reverseport 0.0.0-stage → 1.2.0

package/dist/cli-runtime/toolContracts-C7pvYKxF.js

@@ -0,0 +1,4516 @@
+import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
+import { init_jsonValue, jsonObjectSchema, jsonValueSchema } from "./providerOperationHealth-DSTcYPJe.js";
+import { analysisProviderSelectorSchema, analyzeJavaScriptSemantics, androidApplicationProjectionInputSchema, androidApplicationProjectionResultSchema, appleApplicationProjectionInputSchema, appleApplicationProjectionResultSchema, artifactIntegrityPolicySchema, browserScenarioCaptureSchema, browserTargetListSchema, canonicalJson, captureWebScreenshotInputSchema, compareUnicodeCodePoints, compareWebScreenshotsInputSchema, createEvidence, createWebTextArtifact, digestCanonicalValue, digestProcessCommitment, electronActiveObservationInputSchema, electronActiveObservationResultSchema, electronPageInspectionSchema, electronTargetListSchema, evidenceSchema, functionDossierSchema, harmonyApplicationProjectionInputSchema, harmonyApplicationProjectionResultSchema, init_androidApplication, init_appleApplication, init_artifactIntegrityPolicy, init_browserObservation, init_browserObservationSchemas, init_browserScenarioCapture, init_canonicalDigest, init_comparisonSemantics, init_digests, init_electronActiveObservation, init_electronObservation, init_evidence, init_harmonyApplication, init_hopperValues, init_javascriptSemanticAnalysis, init_localPath, init_nativeInstruction, init_processCaptureParsing, init_processScenario, init_providerSelection, init_reconstructionCoverage, init_reconstructionCoverageInput, init_reconstructionObligationLedgerSchemas, init_residualUnknown, init_unicodeCodePointOrder, init_webContentArtifact, init_webScreenshot, inspectElectronPageInputSchema, inspectWebPageInputSchema, listBrowserTargetsInputSchema, listElectronTargetsInputSchema, localPathStringSchema, nativeInstructionInputSchema, parseEvidence, parseProcessCapture, prefixedDigestSchema, processScenarioSchema, reconstructionClosureResultSchema, reconstructionCoverageEvaluationInputSchema, reconstructionObligationLedgerInputSchema, reconstructionObligationLedgerSchema, recordUnknownInputSchema, updateUnknownInputSchema, webPageInspectionSchema, webScreenshotDiffSchema, webScreenshotSchema } from "./reconstructionObligationLedgerSchemas-dvp6PEnZ.js";
+import { NATIVE_TOOL_CONTRACTS, adbInputSchemas, adbResultSchemas, addressContextInputSchema, analysisViewResultSchema, analyzeWebBundleInputSchema, androidInputSchemas, androidResultSchemas, apktoolInputSchemas, apktoolResultSchemas, binaryLayoutSchema, binaryLayoutSummaryViewResultSchema, browserCaptureComparisonInputSchema, browserCaptureComparisonSchema, browserScenarioInputSchema, discoverWebMcpToolsInputSchema, evmInterfaceSchema, exportWebScriptsInputSchema, firmwareInputSchemas, firmwareResultSchemas, getEvidenceBundleInputSchema, goBinarySchema, importEvidenceBundleInputSchema, init_adbDeviceAnalysis, init_analysisView, init_androidAnalysis, init_apktoolResourceAnalysis, init_binaryLayout, init_browserCaptureComparison, init_browserScenario, init_browserSession, init_evmInterface, init_firmwareAnalysis, init_goBinary, init_javascriptRecovery, init_jebAnalysis, init_nativeToolContracts, init_peResources, init_recordedCrash, init_sessionToolSchemas, init_wasmArtifact, init_webBundleAnalysis, init_webEventListeners, init_webExecution, init_webMcpDiscovery, init_webModuleTrace, init_webNetworkCapture, init_webScriptExport, init_webSourceLocation, inspectAnalysisViewInputSchema, inspectBinaryLayoutInputSchema, inspectEvmInterfaceInputSchema, inspectGoBinaryInputSchema, inspectPeResourcesInputSchema, inspectRecordedCrashInputSchema, inspectWasmArtifactInputSchema, inspectWebEventListenersInputSchema, inspectWebNetworkCaptureInputSchema, javascriptApplicationSummaryViewResultSchema, javascriptRecoveryInputSchema, javascriptRecoveryResultSchema, jebInputSchemas, jebResultSchemas, listUnknownsInputSchema, navigationContextInputSchema, observeWebExecutionInputSchema, observeWebSessionInputSchema, peResourcesSchema, processComparisonInputSchema, recordedCrashSchema, verifyUnknownResolutionInputSchema, wasmArtifactSchema, webBundleAnalysisSchema, webEventListenersSchema, webExecutionSchema, webMcpDiscoverySchema, webModuleTraceInputSchema, webModuleTraceResultSchema, webNetworkCaptureSchema, webObservationSessionSchema, webScriptExportResultSchema, webSourceLocationInputSchema, webSourceLocationResultSchema } from "./browserScenario-CTNr5ISp.js";
+import { appleAssetCatalogInputSchema, artifactComparisonInputSchema, artifactOutputSchemas, binaryArchitectureSchema, bundleComparisonInputSchema, callPathInputSchema, changedBehaviorInputSchema, compareProcessCaptures, dylibResolutionInputSchema, enhancedOutputSchemas, evidenceResultOf, functionComparisonInputSchema, functionComparisonResultSchema, init_appleAssetCatalog, init_artifactComparison, init_bundleComparison, init_callPathSchemas, init_changedBehavior, init_dylibResolution, init_functionComparisonSchemas, init_keyedArchive, init_managedReconstruction, init_nativeDataType, init_nativeFunctionAnnotations, init_processComparison, init_rawBinary, init_reconstructionVerificationSchemas, init_staticRuntimeCorrelation, init_toolEffects, init_toolOutputSchemaGroups, init_toolOutputSchemaPrimitives, keyedArchiveInputSchema, managedReconstructionImportInputSchema, managedWorkflowOutputSchemas, nativeDataTypeInputSchema, nativeFunctionAnnotationsInputSchema, officialOutputSchemas, rawBinaryEntryPointSchema, rawBinarySelectionError, reconstructionVerificationInputSchema, requireOutputSchema, sessionOutputSchemas, staticRuntimeCorrelationInputSchema, toolContractMetadata } from "./toolEffects-DW31yTSx.js";
+import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES, JavaScriptSemanticEvidenceContextRegistry, analyzeJavaScriptApplicationInputSchema, createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, init_javascriptApplicationAnalysis, init_javascriptRuntimeObservation, init_javascriptSemanticGraph, init_javascriptSemanticGraphSchemas, javascriptApplicationAnalysisResultSchema, javascriptRuntimeObservationSchema, javascriptRuntimeTargetListSchema, listJavaScriptRuntimeTargetsInputSchema, observeJavaScriptRuntimeInputSchema } from "./javascriptRuntimeObservation-9xTNoKY2.js";
+import { completeApplicationCoverage, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, init_javascriptApplicationEvidenceSchemas, init_javascriptApplicationGraph, partialApplicationCoverage } from "./javascriptApplicationGraph-DUWeec4O.js";
+import { MANAGED_TOOL_CONTRACTS, executableFormatHintSchema, init_dosCom, init_managedToolContracts } from "./managedToolContracts-BSy4TRaK.js";
+import { applicationFeatureTraceResultSchema, applicationVersionComparisonResultSchema, compareApplicationVersionsInputSchema, compareJavaScriptExportShapesInputSchema, compareSourceToBundleInputSchema, createHistoricalSourceGraph, init_javascriptApplicationVersionComparisonSchemas, init_javascriptExportShapeComparisonSchemas, init_javascriptFeatureTraceSchemas, init_referenceSourceGraph, init_sourceToBundleComparisonSchemas, javaScriptExportShapeComparisonResultSchema, sourceToBundleComparisonResultSchema, traceApplicationFeatureInputSchema } from "./javascriptExportShapeComparisonSchemas-BzSil7ft.js";
+import { init_javascriptSemanticQuerySchemas, init_javascriptSemanticTraceSchemas, javaScriptSemanticQueryInputSchema, javaScriptSemanticTraceResultSchema } from "./javascriptSemanticTraceSchemas-BHItrqIA.js";
+import { init_javascriptRuntimeReconciliationSchemas, javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema } from "./javascriptRuntimeReconciliationSchemas-D1Mrb_Y0.js";
+import { init_javascriptRuntimeReconciliation, parseRuntimeReconciliationInput, reconcileJavaScriptRuntime } from "./javascriptRuntimeReconciliation-CneBtMvx.js";
+import { init_javascriptExportReturnShapeProjection, projectJavaScriptExportReturnShapes } from "./javascriptExportReturnShapeProjection-BVbnAdOd.js";
+import { enhancedInputSchemas, init_enhancedInputs } from "./enhancedInputs-K8C_o3b4.js";
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { diffLines } from "diff";
+
+//#region dist/contracts/wasm/wasmToolContracts.js
+var WASM_TOOL_CONTRACTS;
+function init_wasmToolContracts() {
+	return (init_wasmToolContracts = __esmMin((() => {
+		init_wasmArtifact();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		WASM_TOOL_CONTRACTS = [{
+			name: "inspect_wasm_artifact",
+			...toolContractMetadata("inspect_wasm_artifact"),
+			kind: "artifact-provider",
+			description: "Validate an explicit local WASM artifact with caller-supplied WABT 1.0.42, retain exact byte SHA-256, sections, upstream import/export WAT forms and decoded WAT inline as Evidence. Optionally associate selected JavaScript glue literals with explicit local candidates while preserving ambiguous URL/basename matches. Configure absolute REA_WABT_BIN_DIRECTORY. No installation, implicit fetch, WASM execution or original-source claim.",
+			inputSchema: inspectWasmArtifactInputSchema,
+			outputSchema: evidenceResultOf(wasmArtifactSchema),
+			examples: [{
+				title: "Inspect a selected local WASM module",
+				input: {
+					path: "/artifacts/module.wasm",
+					glue_paths: [],
+					candidate_paths: []
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/evm/evmToolContracts.js
+var EVM_TOOL_CONTRACTS;
+function init_evmToolContracts() {
+	return (init_evmToolContracts = __esmMin((() => {
+		init_evmInterface();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		EVM_TOOL_CONTRACTS = [{
+			name: "inspect_evm_interface",
+			...toolContractMetadata("inspect_evm_interface"),
+			kind: "artifact-provider",
+			description: "Inspect an explicit local flat EVM bytecode carrier and infer dispatch selectors, argument strings and mutability without executing the target or accessing a chain/RPC endpoint. Choose raw or hex encoding explicitly. Returns original carrier and decoded-byte SHA-256, full bytecode and interface candidates inline as inferred Evidence; bytecode kind, hardfork, deployed authenticity and discovery completeness remain unknown. Initial real-verified Linux x64 profile uses unchanged bundled EVMole 0.9.3/WASM in a bounded owned worker; EOF-style EF00 containers are unsupported. No signature lookup, wallet action or transaction broadcast.",
+			inputSchema: inspectEvmInterfaceInputSchema,
+			outputSchema: evidenceResultOf(evmInterfaceSchema),
+			examples: [{
+				title: "Inspect a local runtime bytecode hex carrier",
+				input: {
+					path: "/artifacts/runtime.hex",
+					encoding: "hex"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/go/goToolContracts.js
+var GO_TOOL_CONTRACTS;
+function init_goToolContracts() {
+	return (init_goToolContracts = __esmMin((() => {
+		init_goBinary();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		GO_TOOL_CONTRACTS = [{
+			name: "inspect_go_binary",
+			...toolContractMetadata("inspect_go_binary"),
+			kind: "artifact-provider",
+			description: "Inspect embedded Go compiler version, main module, dependency/replacement versions and build settings in an explicit local ELF, PE or thin Mach-O image. Returns original artifact SHA-256, exact build-info source ranges, raw framed module bytes and unparsed module-text lines inline as observed Evidence. Supports inline and historical pointer encodings without installing Go, opening a disassembler, executing the target, writing temporary files or accessing the network. Missing metadata is reported as unknown, not proof that an image is not Go. Does not recover functions, source mappings, types or runtime behavior. Resource guards bound files to 256 MiB, aggregate embedded strings to 1 MiB, structural table decoding to 16 MiB and complete inline metadata to 8 MiB; malformed, unsupported and oversized inputs receive typed failures rather than partial success.",
+			inputSchema: inspectGoBinaryInputSchema,
+			outputSchema: evidenceResultOf(goBinarySchema),
+			examples: [{
+				title: "Inspect embedded build provenance",
+				input: { path: "/artifacts/application" }
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/analysisViewApiSurfaceExample.js
+var API_SURFACE_EXAMPLE;
+function init_analysisViewApiSurfaceExample() {
+	return (init_analysisViewApiSurfaceExample = __esmMin((() => {
+		API_SURFACE_EXAMPLE = {
+			input: {
+				source: {
+					kind: "retained-evidence",
+					evidence_id: "ev_9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097"
+				},
+				view: {
+					kind: "api-surface",
+					offset: 0,
+					limit: 50
+				}
+			},
+			output: {
+				parent_evidence_id: "ev_9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097",
+				parent_operation: "inspect_web_network_capture",
+				parent_digest: "9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097",
+				view_digest: "47c1859b7a86dd10770061767300bdb6ec177a9254e8dc7863d5ea8603343da6",
+				artifact: {
+					path: "/fixtures/api-surface.har",
+					sha256: "bf58e2c06e55bfe7e0628157c4ad027ce0aeb81a10e8edef8a7f95b8e5f14225"
+				},
+				coverage: {
+					status: "page",
+					examined: 1,
+					total: 1,
+					next_offset: null,
+					exhausted: true
+				},
+				limitations: ["Grouping does not establish handler identity, URL-space schemas or causality.", "HAR text is producer-decoded Unicode. Original body bytes remain unknown unless content explicitly uses valid base64; declared sizes are preserved independently of retained bytes. mitmproxy 12.2.3 SaveHar may report null optional postData.text; that null is retained and omitted only from the upstream validation copy."],
+				unknowns: [],
+				records: {
+					examined: 2,
+					total: 2,
+					excluded: 0
+				},
+				templated_groups: 1,
+				groups: [{
+					method: "GET",
+					origin: "https://api.example.test",
+					path_template: "/users/{numeric}",
+					templated_segments: [{
+						segment_index: 1,
+						rule: "numeric",
+						basis: "inferred",
+						observed_values: ["8812", "9031"]
+					}],
+					record_ordinals: [0, 1],
+					statuses: [200, 404],
+					content_types: ["application/json", "text/plain"],
+					flags: ["mixed-statuses", "mixed-content-types"]
+				}],
+				excluded_records: [],
+				kind: "api-surface",
+				view: {
+					kind: "api-surface",
+					offset: 0,
+					limit: 50
+				}
+			}
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/analysisViewToolContracts.js
+var RETAINED_EXAMPLE_ID, ANALYSIS_VIEW_TOOL_CONTRACTS;
+function init_analysisViewToolContracts() {
+	return (init_analysisViewToolContracts = __esmMin((() => {
+		init_analysisViewApiSurfaceExample();
+		init_analysisView();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		RETAINED_EXAMPLE_ID = `ev_${"a".repeat(64)}`;
+		ANALYSIS_VIEW_TOOL_CONTRACTS = [{
+			name: "inspect_analysis_view",
+			...toolContractMetadata("inspect_analysis_view"),
+			kind: "application",
+			description: "Inspect selected views of completed binary-layout, JavaScript application or native analyze_function Evidence without repeating analysis. The api-surface view groups retained HAR requests by method, origin and format-rule path template; templated segments are inferences. It reads no headers or bodies and reports no query values. Use an exact same-session retained evidence_id or portable inline Evidence. Select a summary, layout mitigations/linkage facet, one section/symbol/module, or a stable page. Module pages include assets, bundled and source modules; use node_id for ambiguous or unavailable paths. Native views select procedure, pseudocode, assembly, basic blocks, comments, callers/callees, references, unresolved calls, referenced strings/names, native API and high-pcode. Use nonnegative offset and a positive caller-selected limit (defaults 0 and 64); pseudocode uses UTF-16 code units, other native pages use rows. Returns artifact identity, parent Evidence ID, a distinct view digest, coverage, limitations and unknowns. Actual serialized size determines MCP transport admission; choose a smaller page or export the complete retained Evidence if needed.",
+			inputSchema: inspectAnalysisViewInputSchema,
+			outputSchema: evidenceResultOf(analysisViewResultSchema),
+			examples: [
+				{
+					title: "Group requests from retained HAR Evidence",
+					input: API_SURFACE_EXAMPLE.input
+				},
+				{
+					title: "Summarize retained JavaScript application Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: { kind: "summary" }
+					}
+				},
+				{
+					title: "Read one ELF section from retained layout Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: {
+							kind: "item",
+							collection: "sections",
+							selector: { name: ".text" }
+						}
+					}
+				},
+				{
+					title: "Page native high-pcode operations from retained Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: {
+							kind: "native",
+							facet: "value_flow_operations",
+							offset: 0,
+							limit: 32
+						}
+					}
+				},
+				{
+					title: "Page module identities from retained application Evidence",
+					input: {
+						source: {
+							kind: "retained-evidence",
+							evidence_id: RETAINED_EXAMPLE_ID
+						},
+						view: {
+							kind: "page",
+							collection: "modules",
+							offset: 0,
+							limit: 32
+						}
+					}
+				}
+			]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/analysisDetail.js
+var analysisDetailSchema, analysisDetailOutputSchemaOf;
+function init_analysisDetail() {
+	return (init_analysisDetail = __esmMin((() => {
+		init_toolOutputSchemaPrimitives();
+		analysisDetailSchema = z.enum(["complete", "summary"]).default("complete").describe("complete returns the complete analysis Evidence inline. summary retains that complete Evidence in this session and returns its inspect_analysis_view summary; inspect pages, items or facets through normalized_result.parent_evidence_id.");
+		analysisDetailOutputSchemaOf = (analysis, summary) => evidenceResultOf(z.union([analysis, summary]));
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/native/binaryDiagnosticsToolContracts.js
+var inspectBinaryLayoutRequestSchema, BINARY_DIAGNOSTICS_TOOL_CONTRACTS;
+function init_binaryDiagnosticsToolContracts() {
+	return (init_binaryDiagnosticsToolContracts = __esmMin((() => {
+		init_recordedCrash();
+		init_binaryLayout();
+		init_analysisView();
+		init_analysisDetail();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_peResources();
+		inspectBinaryLayoutRequestSchema = inspectBinaryLayoutInputSchema.extend({ detail: analysisDetailSchema });
+		BINARY_DIAGNOSTICS_TOOL_CONTRACTS = [
+			{
+				name: "inspect_pe_resources",
+				...toolContractMetadata("inspect_pe_resources"),
+				kind: "native-provider",
+				description: "Inspect one explicit local PE32/PE32+ image's complete bounded type/name/language resource tree without executing it or opening a disassembler. Returns numeric IDs versus original UTF-16 names, directory/data-entry file locations, payload RVA/file ranges, complete SHA-256 hashes and static RT_GROUP_ICON image-resource candidates. Language fallback, image decoding and actual shell/window loading remain unobserved. Reads a stable regular file; malformed or ambiguous mappings, non-identical overlapping ranges and exhausted budgets return no partial success. Portable on supported Node hosts; no Windows SDK or engine installation required.",
+				inputSchema: inspectPeResourcesInputSchema,
+				outputSchema: evidenceResultOf(peResourcesSchema),
+				examples: [{
+					title: "Inspect PE resource identities and icon relationships",
+					input: { path: "/artifacts/application.exe" }
+				}]
+			},
+			{
+				name: "inspect_binary_layout",
+				...toolContractMetadata("inspect_binary_layout"),
+				kind: "native-provider",
+				description: "Inspect an explicit local binary without launching it as a host process. Returns file-backed section/segment ranges, linked addresses, original symbol/REL/RELA table identities, complete encoded RELR tables and upstream-derived offsets with unknown per-word locations/addends, raw name bytes, dependency/interpreter names and static mitigation inferences inline with artifact SHA-256 Evidence. Initial profile: ELF64 x86-64 little-endian EXEC/DYN/REL on Linux x64 via caller-supplied Python with unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Runtime addresses/library paths, overall relocation inventory completeness and complete derived GOT/PLT coverage remain unknown. Zero executable entry values mean absence; relocatable entries are not applicable. Upstream can emulate PLT instructions with Unicorn for derived static maps. Uses bounded complete output and owned temporary files/processes; malformed, unsupported or oversized objects return no partial success. Select detail summary to retain the complete layout Evidence in this session and receive only its summary view, then inspect sections, symbols, mitigations or linkage with inspect_analysis_view.",
+				inputSchema: inspectBinaryLayoutRequestSchema,
+				outputSchema: analysisDetailOutputSchemaOf(binaryLayoutSchema, binaryLayoutSummaryViewResultSchema),
+				examples: [{
+					title: "Inspect ELF linked and file layout",
+					input: { path: "/artifacts/application.elf" }
+				}, {
+					title: "Retain the complete layout and return its summary view",
+					input: {
+						path: "/artifacts/application.elf",
+						detail: "summary"
+					}
+				}]
+			},
+			{
+				name: "inspect_recorded_crash",
+				...toolContractMetadata("inspect_recorded_crash"),
+				kind: "native-provider",
+				description: "Inspect a supplied Linux ELF64 amd64 little-endian core without launching its target or attaching to any live PID. Returns all recorded segments, raw note owners/descriptors and source ranges, every Linux CORE PRSTATUS thread/register and SIGINFO fields inline with SHA-256 Evidence. Historical PID is recorded metadata; current process/file identity, note coverage and signal-thread associations stay unknown. Optionally add derived core-only GDB/pwndbg mapping candidates through explicit BYO configuration; zero map flags mean unknown permissions. Uses the same stable snapshot for both stages, bounded complete output and owned cleanup. Initial Linux x64 profile: unchanged pwntools 4.15.0/pyelftools 0.33/Unicorn 2.1.2; optional unchanged pwndbg 2026.09.15. No implicit executable/library pairing, GDB command language, host configuration changes or dependency installation.",
+				inputSchema: inspectRecordedCrashInputSchema,
+				outputSchema: evidenceResultOf(recordedCrashSchema),
+				examples: [{
+					title: "Inspect recorded registers and signal evidence",
+					input: { path: "/artifacts/crash.core" }
+				}, {
+					title: "Add core-only debugger mapping candidates",
+					input: {
+						path: "/artifacts/crash.core",
+						include_debugger_context: true
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/artifactToolContracts.js
+var artifactInventoryInputSchema, artifactExtractionInputSchema, artifactExtractionExecutionSchema, exampleInputSchema$1, examples, artifact, ARTIFACT_TOOL_CONTRACTS, ARTIFACT_ANALYSIS_OPERATIONS;
+function init_artifactToolContracts() {
+	return (init_artifactToolContracts = __esmMin((() => {
+		init_toolOutputSchemaGroups();
+		init_artifactIntegrityPolicy();
+		init_jsonValue();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_appleAssetCatalog();
+		init_dylibResolution();
+		init_keyedArchive();
+		artifactInventoryInputSchema = z.strictObject({ integrity_policy: artifactIntegrityPolicySchema });
+		artifactExtractionInputSchema = z.strictObject({ integrity_policy: artifactIntegrityPolicySchema });
+		artifactExtractionExecutionSchema = artifactExtractionInputSchema.extend({ output_root: z.string().min(1) });
+		exampleInputSchema$1 = z.record(z.string(), jsonValueSchema);
+		examples = {
+			inspect_artifact: {},
+			extract_artifact: {},
+			decode_interface_builder: {},
+			inspect_asset_catalog: {
+				offset: 0,
+				limit: 1e3
+			},
+			inspect_keyed_archive: { path: "Contents/Resources/Model.plist" },
+			trace_dylib_resolution: {
+				roots: ["Contents/MacOS/App"],
+				architecture: "arm64"
+			}
+		};
+		artifact = (name, description, inputSchema) => {
+			const outputSchema = requireOutputSchema(artifactOutputSchemas, name);
+			return {
+				name,
+				...toolContractMetadata(name),
+				description,
+				kind: "artifact-provider",
+				inputSchema,
+				outputSchema,
+				examples: [{
+					title: `Example ${name.replaceAll("_", " ")} request`,
+					input: exampleInputSchema$1.parse(examples[name] ?? {})
+				}]
+			};
+		};
+		ARTIFACT_TOOL_CONTRACTS = [
+			artifact("inspect_artifact", "Inspect an active archive or application package in one call. Returns the complete content-addressed artifact graph once, as the nested inventory Evidence, with root and integrity observations, integrity contradictions, hypotheses, unexplored branches, limitations, and next probes inline. Read-only DMG mounting is used automatically on supported macOS hosts. Integrity mismatches fail by default; record-and-continue keeps mismatches explicitly untrusted. It does not extract files; use extract_artifact to materialize its regular contents.", artifactInventoryInputSchema),
+			artifact("extract_artifact", "Extract all regular files from the active archive or application package into a fresh temporary directory chosen by REA. The result includes its location. Rejects traversal and symlink escapes, never overwrites, and verifies cleanup. Integrity mismatches fail by default; record-and-continue extracts the observed bytes and returns each mismatch as an explicitly untrusted integrity contradiction.", artifactExtractionInputSchema),
+			artifact("decode_interface_builder", "Decode compiled storyboard and nib archives inside the active Apple app bundle, including keyed property lists and NIBArchive object tables, into a bounded object, hierarchy, and connection graph. This is static archive parsing; unrecognized archive classes and unresolved code handlers remain explicit unknowns.", z.strictObject({
