
-import {} from "../../domain/analysisErrorBase.js";
 import { createEvidence } from "../../domain/evidence.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
 import { managedNativeVerificationInputSchema, } from "../../domain/managed/managedNativeVerificationSchemas.js";

package/dist/application/managed/ManagedReconstructionService.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
-import {} from "../../domain/analysisErrorBase.js";
 import { createEvidence } from "../../domain/evidence.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
 import { importManagedReconstruction, managedReconstructionImportInputSchema, } from "../../domain/managed/managedReconstruction.js";

package/dist/application/native/NativeCallRoutes.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { parseRelatedAddresses, referenceKindSchema, } from "../../domain/hopperValues.js";
-import { err, ok } from "../../domain/result.js";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
 const referencesSchema = z.object({
     reference_kinds_available: z.boolean(),
@@ -13,13 +12,28 @@ const referencesSchema = z.object({
     unresolved_calls: z.array(z.object({ address: z.string(), reason: z.string() })),
 });
 /** Prefer typed static call references, preserving computed targets and targetless sites. */
-export const readNativeCallRoutes = async (analysis, procedure, signal) => {
-    const options = signal === undefined ? {} : { signal };
+export const readNativeCallRoutes = async (analysis, procedure, signal, selectorOrigin) => {
+    const options = {
+        ...(signal === undefined ? {} : { signal }),
+        ...(selectorOrigin === undefined ? {} : { selectorOrigin }),
+    };
     const execution = await analysis.execute("procedure_references", { procedure, direction: "outgoing" }, options);
+    let unknowns = [];
     if (execution.ok) {
         const parsed = referencesSchema.safeParse(execution.value.result);
         if (!parsed.success)
-            return err(new AnalysisOutputError("procedure_references", "Invalid typed call references"));
+            return {
+                ok: false,
+                error: new AnalysisOutputError("procedure_references", "Invalid typed call references"),
+                unknowns,
+            };
+        // Missing detailed reference flags do not invalidate observed targetless
+        // calls. Keep their producing provider even if another provider supplies
+        // the fallback callee inventory.
+        unknowns = parsed.data.unresolved_calls.map((call) => ({
+            ...call,
+            provider: execution.value.provider,
+        }));
         const references = parsed.data.references;
         if (parsed.data.reference_kinds_available === true ||
             (references.length > 0 && references.every(({ kind }) => kind.available))) {
@@ -30,41 +44,47 @@ export const readNativeCallRoutes = async (analysis, procedure, signal) => {
                 targets.add(call.target_address);
                 countBySite.set(call.source_address, targets);
             }
-            return ok({
-                provider: execution.value.provider,
-                routes: calls.map((call) => ({
-                    address: call.target_procedure?.address ?? call.target_address,
-                    site: call.source_address,
-                    relation: call.kind.available && (call.kind.computed || call.kind.indirect)
-                        ? "indirect_call"
-                        : "direct_call",
-                    resolution: (countBySite.get(call.source_address)?.size ?? 0) > 1
-                        ? "ambiguous"
-                        : call.kind.available &&
-                            (call.kind.computed || call.kind.indirect)
-                            ? "resolved"
-                            : "observed",
-                })),
-                unknowns: parsed.data.unresolved_calls,
-            });
+            return {
+                ok: true,
+                value: {
+                    provider: execution.value.provider,
+                    routes: calls.map((call) => ({
+                        address: call.target_procedure?.address ?? call.target_address,
+                        site: call.source_address,
+                        relation: call.kind.available && (call.kind.computed || call.kind.indirect)
+                            ? "indirect_call"
+                            : "direct_call",
+                        resolution: (countBySite.get(call.source_address)?.size ?? 0) > 1
+                            ? "ambiguous"
+                            : call.kind.available &&
+                                (call.kind.computed || call.kind.indirect)
+                                ? "resolved"
+                                : "observed",
+                    })),
+                    unknowns,
+                },
+            };
         }
     }
     else if (execution.error._tag !== "AnalysisCapabilityUnavailableError")
-        return err(execution.error);
+        return { ok: false, error: execution.error, unknowns };
     const callees = await analysis.execute("procedure_callees", { procedure }, options);
     if (!callees.ok)
-        return callees;
+        return { ok: false, error: callees.error, unknowns };
     const parsed = parseRelatedAddresses(callees.value.result, "callees");
     return parsed.ok
-        ? ok({
-            provider: callees.value.provider,
-            routes: parsed.value.map((address) => ({
-                address,
-                site: procedure,
-                relation: "provider_call",
-                resolution: "inferred",
-            })),
-            unknowns: [],
-        })
-        : parsed;
+        ? {
+            ok: true,
+            value: {
+                provider: callees.value.provider,
+                routes: parsed.value.map((address) => ({
+                    address,
+                    site: procedure,
+                    relation: "provider_call",
+                    resolution: "inferred",
+                })),
+                unknowns,
+            },
+        }
+        : { ok: false, error: parsed.error, unknowns };
 };

