reverseport 0.0.0-stage → 1.2.0

package/dist/cli/interactiveSetup.js

@@ -0,0 +1,236 @@
+import { cancel, confirm, intro, isCancel, multiselect, outro, } from "@clack/prompts";
+import { SUPPORTED_CLIENT_DEFINITIONS } from "../application/SupportedClients.js";
+import { invokingPackageRunner } from "../application/ClientRegistrationIdentity.js";
+const clientDisplayNames = new Map(SUPPORTED_CLIENT_DEFINITIONS.map(({ name, displayName }) => [
+    name,
+    displayName,
+]));
+const promptStreams = {
+    input: process.stdin,
+    output: process.stderr,
+    withGuide: true,
+};
+/** Select agent targets, then review the resolved plan before consent. */
+export const confirmInteractiveSetup = async (actions, accessible, context) => {
+    if (context?.stage === "select" || context === undefined) {
+        intro("REA setup", promptStreams);
+        writeLine("│  Understand local apps and binaries from your terminal or agent.");
+        renderDetectedSummary(context?.clientStates ?? []);
+        renderKeyboardHelp(accessible);
+    }
+    if (context?.stage === "select") {
+        const selected = await selectSetupActions(actions, accessible, context);
+        return selected === undefined
+            ? cancelledDecision()
+            : { approved: false, selectedActionIds: selected };
+    }
+    if (actions.length === 0)
+        return { approved: true, selectedActionIds: [] };
+    renderPreflight(actions);
+    const approved = await confirm({
+        ...promptStreams,
+        message: actions.length === 1
+            ? "Apply this change?"
+            : `Apply these ${String(actions.length)} changes?`,
+        initialValue: true,
+        active: "Yes, apply",
+        inactive: "No, cancel",
+        vertical: accessible,
+    });
+    if (isCancel(approved) || !approved)
+        return cancelledDecision();
+    return { approved: true, selectedActionIds: actions.map(({ id }) => id) };
+};
+/** Render stable, append-only progress for real setup operations. */
+export const renderSetupProgress = (event) => {
+    const symbol = event.state === "started"
+        ? "◇"
+        : event.state === "completed"
+            ? "◆"
+            : event.state === "warning"
+                ? "!"
+                : "✗";
+    const suffix = event.detail === undefined ? "" : ` · ${event.detail}`;
+    writeLine(`${symbol}  ${event.label}${suffix}`);
+};
+/** Finish an interactive setup journey without exposing the full doctor catalog. */
+export const renderInteractiveSetupResult = (result, environment = process.env) => {
+    if (result.status === "ready") {
+        const changedClients = Object.entries(result.clients)
+            .filter(([, client]) => client.status === "configured")
+            .map(([client]) => clientDisplayNames.get(client) ?? client);
+        const readyClients = readyAgentClients(result, changedClients);
+        renderReadyCapabilities(result, readyClients, environment);
+        outro(changedClients.length === 0
+            ? "REA is ready for local app analysis."
+            : `Restart ${changedClients.join(", ")} to load REA.`, promptStreams);
+        return;
+    }
+    if (result.status === "planned" || result.status === "cancelled")
+        return;
+    writeLine(`!  ${result.remediation ?? "Setup needs attention."}`);
+    outro(`Run \`${cliInvocation(environment)} doctor\` for the remaining checks.`, promptStreams);
+};
+const selectSetupActions = async (actions, accessible, context) => {
+    const clientStates = context.clientStates.filter(({ client }) => client.format !== "unsupported");
+    const initial = new Set(context.selectedClientIds);
+    const selectedClientIds = accessible
+        ? await selectClientsAccessibly(clientStates, initial)
+        : await selectClients(clientStates, initial);
+    if (selectedClientIds === undefined)
+        return undefined;
+    const selectedActionIds = selectedClientIds.map((id) => `configure_client:${id}`);
+    const skill = actions.find(({ kind }) => kind === "install_skill");
+    if (skill !== undefined) {
+        if (selectedClientIds.length > 0)
+            selectedActionIds.push(skill.id);
+        else {
+            const included = await confirm({
+                ...promptStreams,
+                message: "Install the guided REA skill for CLI use?",
+                initialValue: false,
+                vertical: accessible,
+            });
+            if (isCancel(included))
+                return undefined;
+            if (included)
+                selectedActionIds.push(skill.id);
+        }
+    }
+    const hopper = actions.find(({ kind }) => kind === "install_hopper");
+    if (hopper !== undefined) {
+        const included = await confirm({
+            ...promptStreams,
+            message: "Install Hopper for deep binary analysis?",
+            initialValue: false,
+            vertical: accessible,
+        });
+        if (isCancel(included))
+            return undefined;
+        if (included)
+            selectedActionIds.push(hopper.id);
+    }
+    return selectedActionIds;
+};
+const clientHint = (state) => state.configured
+    ? "REA already configured · selected from existing configuration"
+    : state.status === "invalid"