+				max_documents: z.number().int().min(1).max(64).default(64),
+				max_objects: z.number().int().min(1).max(2e4).default(2e4),
+				max_connections: z.number().int().min(1).max(4e4).default(4e4)
+			})),
+			artifact("inspect_keyed_archive", "Inspect one Foundation NSKeyedArchiver plist in the active app bundle as original object-table nodes, class descriptors, named roots, and UID edges. Preserves shared and cyclic references without instantiating classes. The path is relative to the bundle; root selection and object pagination preserve original identities.", keyedArchiveInputSchema),
+			artifact("inspect_asset_catalog", "Inspect compiled Assets.car metadata in an active Apple app bundle. Returns stable paginated catalog and rendition records with raw assetutil metadata and catalog digests; rendition bytes are not extracted.", appleAssetCatalogInputSchema),
+			artifact("trace_dylib_resolution", "Trace how dyld would resolve each Mach-O dylib load for the active Mach-O, or for every executable in the active .app bundle (the main app, XPC services, extensions, login items, helpers). Expands @executable_path, @loader_path, and @rpath through each process's LC_RPATH stack in dependents-first load order, and reports every candidate path with its outcome, the resolved image and digest, weak, re-export, and upward flags, and derived findings such as unresolved required loads or absent earlier @rpath candidates. Pure header parsing: nothing is executed, and absolute or system paths outside the analyzed root stay undetermined. Select roots or one architecture to narrow large bundles.", dylibResolutionInputSchema)
+		];
+		ARTIFACT_ANALYSIS_OPERATIONS = ["inventory_artifact", ...ARTIFACT_TOOL_CONTRACTS.map(({ name }) => name)];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/firmware/firmwareToolContracts.js
+var FIRMWARE_TOOL_CONTRACTS;
+function init_firmwareToolContracts() {
+	return (init_firmwareToolContracts = __esmMin((() => {
+		init_firmwareAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		FIRMWARE_TOOL_CONTRACTS = [{
+			name: "inspect_firmware_regions",
+			...toolContractMetadata("inspect_firmware_regions"),
+			kind: "firmware-provider",
+			description: "Inspect signature candidates in a local firmware file with Binwalk 3.1.x (verified with 3.1.0). Returns offsets, reported lengths, descriptions and raw confidence values. Length validation and runtime addresses remain unknown. No extraction or target execution. Linux, caller-supplied tool and util-linux prlimit required; 128 MiB input limit, one worker and 120-second deadline.",
+			inputSchema: firmwareInputSchemas.inspect_firmware_regions,
+			outputSchema: evidenceResultOf(firmwareResultSchemas.inspect_firmware_regions),
+			examples: [{
+				title: "Inspect firmware regions",
+				input: { path: "/tmp/firmware.bin" }
+			}]
+		}, {
+			name: "extract_firmware",
+			...toolContractMetadata("extract_firmware"),
+			kind: "firmware-provider",
+			description: "Extract caller-selected firmware bytes with Unblob 26.6.x (verified with 26.6.4) into an absent output directory. Returns verified child paths/digests, task derivations, unknown chunks and extraction diagnostics inline. Preserves the default sandbox; publishes regular files only. Linux, caller-supplied tool, format-specific extractors and util-linux prlimit required. No mounts or extracted-code execution. Select a returned native file with open_binary for Ghidra analysis; decompressed offsets are not original-file addresses.",
+			inputSchema: firmwareInputSchemas.extract_firmware,
+			outputSchema: evidenceResultOf(firmwareResultSchemas.extract_firmware),
+			examples: [{
+				title: "Extract selected firmware",
+				input: {
+					path: "/tmp/firmware.bin",
+					output_directory: "/tmp/firmware-output",
+					range: {
+						offset: 64,
+						length: 4096
+					}
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/android/androidToolContracts.js
+var ANDROID_TOOL_CONTRACTS;
+function init_androidToolContracts() {
+	return (init_androidToolContracts = __esmMin((() => {
+		init_androidAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		ANDROID_TOOL_CONTRACTS = [
+			{
+				name: "inspect_android_package",
+				...toolContractMetadata("inspect_android_package"),
+				description: "Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and JDK; uses one worker in an isolated temporary workspace.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.inspect_android_package,
+				outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_package),
+				examples: [{
+					title: "Inspect an APK",
+					input: { path: "/tmp/Example.apk" }
+				}]
+			},
+			{
+				name: "search_android_classes",
+				...toolContractMetadata("search_android_classes"),
+				description: "Search complete decompiler class-name rows in an explicit local APK by case-sensitive substring. Empty query inventories all rows. Repeated names remain repeated and appear in duplicate_names; the provider accepts only class names for lookup, so these rows do not identify which same-name class node a later lookup selects. Retains artifact and engine identity; no APK execution.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.search_android_classes,
+				outputSchema: evidenceResultOf(androidResultSchemas.search_android_classes),
+				examples: [{
+					title: "Find activity classes",
+					input: {
+						path: "/tmp/Example.apk",
+						query: "Activity"
+					}
+				}]
+			},
+			{
+				name: "inspect_android_class",
+				...toolContractMetadata("inspect_android_class"),
+				description: "Inspect one exact Android class's parsed methods, fields and inner classes, including synthetic members. Returns display signatures and explicit unknown DEX descriptors without generating source. Overload indices remain consistent within the artifact and engine session.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.inspect_android_class,
+				outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_class),
+				examples: [{
+					title: "Inspect a class",
+					input: {
+						path: "/tmp/Example.apk",
+						class_name: "example.MainActivity"
+					}
+				}]
+			},
+			{
+				name: "inspect_android_method",
+				...toolContractMetadata("inspect_android_method"),
+				description: "Decompile one Android method with smali fallback. Requires explicit overload_index when multiple methods share a name. Reports representation, fallback markers and source truncation; never treats display signatures as exact DEX identities.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.inspect_android_method,
+				outputSchema: evidenceResultOf(androidResultSchemas.inspect_android_method),
+				examples: [{
+					title: "Decompile a method",
+					input: {
+						path: "/tmp/Example.apk",
+						class_name: "example.MainActivity",
+						method_name: "onCreate"
+					}
+				}]
+			},
+			{
+				name: "trace_android_references",
+				...toolContractMetadata("trace_android_references"),
+				description: "Trace incoming static references to an exact Android class or unique method. Overloaded method reference queries are explicitly unsupported by the current engine. Source lines and DEX offsets remain unknown; no runtime calls are inferred.",
+				kind: "android-provider",
+				inputSchema: androidInputSchemas.trace_android_references,
+				outputSchema: evidenceResultOf(androidResultSchemas.trace_android_references),
+				examples: [{
+					title: "Find references to a class",
+					input: {
+						path: "/tmp/Example.apk",
+						class_name: "example.MainActivity"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/apktool/apktoolToolContracts.js
+var APKTOOL_TOOL_CONTRACTS;
+function init_apktoolToolContracts() {
+	return (init_apktoolToolContracts = __esmMin((() => {
+		init_apktoolResourceAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		APKTOOL_TOOL_CONTRACTS = [{
+			name: "inspect_apktool_client",
+			...toolContractMetadata("inspect_apktool_client"),
+			description: "Inspect the caller-selected apktool launcher: resolved command, selection source, and version. Decodes nothing. REA never installs Apktool or Java; select a launcher with REA_APKTOOL_COMMAND (absolute) or apktool on PATH.",
+			kind: "apktool-provider",
+			inputSchema: apktoolInputSchemas.inspect_apktool_client,
+			outputSchema: evidenceResultOf(apktoolResultSchemas.inspect_apktool_client),
+			examples: [{
+				title: "Check the Apktool launcher",
+				input: {}
+			}]
+		}, {
+			name: "decode_android_resources",
+			...toolContractMetadata("decode_android_resources"),
+			description: "Decode one local APK's resources with `apktool d --no-src` in a provider-owned workspace that is removed after projection: the readable AndroidManifest.xml, apktool.yml version and SDK facts, the app's string resources (default or one locale, bounded to 2000 entries), available string locales, and the decoded file count. The target APK is digest with SHA-256 before decoding; smali is skipped because Java-source recovery belongs to the JADX family.",
+			kind: "apktool-provider",
+			inputSchema: apktoolInputSchemas.decode_android_resources,
+			outputSchema: evidenceResultOf(apktoolResultSchemas.decode_android_resources),
+			examples: [{
+				title: "Decode an APK's resources",
+				input: { path: "/targets/Example.apk" }
+			}, {
+				title: "Decode one locale's strings",
+				input: {
+					path: "/targets/Example.apk",
+					locale: "de"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/jeb/jebToolContracts.js
+var JEB_TOOL_CONTRACTS;
+function init_jebToolContracts() {
+	return (init_jebToolContracts = __esmMin((() => {
+		init_jebAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		JEB_TOOL_CONTRACTS = [
+			{
+				name: "inspect_jeb_client",
+				...toolContractMetadata("inspect_jeb_client"),
+				description: "Inspect the running JEB client serving MCP: engine version, GUI or headless mode, and startup time. Does not open a target. Requires a caller-started JEB client reachable at REA_JEB_MCP_URL (default http://127.0.0.1:8425/mcp); REA never installs or launches JEB.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.inspect_jeb_client,
+				outputSchema: evidenceResultOf(jebResultSchemas.inspect_jeb_client),
+				examples: [{
+					title: "Check the engine",
+					input: {}
+				}]
+			},
+			{
+				name: "open_jeb_project",
+				...toolContractMetadata("open_jeb_project"),
+				description: "Open or create a JEB project from an artifact file or existing .jdb2 database on the engine host. Returns the project's input-file digests and top-level units. The engine analyzes the target itself; REA does not read the file or execute it. Fails when a project is already open.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.open_jeb_project,
+				outputSchema: evidenceResultOf(jebResultSchemas.open_jeb_project),
+				examples: [{
+					title: "Open a target for analysis",
+					input: { path: "/tmp/Example.apk" }
+				}]
+			},
+			{
+				name: "list_jeb_units",
+				...toolContractMetadata("list_jeb_units"),
+				description: "List project units by stable unit path and type, with optional wildcard filter, parent restriction, and pagination. The engine caps pages at 100 units; a full page reports partial coverage because more units may exist. Read-only.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.list_jeb_units,
+				outputSchema: evidenceResultOf(jebResultSchemas.list_jeb_units),
+				examples: [{
+					title: "List units",
+					input: {}
+				}, {
+					title: "Find DEX units",
+					input: { filter: "*.dex" }
+				}]
+			},
+			{
+				name: "decompile_jeb_item",
+				...toolContractMetadata("decompile_jeb_item"),
+				description: "Decompile one type or method to engine pseudo-code using its decompiler (Dalvik, Java, or native). item_address comes from the engine's code item listing; unit_path defaults to the engine's first code unit and stays unknown when omitted. Read-only with respect to the target file.",
+				kind: "jeb-provider",
+				inputSchema: jebInputSchemas.decompile_jeb_item,
+				outputSchema: evidenceResultOf(jebResultSchemas.decompile_jeb_item),
+				examples: [{
+					title: "Decompile a method",
+					input: {
+						item_address: "Lcom/example/Main;->onCreate()V",
+						item_kind: "method"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/adb/adbToolContracts.js
+var ADB_TOOL_CONTRACTS;
+function init_adbToolContracts() {
+	return (init_adbToolContracts = __esmMin((() => {
+		init_adbDeviceAnalysis();
+		init_toolOutputSchemaPrimitives();
+		init_toolEffects();
+		ADB_TOOL_CONTRACTS = [
+			{
+				name: "inspect_adb_client",
+				...toolContractMetadata("inspect_adb_client"),
+				description: "Inspect the caller-selected adb client: resolved binary, version, and install path. Never contacts devices and never starts the adb server. REA never installs platform tools; select a binary with REA_ADB_PATH (absolute) or adb on PATH.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_client,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_client),
+				examples: [{
+					title: "Check the adb client",
+					input: {}
+				}]
+			},
+			{
+				name: "list_adb_devices",
+				...toolContractMetadata("list_adb_devices"),
+				description: "List attached devices exactly as `adb devices -l` reports them: serial, state, transport, model metadata, and an inferred emulator/physical kind with its evidence basis. Emulators and USB or network devices appear alike; REA neither starts nor manages them. May start the local adb server on first use.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_devices,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_devices),
+				examples: [{
+					title: "List attached devices",
+					input: {}
+				}]
+			},
+			{
+				name: "inspect_adb_device",
+				...toolContractMetadata("inspect_adb_device"),
+				description: "Inspect one device's build identity through a fixed `getprop` whitelist: Android and SDK versions, security patch, fingerprint, product identity, CPU ABIs, and debuggable flag, plus the observed emulator indicator ro.kernel.qemu. Read-only with respect to the device.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_device,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_device),
+				examples: [{
+					title: "Inspect one device",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "list_adb_packages",
+				...toolContractMetadata("list_adb_packages"),
+				description: "List installed packages on one device with each base APK's device path, optionally scoped to third-party or system packages. Paths are device filesystem paths, not host-local. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_packages,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_packages),
+				examples: [{
+					title: "List third-party packages",
+					input: {
+						serial: "emulator-5554",
+						scope: "third_party"
+					}
+				}]
+			},
+			{
+				name: "pull_adb_package",
+				...toolContractMetadata("pull_adb_package"),
+				description: "Pull one installed package's complete APK set (base plus every split, as `pm path` reports) from the device into a caller-selected output directory, creating a package-named subdirectory that must not already exist. Every pulled file is digested with SHA-256; partial pulls keep successful artifacts and per-file failure reasons. The device keeps the originals.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.pull_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.pull_adb_package),
+				examples: [{
+					title: "Pull a package APK set",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app",
+						output_directory: "/tmp/rea-pulls"
+					}
+				}]
+			},
+			{
+				name: "read_adb_logcat",
+				...toolContractMetadata("read_adb_logcat"),
+				description: "Read a bounded dump of the device log (`logcat -d -t`) for one buffer, optionally restricted to a process id. No streaming, no clearing; the newest lines are kept when the count cap trims. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.read_adb_logcat,
+				outputSchema: evidenceResultOf(adbResultSchemas.read_adb_logcat),
+				examples: [{
+					title: "Read the last 200 main-buffer lines",
+					input: {
+						serial: "emulator-5554",
+						count: 200,
+						buffer: "main"
+					}
+				}]
+			},
+			{
+				name: "inspect_adb_package",
+				...toolContractMetadata("inspect_adb_package"),
+				description: "Inspect one installed package through `dumpsys package`: version name/code, install and update times, installer, user id, flags, and the requested-permission count. A fixed projection of version-dependent output; unknown sections are ignored rather than guessed. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_package),
+				examples: [{
+					title: "Inspect an installed package",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			},
+			{
+				name: "pull_adb_file",
+				...toolContractMetadata("pull_adb_file"),
+				description: "Pull one absolute device path (a database, shared-preferences XML, or any readable file) into a caller-selected output directory, digesting it with SHA-256. The local copy must not already exist. Read-only with respect to the device.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.pull_adb_file,
+				outputSchema: evidenceResultOf(adbResultSchemas.pull_adb_file),
+				examples: [{
+					title: "Pull an app database",
+					input: {
+						serial: "emulator-5554",
+						device_path: "/data/data/com.example.app/databases/app.db",
+						output_directory: "/tmp/rea-pulls"
+					}
+				}]
+			},
+			{
+				name: "push_adb_file",
+				...toolContractMetadata("push_adb_file"),
+				description: "Push one local file to an absolute device path. The only device-mutating ADB tool: existing device files are refused unless overwrite is explicitly requested, and the transfer is verified by comparing the local digest with the device's own sha256sum when the device provides one.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.push_adb_file,
+				outputSchema: evidenceResultOf(adbResultSchemas.push_adb_file),
+				examples: [{
+					title: "Push a script to tmp",
+					input: {
+						serial: "emulator-5554",
+						local_path: "/tmp/frida-server",
+						device_path: "/data/local/tmp/frida-server"
+					}
+				}]
+			},
+			{
+				name: "capture_adb_screen",
+				...toolContractMetadata("capture_adb_screen"),
+				description: "Capture one frame of the device screen as a PNG (`screencap -p` through exec-out, no device-side file) into a caller-selected output directory, digesting it and reporting its dimensions. No recording or interaction.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.capture_adb_screen,
+				outputSchema: evidenceResultOf(adbResultSchemas.capture_adb_screen),
+				examples: [{
+					title: "Capture the current screen",
+					input: {
+						serial: "emulator-5554",
+						output_directory: "/tmp/rea-captures"
+					}
+				}]
+			},
+			{
+				name: "list_adb_processes",
+				...toolContractMetadata("list_adb_processes"),
+				description: "List running processes exactly as `ps -A` reports them: user, pid, ppid, rss, state, and name. Useful for pairing with instrumentation lanes. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_processes,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_processes),
+				examples: [{
+					title: "List processes",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "list_adb_directory",
+				...toolContractMetadata("list_adb_directory"),
+				description: "List the immediate children of one absolute device directory, including hidden entries: names, kinds, permissions, owner, group, sizes, dates, and symlink targets. Names and targets preserve embedded newlines. Recognizes the standard errors for absent paths and denied reads. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_directory,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_directory),
+				examples: [{
+					title: "List an app's data directory",
+					input: {
+						serial: "emulator-5554",
+						device_path: "/data/data/com.example.app"
+					}
+				}]
+			},
+			{
+				name: "list_adb_features",
+				...toolContractMetadata("list_adb_features"),
+				description: "List the device's declared hardware and software features (`pm list features`) for device fingerprinting. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_features,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_features),
+				examples: [{
+					title: "List features",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "list_adb_services",
+				...toolContractMetadata("list_adb_services"),
+				description: "List the device's binder services with their interfaces (`service list`). Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.list_adb_services,
+				outputSchema: evidenceResultOf(adbResultSchemas.list_adb_services),
+				examples: [{
+					title: "List services",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "inspect_adb_display",
+				...toolContractMetadata("inspect_adb_display"),
+				description: "Report the display's physical and any overridden size (`wm size`) and density (`wm density`) as the device declares them. Read-only; setting values is not exposed.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_display,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_display),
+				examples: [{
+					title: "Inspect the display",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "inspect_adb_window",
+				...toolContractMetadata("inspect_adb_window"),
+				description: "Report the window manager's current focus declarations (`dumpsys window windows`: mCurrentFocus and mFocusedApp) — what is on screen at read time without any interaction. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.inspect_adb_window,
+				outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_window),
+				examples: [{
+					title: "Inspect window focus",
+					input: { serial: "emulator-5554" }
+				}]
+			},
+			{
+				name: "read_adb_setting",
+				...toolContractMetadata("read_adb_setting"),
+				description: "Read one settings value (`settings get`) from the system, secure, or global namespace. Absent keys report the device's own null observation. Read-only; writing settings is not exposed.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.read_adb_setting,
+				outputSchema: evidenceResultOf(adbResultSchemas.read_adb_setting),
+				examples: [{
+					title: "Read the ADB-enabled setting",
+					input: {
+						serial: "emulator-5554",
+						namespace: "secure",
+						key: "adb_enabled"
+					}
+				}]
+			},
+			{
+				name: "collect_adb_bugreport",
+				...toolContractMetadata("collect_adb_bugreport"),
+				description: "Collect one device-generated bugreport archive (`adb bugreport`) into a caller-selected output directory, digesting the zip. The archive contains the device's own dumpstate, dumpsys, and logcat report; collection can take minutes. Read-only with respect to configuration.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.collect_adb_bugreport,
+				outputSchema: evidenceResultOf(adbResultSchemas.collect_adb_bugreport),
+				examples: [{
+					title: "Collect a bugreport",
+					input: {
+						serial: "emulator-5554",
+						output_directory: "/tmp/rea-bugreports"
+					}
+				}]
+			},
+			{
+				name: "resolve_adb_packages",
+				...toolContractMetadata("resolve_adb_packages"),
+				description: "Find installed packages by case-insensitive substring of the package name (e.g. `whatsapp` → `com.whatsapp`), returning each match's base APK device path. The first step of an easy get: resolve, then pull_adb_package the exact name. Read-only.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.resolve_adb_packages,
+				outputSchema: evidenceResultOf(adbResultSchemas.resolve_adb_packages),
+				examples: [{
+					title: "Find a package by partial name",
+					input: {
+						serial: "emulator-5554",
+						query: "whatsapp"
+					}
+				}]
+			},
+			{
+				name: "install_adb_package",
+				...toolContractMetadata("install_adb_package"),
+				description: "Install one local APK on the device (`adb install [-r]`), recording the APK's host digest and byte size. A device-mutating tool: `replace` re-installs over an existing package while keeping its data; the device's own Success/Failure verdict is preserved with its reason.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.install_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.install_adb_package),
+				examples: [{
+					title: "Install an APK",
+					input: {
+						serial: "emulator-5554",
+						apk_path: "/tmp/app.apk"
+					}
+				}, {
+					title: "Replace an existing install keeping data",
+					input: {
+						serial: "emulator-5554",
+						apk_path: "/tmp/app.apk",
+						replace: true
+					}
+				}]
+			},
+			{
+				name: "uninstall_adb_package",
+				...toolContractMetadata("uninstall_adb_package"),
+				description: "Uninstall one package from the device (`adb uninstall`), removing its data for user 0. A device-mutating tool; absent packages report the device's own refusal reason.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.uninstall_adb_package,
+				outputSchema: evidenceResultOf(adbResultSchemas.uninstall_adb_package),
+				examples: [{
+					title: "Uninstall a package",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			},
+			{
+				name: "start_adb_app",
+				...toolContractMetadata("start_adb_app"),
+				description: "Start one installed app by launching its declared launcher activity: the component is resolved through `cmd package resolve-activity --brief`, then started with `am start -n`. A device-mutating tool for dynamic-analysis workflows; pair with `read_adb_logcat` (pid filter) and `list_adb_processes` to observe the started app, and `stop_adb_app` to end the run.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.start_adb_app,