package/dist/application/native/NativeDispatchMetadataInspection.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { addressedValue } from "../../contracts/toolOutputSchemaPrimitives.js";
 import { nativeDispatchMetadataResultSchema, inspectNativeDispatchMetadata, } from "../../domain/native/objcSwiftMetadata.js";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
@@ -15,8 +16,11 @@ export const inspectNativeDispatch = async (analysis, maxRecords, signal) => {
         return err(execution.error);
     const names = z
         .array(z.union([
-        z.strictObject({ address: z.string(), value: z.string() }),
-        z.strictObject({ address: z.string(), name: z.string() }),
+        addressedValue.strict(),
+        addressedValue
+            .omit({ value: true })
+            .extend({ name: z.string() })
+            .strict(),
     ]))
         .safeParse(execution.value.result);
     if (!names.success)

package/dist/application/native/NativeUiActionTrace.js

@@ -78,6 +78,9 @@ export const traceNativeUiAction = async (analysis, input, signal) => {
         const native = await analysis.execute("procedure_address", { procedure: input.action }, signal === undefined ? {} : { signal });
         if (!native.ok && native.error._tag === "AnalysisCancelledError")
             return err(native.error);
+        if (!native.ok &&
+            native.error._tag !== "AnalysisCapabilityUnavailableError")
+            return err(native.error);
         if (native.ok) {
             const address = z.string().safeParse(native.value.result);
             if (!address.success || native.value.subject?.sha256 !== targetSha256)
@@ -289,30 +292,17 @@ const addDirectCallees = async (input) => {
             omitted += queue.length - queueIndex + 1;
             break;
         }
-        const execution = await readNativeCallRoutes(input.analysis, current.address, input.signal);
+        const execution = await readNativeCallRoutes(input.analysis, current.address, input.signal, "provider");
         examined += 1;
-        if (!execution.ok) {
-            if (execution.error._tag === "AnalysisCancelledError")
-                return { error: execution.error };
-            const id = `unknown-callees:${current.address}`;
-            edges.set(id, {
-                id,
-                from: current.node.id,
-                to: null,
-                relation: "direct_call",
-                resolution: "unresolved",
-                reason: projectAnalysisError(execution.error).message,
-                evidence: [],
-                limitations: [
-                    "The provider could not enumerate resolved direct callees.",
-                ],
-            });
-            continue;
-        }
-        for (const unknown of execution.value.unknowns) {
+        if (!execution.ok && execution.error._tag === "AnalysisCancelledError")
+            return { error: execution.error };
+        const unknowns = execution.ok
+            ? execution.value.unknowns
+            : execution.unknowns;
+        for (const [index, unknown] of unknowns.entries()) {
             if (edges.size >= input.input.max_edges) {
                 truncated = true;
-                omitted++;
+                omitted += unknowns.length - index;
                 break;
             }
             const id = `unknown-dispatch:${current.address}:${unknown.address}`;
@@ -326,7 +316,8 @@ const addDirectCallees = async (input) => {
                 evidence: [
                     {
                         kind: "reference",
-                        description: unknown.reason,
+                        provider: unknown.provider,
+                        description: `${unknown.provider.name} reported an unresolved call: ${unknown.reason}`,
                         location: { address: unknown.address, file_offset: null },
                         artifact_path: null,
                         artifact_sha256: input.targetSha256,
@@ -335,6 +326,27 @@ const addDirectCallees = async (input) => {
                 limitations: [],
             });
         }
+        if (!execution.ok) {
+            if (edges.size >= input.input.max_edges) {
+                truncated = true;
+                omitted += 1;
+                continue;
+            }
+            const id = `unknown-callees:${current.address}`;
+            edges.set(id, {
+                id,
+                from: current.node.id,
+                to: null,
+                relation: "direct_call",
+                resolution: "unresolved",
+                reason: projectAnalysisError(execution.error).message,
+                evidence: [],
+                limitations: [
+                    "The provider could not enumerate resolved direct callees.",
+                ],
+            });
+            continue;
+        }
         for (const [index, route] of execution.value.routes.entries()) {
             const address = route.address;
             if (edges.size >= input.input.max_edges) {
@@ -346,6 +358,7 @@ const addDirectCallees = async (input) => {
             const evidence = [
                 {
                     kind: "reference",
+                    provider: execution.value.provider,
                     description: `${execution.value.provider.name} reported ${route.relation} from ${current.address} to ${address}`,
                     location: { address: route.site, file_offset: null },
                     artifact_path: null,