+        ? "Existing configuration needs repair before setup"
+        : state.detected
+            ? "Detected · choose to configure"
+            : "Not detected · configuration is still available";
+const selectClients = async (states, initial) => {
+    if (states.length === 0)
+        return [];
+    const selection = await multiselect({
+        ...promptStreams,
+        message: "Which agents should use REA?",
+        options: states.map((state) => ({
+            value: state.client.name,
+            label: clientDisplayNames.get(state.client.name) ?? state.client.name,
+            hint: clientHint(state),
+        })),
+        initialValues: states
+            .filter(({ client }) => initial.has(client.name))
+            .map(({ client }) => client.name),
+        required: false,
+        maxItems: Math.max(3, Math.min(states.length, (process.stderr.rows ?? 24) - 8)),
+        showInstructions: true,
+    });
+    return isCancel(selection) ? undefined : selection;
+};
+const selectClientsAccessibly = async (states, initial) => {
+    const selected = [];
+    for (const state of states) {
+        const included = await confirm({
+            ...promptStreams,
+            message: `Configure ${clientDisplayNames.get(state.client.name) ?? state.client.name}? ${clientHint(state)}`,
+            initialValue: initial.has(state.client.name),
+            vertical: true,
+        });
+        if (isCancel(included))
+            return undefined;
+        if (included)
+            selected.push(state.client.name);
+    }
+    return selected;
+};
+const renderDetectedSummary = (states) => {
+    const detected = states.filter(({ detected }) => detected);
+    writeLine("│");
+    writeLine(detected.length === 0
+        ? "◆  No agents detected. Choose any supported agent below."
+        : `◆  Detected: ${humanList(detected.map(({ client }) => clientDisplayNames.get(client.name) ?? client.name))}`);
+};
+const renderKeyboardHelp = (accessible) => {
+    writeLine("│");
+    writeLine(accessible
+        ? "│  Keys: Enter answer · Ctrl-C cancel"
+        : "│  Keys: ↑/↓ navigate · Space toggle · Enter confirm · Ctrl-C cancel");
+};
+const cliInvocation = (environment) => {
+    const runner = invokingPackageRunner(environment);
+    return runner === undefined ? "rea" : `${runner} reverseport`;
+};
+const renderReadyCapabilities = (result, readyClients, environment) => {
+    writeLine("◆  What you can do now");
+    const providers = readyProviders(result);
+    if (providers.length > 0)
+        writeLine(`│  Deep analysis: ${humanList(providers)}`);
+    if (readyClients.length > 0)
+        writeLine(`│  Agent access: ${humanList(readyClients)}`);
+    if (result.doctor.identity?.skill.state === "aligned")
+        writeLine("│  Guided reverse-engineering workflows: installed");
+    writeLine(`│  CLI: ${cliInvocation(environment)} ${providers.length > 0 ? "analyze /path/to/app" : "capabilities"}`);
+    const firstClient = readyClients[0];
+    if (firstClient !== undefined)
+        writeLine(`│  Try in ${firstClient}: "Explain how a feature works in /path/to/app and show the evidence."`);
+};
+const readyAgentClients = (result, changedClients) => {
+    const alignedClients = (result.doctor.identity?.registrations ?? [])
+        .filter(({ state }) => state === "aligned")
+        .map(({ client }) => clientDisplayNames.get(client) ?? client);
+    return [...new Set([...alignedClients, ...changedClients])];
+};
+const readyProviders = (result) => result.doctor.availableProviders.map(displayProviderId);
+const displayProviderId = (id) => id.length === 0 ? id : `${id[0]?.toUpperCase() ?? ""}${id.slice(1)}`;
+const humanList = (values) => {
+    if (values.length < 2)
+        return values[0] ?? "";
+    if (values.length === 2)
+        return `${values[0]} and ${values[1]}`;
+    return `${values.slice(0, -1).join(", ")}, and ${values.at(-1)}`;
+};
+const renderPreflight = (actions) => {
+    writeLine("│");
+    writeLine("◆  Ready to review");
+    for (const action of actions) {
+        writeLine("│");
+        writeLine(`│  ${action.operation.toUpperCase()}  ${action.label}`);
+        writeLine(`│          ${action.target}`);
+        if (action.backupPath !== undefined)
+            writeLine(`│          backup: ${action.backupPath}`);
+        for (const origin of action.networkOrigins ?? [])
+            writeLine(`│          network: ${origin}`);
+        if (action.integrity !== undefined)
+            writeLine(`│          integrity: ${action.integrity}`);
+        for (const command of action.commands ?? [])
+            writeLine(`│          command: ${command}`);
+        writeLine(`│          ${action.detail}`);
+        if (action.external)
+            writeLine("│          external software");
+    }
+    writeLine("│");
+    writeLine("│  REA will preserve unrelated configuration and will not install or upgrade Node.js, npm, Homebrew, Java, or Ghidra.");
+};
+const cancelledDecision = () => {
+    cancel("Setup cancelled. No changes were made.", promptStreams);
+    return {
+        approved: false,
+        selectedActionIds: [],
+        cancelled: true,
+    };
+};
+const writeLine = (line) => {
+    process.stderr.write(`${line}\n`);
+};