+				outputSchema: evidenceResultOf(adbResultSchemas.start_adb_app),
+				examples: [{
+					title: "Start an app",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			},
+			{
+				name: "start_adb_activity",
+				...toolContractMetadata("start_adb_activity"),
+				description: "Start an intent with `am start`: one action, optional data URI, optional explicit component, and up to 16 typed extras (string, boolean, int, long, float). A device-mutating tool; the activity manager's Starting/Error verdict is preserved verbatim.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.start_adb_activity,
+				outputSchema: evidenceResultOf(adbResultSchemas.start_adb_activity),
+				examples: [{
+					title: "Open a deep link",
+					input: {
+						serial: "emulator-5554",
+						action: "android.intent.action.VIEW",
+						data_uri: "https://example.com/path"
+					}
+				}, {
+					title: "Start with typed extras",
+					input: {
+						serial: "emulator-5554",
+						action: "com.example.APP_ACTION",
+						extras: [{
+							key: "level",
+							type: "int",
+							value: "3"
+						}]
+					}
+				}]
+			},
+			{
+				name: "stop_adb_app",
+				...toolContractMetadata("stop_adb_app"),
+				description: "Force-stop every process of one package (`am force-stop`), ending a dynamic-analysis run. A device-mutating tool; it succeeds whether or not the package had running processes.",
+				kind: "adb-provider",
+				inputSchema: adbInputSchemas.stop_adb_app,
+				outputSchema: evidenceResultOf(adbResultSchemas.stop_adb_app),
+				examples: [{
+					title: "Stop an app",
+					input: {
+						serial: "emulator-5554",
+						package: "com.example.app"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/managed/managedWorkflowExamples.js
+var MANAGED_STATIC_EXAMPLE_PROVIDER, NATIVE_EXAMPLE_PROVIDER, emptyManagedMembers, evidence, runtimeMembers, MANAGED_MEMBER_COMPARISON_EXAMPLE, runtimeExampleEvidence, MANAGED_APPLICATION_GRAPH_EXAMPLE, boundaryEvidence, nativeExportEvidence, coverage, MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE, MANAGED_NATIVE_VERIFICATION_EXAMPLE;
+function init_managedWorkflowExamples() {
+	return (init_managedWorkflowExamples = __esmMin((() => {
+		init_evidence();
+		MANAGED_STATIC_EXAMPLE_PROVIDER = {
+			id: "rea-dotnet-static",
+			name: "REA managed static analysis provider",
+			version: "1"
+		};
+		NATIVE_EXAMPLE_PROVIDER = {
+			id: "native-macos",
+			name: "REA native macOS provider",
+			version: "1"
+		};
+		emptyManagedMembers = (sha256, mvid) => ({
+			artifact: {
+				path: `/examples/${sha256.slice(0, 8)}.dll`,
+				sha256,
+				byte_length: 4096,
+				format: "pe"
+			},
+			module: {
+				name: "Example.dll",
+				generation: 0,
+				mvid,
+				enc_id: null,
+				enc_base_id: null,
+				token: "0x00000001",
+				row_offset: 0
+			},
+			metadata: {
+				status: "complete",
+				version: "v4.0.30319",
+				table_row_counts: {}
+			},
+			identity_scope: {
+				token_identity: "build-local",
+				requires_artifact_sha256: sha256,
+				requires_mvid: mvid
+			},
+			types: [],
+			exported_types: [],
+			fields: [],
+			methods: [],
+			member_refs: [],
+			call_edges: [],
+			field_accesses: [],
+			selection: null,
+			coverage: {
+				state: "complete",
+				issues: []
+			},
+			limitations: []
+		});
+		evidence = (result) => createEvidence(undefined, MANAGED_STATIC_EXAMPLE_PROVIDER, {
+			operation: "inspect_managed_members",
+			parameters: {},
+			result,
+			rawResult: null,
+			limitations: result.limitations
+		});
+		runtimeMembers = () => {
+			const result = emptyManagedMembers("2".repeat(64), "11112222-3333-4444-9555-666677778888");
+			return {
+				...result,
+				methods: [{
+					token: "0x06000001",
+					row_offset: 128,
+					declaring_type_token: "0x02000001",
+					declaring_type: "Example.Program",
+					name: "Main",
+					rva: 8192,
+					impl_flags: 0,
+					flags: 22,
+					signature: {
+						raw_length: 3,
+						raw_sha256: "3".repeat(64),
+						kind: "method",
+						parse_status: "decoded",
+						calling_convention: "default",
+						generic_parameter_count: 0,
+						parameter_count: 0,
+						return_type: "void",
+						parameter_types: [],
+						field_type: null,
+						issue: null
+					},
+					body: {
+						status: "present",
+						header_format: "tiny",
+						rva: 8192,
+						file_offset: 512,
+						max_stack: 8,
+						init_locals: false,
+						local_var_sig_token: null,
+						il_size: 1,
+						il_sha256: "4".repeat(64),
+						normalized_il_sha256: "5".repeat(64),
+						instruction_count: 1,
+						decoded_instruction_count: 1,
+						truncated_instructions: 0,
+						opcode_counts: { ret: 1 },
+						anchors: [],
+						exception_regions: [],
+						issue: null
+					}
+				}]
+			};
+		};
+		MANAGED_MEMBER_COMPARISON_EXAMPLE = {
+			left: evidence(emptyManagedMembers("0".repeat(64), "00112233-4455-6677-8899-aabbccddeeff")),
+			right: evidence(emptyManagedMembers("1".repeat(64), "ffeeddcc-bbaa-4988-9766-554433221100"))
+		};
+		runtimeExampleEvidence = evidence(runtimeMembers());
+		MANAGED_APPLICATION_GRAPH_EXAMPLE = { managed_members: runtimeExampleEvidence };
+		boundaryEvidence = () => {
+			const result = {
+				artifact: {
+					path: "/examples/ManagedInterop.exe",
+					sha256: "6".repeat(64),
+					byte_length: 8192,
+					format: "pe"
+				},
+				module: {
+					name: "ManagedInterop.exe",
+					generation: 0,
+					mvid: "00112233-4455-4677-8899-aabbccddeeff",
+					enc_id: null,
+					enc_base_id: null,
+					token: "0x00000001",
+					row_offset: 0
+				},
+				metadata: {
+					status: "complete",
+					version: "v4.0.30319",
+					table_row_counts: {}
+				},
+				identity_scope: {
+					token_identity: "build-local",
+					requires_artifact_sha256: "6".repeat(64),
+					requires_mvid: "00112233-4455-4677-8899-aabbccddeeff"
+				},
+				cli_native: {
+					il_only: true,
+					requires_32bit: false,
+					strong_name_signed: false,
+					native_entry_point: false,
+					ready_to_run_signature: false,
+					managed_native_header_rva: 0,
+					managed_native_header_size: 0
+				},
+				module_refs: [{
+					token: "0x1a000001",
+					row_offset: 256,
+					name: "nativehelper.dll"
+				}],
+				pinvoke_imports: [{
+					token: "0x1c000001",
+					row_offset: 288,
+					mapping_flags: 0,
+					mapping_flags_hex: "0x0000",
+					member_token: "0x06000001",
+					member_kind: "method",
+					member_name: "OpenNative",
+					import_name: "open_native",
+					import_scope_token: "0x1a000001",
+					import_scope_name: "nativehelper.dll",
+					no_mangle: true,
+					char_set: "not-specified",
+					call_convention: "cdecl",
+					supports_last_error: false,
+					best_fit: "assembly-default",
+					throw_on_unmappable_char: "assembly-default",
+					verification: "managed-declaration-only"
+				}],
+				native_implementations: [],
+				summary: {
+					module_ref_count: 1,
+					pinvoke_import_count: 1,
+					native_implementation_count: 0,
+					ready_to_run: false,
+					mixed_mode_or_native_header: false
+				},
+				coverage: {
+					state: "complete",
+					issues: []
+				},
+				limitations: []
+			};
+			return createEvidence(undefined, MANAGED_STATIC_EXAMPLE_PROVIDER, {
+				operation: "inspect_managed_native_boundaries",
+				parameters: {},
+				result,
+				rawResult: null,
+				limitations: result.limitations
+			});
+		};
+		nativeExportEvidence = () => {
+			const result = {
+				format: "mach-o",
+				selected_architecture: {
+					name: "x86_64",
+					container_file_offset: null
+				},
+				endian: "little",
+				word_size: 64,
+				file_type: "dylib",
+				flags: [],
+				uuid: null,
+				entrypoints: coverage([]),
+				architectures: coverage([]),
+				build_metadata: coverage([]),
+				load_commands: coverage([]),
+				dependencies: coverage([]),
+				imports: coverage([]),
+				exports: coverage([{
+					name: "open_native",
+					address: "0x1000",
+					weak: false,
+					reexport: false,
+					source: "nm"
+				}]),
+				segments: coverage([]),
+				provenance: [],
+				limitations: ["Selected Mach-O slice container offset is unknown in this synthetic example."]
+			};
+			return createEvidence({
+				path: "/examples/nativehelper.dll",
+				sha256: "7".repeat(64),
+				format: "mach-o",
+				architecture: "x86_64"
+			}, NATIVE_EXAMPLE_PROVIDER, {
+				operation: "inspect_macho",
+				parameters: {},
+				result,
+				rawResult: null,
+				limitations: result.limitations
+			});
+		};
+		coverage = (items) => ({
+			items: [...items],
+			total: items.length,
+			exhaustive: true,
+			limitations: []
+		});
+		MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE = {
+			static_members: runtimeExampleEvidence,
+			decompiler: {
+				name: "ilspycmd",
+				version: "9.1.0.7988",
+				family: "ilspy",
+				executable_sha256: null,
+				options: [
+					"--disable-updatecheck",
+					"--type",
+					"Example.Program"
+				]
+			},
+			methods: [{
+				token: "0x06000001",
+				signature_sha256: "3".repeat(64),
+				normalized_il_sha256: "5".repeat(64),
+				reconstruction: {
+					kind: "decompiled-csharp",
+					language: "csharp",
+					text: "internal static void Main() { }",
+					source_path: "/examples/Example.Program.cs",
+					start_line: 1,
+					end_line: 1
+				}
+			}],
+			notes: ["Synthetic example only; decompiler output is imported as inference."]
+		};
+		MANAGED_NATIVE_VERIFICATION_EXAMPLE = {
+			managed_boundaries: boundaryEvidence(),
+			native_observations: [nativeExportEvidence()]
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/managed/managedWorkflowToolContracts.js
+var compareManagedMembersReferenceInputSchema, managedReconstructionReferenceInputSchema, managedNativeVerificationReferenceInputSchema, managedApplicationGraphReferenceFacts, managedApplicationGraphReferenceShape, managedApplicationGraphReferenceInputSchema, comparisonOutputSchema$1, reconstructionOutputSchema, nativeVerificationOutputSchema, managedApplicationGraphOutputSchema, MANAGED_WORKFLOW_TOOL_CONTRACTS;
+function init_managedWorkflowToolContracts() {
+	return (init_managedWorkflowToolContracts = __esmMin((() => {
+		init_evidence();
+		init_managedReconstruction();
+		init_toolOutputSchemaGroups();
+		init_managedWorkflowExamples();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		compareManagedMembersReferenceInputSchema = z.strictObject({
+			left: evidenceSchema,
+			right: evidenceSchema
+		}).superRefine((input, context) => {
+			if (input.left.evidence_id === input.right.evidence_id) context.addIssue({
+				code: "custom",
+				path: ["right"],
+				message: "Managed member Evidence must be distinct"
+			});
+		});
+		managedReconstructionReferenceInputSchema = managedReconstructionImportInputSchema.extend({ static_members: evidenceSchema });
+		managedNativeVerificationReferenceInputSchema = z.strictObject({
+			managed_boundaries: evidenceSchema,
+			native_observations: z.array(evidenceSchema).min(1).describe("Native function or export Evidence records")
+		}).superRefine((input, context) => {
+			const ids = new Set([input.managed_boundaries.evidence_id]);
+			for (const [index, evidence] of input.native_observations.entries()) {
+				if (evidence.evidence_id === input.managed_boundaries.evidence_id) context.addIssue({
+					code: "custom",
+					path: ["native_observations", index],
+					message: "Native observation Evidence must be distinct from managed boundary Evidence"
+				});
+				if (ids.has(evidence.evidence_id)) context.addIssue({
+					code: "custom",
+					path: ["native_observations", index],
+					message: "Native observation Evidence IDs must be unique"
+				});
+				ids.add(evidence.evidence_id);
+			}
+		});
+		managedApplicationGraphReferenceFacts = {};
+		managedApplicationGraphReferenceShape = z.strictObject({
+			...managedApplicationGraphReferenceFacts,
+			managed_artifact: evidenceSchema.optional(),
+			managed_members: evidenceSchema.optional(),
+			managed_native_boundaries: evidenceSchema.optional()
+		});
+		managedApplicationGraphReferenceInputSchema = z.union([
+			managedApplicationGraphReferenceShape.extend({ managed_artifact: evidenceSchema }),
+			managedApplicationGraphReferenceShape.extend({ managed_members: evidenceSchema }),
+			managedApplicationGraphReferenceShape.extend({ managed_native_boundaries: evidenceSchema })
+		]).superRefine((input, context) => {
+			const ids = [
+				input.managed_artifact?.evidence_id,
+				input.managed_members?.evidence_id,
+				input.managed_native_boundaries?.evidence_id
+			].filter((id) => id !== undefined);
+			if (ids.length === 0) context.addIssue({
+				code: "custom",
+				message: "Provide at least one managed Evidence source"
+			});
+			if (new Set(ids).size !== ids.length) context.addIssue({
+				code: "custom",
+				message: "Managed application graph Evidence IDs must be unique"
+			});
+		});
+		comparisonOutputSchema$1 = requireOutputSchema(managedWorkflowOutputSchemas, "compare_managed_members");
+		reconstructionOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "import_managed_reconstruction");
+		nativeVerificationOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "verify_managed_native_boundaries");
+		managedApplicationGraphOutputSchema = requireOutputSchema(managedWorkflowOutputSchemas, "project_managed_application_graph");
+		MANAGED_WORKFLOW_TOOL_CONTRACTS = [
+			{
+				name: "compare_managed_members",
+				...toolContractMetadata("compare_managed_members"),
+				description: "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact CIL/signature, exact declared type, name, and raw signature (decoded or not), and decoded structural method shape. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
+				kind: "application",
+				inputSchema: compareManagedMembersReferenceInputSchema,
+				outputSchema: comparisonOutputSchema$1,
+				examples: [{
+					title: "Compare two managed member observations",
+					input: {
+						left: MANAGED_MEMBER_COMPARISON_EXAMPLE.left,
+						right: MANAGED_MEMBER_COMPARISON_EXAMPLE.right
+					}
+				}]
+			},
+			{
+				name: "verify_managed_native_boundaries",
+				...toolContractMetadata("verify_managed_native_boundaries"),
+				description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states.",
+				kind: "application",
+				inputSchema: managedNativeVerificationReferenceInputSchema,
+				outputSchema: nativeVerificationOutputSchema,
+				examples: [{
+					title: "Verify a managed P/Invoke declaration against native Evidence",
+					input: {
+						managed_boundaries: MANAGED_NATIVE_VERIFICATION_EXAMPLE.managed_boundaries,
+						native_observations: MANAGED_NATIVE_VERIFICATION_EXAMPLE.native_observations
+					}
+				}]
+			},
+			{
+				name: "import_managed_reconstruction",
+				...toolContractMetadata("import_managed_reconstruction"),
+				description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.",
+				kind: "application",
+				inputSchema: managedReconstructionReferenceInputSchema,
+				outputSchema: reconstructionOutputSchema,
+				examples: [{
+					title: "Import a decompiler reconstruction for one managed method",
+					input: {
+						static_members: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.static_members,
+						decompiler: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.decompiler,
+						methods: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.methods,
+						notes: MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE.notes
+					}
+				}]
+			},
+			{
+				name: "project_managed_application_graph",
+				...toolContractMetadata("project_managed_application_graph"),
+				description: "Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.",
+				kind: "application",
+				inputSchema: managedApplicationGraphReferenceInputSchema,
+				outputSchema: managedApplicationGraphOutputSchema,
+				examples: [{
+					title: "Project static managed observations into an application graph",
+					input: { managed_members: MANAGED_APPLICATION_GRAPH_EXAMPLE.managed_members }
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/browserScenarioToolContracts.js
+var example, BROWSER_SCENARIO_TOOL_CONTRACTS;
+function init_browserScenarioToolContracts() {
+	return (init_browserScenarioToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_browserScenario();
+		init_browserScenarioCapture();
+		example = {
+			browser: {
+				mode: "launch",
+				executable_path: "/opt/chromium/chrome"
+			},
+			start_url: {
+				url: "https://app.example.test/",
+				query: []
+			},
+			actions: [{
+				step_id: "settle",
+				action: "wait_for_timeout",
+				duration_ms: 250
+			}]
+		};
+		BROWSER_SCENARIO_TOOL_CONTRACTS = [{
+			name: "capture_browser_scenario",
+			...toolContractMetadata("capture_browser_scenario"),
+			description: "Run a controlled browser scenario when passive observation cannot exercise the application. Launch the selected executable or connect to a loopback CDP target, provide a start URL and actions, and select storage or artifacts when needed. Environment, empty storage, and a URL-only final capture are defaults. capture.network selects request_body, response_body, and header_values independently; selected content is returned inline with transaction and event references, byte digests, and explicit unavailable states. Credentials and declared secrets are redacted. Agents can run their own local fixture servers to control application responses. Actions run until completion or cancellation unless timeout_ms is set. Results are returned inline.",
+			kind: "browser-provider",
+			inputSchema: browserScenarioInputSchema,
+			outputSchema: evidenceResultOf(browserScenarioCaptureSchema),
+			examples: [{
+				title: "Capture a deterministic browser scenario",
+				input: example
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/browserToolContracts.js
+function exampleScreenshot() {
+	return {
+		sha256: "153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c",
+		bytes: 70,
+		media_type: "image/png",
+		data_base64: "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PzWvWQAAAABJRU5ErkJggg=="
+	};
+}
+var listOutputSchema$1, inspectionOutputSchema$1, bundleOutputSchema, observationSessionOutputSchema, webMcpOutputSchema, captureDiffOutputSchema, screenshotOutputSchema, screenshotDiffOutputSchema, endpoint$2, origin, scenarioUrl, scenarioCompleteness, scenarioArtifacts, exampleScenarioCapture, BROWSER_TOOL_CONTRACTS;
+function init_browserToolContracts() {
+	return (init_browserToolContracts = __esmMin((() => {
+		init_browserObservation();
+		init_browserObservationSchemas();
+		init_webBundleAnalysis();
+		init_browserSession();
+		init_webMcpDiscovery();
+		init_browserCaptureComparison();
+		init_webScreenshot();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		listOutputSchema$1 = evidenceResultOf(browserTargetListSchema);
+		inspectionOutputSchema$1 = evidenceResultOf(webPageInspectionSchema);
+		bundleOutputSchema = evidenceResultOf(webBundleAnalysisSchema);
+		observationSessionOutputSchema = evidenceResultOf(webObservationSessionSchema);
+		webMcpOutputSchema = evidenceResultOf(webMcpDiscoverySchema);
+		captureDiffOutputSchema = evidenceResultOf(browserCaptureComparisonSchema);
+		screenshotOutputSchema = evidenceResultOf(webScreenshotSchema);
+		screenshotDiffOutputSchema = evidenceResultOf(webScreenshotDiffSchema);
+		endpoint$2 = "http://127.0.0.1:9222";
+		origin = "https://app.example.test";
+		scenarioUrl = {
+			url: `${origin}/`,
+			origin,
+			query_parameter_names: [],
+			redacted: false
+		};
+		scenarioCompleteness = {
+			status: "complete",
+			equality_eligible: true,
+			missing_sections: [],
+			truncated_sections: []
+		};
+		scenarioArtifacts = {
+			screenshot: { state: "not_requested" },
+			dom: { state: "not_requested" },
+			accessibility: { state: "not_requested" },
+			url: { state: "not_requested" },
+			history: { state: "not_requested" },
+			storage: { state: "not_requested" }
+		};
+		exampleScenarioCapture = () => ({
+			browser: {
+				mode: "connect",
+				process_ownership: "external",
+				cleanup: "disconnected-external",
+				product: "Chromium",
+				version: "149"
+			},
+			scenario: {
+				start_origin: origin,
+				action_count: 1,
+				secret_references: [],
+				network_content: {
+					request_body: false,
+					response_body: false,
+					header_values: false
+				}
+			},
+			duration_ms: 10,
+			steps: [{
+				step_index: 0,
+				step_id: "scenario_start",
+				action: "scenario_start",
+				status: "completed",
+				elapsed_ms: 0,
+				before_url: scenarioUrl,
+				after_url: scenarioUrl,
+				error: null,
+				event_sequence_start: 1,
+				event_sequence_end: 0,
+				artifacts: scenarioArtifacts,
+				completeness: scenarioCompleteness
+			}, {
+				step_index: 1,
+				step_id: "open-settings",
+				action: "click",
+				status: "completed",
+				elapsed_ms: 10,
+				before_url: scenarioUrl,
+				after_url: scenarioUrl,
+				error: null,
+				event_sequence_start: 1,
+				event_sequence_end: 0,
+				artifacts: scenarioArtifacts,
+				completeness: scenarioCompleteness
+			}],
+			events: {
+				retained: 0,
+				dropped: 0,
+				items: []
+			},
+			completeness: scenarioCompleteness,
+			limitations: []
+		});
+		BROWSER_TOOL_CONTRACTS = [
+			{
+				name: "list_browser_targets",
+				...toolContractMetadata("list_browser_targets"),
+				description: "List page targets exposed by the selected loopback Chrome DevTools Protocol endpoint. Optionally filter by exact origin. URLs preserve query values and fragments; only URL userinfo credentials are removed.",
+				kind: "browser-provider",
+				inputSchema: listBrowserTargetsInputSchema,
+				outputSchema: listOutputSchema$1,
+				examples: [{
+					title: "List browser page targets",
+					input: { cdp_endpoint: endpoint$2 }
+				}]
+			},
+			{
+				name: "inspect_web_page",
+				...toolContractMetadata("inspect_web_page"),
+				description: "Passively inspect one selected page target through CDP without evaluating JavaScript, navigating, clicking, closing, or mutating the page. If no origin filter is supplied, capture is scoped to the target's current origin. Returns DOM structure, accessibility, scripts, resources, attach-window network and console metadata, workers, and redacted storage inventory as Evidence.",
+				kind: "browser-provider",
+				inputSchema: inspectWebPageInputSchema,
+				outputSchema: inspectionOutputSchema$1,
+				examples: [{
+					title: "Inspect one browser page",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS"
+					}
+				}]
+			},
+			{
+				name: "analyze_web_bundle",
+				...toolContractMetadata("analyze_web_bundle"),
+				description: "Capture JavaScript source from one selected CDP page and statically derive a chunk graph, route and endpoint candidates, vendor fingerprints, page-declared WebMCP metadata, and optionally fetch source maps from the selected target origin or explicitly requested origins. JavaScript is parsed but never executed.",
+				kind: "browser-provider",
+				inputSchema: analyzeWebBundleInputSchema,
+				outputSchema: bundleOutputSchema,
+				examples: [{
+					title: "Analyze a page bundle",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+						observation_ms: 500,
+						include_accessibility_text: false,
+						include_script_sources: true,
+						include_storage_keys: false,
+						fetch_source_maps: false
+					}
+				}]
+			},
+			{
+				name: "observe_web_session",
+				...toolContractMetadata("observe_web_session"),
+				description: "Arm a CDP observation window of the requested duration while the user operates the page. By default it follows the selected target's current origin; an explicit origin list controls which origins may be retained. Records navigation, redirect, lifecycle, and failure events.",
+				kind: "browser-provider",
+				inputSchema: observeWebSessionInputSchema,
+				outputSchema: observationSessionOutputSchema,
+				examples: [{
+					title: "Observe one external user action",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+						observation_ms: 1e4
+					}
+				}]
+			},
+			{
+				name: "discover_webmcp_tools",
+				...toolContractMetadata("discover_webmcp_tools"),
+				description: "Passively inventory every page-registered WebMCP tool and its complete structural input-schema summary using the experimental CDP WebMCP domain. Metadata is page-declared-untrusted; REA never registers or invokes discovered tools.",
+				kind: "browser-provider",
+				inputSchema: discoverWebMcpToolsInputSchema,
+				outputSchema: webMcpOutputSchema,
+				examples: [{
+					title: "Discover current WebMCP declarations",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+						observation_ms: 100
+					}
+				}]
+			},
+			{
+				name: "compare_web_captures",
+				...toolContractMetadata("compare_web_captures"),
+				description: "Compare passive web captures by providing before and after, each with the complete inspect_web_page normalized_result in inspection and an optional complete discover_webmcp_tools normalized_result in webmcp; or compare recorded scenarios by passing complete capture_browser_scenario normalized_result objects in before_scenario and after_scenario with an optional normalization policy. Use exactly one input group. Network comparison includes observed HTTP requests and WebSocket frame streams; same-URL connections are compared as an unordered collection of ordered streams, retaining connection counts without claiming stable identity between individual connections. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and returns every artifact-level difference plus alignment failures inline. Missing or truncated evidence never proves equality.",
+				kind: "browser-provider",
+				inputSchema: browserCaptureComparisonInputSchema,
+				outputSchema: captureDiffOutputSchema,
