rea-agents 6.4.0 → 6.7.0

package/dist/domain/browserScenarioDiffEvidence.js

@@ -1,3 +1,4 @@
+import { fingerprintScenarioNetworkTransactions, scenarioNetworkTransactions, scenarioNetworkCoverageReason, } from "./browserScenarioNetworkComparison.js";
 const includesCompletenessSection = (completeness, collection, section) => {
     const sections = completeness[collection];
     return sections.includes(section);
@@ -36,19 +37,37 @@ export const actionState = (step) => ({
     after_url: step.after_url,
     error: step.error,
 });
-/** Select events attributed to one scenario step without sequence metadata. */
-export const eventsFor = (capture, stepIndex) => {
-    const sourceSteps = new Map(capture.events.items.map(({ sequence, step_index }) => [
-        sequence,
-        step_index,
-    ]));
-    return capture.events.items.flatMap(({ sequence: _sequence, step_index: eventStepIndex, ...event }) => {
-        if (event.kind === "network-content") {
-            const { source_event_sequence: sourceSequence, ...content } = event;
-            return sourceSteps.get(sourceSequence) === stepIndex ? [content] : [];
-        }
-        return eventStepIndex === stepIndex ? [event] : [];
-    });
+/** Build one graph and fingerprint index per capture, then select in linear total work. */
+export const prepareScenarioEvents = (capture, rules) => {
+    const eventsByStep = new Map();
+    for (const { sequence: _sequence, step_index, ...event } of capture.events
+        .items) {
+        if ("transaction_id" in event)
+            continue;
+        const events = eventsByStep.get(step_index) ?? [];
+        events.push(event);
+        eventsByStep.set(step_index, events);
+    }
+    const nodes = scenarioNetworkTransactions(capture);
+    const fingerprints = fingerprintScenarioNetworkTransactions(nodes, rules);
+    const networkByStep = new Map();
+    for (const [index, node] of nodes.entries()) {
+        const step = networkByStep.get(node.step_index) ?? [];
+        const fingerprint = fingerprints[index];
+        if (fingerprint === undefined)
+            throw new Error("Network comparison node has no fingerprint");
+        step.push(fingerprint);
+        networkByStep.set(node.step_index, step);
+    }
+    for (const fingerprintsForStep of networkByStep.values())
+        fingerprintsForStep.sort();
+    return {
+        coverageReason: scenarioNetworkCoverageReason(capture, nodes),
+        forStep: (stepIndex) => ({
+            events: eventsByStep.get(stepIndex) ?? [],
+            network_transactions: networkByStep.get(stepIndex) ?? [],
+        }),
+    };
 };
 /** Different content selection is missing comparability, not an observed website change. */
 export const networkContentCoverageReason = (before, after) => {
@@ -60,6 +79,18 @@ export const networkContentCoverageReason = (before, after) => {
         ? "Network content selections differ; capture both sides with matching content selection before comparing network evidence."
         : undefined;
 };
+/** Different event-family selection is missing comparability, not an observed website change. */
+export const eventFamilyCoverageReason = (before, after) => {
+    const left = before.scenario.event_families;
+    const right = after.scenario.event_families;
+    const leftFamilies = new Set(left);
+    const rightFamilies = new Set(right);
+    return leftFamilies.size === rightFamilies.size &&
+        [...leftFamilies].every((family) => rightFamilies.has(family))
+        ? undefined
+        : `Event family selections differ (${familyList(leftFamilies)} before, ${familyList(rightFamilies)} after); capture both sides with matching event families before comparing event evidence.`;
+};
+const familyList = (families) => families.size === 0 ? "none" : [...families].sort().join(", ");
 /** Wrap one value as captured comparison evidence. */
 export const captured = (value) => ({
     state: "captured",