package/dist/cli/javascriptApplicationAnalysis.js

@@ -0,0 +1,34 @@
+import { JAVASCRIPT_APPLICATION_PROVIDER } from "../application/InvestigationProviders.js";
+import { createProgressReporter } from "../application/ProgressReporter.js";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+/** Execute the shared one-shot CLI boundary for static JavaScript analysis. */
+export const runCliJavaScriptApplicationAnalysis = async (input, signal) => {
+    const { analyzeJavaScriptApplication } = await import("../application/javascript/JavaScriptApplicationService.js");
+    const progress = createProgressReporter(async (update) => {
+        process.stderr.write(`${JSON.stringify({ rea_progress: update })}\n`);
+    }, { minimumIntervalMs: 0 });
+    const resources = new ArtifactResourceScope();
+    const result = await analyzeJavaScriptApplication(input, resources, {
+        progress,
+        ...(signal === undefined ? {} : { signal }),
+    });
+    try {
+        await resources.close();
+    }
+    catch (cause) {
+        const cleanup = ArtifactReaderFailure.cleanupObservation(cause, "JavaScript application resources");
+        const failure = new ProviderCleanupError(JAVASCRIPT_APPLICATION_PROVIDER.id, cleanup.resources, { reason: cleanup.reason }, { cause, operation: "analyze_javascript_application" });
+        return cliError(result.ok
+            ? failure
+            : analysisErrorWithCleanupFailure(result.error, failure, "analyze_javascript_application"));
+    }
+    return result.ok ? result.value : cliError(result.error);
+};
+const cliError = (error) => ({
+    error: "JavaScript application analysis failed",
+    ...projectAnalysisError(error),
+});