+				examples: [{
+					title: "Compare two recorded browser scenarios",
+					input: {
+						before_scenario: exampleScenarioCapture(),
+						after_scenario: exampleScenarioCapture(),
+						normalization: { rules: [{
+							rule_id: "volatile-build-id",
+							artifacts: ["dom", "accessibility"],
+							match: "build-123",
+							replacement: "[BUILD_ID]"
+						}] }
+					}
+				}]
+			},
+			{
+				name: "capture_web_screenshot",
+				...toolContractMetadata("capture_web_screenshot"),
+				description: "Capture the current visible viewport of one configured page as an inline, content-addressed PNG artifact. The operation never scrolls, navigates, or evaluates page JavaScript.",
+				kind: "browser-provider",
+				inputSchema: captureWebScreenshotInputSchema,
+				outputSchema: screenshotOutputSchema,
+				examples: [{
+					title: "Capture a viewport",
+					input: {
+						cdp_endpoint: endpoint$2,
+						target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS"
+					}
+				}]
+			},
+			{
+				name: "compare_web_screenshots",
+				...toolContractMetadata("compare_web_screenshots"),
+				description: "Compare two self-verifying PNG screenshot artifacts with local pixel metrics. Returns exact changed-pixel ratios and channel deltas without OCR or external services.",
+				kind: "browser-provider",
+				inputSchema: compareWebScreenshotsInputSchema,
+				outputSchema: screenshotDiffOutputSchema,
+				examples: [{
+					title: "Compare two screenshot artifacts",
+					input: {
+						before: exampleScreenshot(),
+						after: exampleScreenshot(),
+						channel_threshold: 0
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/browserProviderToolContracts.js
+var BROWSER_PROVIDER_TOOL_CONTRACTS;
+function init_browserProviderToolContracts() {
+	return (init_browserProviderToolContracts = __esmMin((() => {
+		init_browserScenarioToolContracts();
+		init_browserToolContracts();
+		BROWSER_PROVIDER_TOOL_CONTRACTS = [...BROWSER_TOOL_CONTRACTS, ...BROWSER_SCENARIO_TOOL_CONTRACTS];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptRuntimeReconciliationExample.js
+function browserCompleteness() {
+	return {
+		status: "complete_within_window",
+		conditions: ["complete_within_window"],
+		policy_filtered_sections: [],
+		attach_limited_sections: [],
+		truncated_sections: [],
+		unavailable_sections: [],
+		excluded: [],
+		dropped_events: {
+			scripts: 0,
+			network_requests: 0,
+			console_events: 0,
+			websocket_connections: 0,
+			websocket_frames: 0,
+			webmcp_tools: 0,
+			timeline_events: 0,
+			total: 0
+		}
+	};
+}
+var applicationSha256, script, inputPath, scriptPath, completeCoverage, graphEvidence, asset, graph, evidenceContexts, semanticNode, semanticGraph, JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, runtimeEvidence, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE;
+function init_javascriptRuntimeReconciliationExample() {
+	return (init_javascriptRuntimeReconciliationExample = __esmMin((() => {
+		init_evidence();
+		init_javascriptApplicationGraph();
+		init_webContentArtifact();
+		init_javascriptSemanticGraph();
+		init_javascriptSemanticGraphSchemas();
+		applicationSha256 = "1".repeat(64);
+		script = createWebTextArtifact("export const example = true;\n", "text/javascript");
+		inputPath = "/Applications/Example.app/Contents/Resources/app";
+		scriptPath = `${inputPath}/renderer.js`;
+		completeCoverage = {
+			status: "complete",
+			truncated: false,
+			omitted_count: 0,
+			limits: []
+		};
+		graphEvidence = {
+			authority: "artifact-bytes",
+			state: "observed",
+			confidence: "exact",
+			artifact: {
+				available: true,
+				artifact_id: `art_${script.sha256}`,
+				sha256: script.sha256
+			},
+			location: {
+				available: true,
+				value: {
+					kind: "artifact-path",
+					path: "renderer.js"
+				}
+			},
+			extractor: {
+				name: "rea-javascript-application",
+				version: "1",
+				operation: "inventory-relevant-file",
+				executable_sha256: null
+			},
+			coverage: completeCoverage,
+			limitations: [],
+			evidence_ids: []
+		};
+		asset = createJavaScriptApplicationNode({
+			kind: "javascript-asset",
+			identity: {
+				strategy: "content-digest",
+				stability: "global-exact",
+				sha256: script.sha256
+			},
+			observations: [{
+				label: "renderer.js",
+				properties: {
+					path: "renderer.js",
+					bytes: script.bytes
+				},
+				evidence: graphEvidence
+			}]
+		});
+		graph = createJavaScriptApplicationGraph({
+			schema: "JavaScriptApplicationGraph",
+			root_node_ids: [asset.node_id],
+			nodes: [asset],
+			edges: [],
+			coverage: completeCoverage,
+			limitations: []
+		});
+		evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
+		semanticNode = createJavaScriptSemanticGraphNode({
+			kind: "module",
+			identity: {
+				artifact_sha256: applicationSha256,
+				module_path: "renderer.js",
+				source_range: null,
+				role_key: "example-module"
+			},
+			function_node_id: null,
+			application_node_ids: [asset.node_id],
+			label: "renderer.js",
+			properties: {},
+			evidence: graphEvidence
+		}, evidenceContexts);
+		semanticGraph = createJavaScriptSemanticGraph({
+			schema: "JavaScriptSemanticRelationGraph",
+			root_artifact_sha256: applicationSha256,
+			application_graph_id: graph.graph_id,
+			root_node_ids: [semanticNode.node_id],
+			evidence_contexts: evidenceContexts.contexts,
+			nodes: [semanticNode],
+			relations: [],
+			fingerprints: [],
+			unknowns: [],
+			coverage: {
+				status: "unknown",
+				truncated: false,
+				omitted_nodes: 0,
+				omitted_relations: 0,
+				limits: [],
+				families: JAVASCRIPT_SEMANTIC_RELATION_FAMILIES.map((family) => ({
+					family,
+					status: "unknown",
+					retained_relations: 0,
+					omitted_relations: 0,
+					unknown_ids: []
+				}))
+			},
+			limitations: ["Semantic relations are unavailable in this minimal example."]
+		});
+		JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE = createEvidence({
+			path: inputPath,
+			sha256: applicationSha256,
+			format: "directory"
+		}, {
+			id: "rea-javascript-application",
+			name: "REA JavaScript application analyzer",
+			version: "1"
+		}, {
+			predicateType: "rea.javascript-application-analysis",
+			operation: "analyze_javascript_application",
+			parameters: {},
+			result: {
+				input_path: inputPath,
+				format: "directory",
+				root_artifact_sha256: applicationSha256,
+				inventory_manifest_id: `agm_${"2".repeat(64)}`,
+				inventory_graph_sha256: "3".repeat(64),
+				integrity_contradictions: [],
+				graph,
+				semantic_graph: semanticGraph,
+				summary: {
+					browser_windows: 0,
+					explicit_web_preferences: 0,
+					preload_entrypoints: 0,
+					context_bridge_apis: 0,
+					exposed_api_members: 0,
+					ipc: {
+						operations: 0,
+						literal_channels: 0,
+						dynamic_channel_operations: 0,
+						renderer_transmissions: 0,
+						renderer_listeners: 0,
+						main_handlers: 0,
+						paired_renderer_transmissions: 0,
+						ambiguous_renderer_transmissions: 0,
+						unpaired_literal_renderer_transmissions: 0
+					},
+					sender_validation_observations: 0,
+					utility_processes: 0,
+					resolved_utility_entrypoints: 0,
+					native_addon_bindings: 0,
+					resolved_native_addon_bindings: 0
+				},
+				statistics: {
+					relevant_files: 1,
+					nested_asar_containers: 0,
+					text_bytes_read: script.bytes,
+					invalid_utf8_files: 0,
+					parsed_javascript_files: 1,
+					visited_ast_nodes: 1,
+					findings: 0,
+					modules: 0,
+					parse_failures: 0
+				},
+				limitations: []
+			},
+			confidence: "derived",
+			authority: "shipped-artifact"
+		});
+		runtimeEvidence = createEvidence(undefined, {
+			id: "rea-cdp-electron",
+			name: "REA Electron file-page CDP observation provider",
+			version: "1"
+		}, {
+			predicateType: "rea.electron-page-inspection",
+			operation: "inspect_electron_page",
+			parameters: {
+				cdp_endpoint: "http://127.0.0.1:9223",
+				target_id: "example-target",
+				include_script_sources: true
+			},
+			result: {
+				browser: {
+					product: "Electron/example",
+					protocol_version: "1.3",
+					revision: "example",
+					user_agent: "Electron example",
+					js_version: "1"
+				},
+				target: {
+					target_id: "example-target",
+					type: "page",
+					title: "Example",
+					file_path: `${inputPath}/index.html`,
+					attached: false
+				},
+				capture_window: {
+					started_at: "2026-07-15T00:00:00.000Z",
+					ended_at: "2026-07-15T00:00:00.100Z",
+					observation_ms: 100
+				},
+				completeness: browserCompleteness(),
+				frames: [],
+				dom: {
+					total_nodes: 0,
+					nodes: []
+				},
+				scripts: {
+					total: 1,
+					items: [{
+						script_key: `electron_script_${"4".repeat(64)}`,
+						frame_id: null,
+						file_path: scriptPath,
+						cdp_hash: "example",
+						length: script.bytes,
+						is_module: true,
+						language: "JavaScript",
+						source: {
+							included: true,
+							artifact: script
+						}
+					}]
+				},
+				resources: [],
+				workers: [],
+				limitations: ["Example passive capture."]
+			},
+			confidence: "observed",
+			authority: "external-service"
+		});
+		JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE = {
+			static_layers: [{ analysis: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE }],
+			runtime_observations: [runtimeEvidence]
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/electronToolContracts.js
+var listOutputSchema, inspectionOutputSchema, analyzeJavaScriptApplicationRequestSchema, applicationOutputSchema, reconciliationOutputSchema, endpoint$1, activeExample, ELECTRON_TOOL_CONTRACTS;
+function init_electronToolContracts() {
+	return (init_electronToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_electronObservation();
+		init_electronActiveObservation();
+		init_analysisView();
+		init_analysisDetail();
+		init_javascriptApplicationAnalysis();
+		init_javascriptRuntimeReconciliationSchemas();
+		init_javascriptRuntimeReconciliationExample();
+		listOutputSchema = evidenceResultOf(electronTargetListSchema);
+		inspectionOutputSchema = evidenceResultOf(electronPageInspectionSchema);
+		analyzeJavaScriptApplicationRequestSchema = analyzeJavaScriptApplicationInputSchema.extend({ detail: analysisDetailSchema });
+		applicationOutputSchema = analysisDetailOutputSchemaOf(javascriptApplicationAnalysisResultSchema, javascriptApplicationSummaryViewResultSchema);
+		reconciliationOutputSchema = evidenceResultOf(javascriptRuntimeReconciliationResultSchema);
+		endpoint$1 = "http://127.0.0.1:9223";
+		activeExample = {
+			executable_path: "/Applications/Electron.app/Contents/MacOS/Electron",
+			application_path: "/Applications/Example.app/Contents/Resources/main.js",
+			args: [],
+			actions: [{
+				step_id: "exercise-ipc",
+				kind: "click",
+				selector: "#run"
+			}]
+		};
+		ELECTRON_TOOL_CONTRACTS = [
+			{
+				name: "list_electron_targets",
+				...toolContractMetadata("list_electron_targets"),
+				description: "List every Electron file:// page target from a selected loopback CDP endpoint. Local file paths are canonicalized after symlink resolution. Selecting an endpoint exposes every eligible target and its local path metadata.",
+				kind: "electron-provider",
+				inputSchema: listElectronTargetsInputSchema,
+				outputSchema: listOutputSchema,
+				examples: [{
+					title: "List Electron file pages",
+					input: { cdp_endpoint: endpoint$1 }
+				}]
+			},
+			{
+				name: "inspect_electron_page",
+				...toolContractMetadata("inspect_electron_page"),
+				description: "Passively inspect one Electron file page by supplying its loopback CDP endpoint and target ID. The provider rechecks that the target currently exists at that endpoint and is a local file page. Returns frames, DOM structure, resource paths, and scripts without evaluating renderer JavaScript or invoking Electron APIs. The selected endpoint exposes every local file page and its metadata to this tool.",
+				kind: "electron-provider",
+				inputSchema: inspectElectronPageInputSchema,
+				outputSchema: inspectionOutputSchema,
+				examples: [{
+					title: "Inspect an Electron page",
+					input: {
+						cdp_endpoint: endpoint$1,
+						target_id: "TARGET_ID_FROM_LIST_ELECTRON_TARGETS"
+					}
+				}]
+			},
+			{
+				name: "analyze_javascript_application",
+				...toolContractMetadata("analyze_javascript_application"),
+				description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Select source_paths to acquire and analyze only exact inventoried file paths; the complete artifact inventory and identity remain intact, and unselected sources remain explicit unknowns. Dependencies are not implicitly analyzed. Select detail summary to retain the complete analysis Evidence in this session and receive only its summary view, then inspect selected modules or pages with inspect_analysis_view. Summary detail reduces delivery, whereas source_paths bounds source analysis. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial.",
+				kind: "electron-provider",
+				inputSchema: analyzeJavaScriptApplicationRequestSchema,
+				outputSchema: applicationOutputSchema,
+				examples: [
+					{
+						title: "Analyze one local JavaScript application",
+						input: {
+							input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+							format: "auto",
+							integrity_policy: "fail"
+						}
+					},
+					{
+						title: "Analyze selected entry sources before unrelated vendor files",
+						input: {
+							input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+							source_paths: [
+								"package.json",
+								"main.js",
+								"preload.js"
+							],
+							detail: "summary"
+						}
+					},
+					{
+						title: "Retain the complete analysis and return its summary view",
+						input: {
+							input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+							detail: "summary"
+						}
+					}
+				]
+			},
+			{
+				name: "reconcile_javascript_runtime",
+				...toolContractMetadata("reconcile_javascript_runtime"),
+				description: "Reconcile verified static JavaScript application graphs with existing passive web/Electron CDP, passive V8 Inspector, or provider-owned active Electron Evidence. Active Electron captures contribute an explicitly partial target-only runtime record; they never invent renderer scripts, frames, workers, or execution claims. Exact captured-source digests take priority over caller-declared file/URL mappings; target, frame, script, and worker ambiguity remains explicit, and source-map authority stays separate.",
+				kind: "electron-provider",
+				inputSchema: reconcileJavaScriptRuntimeInputSchema,
+				outputSchema: reconciliationOutputSchema,
+				examples: [{
+					title: "Reconcile one passive Electron capture",
+					input: JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE
+				}]
+			},
+			{
+				name: "capture_electron_scenario",
+				...toolContractMetadata("capture_electron_scenario"),
+				description: "Use this for a provider-owned Electron run when passive CDP or Inspector observation cannot exercise application behavior. REA owns startup and teardown, accepts caller-defined click/wait actions plus window-targeted renderer reload/crash and synthetic open-url/second-instance delivery, and returns correlated window/WebContents/process/preload/session/navigation/shell/IPC evidence without retaining payload values. Actions wait for completion or request cancellation; a missing click target can keep the request pending. Results identify observed and unavailable event families, coverage status, action targets, and truncation. Cleanup failures retain collected observations with explicit cleanup uncertainty. External shell, navigation, permission, download, popup, updater, and OS-integration effects are blocked and recorded. Use passive Electron tools for observation-only work.",
+				kind: "electron-provider",
+				inputSchema: electronActiveObservationInputSchema,
+				outputSchema: evidenceResultOf(electronActiveObservationResultSchema),
+				examples: [{
+					title: "Exercise an owned Electron application",
+					input: activeExample
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptRuntimeObservationToolContracts.js
+var endpoint, JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS;
+function init_javascriptRuntimeObservationToolContracts() {
+	return (init_javascriptRuntimeObservationToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_javascriptRuntimeObservation();
+		endpoint = "http://127.0.0.1:9229";
+		JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS = [{
+			name: "list_javascript_runtime_targets",
+			...toolContractMetadata("list_javascript_runtime_targets"),
+			description: "List every eligible Node/Electron V8 Inspector target from an explicit literal-loopback endpoint. Node discovery file locations that cannot be verified are preserved as unresolved reported URLs; they do not prove filesystem identity. Listing does not attach to targets.",
+			kind: "runtime-provider",
+			inputSchema: listJavaScriptRuntimeTargetsInputSchema,
+			outputSchema: evidenceResultOf(javascriptRuntimeTargetListSchema),
+			examples: [{
+				title: "List Node Inspector targets",
+				input: { inspector_endpoint: endpoint }
+			}]
+		}, {
+			name: "observe_javascript_runtime",
+			...toolContractMetadata("observe_javascript_runtime"),
+			description: "Attach passively to one Node/Electron V8 Inspector target by supplying its loopback Inspector endpoint and target ID. The provider rechecks target presence and attachability; a Node discovery file location may remain unresolved. Loaded script locations are validated independently from Debugger.scriptParsed. Captures script and Runtime execution-context metadata. REA never evaluates, pauses, resumes, reads source, or instruments the target; require/import edges, EventEmitter activity, and Electron IPC remain explicit unknowns. Reconcile the result with static Application Graph Evidence using reconcile_javascript_runtime. The selected endpoint exposes every target it serves to this tool.",
+			kind: "runtime-provider",
+			inputSchema: observeJavaScriptRuntimeInputSchema,
+			outputSchema: evidenceResultOf(javascriptRuntimeObservationSchema),
+			examples: [{
+				title: "Observe one Node runtime",
+				input: {
+					inspector_endpoint: endpoint,
+					target_id: "TARGET_ID_FROM_LIST_JAVASCRIPT_RUNTIME_TARGETS"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/evidenceInputContracts.js
+var retainedEvidenceReferenceSchema, evidenceInputSchema;
+function init_evidenceInputContracts() {
+	return (init_evidenceInputContracts = __esmMin((() => {
+		init_evidence();
+		init_digests();
+		retainedEvidenceReferenceSchema = z.strictObject({
+			kind: z.literal("retained-evidence"),
+			evidence_id: prefixedDigestSchema("ev")
+		});
+		evidenceInputSchema = z.union([evidenceSchema, retainedEvidenceReferenceSchema]);
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/applicationWorkflowInputContracts.js
+var traceApplicationFeatureFacts, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, compareApplicationVersionsFacts, compareApplicationVersionsRequestSchema, compareSourceToBundleFacts, compareSourceToBundleRequestSchema, compareJavaScriptExportShapesFacts, compareJavaScriptExportShapesRequestSchema;
+function init_applicationWorkflowInputContracts() {
+	return (init_applicationWorkflowInputContracts = __esmMin((() => {
+		init_evidenceInputContracts();
+		init_javascriptApplicationVersionComparisonSchemas();
+		init_javascriptExportShapeComparisonSchemas();
+		init_javascriptFeatureTraceSchemas();
+		init_javascriptSemanticQuerySchemas();
+		init_sourceToBundleComparisonSchemas();
+		traceApplicationFeatureFacts = {
+			native_observations: traceApplicationFeatureInputSchema.shape.native_observations,
+			seed: traceApplicationFeatureInputSchema.shape.seed,
+			direction: traceApplicationFeatureInputSchema.shape.direction
+		};
+		traceApplicationFeatureRequestSchema = z.strictObject({
+			...traceApplicationFeatureFacts,
+			application: evidenceInputSchema
+		});
+		traceJavaScriptSemanticsRequestSchema = z.strictObject({
+			application: evidenceInputSchema,
+			query: javaScriptSemanticQueryInputSchema
+		});
+		compareApplicationVersionsFacts = {
+			left_native_observations: compareApplicationVersionsInputSchema.shape.left_native_observations,
+			right_native_observations: compareApplicationVersionsInputSchema.shape.right_native_observations
+		};
+		compareApplicationVersionsRequestSchema = z.strictObject({
+			...compareApplicationVersionsFacts,
+			left: evidenceInputSchema,
+			right: evidenceInputSchema
+		});
+		compareSourceToBundleFacts = { reference: compareSourceToBundleInputSchema.shape.reference };
+		compareSourceToBundleRequestSchema = z.strictObject({
+			...compareSourceToBundleFacts,
+			application: evidenceInputSchema
+		});
+		compareJavaScriptExportShapesFacts = {
+			left_module_path: compareJavaScriptExportShapesInputSchema.shape.left_module_path,
+			left_export_name: compareJavaScriptExportShapesInputSchema.shape.left_export_name,
+			right_module_path: compareJavaScriptExportShapesInputSchema.shape.right_module_path,
+			right_export_name: compareJavaScriptExportShapesInputSchema.shape.right_export_name
+		};
+		compareJavaScriptExportShapesRequestSchema = z.strictObject({
+			...compareJavaScriptExportShapesFacts,
+			left: evidenceInputSchema,
+			right: evidenceInputSchema
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptApplicationWorkflowExamples.js
+var reconciliation, reconciliationEvidence, TRACE_SEED, JAVASCRIPT_FEATURE_TRACE_EXAMPLE, JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE, SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE;
+function init_javascriptApplicationWorkflowExamples() {
+	return (init_javascriptApplicationWorkflowExamples = __esmMin((() => {
+		init_evidence();
+		init_javascriptRuntimeReconciliation();
+		init_javascriptRuntimeReconciliationExample();
+		init_referenceSourceGraph();
+		init_javascriptRuntimeReconciliationSchemas();
+		reconciliation = reconcileJavaScriptRuntime(parseRuntimeReconciliationInput(reconcileJavaScriptRuntimeInputSchema.parse(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE)));
+		reconciliationEvidence = createEvidence(undefined, {
+			id: "rea-javascript-runtime-reconciliation",
+			name: "REA JavaScript runtime reconciliation",
+			version: "1"
+		}, {
+			predicateType: "rea.javascript-runtime-reconciliation",
+			operation: "reconcile_javascript_runtime",
+			parameters: {
+				static_layers: JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE.static_layers.map(({ analysis }) => ({
+					role: "application",
+					evidence_id: analysis.evidence_id,
+					runtime_mappings: []
+				})),
+				runtime_evidence_ids: JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE.runtime_observations.map(({ evidence_id: id }) => id)
+			},
+			result: reconciliation,
+			confidence: "inferred",
+			authority: "analyst-inference",
+			limitations: reconciliation.limitations,
+			evidenceLinks: reconciliation.evidence_links
+		});
+		TRACE_SEED = {
+			kind: "module",
+			value: "renderer.js",
+			match: "exact",
+			case_sensitive: false
+		};
+		JAVASCRIPT_FEATURE_TRACE_EXAMPLE = {
+			application: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE,
+			seed: TRACE_SEED,
+			direction: "both"
+		};
+		JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE = {
+			left: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE,
+			right: reconciliationEvidence
+		};
+		SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE = {
+			reference: createHistoricalSourceGraph({
+				schema: "HistoricalSourceGraph",
+				authority: "historical-reference",
+				root_alias: "$REFERENCE_ROOT",
+				inventory_state: "complete",
+				entries: [{
+					path: "src",
+					kind: "directory",
+					classifications: ["source"],
+					tree_state: "enumerated",
+					limitations: []
+				}, {
+					path: "src/main.ts",
+					kind: "file",
+					sha256: "2".repeat(64),
+					size: 128,
+					language: "TypeScript",
+					classifications: ["source"],
+					content_state: "hashed",
+					limitations: []
+				}],
+				relationships: [],
+				parse_failures: [],
+				exclusions: [],
+				languages: ["TypeScript"],
+				manifests: [],
+				vcs: {
+					kind: "none",
+					head: null,
+					dirty: null
+				},
+				provenance: {
+					importer: "rea",
+					importer_version: "1",
+					caller: "contract-example"
+				},
+				limitations: []
+			}),
+			application: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptExportShapeComparisonExample.js
+var captures, summary, statistics, modulePath, limitations, exampleEvidence, JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE;
+function init_javascriptExportShapeComparisonExample() {
+	return (init_javascriptExportShapeComparisonExample = __esmMin((() => {
+		init_evidence();
+		init_webContentArtifact();
+		init_javascriptSemanticAnalysis();
+		init_javascriptExportReturnShapeProjection();
+		init_javascriptApplicationEvidenceSchemas();
+		init_javascriptApplicationGraph();
+		init_javascriptSemanticGraph();
+		init_javascriptSemanticGraphSchemas();
+		init_javascriptApplicationAnalysis();
+		captures = {
+			count: {
+				input_path: "/examples/javascript-export-presence/left",
+				root_artifact_sha256: "5005ebc2f35719a2fc014f19a81c669f3a1ab471b7245ef6985a111b6845a747",
+				inventory_manifest_id: "agm_f30ded9a83d43a3980417bbe63dfad569e83386f243c4d6a01af0166372cb9e6",
+				inventory_graph_sha256: "4b8aceaf67e43fd8317ec1f5fd1df5235f8fa402335accf011683e008c6bc62c",
+				integrity_contradictions: []
+			},
+			total: {
+				input_path: "/examples/javascript-export-presence/right",
+				root_artifact_sha256: "269ae72a601ad5ac02f1c2dda6ff9accffa2d2e4f4a9e406facee0d5a78a5377",
+				inventory_manifest_id: "agm_d3ceaa1af38fb3474070ca25c0d4644282e5fb7d5824cee3e3a81391481e9fc1",