package/dist/domain/browserScenarioDiffValues.js

@@ -101,19 +101,26 @@ const alignmentFailureSchema = z.strictObject({
     step_id: z.string().min(1).nullable(),
     reason: z.string().min(1),
 });
-const builtInNormalizationSchema = z.enum([
+export const BROWSER_SCENARIO_BUILT_IN_NORMALIZATION_RULES = [
     "ignore_step_elapsed_ms",
     "ignore_event_sequence",
     "ignore_event_step_index",
     "compare_screenshot_content_digest",
     "compare_normalized_text_content",
-]);
+    "ignore_capture_local_network_transaction_ids",
+    "attribute_network_transactions_to_request_step",
+    "compare_network_transactions_as_unordered_collection",
+    "preserve_redirect_transaction_ancestry",
+];
+const builtInNormalizationSchema = z.enum(BROWSER_SCENARIO_BUILT_IN_NORMALIZATION_RULES);
 /** Step alignment, recorded normalization, and inline artifact differences. */
 export const browserScenarioDiffSchema = z.strictObject({
     comparison_kind: z.literal("browser_scenario"),
     overall_status: z.enum(["changed", "unchanged", "unknown"]),
     normalization: z.strictObject({
-        built_in_rules: z.array(builtInNormalizationSchema).length(5),
+        built_in_rules: z
+            .array(builtInNormalizationSchema)
+            .length(BROWSER_SCENARIO_BUILT_IN_NORMALIZATION_RULES.length),
         rules: z.array(normalizationRuleSchema),
         sha256: z.string().regex(/^[a-f0-9]{64}$/u),
     }),

package/dist/domain/browserScenarioNetworkComparison.js

@@ -0,0 +1,158 @@
+import { z } from "zod";
+import { digestCanonicalValue } from "./canonicalDigest.js";
+import { normalizeScenarioValue } from "./browserScenarioNormalization.js";
+/** Numeric links are temporary local indices, never durable transaction identity. */
+export const scenarioNetworkTransactionSchema = z.strictObject({
+    events: z.array(z.unknown()),
+    predecessor: z.number().int().min(-2),
+    step_index: z.number().int().min(0),
+});
+/** Project each transaction once, retaining ancestry as references rather than nested copies. */
+export const scenarioNetworkTransactions = (capture) => {
+    const sourceSteps = new Map(capture.events.items.map((event) => [event.sequence, event.step_index]));
+    const requests = new Map(capture.events.items.flatMap((event) => event.kind === "request" ? [[event.transaction_id, event]] : []));
+    const grouped = new Map();
+    for (const { sequence: _sequence, step_index: step, ...event } of capture
+        .events.items) {
+        if (!("transaction_id" in event))
+            continue;
+        const id = event.transaction_id;
+        const request = requests.get(id);
+        const receiptStep = event.kind === "network-content"
+            ? sourceSteps.get(event.source_event_sequence)
+            : step;
+        const requestStep = request?.step_index ?? receiptStep;
+        let evidence;
+        let predecessor;
+        let predecessorState;
+        if (event.kind === "network-content") {
+            const { transaction_id: _id, source_event_sequence: _source, ...content } = event;
+            evidence = content;
+            predecessor = request?.redirected_from_transaction_id ?? null;
+            predecessorState = request?.redirected_from_transaction_state;
+        }
+        else {
+            const { transaction_id: _id, redirected_from_transaction_id: parent, redirected_from_transaction_state: _state, ...network } = event;
+            evidence = network;
+            predecessor =
+                request === undefined ? parent : request.redirected_from_transaction_id;
+            predecessorState =
+                request === undefined
+                    ? event.redirected_from_transaction_state
+                    : request.redirected_from_transaction_state;
+        }
+        const previous = grouped.get(id);
+        if (previous === undefined)
+            grouped.set(id, {
+                events: [evidence],
+                predecessor,
+                predecessorState,
+                predecessorConflict: event.kind !== "network-content" &&
+                    request !== undefined &&
+                    ((event.redirected_from_transaction_id !== null &&
+                        event.redirected_from_transaction_id !==
+                            request.redirected_from_transaction_id) ||
+                        (event.redirected_from_transaction_state === "root" &&
+                            request.redirected_from_transaction_id !== null)),
+                stepIndex: requestStep ?? step,
+            });
+        else {
+            previous.events.push(evidence);
+            if (event.kind !== "network-content") {
+                const parent = event.redirected_from_transaction_id;
+                const state = event.redirected_from_transaction_state;
+                const knownParent = previous.predecessor;
+                if (parent !== null &&
+                    (knownParent !== null
+                        ? parent !== knownParent
+                        : previous.predecessorState === "root"))
+                    previous.predecessorConflict = true;
+                else if (parent !== null && knownParent === null) {
+                    previous.predecessor = parent;
+                    previous.predecessorState = state;
+                }
+                else if (parent === null && state === "root" && knownParent !== null)
+                    previous.predecessorConflict = true;
+                else if (parent === null &&
+                    state === "root" &&
+                    previous.predecessorState !== "root")
+                    previous.predecessorState = "root";
+            }
+        }
+    }
+    const indices = new Map([...grouped.keys()].map((id, index) => [id, index]));
+    return [...grouped.values()].map((node) => ({
+        events: node.events,
+        predecessor: node.predecessorConflict
+            ? -2
+            : node.predecessor === null
+                ? node.predecessorState === "root"
+                    ? -1
+                    : -2
+                : (indices.get(node.predecessor) ?? -2),
+        step_index: node.stepIndex,
+    }));
+};
+/** Missing or cyclic ancestry cannot support an unchanged claim. */
+export const scenarioNetworkCoverageReason = (capture, nodes = scenarioNetworkTransactions(capture)) => {
+    const finished = new Set();
+    for (let start = 0; start < nodes.length; start += 1) {
+        const path = new Set();
+        let index = start;
+        while (index >= 0 && !finished.has(index)) {
+            if (path.has(index))
+                return "Redirect ancestry contains a cycle; network transaction identity remains unknown.";
+            path.add(index);
+            const node = nodes[index];
+            if (node === undefined)
+                return "Redirect predecessor evidence is missing; network transaction identity remains unknown.";
+            index = node.predecessor;
+        }
+        if (index === -2)
+            return "Redirect predecessor evidence is missing; network transaction identity remains unknown.";
+        for (const item of path)
+            finished.add(item);
+    }
+    return undefined;
+};
+/** Hash normalized own evidence and its complete parent fingerprint in linear graph space. */
+export const fingerprintScenarioNetworkTransactions = (nodes, rules = []) => {
+    const own = nodes.map((node) => node.events
+        .map((event) => digestCanonicalValue(normalizeScenarioValue(event, "events", rules), "Browser scenario"))
+        .sort());
+    const fingerprints = new Map();
+    for (let start = 0; start < nodes.length; start += 1) {
+        const path = [];
+        const positions = new Map();
+        let index = start;
+        while (index >= 0 &&
+            nodes[index] !== undefined &&
+            !fingerprints.has(index)) {
+            const position = positions.get(index);
+            if (position !== undefined) {
+                // These captures are incomparable; retain an explicit cycle observation.
+                for (const member of path.slice(position))
+                    fingerprints.set(member, digestCanonicalValue({ events: own[member], redirected_from: { state: "cycle" } }, "Browser scenario"));
+                break;
+            }
+            positions.set(index, path.length);
+            path.push(index);
+            index = nodes[index]?.predecessor ?? -2;
+        }
+        for (const member of path.reverse()) {
+            if (fingerprints.has(member))
+                continue;
+            const predecessor = nodes[member]?.predecessor ?? -2;
+            const parent = predecessor === -1
+                ? null
+                : (fingerprints.get(predecessor) ?? { state: "missing" });
+            fingerprints.set(member, digestCanonicalValue({ events: own[member], redirected_from: parent }, "Browser scenario"));
+        }
+    }
+    return nodes.map((_, index) => {
+        const fingerprint = fingerprints.get(index);
+        if (fingerprint === undefined)
+            throw new Error("Network comparison node has no fingerprint");
+        return fingerprint;
+    });
+};