package/dist/cli/javascriptRecoveryCommands.js

@@ -0,0 +1,59 @@
+import { z } from "incur";
+import { JavaScriptRecoveryService } from "../application/javascript/JavaScriptRecoveryService.js";
+import { createJavaScriptRecoveryProvider } from "../composition/javascriptRecovery.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { logCliCommand } from "../cliLogging.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { withCommandCancellation } from "./commandCancellation.js";
+/** Share source recovery with MCP while keeping CLI spelling at this boundary. */
+export const registerJavaScriptRecoveryCommands = (cli, logger, environment) => {
+    const service = new JavaScriptRecoveryService(createJavaScriptRecoveryProvider(environment));
+    cli.command(CLI_COMMANDS.recoverJavaScriptSources, {
+        description: "Recover readable JavaScript modules with source provenance and verified files",
+        args: z.object({
+            path: z
+                .string()
+                .describe("Absolute UTF-8 JavaScript input; never executed"),
+            outputDirectory: z.string().describe("Absolute absent output directory"),
+        }),
+        options: z.object({
+            additionalPath: z
+                .array(z.string())
+                .optional()
+                .describe("Related absolute UTF-8 JavaScript file; repeat for multiple chunks"),
+            extractionMode: z
+                .enum(["structural", "heuristic", "inspection"])
+                .optional()
+                .describe("Structural boundaries, heuristic fallback, or inspection-only regions"),
+            rewriteLevel: z
+                .enum(["minimal", "standard", "aggressive"])
+                .optional()
+                .describe("Upstream syntax recovery level; runtime equivalence remains unknown"),
+        }),
+        run: ({ args, options }) => withCommandCancellation(async (signal) => {
+            try {
+                return await logCliCommand(logger, CLI_COMMANDS.recoverJavaScriptSources, async () => {
+                    const result = await service.recover({
+                        path: args.path,
+                        output_directory: args.outputDirectory,
+                        ...(options.additionalPath === undefined
+                            ? {}
+                            : { additional_paths: options.additionalPath }),
+                        ...(options.extractionMode === undefined
+                            ? {}
+                            : { extraction_mode: options.extractionMode }),
+                        ...(options.rewriteLevel === undefined
+                            ? {}
+                            : { rewrite_level: options.rewriteLevel }),
+                    }, { signal });
+                    return result.ok
+                        ? result.value
+                        : projectAnalysisError(result.error);
+                });
+            }
+            finally {
+                await service.close();
+            }
+        }),
+    });
+};