+				inventory_graph_sha256: "3e9bc926951480c35385efe5650d9d781631bd74c37a523d543b5fbe06b01ce6",
+				integrity_contradictions: []
+			}
+		};
+		summary = {
+			browser_windows: 0,
+			explicit_web_preferences: 0,
+			preload_entrypoints: 0,
+			context_bridge_apis: 0,
+			exposed_api_members: 0,
+			ipc: {
+				operations: 0,
+				literal_channels: 0,
+				dynamic_channel_operations: 0,
+				renderer_transmissions: 0,
+				renderer_listeners: 0,
+				main_handlers: 0,
+				paired_renderer_transmissions: 0,
+				ambiguous_renderer_transmissions: 0,
+				unpaired_literal_renderer_transmissions: 0
+			},
+			sender_validation_observations: 0,
+			utility_processes: 0,
+			resolved_utility_entrypoints: 0,
+			native_addon_bindings: 0,
+			resolved_native_addon_bindings: 0
+		};
+		statistics = {
+			relevant_files: 1,
+			nested_asar_containers: 0,
+			text_bytes_read: 60,
+			invalid_utf8_files: 0,
+			parsed_javascript_files: 1,
+			visited_ast_nodes: 12,
+			findings: 1,
+			modules: 0,
+			parse_failures: 0
+		};
+		modulePath = "parser.mjs";
+		limitations = ["This example retains export and return-shape facts only; other application and semantic relationships are omitted."];
+		exampleEvidence = (property) => {
+			const metadata = captures[property];
+			const source = `export default () => ({ kind: "results", ${property}: query() });\n`;
+			const artifact = createWebTextArtifact(source, "text/javascript");
+			const ir = analyzeJavaScriptSemantics(source);
+			const link = ir.moduleLinks.find(({ exportedName }) => exportedName === "default");
+			if (link === undefined) throw new Error("Example source must define a default export");
+			const coverage = ir.coverage.status === "complete" ? completeApplicationCoverage() : partialApplicationCoverage([], ir.coverage.omittedCount);
+			const projection = projectJavaScriptExportReturnShapes({
+				ir,
+				link,
+				modulePath,
+				baseCoverage: coverage
+			});
+			if (projection === null) throw new Error("Example export must retain return shapes");
+			const evidence = {
+				artifact: {
+					available: true,
+					artifact_id: `art_${artifact.sha256}`,
+					sha256: artifact.sha256
+				},
+				location: {
+					available: true,
+					value: {
+						kind: "source-range",
+						source: modulePath,
+						...link.location
+					}
+				},
+				extractor: {
+					name: "rea-javascript-artifact-reconstruction",
+					version: "1",
+					operation: "recover-module-export",
+					executable_sha256: null
+				},
+				coverage,
+				limitations: ir.limitations,
+				evidence_ids: []
+			};
+			const exported = createJavaScriptApplicationNode({
+				kind: "javascript-module",
+				identity: {
+					strategy: "artifact-local-key",
+					stability: "artifact-version",
+					artifact_sha256: artifact.sha256,
+					namespace: "module-export",
+					key: `${metadata.root_artifact_sha256}:${modulePath}:default`
+				},
+				observations: [{
+					label: `${modulePath}:default`,
+					properties: {
+						semantic_role: "export-binding",
+						module_path: modulePath,
+						relationship_kind: link.kind,
+						exported_name: link.exportedName,
+						local_name: link.localName,
+						imported_name: link.importedName,
+						declared_specifier: link.specifier
+					},
+					evidence: {
+						...evidence,
+						authority: "ast-static-analysis",
+						state: "observed",
+						confidence: "exact"
+					}
+				}, {
+					label: `${modulePath}:default:return-shapes`,
+					properties: projection.properties,
+					evidence: {
+						...evidence,
+						authority: "static-relationship-inference",
+						state: "inferred",
+						confidence: "high",
+						location: {
+							available: true,
+							value: {
+								kind: "source-range",
+								source: modulePath,
+								...projection.range
+							}
+						},
+						extractor: {
+							...evidence.extractor,
+							operation: "recover-export-return-shapes"
+						},
+						coverage: projection.coverage,
+						limitations: projection.limitations
+					}
+				}]
+			});
+			const graph = createJavaScriptApplicationGraph({
+				schema: "JavaScriptApplicationGraph",
+				root_node_ids: [exported.node_id],
+				nodes: [exported],
+				edges: [],
+				coverage: partialApplicationCoverage([], null),
+				limitations
+			});
+			const evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
+			const module = createJavaScriptSemanticGraphNode({
+				kind: "module",
+				identity: {
+					artifact_sha256: artifact.sha256,
+					module_path: modulePath,
+					source_range: null,
+					role_key: "example-module"
+				},
+				function_node_id: null,
+				application_node_ids: [exported.node_id],
+				label: modulePath,
+				properties: {},
+				evidence: {
+					...evidence,
+					authority: "ast-static-analysis",
+					state: "observed",
+					confidence: "exact"
+				}
+			}, evidenceContexts);
+			const semanticGraph = createJavaScriptSemanticGraph({
+				schema: "JavaScriptSemanticRelationGraph",
+				root_artifact_sha256: metadata.root_artifact_sha256,
+				application_graph_id: graph.graph_id,
+				root_node_ids: [module.node_id],
+				evidence_contexts: evidenceContexts.contexts,
+				nodes: [module],
+				relations: [],
+				fingerprints: [],
+				unknowns: [],
+				coverage: {
+					status: "unknown",
+					truncated: false,
+					omitted_nodes: null,
+					omitted_relations: null,
+					limits: [],
+					families: JAVASCRIPT_SEMANTIC_RELATION_FAMILIES.map((family) => ({
+						family,
+						status: "unknown",
+						retained_relations: 0,
+						omitted_relations: null,
+						unknown_ids: []
+					}))
+				},
+				limitations
+			});
+			const result = javascriptApplicationAnalysisResultSchema.parse({
+				...metadata,
+				format: "directory",
+				graph,
+				semantic_graph: semanticGraph,
+				summary,
+				statistics,
+				limitations
+			});
+			return createEvidence({
+				path: result.input_path,
+				sha256: result.root_artifact_sha256,
+				format: "directory"
+			}, {
+				id: "rea-javascript-application",
+				name: "REA JavaScript application analyzer",
+				version: "1"
+			}, {
+				predicateType: "rea.javascript-application-analysis",
+				operation: "analyze_javascript_application",
+				parameters: {},
+				result,
+				confidence: "derived",
+				authority: "shipped-artifact",
+				limitations
+			});
+		};
+		JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE = {
+			left: exampleEvidence("count"),
+			right: exampleEvidence("total"),
+			left_module_path: modulePath,
+			left_export_name: "default",
+			right_module_path: modulePath,
+			right_export_name: "default"
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/mobileApplicationGraphExamples.js
+var inventory$1, provider$1, ANDROID_APPLICATION_GRAPH_EXAMPLE, APPLE_APPLICATION_GRAPH_EXAMPLE, MACOS_APPLICATION_GRAPH_EXAMPLE, HARMONY_APPLICATION_GRAPH_EXAMPLE;
+function init_mobileApplicationGraphExamples() {
+	return (init_mobileApplicationGraphExamples = __esmMin((() => {
+		init_canonicalDigest();
+		init_evidence();
+		init_jsonValue();
+		inventory$1 = (format, digit) => {
+			const sha = digit.repeat(64);
+			const artifactId = `art_${digestCanonicalValue({ sha256: sha }, "Artifact inventory")}`;
+			const occurrenceId = `occ_${digestCanonicalValue({ root: artifactId }, "Artifact inventory")}`;
+			const nodes = [{
+				artifact_id: artifactId,
+				format: format === "directory" ? "directory" : "zip",
+				sha256: sha,
+				size: 1,
+				media_type: null,
+				architecture: null,
+				content_state: "materialized",
+				limitations: []
+			}];
+			const occurrences = [{
+				occurrence_id: occurrenceId,
+				artifact_id: artifactId,
+				parent_occurrence_id: null,
+				logical_path: ".",
+				entry_kind: "file",
+				artifact_kind: "resource",
+				artifact_format: format,
+				declared_size: 1,
+				compressed_size: null,
+				executable: false,
+				encrypted: false,
+				hash_status: "verified",
+				source_location: null,
+				limitations: []
+			}];
+			const graphSha256 = digestCanonicalValue({
+				nodes,
+				occurrences,
+				edges: [],
+				integrity_contradictions: []
+			}, "Artifact inventory");
+			return jsonValueSchema.parse({
+				manifest: {
+					manifest_id: `agm_${digestCanonicalValue({
+						root_artifact_id: artifactId,
+						graph_sha256: graphSha256
+					}, "Artifact inventory")}`,
+					root_artifact_id: artifactId,
+					root_sha256: sha,
+					root_format: format,
+					graph_sha256: graphSha256,
+					node_count: nodes.length,
+					occurrence_count: occurrences.length,
+					edge_count: 0
+				},
+				nodes,
+				occurrences,
+				edges: [],
+				provenance: [],
+				limitations: []
+			});
+		};
+		provider$1 = {
+			id: "rea-artifact-graph",
+			name: "REA safe artifact graph provider",
+			version: "1"
+		};
+		ANDROID_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.apk",
+			sha256: "a".repeat(64),
+			format: "apk"
+		}, provider$1, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory$1("apk", "a"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+		APPLE_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.ipa",
+			sha256: "b".repeat(64),
+			format: "ipa"
+		}, provider$1, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory$1("ipa", "b"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+		MACOS_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.app",
+			sha256: "c".repeat(64),
+			format: "directory"
+		}, provider$1, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory$1("directory", "c"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+		HARMONY_APPLICATION_GRAPH_EXAMPLE = { inventory_evidence: [createEvidence({
+			path: "Fixture.hap",
+			sha256: "d".repeat(64),
+			format: "hap"
+		}, provider$1, {
+			operation: "inventory_artifact",
+			parameters: {},
+			result: inventory$1("hap", "d"),
+			confidence: "observed",
+			authority: "shipped-artifact"
+		})] };
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/applicationToolContracts.js
+function applicationToolContract(name) {
+	const contract = APPLICATION_TOOL_CONTRACTS.find(({ name: candidate }) => candidate === name);
+	if (contract === undefined) throw new Error(`Missing application tool contract: ${name}`);
+	return contract;
+}
+var traceOutputSchema, semanticTraceOutputSchema, comparisonOutputSchema, sourceToBundleOutputSchema, exportShapeComparisonOutputSchema, reconstructionObligationLedgerOutputSchema, HASH, retained, APPLICATION_TOOL_CONTRACTS;
+function init_applicationToolContracts() {
+	return (init_applicationToolContracts = __esmMin((() => {
+		init_javascriptApplicationVersionComparisonSchemas();
+		init_javascriptFeatureTraceSchemas();
+		init_javascriptSemanticTraceSchemas();
+		init_javascriptExportShapeComparisonSchemas();
+		init_sourceToBundleComparisonSchemas();
+		init_applicationWorkflowInputContracts();
+		init_reconstructionCoverageInput();
+		init_reconstructionCoverage();
+		init_reconstructionObligationLedgerSchemas();
+		init_androidApplication();
+		init_appleApplication();
+		init_harmonyApplication();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_javascriptApplicationWorkflowExamples();
+		init_javascriptExportShapeComparisonExample();
+		init_mobileApplicationGraphExamples();
+		traceOutputSchema = evidenceResultOf(applicationFeatureTraceResultSchema);
+		semanticTraceOutputSchema = evidenceResultOf(javaScriptSemanticTraceResultSchema);
+		comparisonOutputSchema = evidenceResultOf(applicationVersionComparisonResultSchema);
+		sourceToBundleOutputSchema = evidenceResultOf(sourceToBundleComparisonResultSchema);
+		exportShapeComparisonOutputSchema = evidenceResultOf(javaScriptExportShapeComparisonResultSchema);
+		reconstructionObligationLedgerOutputSchema = evidenceResultOf(reconstructionObligationLedgerSchema);
+		HASH = "0".repeat(64);
+		retained = (evidence_id) => ({
+			kind: "retained-evidence",
+			evidence_id
+		});
+		APPLICATION_TOOL_CONTRACTS = [
+			{
+				name: "trace_application_feature",
+				...toolContractMetadata("trace_application_feature"),
+				description: "Trace a typed literal seed through every reachable part of an authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.",
+				kind: "application",
+				inputSchema: traceApplicationFeatureRequestSchema,
+				outputSchema: traceOutputSchema,
+				examples: [{
+					title: "Trace one module seed through a retained application graph",
+					input: JAVASCRIPT_FEATURE_TRACE_EXAMPLE
+				}, {
+					title: "Use exact Evidence already retained in this session",
+					input: {
+						...JAVASCRIPT_FEATURE_TRACE_EXAMPLE,
+						application: retained(JAVASCRIPT_FEATURE_TRACE_EXAMPLE.application.evidence_id)
+					}
+				}]
+			},
+			{
+				name: "trace_javascript_semantics",
+				...toolContractMetadata("trace_javascript_semantics"),
+				description: "Trace static JavaScript data-flow, direct call/return, and closure relations from inline application Evidence or an exact same-session retained reference. Dynamic or unsupported semantics remain explicit unknowns; static reachability never claims runtime execution.",
+				kind: "application",
+				inputSchema: traceJavaScriptSemanticsRequestSchema,
+				outputSchema: semanticTraceOutputSchema,
+				examples: [{
+					title: "Trace backward provenance from one semantic node",
+					input: {
+						application: JAVASCRIPT_FEATURE_TRACE_EXAMPLE.application,
+						query: {
+							seed: {
+								kind: "semantic-node",
+								node_id: `jsrg_node_${HASH}`
+							},
+							direction: "backward-provenance"
+						}
+					}
+				}]
+			},
+			{
+				name: "compare_application_versions",
+				...toolContractMetadata("compare_application_versions"),
+				description: "Compare two authenticated JavaScript Application Graph versions supplied as inline Evidence or exact same-session retained references. Uses unique-only exact digest, module source digest, source-map identity, structural fingerprint, and non-module semantic-key tiers. Reports added, removed, changed, ambiguous, and unknown entities plus the complete matching changed_from graph without fuzzy or module-ordinal pairing.",
+				kind: "application",
+				inputSchema: compareApplicationVersionsRequestSchema,
+				outputSchema: comparisonOutputSchema,
+				examples: [{
+					title: "Compare authenticated static and reconciled application graphs",
+					input: JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE
+				}, {
+					title: "Use exact Evidence already retained in this session",
+					input: {
+						...JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE,
+						left: retained(JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE.left.evidence_id),
+						right: retained(JAVASCRIPT_APPLICATION_VERSION_COMPARISON_EXAMPLE.right.evidence_id)
+					}
+				}]
+			},
+			{
+				name: "compare_source_to_bundle",
+				...toolContractMetadata("compare_source_to_bundle"),
+				description: "Compare a cryptographically committed HistoricalSourceGraph with authenticated JavaScript Application Graph Evidence supplied inline or by exact same-session retained reference. Uses explicit exact-digest, source-map path, current-path, suffix, and basename signals with stable weights. Classifies unchanged, modified, removed, split, merged, duplicated, and unknown; incomplete coverage and ambiguous weak signals never become absence or forced matches.",
+				kind: "application",
+				inputSchema: compareSourceToBundleRequestSchema,
+				outputSchema: sourceToBundleOutputSchema,
+				examples: [{
+					title: "Compare committed historical source with a shipped bundle graph",
+					input: SOURCE_TO_BUNDLE_COMPARISON_EXAMPLE
+				}]
+			},
+			{
+				name: "compare_javascript_export_shapes",
+				...toolContractMetadata("compare_javascript_export_shapes"),
+				description: "Compare static return shapes for one exact module/export selector on each authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Variants pair only by reciprocal unique literal discriminants. Each retained variant lists observed return-property names even when values stay unknown. Presence (present, absent, or unknown-coverage) is separate from value resolution: a name present on only one paired shape is added or removed when parent-property coverage is complete on both sides, including when the static value is unresolved. Dynamic values, incomplete parent coverage, and unpaired variants remain unknown. Reports JSON Pointer changes without executing JavaScript; runtime behavior requires a separate agent-run probe.",
+				kind: "application",
+				inputSchema: compareJavaScriptExportShapesRequestSchema,
+				outputSchema: exportShapeComparisonOutputSchema,
+				examples: [{
+					title: "Report observed return-property presence when static values stay unknown",
+					input: JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE
+				}, {
+					title: "Use exact Evidence already retained in this session",
+					input: {
+						...JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE,
+						left: retained(JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE.left.evidence_id),
+						right: retained(JAVASCRIPT_EXPORT_SHAPE_COMPARISON_EXAMPLE.right.evidence_id)
+					}
+				}]
+			},
+			{
+				name: "build_reconstruction_obligation_ledger",
+				...toolContractMetadata("build_reconstruction_obligation_ledger"),
+				description: "Generate the complete deterministic ReconstructionObligationLedger from an authenticated Evidence bundle, reviewed obligations, and an explicit reconstruction manifest. Static candidates remain candidates; duplicate ownership, missing original or reconstruction cases, missing parser/type, weak verifier authority, unenumerated claims, contradictions, dependencies, and residual unknowns fail closed. The inline result carries the full-ledger closure digest and typed per-obligation diagnostics.",
+				kind: "application",
+				inputSchema: reconstructionObligationLedgerInputSchema,
+				outputSchema: reconstructionObligationLedgerOutputSchema,
+				examples: [{
+					title: "Generate the complete obligation ledger",
+					input: {
+						evidence_bundle: {
+							artifacts: [],
+							providers: [],
+							environments: [],
+							scenarios: [],
+							captures: [],
+							unknowns: [],
+							records: []
+						},
+						reviewed_obligations: [],
+						manifest: {
+							bindings: [],
+							contradictions: []
+						}
+					}
+				}]
+			},
+			{
+				name: "evaluate_reconstruction_coverage",
+				...toolContractMetadata("evaluate_reconstruction_coverage"),
+				description: "Evaluate inline evidence-backed reconstruction coverage against one named boundary. Missing ownership or inventory is partial; stale, weak, truncated, skipped, or unresolved proof is unknown; contradictions, failed proof, missing owners, and authority routing fail closed.",
+				kind: "application",
+				inputSchema: reconstructionCoverageEvaluationInputSchema,
+				outputSchema: reconstructionClosureResultSchema,
+				examples: [{
+					title: "Evaluate one replacement boundary",
+					input: {
+						coverage: {
+							evidence_bundle: {
+								artifacts: [],
+								providers: [],
+								environments: [],
+								scenarios: [],
+								captures: [],
+								unknowns: [],
+								records: []
+							},
+							artifacts: [],
+							surfaces: [],
+							owners: [],
+							claims: [],
+							verifier_contracts: [],
+							verifier_results: [],
+							residual_unknown_ids: [],
+							contradictions: [],
+							package_proofs: [],
+							boundaries: [{
+								boundary_id: "replacement.cli",
+								title: "CLI replacement",
+								required_surface_ids: ["cli.help"],
+								required_claim_ids: ["claim.cli.help"],
+								required_package_proof_kinds: ["clean-install", "authority-independence"],
+								allowed_dispositions: [],
+								allowed_unknown_ids: []
+							}]
+						},
+						boundary_id: "replacement.cli"
+					}
+				}]
+			},
+			{
+				name: "project_android_application_graph",
+				...toolContractMetadata("project_android_application_graph"),
+				description: "Project authenticated APK inventory_artifact Evidence into an execution-free Android application inventory. Reports exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without decoding DEX, executing the APK, or claiming observed runtime calls.",
+				kind: "application",
+				inputSchema: androidApplicationProjectionInputSchema,
+				outputSchema: evidenceResultOf(androidApplicationProjectionResultSchema),
+				examples: [{
+					title: "Project APK inventory Evidence into an Android application graph",
+					input: ANDROID_APPLICATION_GRAPH_EXAMPLE
+				}]
+			},
+			{
+				name: "project_apple_application_graph",
+				...toolContractMetadata("project_apple_application_graph"),
+				description: "Project authenticated IPA, macOS .app directory, ZIP, or DMG inventory Evidence into an execution-free Apple application inventory. Reports application roots, nested bundles with path-convention roles (app extensions, XPC services, login items, privileged helpers, system extensions, frameworks), launchd plists, exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without parsing plist/CMS semantics or claiming observed runtime calls.",
+				kind: "application",
+				inputSchema: appleApplicationProjectionInputSchema,
+				outputSchema: evidenceResultOf(appleApplicationProjectionResultSchema),
+				examples: [{
+					title: "Project IPA inventory Evidence into an Apple application graph",
+					input: APPLE_APPLICATION_GRAPH_EXAMPLE
+				}, {
+					title: "Project a macOS .app directory inventory into its bundle anatomy",
+					input: MACOS_APPLICATION_GRAPH_EXAMPLE
+				}]
+			},
+			{
+				name: "project_harmony_application_graph",
+				...toolContractMetadata("project_harmony_application_graph"),
+				description: "Project authenticated HarmonyOS HAP, HSP, or App Pack inventory Evidence into an execution-free application inventory. Reports packaging-model hints (Stage module.json versus FA config.json), exact component paths and hashes (manifests, Ark bytecode, resources, native libraries, JavaScript, signing), App Pack child packages, runtime-family hints, and path-based N-API bridge hypotheses without decoding Ark bytecode, parsing manifest semantics, or claiming observed runtime calls.",
+				kind: "application",
+				inputSchema: harmonyApplicationProjectionInputSchema,
+				outputSchema: evidenceResultOf(harmonyApplicationProjectionResultSchema),
+				examples: [{
+					title: "Project HAP inventory Evidence into a HarmonyOS application graph",
+					input: HARMONY_APPLICATION_GRAPH_EXAMPLE
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/webScriptToolContracts.js
+var WEB_SCRIPT_TOOL_CONTRACTS;
+function init_webScriptToolContracts() {
+	return (init_webScriptToolContracts = __esmMin((() => {
+		init_webScriptExport();
+		init_webModuleTrace();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_webSourceLocation();
+		WEB_SCRIPT_TOOL_CONTRACTS = [
+			{
+				name: "trace_web_source_location",
+				...toolContractMetadata("trace_web_source_location"),
+				description: "Trace one generated position in an exported website script through an explicitly paired local source map. Verifies manifest, selected script and map SHA-256/byte identities; returns every equal-position mapping, reported source/root, resolved source URL, embedded sourcesContent and original position inline. One-based lines and zero-based UTF-16 columns; greatest generated position <= requested across lines. Duplicate sources and generated-only mappings remain distinct. Caller-selected pairing does not establish deployment authenticity or execution. Regular maps and inline indexed sections only; external section URLs are unsupported. No network access or application execution; uses the pinned upstream codec in an owned Node process with private temporary files, independent 192 MiB old-generation heap and 20-second deadline. 4 MiB map, 32 MiB reply; complete evidence or actionable resource failure. Cleanup may extend the deadline.",
+				kind: "application",
+				inputSchema: webSourceLocationInputSchema,
+				outputSchema: evidenceResultOf(webSourceLocationResultSchema),
+				examples: [{
+					title: "Trace a selected captured JavaScript point to embedded original source",
+					input: {
+						manifest_path: "/analysis/scripts/manifest.json",
+						script_index: 0,
+						source_map: {
+							path: "/analysis/app.js.map",
+							url: "https://example.test/app.js.map"
+						},
+						generated_position: {
+							line: 1,
+							column: 25
+						}
+					}
+				}]
+			},
+			{
+				name: "trace_web_module_imports",
+				...toolContractMetadata("trace_web_module_imports"),
+				description: "Trace one exported website script's outgoing native ES imports/re-exports, using exact URL and optional selected import-map context. Reads a local export_web_scripts manifest and verifies the selected source's SHA-256/size; returns source positions, native resolved URLs or exact errors, every matching captured candidate and explicit unknown execution. Query/fragment identities are preserved. Computed imports and bundler IDs remain unknown. Select importer_url for unknown inline/document-base context. Caller-supplied Chromium executes only a trusted REA resolver stub in an owned context with page requests locally fulfilled/blocked; no captured application execution or asset refetch. Requires absolute REA_BROWSER_EXECUTABLE for literal imports. 32 MiB manifest, 16 MiB source, 4 MiB map and 20-second native deadline; cleanup may extend the deadline.",
+				kind: "application",
+				inputSchema: webModuleTraceInputSchema,
+				outputSchema: evidenceResultOf(webModuleTraceResultSchema),
+				examples: [{
+					title: "Trace an exported module under a selected import map",
+					input: {
+						manifest_path: "/analysis/exported-scripts/manifest.json",
+						script_index: 0,