package/dist/domain/browserScenarioNormalization.js

@@ -1,11 +1,5 @@
 import { digestCanonicalValue } from "./canonicalDigest.js";
-const BUILT_IN_RULES = [
-    "ignore_step_elapsed_ms",
-    "ignore_event_sequence",
-    "ignore_event_step_index",
-    "compare_screenshot_content_digest",
-    "compare_normalized_text_content",
-];
+import { BROWSER_SCENARIO_BUILT_IN_NORMALIZATION_RULES, } from "./browserScenarioDiffValues.js";
 /** Canonically order and commit a parsed browser scenario normalization policy. */
 export const commitBrowserScenarioNormalization = (input) => {
     const rules = [...input.rules]
@@ -14,15 +8,18 @@ export const commitBrowserScenarioNormalization = (input) => {
         artifacts: [...rule.artifacts].sort(),
     }))
         .sort((left, right) => left.rule_id < right.rule_id ? -1 : left.rule_id > right.rule_id ? 1 : 0);
-    const commitment = { built_in_rules: [...BUILT_IN_RULES], rules };
+    const commitment = {
+        built_in_rules: [...BROWSER_SCENARIO_BUILT_IN_NORMALIZATION_RULES],
+        rules,
+    };
     return {
         ...commitment,
         sha256: digestCanonicalValue(commitment, "Browser scenario"),
     };
 };
-/** Digest one artifact after applying committed exact-literal rules. */
-export const digestNormalizedScenarioValue = (value, artifact, rules) => digestCanonicalValue(normalize(value, artifact, rules), "Browser scenario");
-const normalize = (value, artifact, rules) => {
+/** Digest one artifact after applying committed exact-literal rules, then any artifact ordering. */
+export const digestNormalizedScenarioValue = (value, artifact, rules, order = (normalized) => normalized) => digestCanonicalValue(order(normalizeScenarioValue(value, artifact, rules)), "Browser scenario");
+export const normalizeScenarioValue = (value, artifact, rules) => {
     if (artifact === "screenshot")
         return value;
     if (typeof value === "string")
@@ -30,11 +27,11 @@ const normalize = (value, artifact, rules) => {
             .filter(({ artifacts }) => artifacts.includes(artifact))
             .reduce((normalized, rule) => normalized.split(rule.match).join(rule.replacement), value);
     if (Array.isArray(value))
-        return value.map((item) => normalize(item, artifact, rules));
+        return value.map((item) => normalizeScenarioValue(item, artifact, rules));
     if (typeof value !== "object" || value === null)
         return value;
     return Object.fromEntries(Object.entries(value).map(([key, item]) => [
         key,
-        normalize(item, artifact, rules),
+        normalizeScenarioValue(item, artifact, rules),
     ]));
 };