package/dist/cli/jebCommands.js

@@ -0,0 +1,99 @@
+import { z } from "incur";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { JebAnalysisService } from "../application/jeb/JebAnalysisService.js";
+import { createJebAnalysisProvider } from "../composition/jeb.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { logCliCommand } from "../cliLogging.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { withCommandCancellation } from "./commandCancellation.js";
+/** Expose the same explicit JEB requests through one-shot CLI commands. */
+export const registerJebCommands = (cli, logger, environment, provider = createJebAnalysisProvider(environment)) => {
+    const service = new JebAnalysisService(provider);
+    const execute = (name, operation, input) => withCommandCancellation((signal) => logCliCommand(logger, name, async () => {
+        const result = await service.execute(operation, input, { signal });
+        try {
+            await provider.close();
+        }
+        catch (cause) {
+            if (cause instanceof AnalysisError)
+                return projectAnalysisError(cause);
+            throw cause;
+        }
+        return result.ok ? result.value : projectAnalysisError(result.error);
+    }));
+    cli.command(CLI_COMMANDS.inspectJebClient, {
+        description: "Inspect the running JEB MCP client without opening a target",
+        args: z.object({}),
+        run: () => execute(CLI_COMMANDS.inspectJebClient, "inspect_jeb_client", {}),
+    });
+    cli.command(CLI_COMMANDS.openJebProject, {
+        description: "Open or create a JEB project from an artifact or .jdb2 database",
+        args: z.object({
+            path: z
+                .string()
+                .describe("Artifact or .jdb2 path resolved by the JEB engine host"),
+        }),
+        run: ({ args }) => execute(CLI_COMMANDS.openJebProject, "open_jeb_project", args),
+    });
+    cli.command(CLI_COMMANDS.listJebUnits, {
+        description: "List JEB project units by path and type with optional filter",
+        args: z.object({}),
+        options: z.object({
+            filter: z
+                .string()
+                .optional()
+                .describe("Wildcard filter matched against unit paths"),
+            "parent-unit-path": z
+                .string()
+                .optional()
+                .describe("Restrict results to descendants of this unit path"),
+            index: z
+                .number()
+                .int()
+                .nonnegative()
+                .default(0)
+                .describe("Zero-based index of the first result to return"),
+            count: z
+                .number()
+                .int()
+                .min(1)
+                .max(100)
+                .default(100)
+                .describe("Maximum results; the engine caps unit pages at 100"),
+        }),
+        run: ({ options }) => execute(CLI_COMMANDS.listJebUnits, "list_jeb_units", {
+            index: options.index,
+            count: options.count,
+            ...(options.filter === undefined ? {} : { filter: options.filter }),
+            ...(options["parent-unit-path"] === undefined
+                ? {}
+                : { parent_unit_path: options["parent-unit-path"] }),
+        }),
+    });
+    cli.command(CLI_COMMANDS.decompileJebItem, {
+        description: "Decompile one JEB type or method to engine pseudo-code",
+        args: z.object({
+            "item-address": z
+                .string()
+                .min(1)
+                .describe("Type or method address within the unit"),
+            "item-kind": z
+                .enum(["type", "method"])
+                .describe("Kind of item to decompile"),
+        }),
+        options: z.object({
+            "unit-path": z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Target code unit; the engine's first code unit when omitted"),
+        }),
+        run: ({ args, options }) => execute(CLI_COMMANDS.decompileJebItem, "decompile_jeb_item", {
+            item_address: args["item-address"],
+            item_kind: args["item-kind"],
+            ...(options["unit-path"] === undefined
+                ? {}
+                : { unit_path: options["unit-path"] }),
+        }),
+    });
+};

package/dist/cli/jsonOutput.js

@@ -0,0 +1,46 @@
+import { bufferedJsonParts, jsonParts } from "../domain/jsonSerialization.js";
+/**
+ * Write ordinary JSON without constructing a document-sized string.
+ *
+ * `json` is indented for a terminal reader. Piped or redirected output, which
+ * agents and scripts consume, is compact: indentation adds no information and
+ * measured 16-45% more model tokens on real results. The value is identical.
+ */
+export const writeJsonOutput = async (value, destination, format = "json") => {
+    for (const part of bufferedJsonParts(jsonOutputParts(value, format, isTerminal(destination))))
+        await writePart(destination, part);
+};
+const isTerminal = (destination) => "isTTY" in destination && destination.isTTY === true;
+const writePart = (destination, part) => new Promise((resolve, reject) => {
+    const onError = (cause) => reject(cause);
+    destination.once("error", onError);
+    try {
+        destination.write(part, (cause) => {
+            if (cause) {
+                // A Writable can emit its error after invoking the write callback.
+                setImmediate(() => destination.off("error", onError));
+                reject(cause);
+            }
+            else {
+                destination.off("error", onError);
+                resolve();
+            }
+        });
+    }
+    catch (cause) {
+        destination.off("error", onError);
+        reject(cause);
+    }
+});
+/** The exact formatted document, including its final newline. */
+export function* jsonOutputParts(value, format, pretty = true) {
+    if (format === "jsonl" && Array.isArray(value)) {
+        for (const item of value) {
+            yield* jsonParts(item);
+            yield "\n";
+        }
+        return;
+    }
+    yield* jsonParts(value, pretty && format === "json");
+    yield "\n";
+}