+						import_map: {
+							path: "/analysis/import-map.json",
+							base_url: "https://example.test/app/"
+						}
+					}
+				}]
+			},
+			{
+				name: "export_web_scripts",
+				...toolContractMetadata("export_web_scripts"),
+				description: "Export JavaScript bytes already retained in one local inspect_web_page or capture_browser_scenario JSON capture (normalized result or complete Evidence). Writes scripts and a digest-verified manifest into an absent absolute output_directory. Returns all source URLs, script or transaction/event references, unavailable states, and an analysis_input for analyze_javascript_application when any bytes were exported. Include script sources in inspect_web_page or select capture.network.response_body in scenarios. No refetch or execution. Safe unambiguous URL layouts preserve relative module paths; versions, query variants, inline scripts, and path collisions are isolated with explicit resolution limitations.",
+				kind: "application",
+				inputSchema: exportWebScriptsInputSchema,
+				outputSchema: evidenceResultOf(webScriptExportResultSchema),
+				examples: [{
+					title: "Export a saved website capture for static JavaScript analysis",
+					input: {
+						capture_path: "/analysis/capture.json",
+						output_directory: "/analysis/exported-scripts"
+					}
+				}]
+			}
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/webRuntimeToolContracts.js
+var WEB_RUNTIME_TOOL_CONTRACTS;
+function init_webRuntimeToolContracts() {
+	return (init_webRuntimeToolContracts = __esmMin((() => {
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		init_webExecution();
+		init_webEventListeners();
+		WEB_RUNTIME_TOOL_CONTRACTS = [{
+			name: "observe_web_execution",
+			...toolContractMetadata("observe_web_execution"),
+			description: "Instrument one selected CDP page for a finite, externally driven precise coverage window. Resets execution counters and prevents optimized execution until stopped. Returns complete nested UTF-16 ranges/counts, independently hashed script text and request initiator associations by session script ID. Does not navigate, click, evaluate selected code or close the externally owned page. Navigation ends document-scoped collection; workers and UI causality remain outside this claim. Emits an actual armed progress notification before external actions.",
+			kind: "browser-provider",
+			inputSchema: observeWebExecutionInputSchema,
+			outputSchema: evidenceResultOf(webExecutionSchema),
+			examples: [{
+				title: "Attribute externally triggered page execution",
+				input: {
+					cdp_endpoint: "http://127.0.0.1:9222",
+					target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+					observation_ms: 1e4
+				}
+			}]
+		}, {
+			name: "inspect_web_event_listeners",
+			...toolContractMetadata("inspect_web_event_listeners"),
+			description: "Inspect listeners registered directly on the first main-document CSS match in one selected CDP page. Returns event flags, native callback locations, source ownership and exact script text/digests inline. Does not dispatch events, evaluate JavaScript or invoke handlers. Delegated ancestor/framework listeners and execution history remain unknown. Releases REA's object group and transport, preserving the external page.",
+			kind: "browser-provider",
+			inputSchema: inspectWebEventListenersInputSchema,
+			outputSchema: evidenceResultOf(webEventListenersSchema),
+			examples: [{
+				title: "Find a selected button's callback source",
+				input: {
+					cdp_endpoint: "http://127.0.0.1:9222",
+					target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS",
+					selector: "#submit"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/webNetworkCaptureToolContracts.js
+var WEB_NETWORK_CAPTURE_TOOL_CONTRACTS;
+function init_webNetworkCaptureToolContracts() {
+	return (init_webNetworkCaptureToolContracts = __esmMin((() => {
+		init_webNetworkCapture();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		WEB_NETWORK_CAPTURE_TOOL_CONTRACTS = [{
+			name: "inspect_web_network_capture",
+			...toolContractMetadata("inspect_web_network_capture"),
+			description: "Inspect retained local HAR 1.2 or native mitmproxy capture records without contacting recorded URLs. Returns original ordinals, pointers/byte ranges, preserved producer fields, precise numeric representations and exact exposed binary bytes inline. Excludes known transport credentials and explicitly marked values. Decodes every record before optional ordinal selection; malformed or oversized captures return no partial success. Duplicate HAR members are invalid; prototype-named members such as __proto__ are preserved as ordinary own JSON members without prototype mutation. Uses pinned upstream parsers, owned temporary files and bounded offline processes. Native mitmproxy requires caller-supplied mitmdump 12.2.3 on Linux. Browser transaction IDs, runtime attribution and original bytes of HAR Unicode text remain unknown.",
+			kind: "browser-provider",
+			inputSchema: inspectWebNetworkCaptureInputSchema,
+			outputSchema: evidenceResultOf(webNetworkCaptureSchema),
+			examples: [{
+				title: "Inspect historical HAR entries",
+				input: {
+					capture_path: "/captures/session.har",
+					format: "har",
+					record_ordinals: [0, 2]
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/javascript/javascriptRecoveryToolContracts.js
+var JAVASCRIPT_RECOVERY_TOOL_CONTRACTS;
+function init_javascriptRecoveryToolContracts() {
+	return (init_javascriptRecoveryToolContracts = __esmMin((() => {
+		init_javascriptRecovery();
+		init_toolEffects();
+		init_toolOutputSchemaPrimitives();
+		JAVASCRIPT_RECOVERY_TOOL_CONTRACTS = [{
+			name: "recover_javascript_sources",
+			...toolContractMetadata("recover_javascript_sources"),
+			kind: "application",
+			description: "Recover readable modules from local UTF-8 JavaScript scripts/bundles into an absent directory, using caller-supplied Wakaru ^1.13.0 (verified with 1.14.0) on Linux x64. Use additional_paths for related chunks; each input retains its own snapshot and provenance. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB total input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
+			inputSchema: javascriptRecoveryInputSchema,
+			outputSchema: evidenceResultOf(javascriptRecoveryResultSchema),
+			examples: [{
+				title: "Recover a captured production bundle",
+				input: {
+					path: "/tmp/web-scripts/app.js",
+					output_directory: "/tmp/recovered-app"
+				}
+			}, {
+				title: "Recover a code-split bundle together",
+				input: {
+					path: "/tmp/web-scripts/main.js",
+					additional_paths: [
+						"/tmp/web-scripts/runtime.js",
+						"/tmp/web-scripts/shared.js",
+						"/tmp/web-scripts/checkout.chunk.js"
+					],
+					output_directory: "/tmp/recovered-chunks"
+				}
+			}]
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/unknownContractExamples.js
+var UNKNOWN_CONTRACT_EXAMPLES;
+function init_unknownContractExamples() {
+	return (init_unknownContractExamples = __esmMin((() => {
+		UNKNOWN_CONTRACT_EXAMPLES = {
+			list_unknowns: {},
+			record_unknown: {
+				question: "Does this branch require an unavailable external service?",
+				severity: "medium",
+				domain: "protocol",
+				required_authority: "controlled-replay",
+				required_confidence: "observed",
+				required_environment: null,
+				recommended_probes: [{
+					operation: "capture_process_scenario",
+					rationale: "Replay branch."
+				}],
+				relationships: []
+			},
+			update_unknown: {
+				unknown_id: `unk_${"0".repeat(64)}`,
+				expected_revision: 1,
+				status: "investigating",
+				severity: "medium",
+				supporting_evidence_ids: [],
+				contradicting_evidence_ids: [],
+				required_authority: "controlled-replay",
+				required_confidence: "observed",
+				required_environment: null,
+				recommended_probes: [],
+				relationships: [],
+				resolution: null
+			},
+			verify_unknown_resolution: { unknown_id: `unk_${"0".repeat(64)}` }
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/artifactComparisonExample.js
+var inventory, provider, ARTIFACT_COMPARISON_EXAMPLE;
+function init_artifactComparisonExample() {
+	return (init_artifactComparisonExample = __esmMin((() => {
+		init_canonicalDigest();
+		init_evidence();
+		init_jsonValue();
+		inventory = (digit) => {
+			const sha = digit.repeat(64);
+			const artifactId = `art_${digestCanonicalValue({ sha256: sha }, "Artifact example")}`;
+			const occurrenceId = `occ_${digestCanonicalValue({ root: artifactId }, "Artifact example")}`;
+			const nodes = [{
+				artifact_id: artifactId,
+				format: "file",
+				sha256: sha,
+				size: 1,
+				media_type: null,
+				architecture: null,
+				content_state: "materialized",
+				limitations: []
+			}];
+			const occurrences = [{
+				occurrence_id: occurrenceId,
+				artifact_id: artifactId,
+				parent_occurrence_id: null,
+				logical_path: ".",
+				entry_kind: "file",
+				artifact_kind: "resource",
+				artifact_format: "file",
+				declared_size: 1,
+				compressed_size: null,
+				executable: false,
+				encrypted: false,
+				hash_status: "verified",
+				source_location: null,
+				limitations: []
+			}];
+			const graphSha256 = digestCanonicalValue({
+				nodes,
+				occurrences,
+				edges: [],
+				integrity_contradictions: []
+			}, "Artifact example");
+			return jsonValueSchema.parse({
+				manifest: {
+					manifest_id: `agm_${digestCanonicalValue({
+						root_artifact_id: artifactId,
+						graph_sha256: graphSha256
+					}, "Artifact example")}`,
+					root_artifact_id: artifactId,
+					root_sha256: sha,
+					root_format: "file",
+					graph_sha256: graphSha256,
+					node_count: nodes.length,
+					occurrence_count: occurrences.length,
+					edge_count: 0
+				},
+				nodes,
+				occurrences,
+				edges: [],
+				provenance: [],
+				limitations: []
+			});
+		};
+		provider = {
+			id: "rea-artifact",
+			name: "REA artifact graph",
+			version: "1"
+		};
+		ARTIFACT_COMPARISON_EXAMPLE = {
+			left: createEvidence({
+				path: "fixture-left",
+				sha256: "0".repeat(64),
+				format: "file"
+			}, provider, {
+				operation: "inventory_artifact",
+				parameters: {},
+				result: inventory("0"),
+				confidence: "observed",
+				authority: "shipped-artifact"
+			}),
+			right: createEvidence({
+				path: "fixture-right",
+				sha256: "1".repeat(64),
+				format: "file"
+			}, provider, {
+				operation: "inventory_artifact",
+				parameters: {},
+				result: inventory("1"),
+				confidence: "observed",
+				authority: "shipped-artifact"
+			})
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/functionComparisonExample.js
+var dossier, observe, FUNCTION_COMPARISON_EXAMPLE;
+function init_functionComparisonExample() {
+	return (init_functionComparisonExample = __esmMin((() => {
+		init_enhancedInputs();
+		init_evidence();
+		init_jsonValue();
+		dossier = (text) => jsonValueSchema.parse({
+			procedure: {
+				address: "0x1000",
+				name: "main",
+				classification: null,
+				body: {
+					available: false,
+					reason: "The fixture omits function-body extent observations."
+				},
+				signature: "int main(void)",
+				locals: []
+			},
+			pseudocode: text,
+			assembly: [],
+			comments: [],
+			callers: [],
+			callees: [],
+			incoming_references: [],
+			outgoing_references: [],
+			referenced_strings: [],
+			referenced_names: [],
+			basic_blocks: [{
+				start: "0x1000",
+				end: "0x1001",
+				successors: []
+			}],
+			native_api: null,
+			native_value_flow: null,
+			limitations: ["The fixture omits native API and value-flow observations."]
+		});
+		observe = (digit, text) => createEvidence({
+			path: `/tmp/function-${digit}`,
+			sha256: digit.repeat(64),
+			format: "mach-o"
+		}, {
+			id: "rea-workflow",
+			name: "REA composed investigation workflow",
+			version: "1"
+		}, {
+			operation: "analyze_function",
+			parameters: enhancedInputSchemas.analyze_function.parse({ procedure: "main" }),
+			result: dossier(text),
+			confidence: "derived",
+			authority: "shipped-artifact"
+		});
+		FUNCTION_COMPARISON_EXAMPLE = {
+			left: observe("0", "return 0;"),
+			right: observe("1", "return 1;")
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/domain/process/processCaptureExample.js
+var normalization, scenario, comparisonContract, EMPTY_PROCESS_CAPTURE_EXAMPLE, finalizedScenario, finalizedComparisonContract, FINALIZED_PROCESS_CAPTURE_EXAMPLE;
+function init_processCaptureExample() {
+	return (init_processCaptureExample = __esmMin((() => {
+		init_processScenario();
+		normalization = {
+			paths: true,
+			pids: true,
+			ports: true,
+			time_bucket_ms: 10,
+			patterns: []
+		};
+		scenario = { executable_sha256: "0".repeat(64) };
+		comparisonContract = {};
+		EMPTY_PROCESS_CAPTURE_EXAMPLE = {
+			manifest: {
+				rea_version: "1.1.0",
+				provider_version: "3",
+				platform: "fixture",
+				architecture: "fixture",
+				pty_backend: "node-pty",
+				started_at: "2026-01-01T00:00:00.000Z",
+				completed_at: "2026-01-01T00:00:00.001Z",
+				scenario,
+				comparison_contract: comparisonContract,
+				full_scenario_sha256: digestProcessCommitment(scenario),
+				comparison_contract_sha256: digestProcessCommitment(comparisonContract),
+				selected_executable_sha256: "0".repeat(64),
+				executable_sha256: "0".repeat(64),
+				executable_identity: {
+					state: "path_metadata_unchanged",
+					reason: null
+				},
+				normalization_sha256: digestProcessCommitment(normalization)
+			},
+			normalization,
+			frames: [],
+			rendered_frames: [],
+			interaction_events: [],
+			exit: {
+				code: 0,
+				signal: null,
+				reason: "exited"
+			},
+			settlement: {
+				state: "quiesced",
+				elapsed_ms: 50,
+				cleanup_outcome: "not_required"
+			},
+			process_samples: [],
+			filesystem_checkpoints: [{
+				name: "before",
+				at_ms: 0,
+				files: [],
+				effects: [],
+				truncated: false
+			}, {
+				name: "after_settlement",
+				at_ms: 50,
+				files: [],
+				effects: [],
+				truncated: false
+			}],
+			event_journal: [],
+			files_before: [],
+			files_after: [],
+			filesystem_effects: [],
+			truncated: false,
+			truncation_details: {
+				raw_terminal: {
+					budget_bytes: 1e6,
+					observed_bytes: 0,
+					retained_bytes: 0,
+					observed_frames: 0,
+					retained_frames: 0
+				},
+				rendered_terminal: {
+					budget_bytes: 1e6,
+					observed_bytes: 0,
+					retained_bytes: 0,
+					observed_frames: 0,
+					retained_frames: 0
+				},
+				filesystem_before: {
+					files_limit: 1e4,
+					depth_limit: 16,
+					enumeration_truncated: false,
+					enumeration_reasons: [],
+					hash_budget_bytes: 1e7,
+					hashed_bytes: 0,
+					hash_omissions: []
+				},
+				filesystem_after: {
+					files_limit: 1e4,
+					depth_limit: 16,
+					enumeration_truncated: false,
+					enumeration_reasons: [],
+					hash_budget_bytes: 1e7,
+					hashed_bytes: 0,
+					hash_omissions: []
+				},
+				process: {
+					sample_limit: 1e3,
+					sampling_partial: false,
+					retained_samples: 0,
+					sample_limit_reached: false,
+					sampling_failures: 0,
+					first_sampling_failure: null,
+					coverage: "sampled"
+				}
+			},
+			limitations: [],
+			residual_unknowns: [],
+			cleanup: {
+				owned_process_group: "verified",
+				temporary_root: "removed"
+			}
+		};
+		finalizedScenario = {
+			...scenario,
+			finalization_ms: 1500
+		};
+		finalizedComparisonContract = { finalization_ms: 1500 };
+		FINALIZED_PROCESS_CAPTURE_EXAMPLE = {
+			...EMPTY_PROCESS_CAPTURE_EXAMPLE,
+			manifest: {
+				...EMPTY_PROCESS_CAPTURE_EXAMPLE.manifest,
+				scenario: finalizedScenario,
+				comparison_contract: finalizedComparisonContract,
+				full_scenario_sha256: digestProcessCommitment(finalizedScenario),
+				comparison_contract_sha256: digestProcessCommitment(finalizedComparisonContract)
+			},
+			exit: {
+				code: null,
+				signal: 0,
+				reason: "timeout",
+				finalization: {
+					requested_ms: 1500,
+					elapsed_ms: 12,
+					exit_code: 0,
+					signals: [{
+						signal: "SIGTERM",
+						sent_at_ms: 0,
+						delivery: "signaled"
+					}]
+				}
+			}
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/domain/functionDossierEvidence.js
+var parseFunctionEvidence;
+function init_functionDossierEvidence() {
+	return (init_functionDossierEvidence = __esmMin((() => {
+		init_evidence();
+		init_unicodeCodePointOrder();
+		init_hopperValues();
+		parseFunctionEvidence = (input) => {
+			const evidence = parseEvidence(input);
+			if (evidence.operation !== "analyze_function") throw new TypeError("Function comparison requires analyze_function Evidence");
+			if (evidence.subject === null) throw new TypeError("Function comparison requires artifact-bound Evidence");
+			const dossier = functionDossierSchema.parse(evidence.normalized_result);
+			return {
+				evidence,
+				subject: evidence.subject,
+				dossier,
+				limitations: [...new Set([...evidence.limitations, ...dossier.limitations])].sort((left, right) => compareUnicodeCodePoints(left, right))
+			};
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/domain/functionComparisonNormalization.js
+var identityProjection, functionMatch, normalizeCfg, referenceProjection, referenceKindProjection, commentProjection, stringAndNameProjection, sorted, isAutoName, parseAddress, relativeAddress;
+function init_functionComparisonNormalization() {
+	return (init_functionComparisonNormalization = __esmMin((() => {
+		init_comparisonSemantics();
+		init_unicodeCodePointOrder();
+		identityProjection = (snapshot) => ({
+			name: snapshot.dossier.procedure.name,
+			signature: snapshot.dossier.procedure.signature,
+			locals: snapshot.dossier.procedure.locals.map(({ description }) => description).sort()
+		});
+		functionMatch = (left, right) => {
+			if (!isAutoName(left.dossier.procedure.name) && left.dossier.procedure.name === right.dossier.procedure.name) return {
+				status: "matched",
+				method: "symbol",
+				left_name: left.dossier.procedure.name,
+				right_name: right.dossier.procedure.name
+			};
+			return {
+				status: left.dossier.procedure.name === right.dossier.procedure.name ? "ambiguous" : "mismatched",
+				method: "explicit",
+				left_name: left.dossier.procedure.name,
+				right_name: right.dossier.procedure.name
+			};
+		};
+		normalizeCfg = (blocks) => {
+			const parsed = [];
+			for (const block of blocks) {
+				const start = parseAddress(block.start);
+				const end = parseAddress(block.end);
+				if (start === null || end === null || end <= start) return null;
+				parsed.push({
+					block,
+					start,
+					end
+				});
+			}
+			const ordered = parsed.sort((left, right) => left.start < right.start ? -1 : left.start > right.start ? 1 : 0);
+			if (new Set(ordered.map(({ start }) => start)).size !== ordered.length) return null;
+			const indices = new Map(ordered.map(({ start }, index) => [start, index]));
+			const graph = [];
+			for (const { block, start, end } of ordered) {
+				const successors = [];
+				for (const address of block.successors) {
+					const parsedAddress = parseAddress(address);
+					if (parsedAddress === null) return null;
+					const index = indices.get(parsedAddress);
+					if (index === undefined) return null;
+					successors.push(index);
+				}
+				graph.push({
+					size: String(end - start),
+					successors: successors.sort((left, right) => left - right)
+				});
+			}
+			return graph;
+		};
+		referenceProjection = (snapshot) => sorted([...snapshot.dossier.incoming_references.map((item) => ({
+			direction: "in",
+			source: item.source_procedure?.name ?? null,
+			target: item.target_procedure?.name ?? null
+		})), ...snapshot.dossier.outgoing_references.map((item) => ({
+			direction: "out",
+			source: item.source_procedure?.name ?? null,
+			target: item.target_procedure?.name ?? null
+		}))]);
+		referenceKindProjection = (snapshot) => {
+			const edges = [...snapshot.dossier.incoming_references.map((edge) => ({
+				direction: "in",
+				edge
+			})), ...snapshot.dossier.outgoing_references.map((edge) => ({
+				direction: "out",
+				edge
+			}))];
+			if (edges.some(({ edge }) => !edge.kind.available)) return null;
+			return sorted(edges.map(({ direction, edge }) => {
+				if (!edge.kind.available) throw new TypeError("Reference-kind availability changed during projection");
+				return {
+					direction,
+					source: edge.source_procedure?.name ?? null,
+					target: edge.target_procedure?.name ?? null,
+					type: edge.kind.type,
+					flow: edge.kind.flow,
+					call: edge.kind.call,
+					jump: edge.kind.jump,
+					data: edge.kind.data,
+					read: edge.kind.read,
+					write: edge.kind.write,
+					indirect: edge.kind.indirect,
+					computed: edge.kind.computed,
+					conditional: edge.kind.conditional,
+					terminal: edge.kind.terminal,
+					primary: edge.kind.primary,
+					operand_index: edge.kind.operand_index,
+					external: edge.kind.external
+				};
+			}));
+		};
+		commentProjection = (snapshot) => {
+			const values = snapshot.dossier.comments.map(({ address, kind, text }) => ({
+				offset: relativeAddress(address, snapshot.dossier.procedure.address),
+				kind,
+				text
+			}));
+			return values.some(({ offset }) => offset === null) ? null : sorted(values);
+		};
+		stringAndNameProjection = (snapshot) => {
+			const values = [...snapshot.dossier.referenced_strings.map(({ source_address: sourceAddress, value }) => ({
+				kind: "string",
+				source_offset: relativeAddress(sourceAddress, snapshot.dossier.procedure.address),
+				value
+			})), ...snapshot.dossier.referenced_names.map(({ source_address: sourceAddress, value }) => ({
+				kind: "name",
+				source_offset: relativeAddress(sourceAddress, snapshot.dossier.procedure.address),
+				value
+			}))];
+			return values.some(({ source_offset: offset }) => offset === null) ? null : sorted(values);
+		};
+		sorted = (values) => values.map((value) => ({
+			value,
+			json: canonicalJson(value, "Function normalization")
+		})).sort((left, right) => compareUnicodeCodePoints(left.json, right.json)).map(({ value }) => value);
+		isAutoName = (name) => /^(?:sub_[0-9a-f]+|fcn\.[0-9a-f]+|FUN_[0-9a-f]+)$/iu.test(name);
+		parseAddress = (value) => /^0x[0-9a-f]+$/iu.test(value) ? BigInt(value) : null;
+		relativeAddress = (value, base) => {
+			const parsed = parseAddress(value);
+			const parsedBase = parseAddress(base);
+			return parsed === null || parsedBase === null || parsed < parsedBase ? null : String(parsed - parsedBase);
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/domain/functionComparisonResults.js
+var dimensionResult, unresolvedDimension, overallStatus, summarize, digest;
+function init_functionComparisonResults() {
+	return (init_functionComparisonResults = __esmMin((() => {
+		init_canonicalDigest();
+		dimensionResult = (input) => {
+			const context = {
+				dimension: input.dimension,
+				left_digest: digest(input.left),
+				right_digest: digest(input.right),
+				left_count: input.leftCount,
+				right_count: input.rightCount,
+				text_delta: input.textDelta,
+				evidence_links: [...input.links],
+				limitations: [...input.limitations]
+			};
+			if (input.status === "unchanged") return {
+				...context,
+				status: "unchanged",
+				conclusion_kind: "derived_relationship"
+			};
+			return {
+				...context,
+				status: "changed",
+				conclusion_kind: input.providersDiffer ? "contradiction" : "derived_relationship"
+			};
+		};
+		unresolvedDimension = (input) => ({
+			dimension: input.dimension,
+			status: "unknown",
+			left_digest: null,
+			right_digest: null,
+			left_count: input.leftCount,
+			right_count: input.rightCount,
+			text_delta: null,
+			conclusion_kind: "unresolved_branch",
+			evidence_links: [...input.links],
+			limitations: [...input.limitations]
+		});
+		overallStatus = (dimensions, match) => {
+			if (match === "ambiguous" || dimensions.some(({ status }) => status === "unknown")) return "unknown";
+			if (match === "mismatched") return "changed";
+			return dimensions.some(({ status }) => status === "changed") ? "changed" : "unchanged";
+		};
+		summarize = (dimensions) => ({
+			unchanged: dimensions.filter(({ status }) => status === "unchanged").length,
+			changed: dimensions.filter(({ status }) => status === "changed").length,
+			unknown: dimensions.filter(({ status }) => status === "unknown").length
+		});
+		digest = (value) => digestCanonicalValue(value, "Function comparison");
+	})))();
+}
+
+//#endregion
+//#region dist/domain/functionComparisonDimensions.js
+var compareDimensions, compareText, compareComments, compareStringsAndNames, compareReferences, compareIdentity, compareCalls, callProjection, compareCfg, compareValues;
+function init_functionComparisonDimensions() {
+	return (init_functionComparisonDimensions = __esmMin((() => {
+		init_comparisonSemantics();
+		init_functionComparisonNormalization();
+		init_functionComparisonResults();
+		compareDimensions = (left, right, context) => {
+			return [
+				compareIdentity(left, right, context),
+				compareText("pseudocode", left.dossier.pseudocode, right.dossier.pseudocode, context),
+				compareText("assembly", left.dossier.assembly.join("\n"), right.dossier.assembly.join("\n"), context),
+				compareComments(left, right, context),
+				compareCalls(left, right, context),
+				compareReferences(left, right, context),
+				compareStringsAndNames(left, right, context),
+				compareCfg(left, right, context)
+			];
+		};
+		compareText = (dimension, left, right, context) => {
+			const limitations = dimension === "assembly" ? ["Assembly is opaque provider text; relocation normalization is unavailable."] : [];
+			if (context.providersDiffer) return unresolvedDimension({
+				dimension,
+				links: context.links,
+				leftCount: [...left].length,
+				rightCount: [...right].length,
+				limitations: [...limitations, "Exact text comparison requires one provider identity."]