package/dist/domain/browserScenarioValues.js

@@ -3,6 +3,8 @@ import { isAbsolute } from "node:path";
 import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { localPathStringSchema } from "./localPath.js";
 import { browserNetworkContentSelectionSchema } from "./browserNetworkEvidence.js";
+import { browserScenarioEventFamilySchema } from "./browserScenarioCaptureValues.js";
+import { browserScenarioCaptureLimitsSchema, DEFAULT_BROWSER_SCENARIO_CAPTURE_LIMITS, } from "./browserScenarioCaptureLimits.js";
 import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
 export const scenarioIdentifierSchema = z.string().regex(IDENTIFIER_PATTERN);
 const browserExecutablePathSchema = localPathStringSchema.refine(isAbsolute, {
@@ -80,7 +82,8 @@ export const browserScenarioEnvironmentSchema = z
         .string()
         .min(2)
         .regex(/^[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*$/u)
-        .default("en-US"),
+        .default("en-US")
+        .describe("Formatting locale. Launch also sets navigator.language(s) and Accept-Language; connect retains the caller's page and request languages and reports this limitation."),
     timezone: z
         .string()
         .min(1)
@@ -241,19 +244,9 @@ export const browserScenarioCaptureSchema = z
     .strictObject({
     after_each_step: z.array(snapshotKindSchema).default([]),
     at_end: z.array(snapshotKindSchema).default(["url"]),
-    events: z
-        .array(z.enum([
-        "console",
-        "page-errors",
-        "network",
-        "websockets",
-        "frames",
-        "workers",
-        "popups",
-        "downloads",
-    ]))
-        .default([]),
+    events: z.array(browserScenarioEventFamilySchema).default([]),
     network: browserNetworkContentSelectionSchema,
+    limits: browserScenarioCaptureLimitsSchema.default(DEFAULT_BROWSER_SCENARIO_CAPTURE_LIMITS),
 })
     .default({
     after_each_step: [],
@@ -264,5 +257,6 @@ export const browserScenarioCaptureSchema = z
         response_body: false,
         header_values: false,
     },
+    limits: DEFAULT_BROWSER_SCENARIO_CAPTURE_LIMITS,
 })
     .describe("Optional retained artifacts and event families. Defaults to only a final sanitized URL; request screenshots, DOM, accessibility, history, storage, and event capture explicitly.");

package/dist/domain/browserSession.js

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
+import { browserAllowedOriginsSchema, browserObservationEndpointSchema, } from "./browserObservation.js";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserVersionSchema } from "./browserObservationSchemas.js";
 /** Input for a navigation-aware browser observation window. */
 export const observeWebSessionInputSchema = z.strictObject({
-    cdp_endpoint: browserEndpointSchema,
+    cdp_endpoint: browserObservationEndpointSchema,
     allowed_origins: browserAllowedOriginsSchema,
     target_id: z.string().trim().min(1),
     observation_ms: z.number().int().min(1).default(10_000),