package/dist/cli/managedCommands.js

@@ -0,0 +1,129 @@
+import { z } from "incur";
+import { compareManagedMemberPaths } from "../application/managed/ManagedMemberComparisonService.js";
+import { verifyManagedNativeBoundariesEvidence } from "../application/managed/ManagedNativeVerificationService.js";
+import { importManagedReconstructionEvidence } from "../application/managed/ManagedReconstructionService.js";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
+import { parseCliJsonInput } from "../cliJsonInput.js";
+import { MANAGED_STATIC_PROVIDER } from "../application/InvestigationProviders.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { logCliCommand } from "../cliLogging.js";
+import { registerProjectManagedApplicationGraph } from "./managedProjectGraphCommand.js";
+import { managedMembersInputSchema } from "../contracts/managed/managedToolContracts.js";
+export const registerManagedCommands = (cli, logger, runProviderAnalysis) => {
+    registerInspectManagedArtifact(cli, logger, runProviderAnalysis);
+    registerInspectManagedMembers(cli, logger, runProviderAnalysis);
+    registerInspectManagedNativeBoundaries(cli, logger, runProviderAnalysis);
+    registerCompareManagedMembers(cli, logger);
+    registerImportManagedReconstruction(cli, logger);
+    registerVerifyManagedNativeBoundaries(cli, logger);
+    registerProjectManagedApplicationGraph(cli, logger);
+};
+const registerInspectManagedArtifact = (cli, logger, runProviderAnalysis) => {
+    cli.command(CLI_COMMANDS.inspectManagedArtifact, {
+        description: "Inspect PE/CLI identity without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "inspect-managed-artifact", () => runProviderAnalysis(args.path, "inspect_managed_artifact", {}, logger)),
+    });
+};
+const registerInspectManagedMembers = (cli, logger, runProviderAnalysis) => {
+    cli.command(CLI_COMMANDS.inspectManagedMembers, {
+        description: "Inspect PE/CLI metadata members, signatures, and CIL anchors without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        options: z.object({
+            type: managedMembersInputSchema.shape.type_names.describe("Inspect only members declared by this exact type full name, such as System.Threading.Monitor; a nested type is named by its bare name, which selects every nested type of that name (repeatable)"),
+        }),
+        run: ({ args, options }) => logCliCommand(logger, "inspect-managed-members", () => runProviderAnalysis(args.path, "inspect_managed_members", options.type === undefined ? {} : { type_names: options.type }, logger)),
+    });
+};
+const registerInspectManagedNativeBoundaries = (cli, logger, runProviderAnalysis) => {
+    cli.command(CLI_COMMANDS.inspectManagedNativeBoundaries, {
+        description: "Inspect PE/CLI PInvoke and native implementation boundary declarations without loading target code",
+        args: z.object({
+            path: z.string().describe("Managed PE executable or assembly path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "inspect-managed-native-boundaries", () => runProviderAnalysis(args.path, "inspect_managed_native_boundaries", {}, logger)),
+    });
+};
+const compareManagedMemberArgs = z.object({
+    leftPath: z.string().describe("Baseline managed PE executable or assembly"),
+    rightPath: z.string().describe("Candidate managed PE executable or assembly"),
+});
+const registerCompareManagedMembers = (cli, logger) => {
+    cli.command(CLI_COMMANDS.compareManagedMembers, {
+        description: "Compare managed PE/CLI member inventories by exact declared type, name, and signature; names alone never form a match",
+        args: compareManagedMemberArgs,
+        run: ({ args }) => logCliCommand(logger, "compare-managed-members", async () => {
+            const resources = new ArtifactResourceScope();
+            const result = await compareManagedMemberPaths({
+                leftPath: args.leftPath,
+                rightPath: args.rightPath,
+            }, {}, resources);
+            try {
+                await resources.close();
+            }
+            catch (cause) {
+                const cleanup = ArtifactReaderFailure.cleanupObservation(cause, "Managed member comparison resources");
+                const failure = new ProviderCleanupError(MANAGED_STATIC_PROVIDER.id, cleanup.resources, { reason: cleanup.reason }, {
+                    cause,
+                    operation: "compare_managed_members",
+                    ...(result.ok ? { partialObservation: result.value } : {}),
+                });
+                const error = result.ok
+                    ? failure
+                    : analysisErrorWithCleanupFailure(result.error, failure, "compare_managed_members");
+                return {
+                    error: "Managed member comparison failed",
+                    ...projectAnalysisError(error),
+                };
+            }
+            return result.ok
+                ? result.value
+                : {
+                    error: "Managed member comparison failed",
+                    ...projectAnalysisError(result.error),
+                };
+        }),
+    });
+};
+const registerImportManagedReconstruction = (cli, logger) => {
+    cli.command(CLI_COMMANDS.importManagedReconstruction, {
+        description: "Import decompiler-produced managed reconstruction against exact static member evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed reconstruction JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "import-managed-reconstruction", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "import-managed-reconstruction");
+            if (!input.ok)
+                return input.error;
+            const result = importManagedReconstructionEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};
+const registerVerifyManagedNativeBoundaries = (cli, logger) => {
+    cli.command(CLI_COMMANDS.verifyManagedNativeBoundaries, {
+        description: "Verify managed P/Invoke declarations against authenticated native Evidence",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed/native verification JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "verify-managed-native-boundaries", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "verify-managed-native-boundaries");
+            if (!input.ok)
+                return input.error;
+            const result = verifyManagedNativeBoundariesEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};