+			});
+			const changes = diffLines(left, right, {
+				timeout: 100,
+				maxEditLength: 1e4
+			});
+			if (changes === undefined) return unresolvedDimension({
+				dimension,
+				links: context.links,
+				leftCount: [...left].length,
+				rightCount: [...right].length,
+				limitations: ["Bounded line diff exceeded its time or edit-distance limit."]
+			});
+			const delta = changes.reduce((summary, change) => ({
+				added_lines: summary.added_lines + (change.added ? change.count ?? 0 : 0),
+				removed_lines: summary.removed_lines + (change.removed ? change.count ?? 0 : 0),
+				hunks: summary.hunks + (change.added || change.removed ? 1 : 0)
+			}), {
+				added_lines: 0,
+				removed_lines: 0,
+				hunks: 0
+			});
+			return dimensionResult({
+				dimension,
+				status: delta.hunks === 0 ? "unchanged" : "changed",
+				left,
+				right,
+				...context,
+				leftCount: [...left].length,
+				rightCount: [...right].length,
+				textDelta: delta,
+				limitations
+			});
+		};
+		compareComments = (left, right, context) => {
+			const leftValues = commentProjection(left);
+			const rightValues = commentProjection(right);
+			if (leftValues === null || rightValues === null) return unresolvedDimension({
+				dimension: "comments",
+				links: context.links,
+				leftCount: left.dossier.comments.length,
+				rightCount: right.dossier.comments.length,
+				limitations: ["Comment locations could not be normalized relative to the function."]
+			});
+			return compareValues("comments", leftValues, rightValues, context);
+		};
+		compareStringsAndNames = (left, right, context) => {
+			const leftValues = stringAndNameProjection(left);
+			const rightValues = stringAndNameProjection(right);
+			if (leftValues === null || rightValues === null) return unresolvedDimension({
+				dimension: "strings_names",
+				links: context.links,
+				leftCount: null,
+				rightCount: null,
+				limitations: ["Reference source locations could not be normalized to function offsets."]
+			});
+			return compareValues("strings_names", leftValues, rightValues, context);
+		};
+		compareReferences = (left, right, context) => {
+			const leftProjection = referenceProjection(left);
+			const rightProjection = referenceProjection(right);
+			if (leftProjection.length === 0 && rightProjection.length === 0) return compareValues("references", leftProjection, rightProjection, context);
+			if (canonicalJson(leftProjection, "Function comparison") !== canonicalJson(rightProjection, "Function comparison")) return dimensionResult({
+				dimension: "references",
+				status: "changed",
+				left: leftProjection,
+				right: rightProjection,
+				...context,
+				leftCount: leftProjection.length,
+				rightCount: rightProjection.length,
+				textDelta: null,
+				limitations: ["Reference endpoints differ independently of provider reference-kind metadata."]
+			});
+			const leftKinds = referenceKindProjection(left);
+			const rightKinds = referenceKindProjection(right);
+			if (leftKinds !== null && rightKinds !== null) return compareValues("references", leftKinds, rightKinds, context);
+			return unresolvedDimension({
+				dimension: "references",
+				links: context.links,
+				leftCount: leftProjection.length,
+				rightCount: rightProjection.length,
+				limitations: ["At least one provider did not expose reference kinds, so equal endpoints do not prove equal edge semantics."]
+			});
+		};
+		compareIdentity = (left, right, context) => {
+			if (isAutoName(left.dossier.procedure.name) || isAutoName(right.dossier.procedure.name)) return unresolvedDimension({
+				dimension: "identity",
+				links: context.links,
+				leftCount: null,
+				rightCount: null,
+				limitations: ["Address-derived function names are not stable cross-version identity."]
+			});
+			return compareValues("identity", identityProjection(left), identityProjection(right), context);
+		};
+		compareCalls = (left, right, context) => {
+			const leftValues = callProjection(left);
+			const rightValues = callProjection(right);
+			if ([...leftValues, ...rightValues].some(({ name }) => isAutoName(name))) return unresolvedDimension({
+				dimension: "calls",
+				links: context.links,
+				leftCount: leftValues.length,
+				rightCount: rightValues.length,
+				limitations: ["Address-derived callee or caller names cannot be matched safely."]
+			});
+			return compareValues("calls", sorted(leftValues), sorted(rightValues), context);
+		};
+		callProjection = (snapshot) => [...snapshot.dossier.callers.map(({ name }) => ({
+			direction: "in",
+			name
+		})), ...snapshot.dossier.callees.map(({ name }) => ({
+			direction: "out",
+			name
+		}))];
+		compareCfg = (left, right, context) => {
+			const leftBlocks = left.dossier.basic_blocks;
+			const rightBlocks = right.dossier.basic_blocks;
+			const leftGraph = normalizeCfg(leftBlocks);
+			const rightGraph = normalizeCfg(rightBlocks);
+			if (leftGraph === null || rightGraph === null) return unresolvedDimension({
+				dimension: "cfg",
+				links: context.links,
+				leftCount: leftBlocks.length,
+				rightCount: rightBlocks.length,
+				limitations: ["CFG addresses could not be normalized to local block indices."]
+			});
+			return compareValues("cfg", leftGraph, rightGraph, context);
+		};
+		compareValues = (dimension, left, right, context) => {
+			const leftJson = canonicalJson(left, "Function comparison");
+			const rightJson = canonicalJson(right, "Function comparison");
+			return dimensionResult({
+				dimension,
+				status: leftJson === rightJson ? "unchanged" : "changed",
+				left,
+				right,
+				...context,
+				leftCount: Array.isArray(left) ? left.length : null,
+				rightCount: Array.isArray(right) ? right.length : null,
+				textDelta: null,
+				limitations: []
+			});
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/domain/functionComparison.js
+var compareFunctions;
+function init_functionComparison() {
+	return (init_functionComparison = __esmMin((() => {
+		init_comparisonSemantics();
+		init_unicodeCodePointOrder();
+		init_functionDossierEvidence();
+		init_functionComparisonNormalization();
+		init_functionComparisonSchemas();
+		init_functionComparisonResults();
+		init_functionComparisonDimensions();
+		compareFunctions = (leftInput, rightInput) => {
+			const left = parseFunctionEvidence(leftInput);
+			const right = parseFunctionEvidence(rightInput);
+			const links = [left.evidence.evidence_id, right.evidence.evidence_id];
+			const providersDiffer = canonicalJson(left.evidence.provider, "Function comparison") !== canonicalJson(right.evidence.provider, "Function comparison");
+			const dimensions = compareDimensions(left, right, {
+				links,
+				providersDiffer
+			});
+			const match = functionMatch(left, right);
+			const changes = dimensions.filter(({ status }) => status !== "unchanged");
+			return functionComparisonResultSchema.parse({
+				status: overallStatus(dimensions, match.status),
+				function_match: match,
+				left_subject_sha256: left.subject.digest.sha256,
+				right_subject_sha256: right.subject.digest.sha256,
+				summary: summarize(dimensions),
+				dimensions,
+				changes,
+				limitations: [...new Set([
+					...left.limitations.map((item) => `Left: ${item}`),
+					...right.limitations.map((item) => `Right: ${item}`),
+					...providersDiffer ? ["Provider-specific pseudocode and assembly representations were not equated."] : []
+				])].sort((a, b) => compareUnicodeCodePoints(a, b))
+			});
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/investigationExamples.js
+var comparison, FUNCTION_COMPARISON_EVIDENCE, PROCESS_PROVIDER, capture, captureEvidence, PROCESS_CAPTURE_REFERENCE, PROCESS_CAPTURE_RECONSTRUCTION, PROCESS_COMPARISON_EVIDENCE, INVESTIGATION_EXAMPLES;
+function init_investigationExamples() {
+	return (init_investigationExamples = __esmMin((() => {
+		init_evidence();
+		init_jsonValue();
+		init_processComparison();
+		init_processCaptureParsing();
+		init_functionComparisonExample();
+		init_processCaptureExample();
+		init_functionComparison();
+		comparison = compareFunctions(FUNCTION_COMPARISON_EXAMPLE.left, FUNCTION_COMPARISON_EXAMPLE.right);
+		FUNCTION_COMPARISON_EVIDENCE = createEvidence(undefined, {
+			id: "rea-function-comparison",
+			name: "REA function comparison",
+			version: "1"
+		}, {
+			predicateType: "rea.function-comparison",
+			operation: "compare_functions",
+			parameters: {
+				left_evidence_id: FUNCTION_COMPARISON_EXAMPLE.left.evidence_id,
+				right_evidence_id: FUNCTION_COMPARISON_EXAMPLE.right.evidence_id
+			},
+			result: jsonValueSchema.parse(comparison),
+			confidence: "derived",
+			authority: "analyst-inference",
+			evidenceLinks: [FUNCTION_COMPARISON_EXAMPLE.left.evidence_id, FUNCTION_COMPARISON_EXAMPLE.right.evidence_id]
+		});
+		PROCESS_PROVIDER = {
+			id: "rea-process",
+			name: "REA deterministic process harness",
+			version: "3"
+		};
+		capture = parseProcessCapture(EMPTY_PROCESS_CAPTURE_EXAMPLE);
+		captureEvidence = (scenario) => createEvidence(undefined, PROCESS_PROVIDER, {
+			predicateType: "rea.process-capture",
+			operation: "capture_process_scenario",
+			parameters: { scenario },
+			result: jsonValueSchema.parse(capture),
+			confidence: "observed",
+			authority: "controlled-replay",
+			environment: {
+				id: "fixture-linux",
+				platform: "linux",
+				architecture: "x86_64",
+				isolation: "container"
+			}
+		});
+		PROCESS_CAPTURE_REFERENCE = captureEvidence("reference");
+		PROCESS_CAPTURE_RECONSTRUCTION = captureEvidence("reconstruction");
+		PROCESS_COMPARISON_EVIDENCE = createEvidence(undefined, PROCESS_PROVIDER, {
+			predicateType: "rea.process-comparison",
+			operation: "compare_process_captures",
+			parameters: {
+				left_evidence_id: PROCESS_CAPTURE_REFERENCE.evidence_id,
+				right_evidence_id: PROCESS_CAPTURE_RECONSTRUCTION.evidence_id,
+				left_normalization: capture.normalization,
+				right_normalization: capture.normalization
+			},
+			result: jsonValueSchema.parse(compareProcessCaptures(capture, capture)),
+			confidence: "derived",
+			authority: "analyst-inference",
+			evidenceLinks: [PROCESS_CAPTURE_REFERENCE.evidence_id, PROCESS_CAPTURE_RECONSTRUCTION.evidence_id]
+		});
+		INVESTIGATION_EXAMPLES = {
+			compare_process_captures: { input: {
+				left: PROCESS_CAPTURE_REFERENCE,
+				right: PROCESS_CAPTURE_RECONSTRUCTION
+			} },
+			find_changed_behavior: { comparisons: [FUNCTION_COMPARISON_EVIDENCE] },
+			build_call_path: {
+				functions: [FUNCTION_COMPARISON_EXAMPLE.left],
+				start: { address: "0x1000" },
+				goal: { address: "0x1000" }
+			},
+			correlate_static_and_runtime: {
+				static_comparisons: [FUNCTION_COMPARISON_EVIDENCE],
+				runtime_comparisons: [PROCESS_COMPARISON_EVIDENCE],
+				mappings: [{
+					static: {
+						comparison_evidence_id: FUNCTION_COMPARISON_EVIDENCE.evidence_id,
+						selector: {
+							kind: "function",
+							dimension: "pseudocode"
+						}
+					},
+					runtime: {
+						comparison_evidence_id: PROCESS_COMPARISON_EVIDENCE.evidence_id,
+						dimension: "terminal"
+					},
+					side_alignment: "left_to_left",
+					hypothesis: {
+						statement: "Static implementation changed without terminal change.",
+						expected_pattern: "static_only"
+					}
+				}]
+			},
+			verify_reconstruction: { specification: {
+				name: "Terminal compatibility",
+				claims: [{
+					kind: "behavioral",
+					claim_id: "terminal-output",
+					title: "Terminal output remains equivalent",
+					comparison_evidence_id: PROCESS_COMPARISON_EVIDENCE.evidence_id,
+					dimension: "terminal"
+				}]
+			} }
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/toolContractExamples.js
+var TOOL_EXAMPLE_OVERRIDES;
+function init_toolContractExamples() {
+	return (init_toolContractExamples = __esmMin((() => {
+		init_unknownContractExamples();
+		init_artifactComparisonExample();
+		init_functionComparisonExample();
+		init_investigationExamples();
+		TOOL_EXAMPLE_OVERRIDES = {
+			...UNKNOWN_CONTRACT_EXAMPLES,
+			...INVESTIGATION_EXAMPLES,
+			batch_decompile: { addresses: ["main", "0x1000"] },
+			goto_address: { address: "0x1000" },
+			procedure_address: { procedure: "main" },
+			procedure_assembly: { procedure: "main" },
+			procedure_callees: { procedure: "main" },
+			procedure_callers: { procedure: "main" },
+			procedure_info: { procedure: "main" },
+			trace_native_values: { procedure: "0x1000" },
+			inspect_native_data_type: { type: "/MyStruct" },
+			inspect_native_instruction: { address: "0x1000" },
+			resolve_native_call_targets: { address: "0x1000" },
+			read_function_instructions: { procedure: "main" },
+			read_bytes: {
+				address: "0x1000",
+				length: 16
+			},
+			address_to_file_offset: { address: "0x1000" },
+			procedure_references: { procedure: "main" },
+			procedure_pseudo_code: { procedure: "main" },
+			resolve_containing_procedure: { address: "0x1000" },
+			search_procedures: { pattern: "main" },
+			search_strings: { pattern: "authorization failed" },
+			set_address_name: {
+				address: "0x1000",
+				name: "entry"
+			},
+			set_addresses_names: { names: { "0x1000": "entry" } },
+			set_bookmark: { address: "0x1000" },
+			set_comment: {
+				address: "0x1000",
+				comment: "validated entry point"
+			},
+			set_inline_comment: {
+				address: "0x1000",
+				comment: "calls parser"
+			},
+			unset_bookmark: { address: "0x1000" },
+			get_call_graph: { address: "0x1000" },
+			find_xrefs_to_name: { name: "malloc" },
+			analyze_function: { procedure: "main" },
+			annotate_native_function: {
+				procedure: "0x10100",
+				name: "entry",
+				comment: "Analyst observation"
+			},
+			analyze_swift_types: {
+				category: "classes",
+				pattern: "Account"
+			},
+			inspect_native_api: { procedure: "main" },
+			trace_feature: { query: "license" },
+			trace_call_path: {
+				start: "0x1000",
+				goal: "0x1100"
+			},
+			trace_native_ui_action: { action: "buildTapped:" },
+			open_binary: { path: "/tmp/fixture" },
+			export_evidence_bundle: { path: "/tmp/evidence.json" },
+			get_evidence_bundle: {
+				detail: "summary",
+				filters: {
+					operation: "analyze_function",
+					procedure_address: "0x1000"
+				}
+			},
+			inspect_address_context: { address: "0x1000" },
+			import_evidence_bundle: { path: "/tmp/evidence.json" },
+			capture_process_scenario: {
+				executable: "/usr/bin/true",
+				working_directory: "/tmp",
+				timeout_ms: 3e4,
+				finalization_ms: 1500
+			},
+			compare_process_captures: {
+				left: PROCESS_CAPTURE_REFERENCE,
+				right: PROCESS_CAPTURE_RECONSTRUCTION
+			},
+			compare_artifacts: {
+				left: ARTIFACT_COMPARISON_EXAMPLE.left,
+				right: ARTIFACT_COMPARISON_EXAMPLE.right
+			},
+			compare_functions: {
+				left: FUNCTION_COMPARISON_EXAMPLE.left,
+				right: FUNCTION_COMPARISON_EXAMPLE.right
+			},
+			compare_bundles: {
+				left_bundle_path: "/tmp/left-evidence.json",
+				right_bundle_path: "/tmp/right-evidence.json"
+			}
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/toolContractHelpers.js
+var document, address, optionalAddress, procedure, exampleInputSchema, examplesFor;
+function init_toolContractHelpers() {
+	return (init_toolContractHelpers = __esmMin((() => {
+		init_jsonValue();
+		init_toolContractExamples();
+		document = z.string().optional().describe("The active target's provider document name; use open_binary to switch targets");
+		address = z.string().describe("A provider-normalized address; default memory uses 0x-prefixed hexadecimal");
+		optionalAddress = address.optional();
+		procedure = z.string().describe("The procedure name or address");
+		exampleInputSchema = z.record(z.string(), jsonValueSchema);
+		examplesFor = (name, inputSchema) => {
+			const parsed = inputSchema.parse(TOOL_EXAMPLE_OVERRIDES[name] ?? {});
+			return [{
+				title: `Example ${name.replaceAll("_", " ")} request`,
+				input: exampleInputSchema.parse(parsed)
+			}];
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/functionInstructionContract.js
+var functionInstructionInputSchema;
+function init_functionInstructionContract() {
+	return (init_functionInstructionContract = __esmMin((() => {
+		functionInstructionInputSchema = z.object({
+			procedure: z.string().describe("The procedure name or address"),
+			document: z.string().optional().describe("The document name")
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/hopperMemoryContracts.js
+var HOPPER_MEMORY_TOOL_DEFINITIONS;
+function init_hopperMemoryContracts() {
+	return (init_hopperMemoryContracts = __esmMin((() => {
+		init_toolContractHelpers();
+		HOPPER_MEMORY_TOOL_DEFINITIONS = [{
+			name: "read_bytes",
+			description: "Read analyzed bytes from one provider-normalized virtual address. The hexadecimal payload reports the exact returned length; incomplete reads remain explicit and unsupported provider APIs return typed capability unavailability.",
+			inputSchema: z.object({
+				address,
+				length: z.number().int().min(1).default(256),
+				document
+			})
+		}, {
+			name: "address_to_file_offset",
+			description: "Map one provider-normalized virtual address to its original nonnegative file offset. Hopper verifies the original bytes against the selected executable digest and translates FAT image-relative offsets using the loaded header. Results preserve the provider coordinate, image base, and source path. Unmapped addresses fail explicitly; changed or unavailable sources return typed errors retaining native mapping facts as partial evidence.",
+			inputSchema: z.object({
+				address,
+				document
+			})
+		}];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/analysisSearchContract.js
+var analysisSearchInput;
+function init_analysisSearchContract() {
+	return (init_analysisSearchContract = __esmMin((() => {
+		analysisSearchInput = {
+			pattern: z.string().min(1).describe("The literal text or regex pattern to search for"),
+			mode: z.enum(["literal", "regex"]).default("literal").describe("literal (default) matches the exact text; regex uses ECMAScript syntax"),
+			case_sensitive: z.boolean().default(false).describe("Whether to match case"),
+			document: z.string().optional().describe("The document name")
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/officialToolContracts.js
+var official, OFFICIAL_TOOL_CONTRACTS;
+function init_officialToolContracts() {
+	return (init_officialToolContracts = __esmMin((() => {
+		init_nativeFunctionAnnotations();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		init_toolContractHelpers();
+		init_toolEffects();
+		init_nativeDataType();
+		init_nativeInstruction();
+		init_functionInstructionContract();
+		init_hopperMemoryContracts();
+		init_analysisSearchContract();
+		official = (name, description, inputSchema) => {
+			const strictInputSchema = inputSchema.strict();
+			return {
+				name,
+				...toolContractMetadata(name),
+				description,
+				kind: "official-proxy",
+				inputSchema: strictInputSchema,
+				outputSchema: requireOutputSchema(officialOutputSchemas, name),
+				examples: examplesFor(name, strictInputSchema)
+			};
+		};
+		OFFICIAL_TOOL_CONTRACTS = [
+			official("annotate_native_function", "Atomically update one function name and/or entry comments, read them back, and return a refreshed complete function dossier. Ghidra changes its ephemeral session analysis database only; original executable bytes remain unchanged. Empty comment text clears that comment. Edits remain available to subsequent MCP calls until close; CLI returns the updated dossier before discarding its session. Invalid edits roll back the entire operation. The experimental Windows Ghidra profile and providers without this capability do not support it.", nativeFunctionAnnotationsInputSchema),
+			official("inspect_native_load_image", "Verify the provider's loaded DOS MZ or explicitly selected COM image against its immutable target snapshot: complete original/modified source-byte digests, header/module file mappings and memory digests, relocations and external entry. Returns measured observations and independent checks with mismatch coordinates. COM verification includes its imposed entry register context and does not claim PSP/runtime coverage. Overlay and uninitialized coverage remain explicit; other formats return unsupported. Does not execute or modify the target.", z.strictObject({})),
+			official("inspect_native_data_type", "Inspect one recovered type by exact database category path or defined typed data address. Returns observed size, alignment, packing, fields, bitfields, enum values, and child type identities; source-level authority and flexible-tail semantics remain unknown unless substantiated.", nativeDataTypeInputSchema),
+			official("inspect_native_instruction", "Inspect one exact code or data address: decoded bytes, mnemonic, ordered operand tokens, flow, outgoing instruction references and typed incoming references where available. Incoming references preserve source, access kind, operand index and analysis provenance even at data addresses; they do not prove runtime access. Memory addressing decomposition is unavailable when the provider supplies only tokens. Data, interior instruction addresses and undecodable bytes are distinct outcomes.", nativeInstructionInputSchema),
+			official("resolve_native_call_targets", "Resolve one explicit static call site using typed provider call references. Preserves ambiguous targets as candidates and unresolved computed calls as unknown; does not execute code or traverse a call graph.", nativeInstructionInputSchema),
+			official("address_name", "Resolve the primary analyzed name at a code or data address. Headless providers require an explicit address; GUI providers may default to their current cursor. Null means the provider has no primary name at that address.", z.object({
+				document,
+				address: optionalAddress
+			})),
+			official("comment", "Read the regular analysis comment at an address, defaulting to the current cursor. This is read-only and returns null when no comment exists; use set_comment to persist a finding.", z.object({
+				document,
+				address: optionalAddress
+			})),
+			official("current_address", "Return Hopper's current cursor address for the selected document. Use only for interactive navigation state; prefer explicit addresses in reproducible investigations.", z.object({ document })),
+			official("current_procedure", "Return the analyzed procedure containing Hopper's current cursor. This uses GUI cursor state and is not a procedure-name lookup.", z.object({ document })),
+			official("current_document", "Return the document currently selected by REA's Hopper bridge.", z.object({})),
+			official("goto_address", "Move Hopper's GUI cursor to a mapped address and return the observed cursor address. Interior coordinates snap to the containing analyzed object's start. Unmapped destinations fail without moving the cursor. This changes navigation state but not analysis data; use explicit-address tools for headless workflows.", z.object({
+				address,