package/dist/domain/bundleComparison.js

@@ -71,11 +71,7 @@ export const compareBundles = (leftInput, rightInput, recordPairs = []) => {
     const changes = [...recordResult.changes, ...unknownResult.changes].sort(compareChanges);
     const unresolved = changes.filter(({ conclusion_kind: kind }) => kind !== "observed_change").length;
     return bundleComparisonResultSchema.parse({
-        status: leftDigest === rightDigest && changes.length === 0
-            ? "unchanged"
-            : unresolved > 0
-                ? "unknown"
-                : "changed",
+        status: unresolved > 0 ? "unknown" : changes.length > 0 ? "changed" : "unchanged",
         left_bundle_sha256: leftDigest,
         right_bundle_sha256: rightDigest,
         summary: {

package/dist/domain/callPath.js

@@ -1,5 +1,7 @@
+import { relationshipCoverageLimitations } from "./relationshipCoverage.js";
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
+import { isCallerOnlyIncompleteCoverage } from "./functionCallCoverage.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /** Minimal directed caller-to-callee adjacency for call-path search. */
 class CallGraph {
@@ -163,16 +165,51 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
     const reached = new Map([[start, 0]]);
     const queue = [start];
     const limitations = [];
+    let incompleteExpandedCoverage = false;
     for (let index = 0; index < queue.length; index += 1) {
         const node = queue[index];
         if (node === undefined)
             continue;
         const depth = reached.get(node) ?? 0;
-        if (node === goal)
-            continue;
         const snapshot = snapshots.get(node);
+        if (snapshot !== undefined) {
+            const coverage = snapshot.evidence.relationship_coverage;
+            for (const limitation of snapshot.limitations)
+                limitations.push(limitation);
+            if (coverage !== null) {
+                for (const limitation of relationshipCoverageLimitations(coverage))
+                    limitations.push(limitation);
+                for (const diagnostic of coverage.diagnostics ?? [])
+                    limitations.push(diagnostic);
+            }
+            // The requested goal is a terminal for this search. Its outgoing edges
+            // cannot add a path to the goal, so its dossier limits are contextual
+            // but do not make the searched start-to-goal closure incomplete.
+            if (node === goal)
+                continue;
+            const callees = snapshot.dossier.facet_availability?.callees;
+            if (callees?.available === false) {
+                limitations.push(callees.reason);
+                incompleteExpandedCoverage = true;
+            }
+            // Explicit, Evidence-bound relationship coverage owns completeness;
+            // generic provider/dossier limitations remain contextual. Legacy Evidence
+            // without that metadata retains its conservative limitation-based rule.
+            // The search only expands callee edges, so coverage that is unknown
+            // solely because callers are unobservable does not make the searched
+            // callee closure incomplete; the caller caveat stays in limitations.
+            if (coverage === null
+                ? snapshot.limitations.length > 0
+                : coverage.status !== "complete" &&
+                    !isCallerOnlyIncompleteCoverage(coverage))
+                incompleteExpandedCoverage = true;
+        }
+        else if (node === goal) {
+            continue;
+        }
         if (snapshot === undefined) {
             limitations.push(`No analyze_function Evidence covers reachable function ${node}`);
+            incompleteExpandedCoverage = true;
             continue;
         }
         const neighbors = graph.outNeighbors(node).sort(compareUnicodeCodePoints);
@@ -186,7 +223,7 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
         graph,
         snapshots,
         reached,
-        exhaustive: limitations.length === 0,
+        exhaustive: !incompleteExpandedCoverage,
         limitations,
     };
 };