package/dist/cli/managedProjectGraphCommand.js

@@ -0,0 +1,24 @@
+import { z } from "incur";
+import { projectManagedApplicationGraphEvidence } from "../application/managed/ManagedApplicationGraphService.js";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { parseCliJsonInput } from "../cliJsonInput.js";
+import { logCliCommand } from "../cliLogging.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+/** Register managed static-Evidence application graph projection. */
+export const registerProjectManagedApplicationGraph = (cli, logger) => {
+    cli.command(CLI_COMMANDS.projectManagedApplicationGraph, {
+        description: "Project authenticated managed static Evidence into an application graph",
+        args: z.object({
+            inputJson: z
+                .string()
+                .describe("Inline managed application graph JSON or JSON file path"),
+        }),
+        run: ({ args }) => logCliCommand(logger, "project-managed-application-graph", async () => {
+            const input = await parseCliJsonInput(args.inputJson, "project-managed-application-graph");
+            if (!input.ok)
+                return input.error;
+            const result = projectManagedApplicationGraphEvidence(input.value);
+            return result.ok ? result.value : projectAnalysisError(result.error);
+        }),
+    });
+};

package/dist/cli/nativeCallCommands.js

@@ -0,0 +1,33 @@
+import { z } from "incur";
+import { CLI_COMMANDS } from "../cliCommandNames.js";
+import { parseCliJsonInput } from "../cliJsonInput.js";
+import { logCliCommand } from "../cliLogging.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { nativeCallObservationInputSchema } from "../domain/native/nativeCallObservation.js";
+const OPERATION = "observe_native_calls";
+/** `observe-native-calls <path> <input-json>`: the MCP input object as JSON. */
+export const registerNativeCallCommands = (cli, logger, runProviderAnalysis) => {
+    cli.command(CLI_COMMANDS.observeNativeCalls, {
+        description: "Launch a Mach-O under LLDB and record entries into selected functions or Objective-C methods",
+        args: z.object({
+            path: z.string().describe("Mach-O or app path"),
+            inputJson: z
+                .string()
+                .describe("Inline JSON or a JSON file path: breakpoints, arguments, environment, duration_ms, max_events, argument_registers, backtrace_frames"),
+        }),
+        run: ({ args }) => logCliCommand(logger, CLI_COMMANDS.observeNativeCalls, async () => {
+            const input = await parseCliJsonInput(args.inputJson, OPERATION);
+            if (!input.ok)
+                return input.error;
+            const parsed = nativeCallObservationInputSchema.safeParse(input.value);
+            if (!parsed.success)
+                return {
+                    error: "Analysis failed",
+                    ...projectAnalysisError(analysisInputErrorFromIssues(OPERATION, parsed.error.issues, input.value)),
+                };
+            return runProviderAnalysis(args.path, OPERATION, z.record(z.string(), jsonValueSchema).parse(parsed.data), logger);
+        }),
+    });
+};