package/dist/application/native/NativeValueTrace.js

@@ -4,27 +4,55 @@ import { nativeValueTraceInputSchema, nativeValueTraceSchema, } from "../../doma
 import { createEvidence } from "../../domain/evidence.js";
 import { AnalysisCancelledError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
 import { err, ok } from "../../domain/result.js";
+import { jsonParts } from "../../domain/jsonSerialization.js";
+const NODE_PAYLOAD_BYTES = 8 * 1024 * 1024;
 /** Compose bounded high-p-code def-use graphs across exactly referenced call destinations. */
 export const traceNativeValues = async (analysis, parameters, signal) => {
     const input = nativeValueTraceInputSchema.parse(parameters);
     const nodes = [];
-    const nodeIds = new Set();
     const edges = [];
     const procedures = [];
     const unknowns = [];
     const callBindings = [];
     const pending = [{ procedure: input.procedure, depth: 0 }];
+    const attempted = new Set();
     const visited = new Set();
     let targetSha256;
     let truncated = false;
     let decompilations = 0;
     let callSites = 0;
     let bytes = 0;
+    let nodeBudgetReached = false;
+    const retainNode = (value) => {
+        if (nodeBudgetReached)
+            return false;
+        if (nodes.length >= input.max_nodes) {
+            truncated = true;
+            nodeBudgetReached = true;
+            return false;
+        }
+        let size = 0;
+        // Reuse bounded JSON encoding to count escapes and UTF-8 expansion
+        // before allocating a complete serialized node that might not fit.
+        for (const part of jsonParts(value)) {
+            size += Buffer.byteLength(part);
+            if (size > NODE_PAYLOAD_BYTES - bytes) {
+                truncated = true;
+                nodeBudgetReached = true;
+                return false;
+            }
+        }
+        bytes += size;
+        nodes.push(value);
+        return true;
+    };
     while (pending.length > 0) {
         if (signal?.aborted)
             return err(new AnalysisCancelledError("trace_native_values"));
         const next = pending.shift();
-        if (next === undefined || visited.has(next.procedure))
+        if (next === undefined ||
+            attempted.has(next.procedure) ||
+            visited.has(next.procedure))
             continue;
         if (decompilations >= input.max_functions) {
             truncated = true;
@@ -35,7 +63,13 @@ export const traceNativeValues = async (analysis, parameters, signal) => {
             });
             break;
         }
-        const execution = await analysis.execute("analyze_function", { procedure: next.procedure }, signal === undefined ? {} : { signal });
+        // An exact selector is attempted once per trace, even on failure. Only
+        // successful dossiers establish canonical procedure identity in visited.
+        attempted.add(next.procedure);
+        const execution = await analysis.execute("analyze_function", { procedure: next.procedure }, {
+            ...(signal === undefined ? {} : { signal }),
+            ...(next.depth > 0 ? { selectorOrigin: "provider" } : {}),
+        });
         decompilations++;
         if (!execution.ok) {
             if (execution.error._tag === "AnalysisCancelledError")
@@ -96,6 +130,10 @@ export const traceNativeValues = async (analysis, parameters, signal) => {
             });
         }
         const ids = new Set();
+        // Keep generated parameter identity independent of which operations fit
+        // the budget, while preserving every provider-supplied operation ID.
+        const operationIds = new Set(flow.operations.map(({ id }) => id));
+        const parameterIds = new Map();
         const qualified = (id) => `${address}/${id}`;
         for (const operation of flow.operations) {
             if (operation.block_membership === "detached" ||