package/dist/domain/captures/packetCapture.js

@@ -0,0 +1,139 @@
+import { z } from "zod";
+import { fixedTupleSchema } from "../fixedTupleSchema.js";
+import { localPathStringSchema } from "../localPath.js";
+const argument = z
+    .string()
+    .min(1)
+    .max(8192)
+    .refine((value) => !value.includes("\0"), "NUL is not an argument character");
+const captureInputShape = z.strictObject({
+    path: localPathStringSchema.describe("Absolute local capture path"),
+    fields: z
+        .array(argument)
+        .max(1024)
+        .min(1)
+        .describe("TShark field names to return, e.g. ip.addr, usb.endpoint_address, btatt.opcode; frame.number is always included"),
+    display_filter: argument
+        .nullable()
+        .default(null)
+        .describe("Optional Wireshark display filter (-Y), applied within the read limit"),
+    decode_as: z
+        .array(argument)
+        .max(1024)
+        .default([])
+        .describe("Explicit TShark decode-as selections, e.g. tcp.port==8888,http"),
+    packet_limit: z
+        .number()
+        .int()
+        .positive()
+        .max(2147483647)
+        .nullable()
+        .default(null)
+        .describe("Maximum input packets to read before filtering; omitted scans to EOF within resource limits"),
+    two_pass: z
+        .boolean()
+        .default(true)
+        .describe("Use two-pass analysis for fields requiring later packets; false requests a single pass"),
+    match_offset: z
+        .number()
+        .int()
+        .nonnegative()
+        .default(0)
+        .describe("Skip this many matching packets after filtering; default 0"),
+    match_limit: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .default(50)
+        .describe("Return at most this many matching packets after filtering; default 50. Null explicitly returns all remaining matches within producer resource limits."),
+});
+// Bound UTF-8 selector text, terminators, option names and 64-bit argv pointers
+// before Set/flatMap expansion. 32 KiB reserves headroom below Linux execve's
+// 32-page argv+environment floor; ambient environments can still exhaust it.
+export const withinPacketCaptureSelectorBudget = (input) => {
+    if (input.fields.length > 1024 || input.decode_as.length > 1024)
+        return false;
+    let bytes = 0;
+    for (const selections of [input.fields, input.decode_as])
+        for (const value of selections) {
+            bytes += Buffer.byteLength(value, "utf8") + 20;
+            if (bytes > 32768)
+                return false;
+        }
+    if (input.display_filter !== null)
+        bytes += Buffer.byteLength(input.display_filter, "utf8") + 20;
+    return bytes <= 32768;
+};
+export const packetCaptureSelectorBudgetIssue = {
+    message: "Packet selectors exceed the 32 KiB encoded argument budget; reduce fields, decode-as rules or filter text.",
+};
+export const inspectPacketCaptureInputSchema = captureInputShape.refine(withinPacketCaptureSelectorBudget, packetCaptureSelectorBudgetIssue);
+export const packetCaptureOptionsSchema = captureInputShape
+    .omit({ path: true })
+    .refine(withinPacketCaptureSelectorBudget, packetCaptureSelectorBudgetIssue);
+/** Values remain strings; repeated occurrences remain ordered arrays. */
+export const packetFieldsSchema = z
+    .object({
+    "frame.number": fixedTupleSchema([z.string().regex(/^[1-9][0-9]*$/)]),
+})
+    .catchall(z.array(z.string()));
+export const packetCaptureSchema = z
+    .strictObject({
+    artifact: z.strictObject({
+        path: z.string(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        bytes: z.number().int().nonnegative(),
+    }),
+    selection: inspectPacketCaptureInputSchema,
+    packets: z.array(packetFieldsSchema),
+    output_window: z.strictObject({
+        matching_packets: z
+            .number()
+            .int()
+            .nonnegative()
+            .describe("Matches in the completed producer output within the indicated input read scope, not total capture packets"),
+        returned_packets: z.number().int().nonnegative(),
+        has_more: z.boolean(),
+    }),
+    read_scope: z.enum(["to-eof", "up-to-input-packet-limit"]),
+    diagnostics: z.string(),
+    tool: z.strictObject({
+        configured_path: z.string(),
+        path: z.string(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        version_banner: z.string(),
+        version_diagnostics: z.string(),
+        arguments: z.array(z.string()),
+    }),
+    configuration: z.literal("private-empty-personal-profile"),
+    resource_limiter: z.strictObject({
+        configured_path: z.string(),
+        path: z.string(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        arguments: z.array(z.string()),
+    }),
+    limits: z.strictObject({
+        input_bytes: z.number().int().positive(),
+        output_bytes: z.number().int().positive(),
+        command_timeout_ms: z.number().int().positive(),
+        address_space_bytes: z.number().int().nonnegative(),
+        file_bytes: z.number().int().nonnegative(),
+        cpu_seconds: z.number().int().nonnegative(),
+    }),
+    hardware_acquisition: z.literal("not-performed"),
+})
+    .superRefine((report, context) => {
+    const remaining = Math.max(report.output_window.matching_packets - report.selection.match_offset, 0);
+    const expected = report.selection.match_limit === null
+        ? remaining
+        : Math.min(remaining, report.selection.match_limit);
+    if (report.packets.length !== expected ||
+        report.output_window.returned_packets !== expected ||
+        report.output_window.has_more !== remaining > expected)
+        context.addIssue({
+            code: "custom",
+            path: ["output_window"],
+            message: "Returned packet window must match examined matches and caller-selected offset/limit",
+        });
+});