@@ -109,42 +147,37 @@ export const traceNativeValues = async (analysis, parameters, signal) => {
                 kind: "operation",
                 parameter: null,
             };
-            const size = Buffer.byteLength(JSON.stringify(node));
-            if (nodes.length >= input.max_nodes || bytes + size > 8 * 1024 * 1024) {
-                truncated = true;
+            if (!retainNode(node))
                 break;
-            }
-            bytes += size;
             ids.add(operation.id);
-            nodes.push(node);
-            nodeIds.add(node.id);
         }
         for (const parameter of flow.parameters) {
-            if (nodes.length >= input.max_nodes) {
-                truncated = true;
-                break;
-            }
-            const id = `${address}/parameter:${parameter.ordinal}`;
-            nodes.push({
+            const parameterId = `parameter:${parameter.ordinal}`;
+            let localId = parameterId;
+            for (let suffix = 1; operationIds.has(localId); suffix++)
+                localId = `${parameterId}#${suffix}`;
+            const id = qualified(localId);
+            if (!retainNode({
                 id,
                 procedure: address,
                 evidence_id: evidenceId,
                 kind: "parameter",
                 operation: null,
                 parameter,
-            });
-            nodeIds.add(id);
+            }))
+                break;
+            parameterIds.set(parameter.ordinal, id);
         }
         for (const use of flow.parameter_uses) {
-            if (!ids.has(use.use) ||
-                !nodeIds.has(`${address}/parameter:${use.ordinal}`))
+            const source = parameterIds.get(use.ordinal);
+            if (!ids.has(use.use) || source === undefined)
                 continue;
             if (edges.length >= input.max_edges) {
                 truncated = true;
                 break;
             }
             edges.push({
-                source: `${address}/parameter:${use.ordinal}`,
+                source,
                 target: qualified(use.use),
                 input_index: use.input_index,
                 kind: "parameter-use",
@@ -240,9 +273,10 @@ export const traceNativeValues = async (analysis, parameters, signal) => {
             }
         }
         if (truncated &&
-            (nodes.length >= input.max_nodes ||
+            (nodeBudgetReached ||
+                nodes.length >= input.max_nodes ||
                 edges.length >= input.max_edges ||
-                bytes >= 8 * 1024 * 1024))
+                bytes >= NODE_PAYLOAD_BYTES))
             break;
     }
     if (targetSha256 === undefined)

package/dist/application/pcap/PcapAnalysisPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/pcap/PcapAnalysisService.js

@@ -0,0 +1,24 @@
+import { pcapRequestSchema, } from "../../domain/pcap/pcapAnalysis.js";
+import { AnalysisCancelledError, AnalysisInputError, } from "../../domain/analysisErrorCore.js";
+import { createPcapEvidence } from "../../domain/pcap/pcapEvidence.js";
+import { err, ok } from "../../domain/result.js";
+/** Shared CLI/MCP admission, execution, and Evidence composition for pcap. */
+export class PcapAnalysisService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Run one caller-selected pcap request and retain capture identity inline. */
+    async execute(operation, input, options) {
+        if (options?.signal?.aborted === true)
+            return err(new AnalysisCancelledError(operation));
+        const request = pcapRequestSchema.safeParse({ operation, input });
+        if (!request.success)
+            return err(new AnalysisInputError(operation, { cause: request.error }));
+        const executed = await this.provider.execute(request.data, options);
+        if (!executed.ok)
+            return executed;
+        const execution = executed.value;
+        return ok(createPcapEvidence(request.data, execution));
+    }
+}