+				document
+			})),
+			official("inline_comment", "Read the inline instruction comment at an address, defaulting to the current cursor. Returns null when absent; use set_inline_comment to write one.", z.object({
+				document,
+				address: optionalAddress
+			})),
+			official("list_bookmarks", "List every bookmark in the selected Hopper document as address and name pairs; unnamed bookmarks retain a null name. Use bookmarks as analyst-authored navigation aids; this does not discover code references.", z.object({ document })),
+			official("list_documents", "List provider program or document identities. Hopper may expose several documents; a Ghidra headless session contains exactly its one imported Program.", z.object({})),
+			official("list_names", "List every analyzed memory and external symbol as address/value pairs. Provider metadata distinguishes Ghidra primary, dynamic, external, type, and source facts when available. On large binaries this can return tens of thousands of rows; prefer search_procedures or search_strings with a pattern, or binary_overview for counts.", z.object({
+				document,
+				address: optionalAddress
+			})),
+			official("list_procedures", "List every analyzed procedure as address/value pairs after provider analysis. Ghidra metadata distinguishes thunks and external functions; use returned addresses in later function operations. On large binaries this can return tens of thousands of rows; prefer search_procedures or search_strings with a pattern, or binary_overview for counts.", z.object({ document })),
+			official("list_segments", "List segments or memory blocks using exclusive end addresses. Ghidra reports block permissions, address space, image base, initialization, and overlay facts; Hopper marks unavailable permissions explicitly.", z.object({ document })),
+			official("list_strings", "List every provider-defined string object, or filter to one address, as address/value pairs with encoding, terminator status, and byte length when available. Hopper reads complete typed objects and retains its original display text as provider_value; long literals may span adjacent unterminated objects. On large binaries this can return tens of thousands of rows; prefer search_procedures or search_strings with a pattern, or binary_overview for counts.", z.object({
+				document,
+				address: optionalAddress
+			})),
+			official("next_address", "Return the next analyzed object address after an explicit address or current cursor. This is a navigation primitive, not instruction-flow or CFG analysis.", z.object({
+				document,
+				address: optionalAddress
+			})),
+			official("prev_address", "Return the previous analyzed object start before an explicit address or current cursor. This is a navigation primitive and may fail at document boundaries; data objects and instructions remain distinct from control flow.", z.object({
+				document,
+				address: optionalAddress
+			})),
+			official("procedure_address", "Resolve an unambiguous procedure symbol name or provider-normalized address to its canonical entry address. External address spaces remain explicit.", z.object({
+				procedure,
+				document
+			})),
+			official("procedure_assembly", "Return assembly for one analyzed procedure identified by symbol or hexadecimal address. Use when pseudocode loses calling-convention or instruction-level detail; output is currently returned as one unpaginated string. Ghidra terminal-call assumptions that may cut the analyzed body are reported in Evidence limitations.", z.object({
+				procedure,
+				document
+			})),
+			official("procedure_callees", "Return the provider's resolved direct callees for one procedure identified by symbol or address. Unresolved indirect calls may be absent; use analyze_function and typed references to preserve available edge uncertainty.", z.object({
+				procedure,
+				document
+			})),
+			official("procedure_callers", "Return the provider's resolved direct callers for one procedure identified by symbol or address. Results reflect completed static analysis and may omit unresolved indirect references.", z.object({
+				procedure,
+				document
+			})),
+			official("procedure_info", "Return provider metadata for one procedure identified by symbol or address: entrypoint, signature, locals, size, block count, and complete inclusive body ranges when observed. Extents reflect the provider's analyzed body; Ghidra terminal-call assumptions that may cut it are reported in Evidence limitations. Hopper locals preserve observed names and signed stack displacements; source types remain unknown. Body byte count and enclosing span remain distinct; unavailable extent is explicit.", z.object({
+				procedure,
+				document
+			})),
+			official("read_function_instructions", "Return every raw instruction for one analyzed procedure. Instruction text and body extent are provider-specific. Ghidra terminal-call assumptions that may cut the analyzed body are reported in limitations.", functionInstructionInputSchema),
+			...HOPPER_MEMORY_TOOL_DEFINITIONS.map(({ name, description, inputSchema }) => official(name, description, inputSchema)),
+			official("procedure_references", "Return every raw incoming or outgoing reference edge for one procedure. Endpoint procedures are resolved only from provider containment. Ghidra preserves detailed reference flags. Hopper preserves native CallReference classifications and exact endpoints while leaving unavailable detailed flags explicit.", z.object({
+				procedure,
+				direction: z.enum(["incoming", "outgoing"]).default("outgoing"),
+				document
+			})),
+			official("procedure_pseudo_code", "Decompile one analyzed procedure by symbol name or provider-normalized address. Returns provider-specific pseudocode, never original source or cross-provider text equivalence, and may return null; request procedure_assembly when instruction precision matters. Ghidra no-return assumptions may cut the analyzed body; Evidence limitations report observed terminal calls and available callee identities.", z.object({
+				procedure,
+				document
+			})),
+			official("resolve_containing_procedure", "Resolve an arbitrary address, including an interior instruction or exact external entry, to its provider-analyzed containing procedure. A negative result distinguishes outside segments from not in a procedure and is never guessed from nearby symbols.", z.object({
+				address,
+				document
+			})),
+			official("search_procedures", "Search every analyzed procedure name using literal matching by default or regex when requested. Results are deterministic and complete. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker; a matching deadline leaves its API usable.", z.object(analysisSearchInput)),
+			official("search_strings", "Search every provider-defined string object using literal matching by default or regex when requested. Results are deterministic and complete over those defined objects, not every text sequence in artifact bytes. Ghidra may omit packed or undefined literals, including Rust strings; an empty result does not prove text is absent. If an address is known, read_bytes and xrefs inspect its bytes and references. Hopper retains typed byte decoding, native display, and explicit decoding unknowns. Adjacent long-literal fragments match independently. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker; a matching deadline leaves its API usable.", z.object(analysisSearchInput)),
+			official("set_address_name", "Assign an analyst name to one mapped hexadecimal address and report whether the native edit succeeded and exact readback matched. Hopper rejects symbol names exceeding 1024 UTF-16 code units before mutation, and rejects names owned by another address; use set_addresses_names to explicitly move or swap labels among selected addresses. This mutates analysis metadata.", z.object({
+				address,
+				name: z.string(),
+				document
+			})),
+			official("set_addresses_names", "Assign analyst names to multiple mapped addresses in one call and return per-address edit/readback success booleans. Hopper validates mapped destinations, native string representations, its 1024 UTF-16 code-unit symbol-name limit, and unique destinations/names before applying edits. Existing labels may move or swap only among explicitly selected addresses; unselected label owners remain unchanged. This mutates analysis metadata; verify failures individually.", z.object({
+				names: z.record(z.string(), z.string()),
+				document
+			})),
+			official("set_bookmark", "Create or replace a bookmark at a mapped hexadecimal address and report success. This mutates navigation metadata; bookmarks are analyst-authored navigation aids, not binary evidence.", z.object({
+				address,
+				name: z.string().optional(),
+				document
+			})),
+			official("set_comment", "Write a regular analysis comment at a hexadecimal address and return whether readback matched. An empty comment clears it. This mutates the Hopper document; use comments to record evidence IDs or reasoning.", z.object({
+				address,
+				comment: z.string(),
+				document
+			})),
+			official("set_inline_comment", "Write an inline instruction comment at a hexadecimal address and return whether readback matched. An empty comment clears it; Hopper may flatten newlines, producing false on exact readback. This mutates analysis metadata.", z.object({
+				address,
+				comment: z.string(),
+				document
+			})),
+			official("unset_bookmark", "Remove the bookmark at a mapped hexadecimal address and return whether it is absent. Hopper also permits removing an existing legacy bookmark outside mapped memory. This mutates navigation metadata and does not alter binary bytes.", z.object({
+				address,
+				document
+			})),
+			official("xrefs", "Return analyzed references to a code or data address. Hopper may default to its current cursor; headless providers such as Ghidra require an explicit address. Use to connect strings, globals, selectors, and functions; bare addresses are untyped and indirect references may be incomplete. Use inspect_native_instruction at the target address for typed incoming references where supported.", z.object({
+				document,
+				address: optionalAddress
+			}))
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/functionWorkflowToolContracts.js
+var functionWorkflow, FUNCTION_WORKFLOW_TOOL_CONTRACTS;
+function init_functionWorkflowToolContracts() {
+	return (init_functionWorkflowToolContracts = __esmMin((() => {
+		init_jsonValue();
+		init_enhancedInputs();
+		init_toolContractExamples();
+		init_toolEffects();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		functionWorkflow = (name, description) => {
+			const inputSchema = enhancedInputSchemas[name];
+			const outputSchema = requireOutputSchema(enhancedOutputSchemas, name);
+			return {
+				name,
+				...toolContractMetadata(name),
+				description,
+				kind: "enhanced",
+				inputSchema,
+				outputSchema,
+				examples: [{
+					title: `Example ${name.replaceAll("_", " ")} request`,
+					input: jsonObjectSchema.parse(inputSchema.parse(TOOL_EXAMPLE_OVERRIDES[name] ?? {}))
+				}]
+			};
+		};
+		FUNCTION_WORKFLOW_TOOL_CONTRACTS = [functionWorkflow("analyze_function", "Build a dossier for one native function identified by symbol or provider-returned address. Returns identity with complete inclusive analyzed body ranges or explicit unknown, provider-specific pseudocode and assembly, comments, calls, references, referenced strings/names, local CFG blocks, and available native API boundary observations. Ghidra terminal-call assumptions that may cut the analyzed body are reported in limitations with available callee identities."), functionWorkflow("inspect_native_api", "Analyze a native API boundary in one function identified by symbol or provider-returned address. Returns confidence, evidence, jump-table dispatch/data/case mappings, separately evidenced default targets, unsupported branches, and residual unknowns. Null case values mean unresolved cases, never a known default.")];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/enhancedToolContracts.js
+var enhanced, ENHANCED_TOOL_CONTRACTS;
+function init_enhancedToolContracts() {
+	return (init_enhancedToolContracts = __esmMin((() => {
+		init_enhancedInputs();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		init_toolContractHelpers();
+		init_toolEffects();
+		init_functionWorkflowToolContracts();
+		enhanced = (name, description, inputSchema) => ({
+			name,
+			...toolContractMetadata(name),
+			description,
+			kind: "enhanced",
+			inputSchema,
+			outputSchema: requireOutputSchema(enhancedOutputSchemas, name),
+			examples: examplesFor(name, inputSchema)
+		});
+		ENHANCED_TOOL_CONTRACTS = [
+			enhanced("inspect_native_dispatch_metadata", "Inspect the bound provider's name inventory for Objective-C class/method symbols and Swift mangled symbols, returning at most max_records decoded names. Includes target SHA-256 when available, provider identity/version, analysis-profile digest, facet coverage, and per-record Evidence. This is symbol-level evidence, not runtime metadata: ivar layouts, protocol conformances, witness/class tables, and relative pointers are explicitly marked unsupported unless a provider supplies those decoders. The provider controls how its name inventory is acquired.", enhancedInputSchemas.inspect_native_dispatch_metadata),
+			enhanced("get_objc_classes", "Discover and deduplicate Objective-C class labels, optionally filtering by literal substring.", enhancedInputSchemas.get_objc_classes),
+			enhanced("get_objc_protocols", "Discover and deduplicate Objective-C and Swift protocol labels.", enhancedInputSchemas.get_objc_protocols),
+			enhanced("batch_decompile", "Decompile each explicit procedure symbol or address concurrently. Preserves each input selector in address and reports the observed canonical entry and entry label in procedure; identity or label failures remain explicit without discarding usable pseudocode. Returns ordered per-item success or error results and aggregate counts.", enhancedInputSchemas.batch_decompile),
+			enhanced("get_call_graph", "Resolve one symbol or address to its canonical procedure entry, then traverse the bound provider's caller or callee relationships until the reachable graph is exhausted. Every node uses a canonical address and has an ok/error status; failures use safe typed projections. Unresolved indirect calls may be missing and results are not a whole-program CFG.", enhancedInputSchemas.get_call_graph),
+			enhanced("analyze_swift_types", "Categorize analyzed Swift procedure names using their manglings or same-address Swift symbol aliases. Decodes legacy and literal modern nominal contexts into classes, structs, enums, protocols, and extensions. Preserves provider names and supporting mangled_names; unresolved categories appear in other and in unclassified, which remains inline even under category filters. Returns deduplicated procedure-name counts, not unique source types, plus identification limitations. Optionally select one category and/or apply a case-sensitive literal filter to provider names or supporting manglings; for example, use {category: \"structs\", pattern: \"Pair\"}.", enhancedInputSchemas.analyze_swift_types),
+			enhanced("find_xrefs_to_name", "Resolve an exact name against the bound provider's name inventory and return a resolved or unresolved result. Unresolved names use the stable name_not_found reason; this xref workflow returns address-only projections.", enhancedInputSchemas.find_xrefs_to_name),
+			enhanced("binary_overview", "Return native-binary metadata, every segment with its length, and exhaustive procedure/string counts. Use search_procedures, list_procedures, or analyze_function directly when you already know which procedure to inspect.", enhancedInputSchemas.binary_overview),
+			...FUNCTION_WORKFLOW_TOOL_CONTRACTS,
+			enhanced("trace_feature", "Trace the complete literal query, preserving spaces, through every matching string and procedure, their xrefs, and truthful containing-procedure resolution. Returns observations, operation count, and residual unknowns without inferring reference kinds.", enhancedInputSchemas.trace_feature),
+			enhanced("trace_call_path", "Resolve start and optional goal symbols or addresses to canonical procedure entries, then trace direct callers or callees until the graph is exhausted or the goal is reached. Results use canonical addresses; Evidence preserves supplied selectors. Returns visited nodes, direct-call edges, a shortest traversal path, provider failures, and residual unknowns. A requested goal is unknown when unresolved expansions prevent proving it absent; unresolved indirect calls remain unknown.", enhancedInputSchemas.trace_call_path),
+			enhanced("trace_native_ui_action", "Trace one unique compiled UI action, object ID, native symbol or exact function address through authored connections, encoded or symbolized Objective-C handlers, and bounded static call references. Typed direct and resolved indirect calls, ambiguous candidates, inferred untyped provider callees, and targetless sites remain distinct. Runtime reachability is unknown; use trace_native_values for recovered value dependencies.", enhancedInputSchemas.trace_native_ui_action),
+			enhanced("trace_native_values", "Trace a bounded static dependency graph from one explicit native procedure. Includes high-p-code def-use, constants, operators, memory and branch operations, resolved call edges, and derived argument/parameter and return/output bindings. Missing bindings, alias semantics, persistent state and RNG roles remain unknown. Budgets bound depth, decompilations, graph size and payloads; nodes are paginated.", enhancedInputSchemas.trace_native_values)
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/sessionLifecycleInputs.js
+var snapshotPathSchema, binaryTargetPathSchema, openBinaryInputSchema, closeBinaryInputSchema;
+function init_sessionLifecycleInputs() {
+	return (init_sessionLifecycleInputs = __esmMin((() => {
+		init_dosCom();
+		init_localPath();
+		init_rawBinary();
+		init_providerSelection();
+		snapshotPathSchema = localPathStringSchema.refine(isAbsolute, { message: "snapshot_path must be an absolute local filesystem path (for example /tmp/rea/analysis.json or C:\\rea\\analysis.json)" }).describe("Absolute local filesystem path for the analysis snapshot; relative paths are rejected.");
+		binaryTargetPathSchema = localPathStringSchema.refine(isAbsolute, { message: "path must be an absolute local filesystem path (for example /tmp/fixture.bin or C:\\analysis\\fixture.bin)" }).describe("Absolute local filesystem path for the analysis target; relative paths are rejected.");
+		openBinaryInputSchema = z.strictObject({
+			path: binaryTargetPathSchema,
+			format: executableFormatHintSchema.optional().describe("Explicit headerless interpretation: dos-com or raw-binary. Omission preserves header-based detection."),
+			architecture: binaryArchitectureSchema.optional().describe("Caller-supplied CPU family. Required with format=raw-binary; rejected otherwise."),
+			entry_point: rawBinaryEntryPointSchema.optional().describe("Caller-supplied load and entry address (0xhex). File offset 0 is mapped here. Required with format=raw-binary; rejected otherwise."),
+			provider_id: analysisProviderSelectorSchema.optional(),
+			snapshot_path: snapshotPathSchema.optional()
+		}).superRefine((value, context) => {
+			const pairing = rawBinarySelectionError({
+				...value.format === undefined ? {} : { format: value.format },
+				...value.architecture === undefined ? {} : { architecture: value.architecture },
+				...value.entry_point === undefined ? {} : { entryPoint: value.entry_point }
+			});
+			if (pairing === undefined) return;
+			context.addIssue({
+				code: "custom",
+				path: value.format === "raw-binary" ? value.architecture === undefined ? ["architecture"] : ["entry_point"] : value.architecture === undefined ? ["entry_point"] : ["architecture"],
+				message: pairing
+			});
+		});
+		closeBinaryInputSchema = z.strictObject({
+			snapshot_path: snapshotPathSchema.optional(),
+			overwrite: z.boolean().default(false)
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/sessionStatusContract.js
+var binarySessionInputSchema;
+function init_sessionStatusContract() {
+	return (init_sessionStatusContract = __esmMin((() => {
+		init_localPath();
+		binarySessionInputSchema = z.strictObject({
+			expected_package_version: z.string().min(1).optional(),
+			expected_catalog_digest: z.string().regex(/^[a-f0-9]{64}$/u).optional(),
+			expected_server_path: localPathStringSchema.refine(isAbsolute, { message: "expected_server_path must be an absolute local filesystem path (for example /opt/rea/dist/main.js)" }).describe("Absolute local filesystem path expected for the running server; relative paths are rejected.").optional()
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/sessionToolContracts.js
+var session, exportEvidenceBundleInputSchema, SESSION_TOOL_CONTRACTS;
+function init_sessionToolContracts() {
+	return (init_sessionToolContracts = __esmMin((() => {
+		init_localPath();
+		init_artifactComparison();
+		init_bundleComparison();
+		init_callPathSchemas();
+		init_changedBehavior();
+		init_functionComparisonSchemas();
+		init_processScenario();
+		init_residualUnknown();
+		init_reconstructionVerificationSchemas();
+		init_staticRuntimeCorrelation();
+		init_toolOutputSchemaGroups();
+		init_toolOutputSchemaPrimitives();
+		init_sessionLifecycleInputs();
+		init_sessionStatusContract();
+		init_sessionToolSchemas();
+		init_toolContractHelpers();
+		init_toolEffects();
+		session = (name, description, inputSchema) => ({
+			name,
+			...toolContractMetadata(name),
+			description,
+			kind: "session",
+			inputSchema,
+			outputSchema: requireOutputSchema(sessionOutputSchemas, name),
+			examples: examplesFor(name, inputSchema)
+		});
+		exportEvidenceBundleInputSchema = z.strictObject({
+			path: localPathStringSchema.refine(isAbsolute, { message: "path must be an absolute local filesystem path (for example /tmp/rea/evidence.json or C:\\rea\\evidence.json)" }).describe("Absolute local filesystem path for the exported evidence bundle; relative paths are rejected."),
+			overwrite: z.boolean().default(false)
+		});
+		SESSION_TOOL_CONTRACTS = [
+			session("open_binary", "Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. format=dos-com explicitly interprets 1..65280 headerless bytes as a DOS COM analysis image. format=raw-binary interprets headerless bytes with a required architecture and entry_point; file offset 0 maps at that address. Omission preserves header-based detection. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. Reopening the same target and profile retains its active database and metadata edits. An optional analysis snapshot is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly; importing into a session with metadata mutations requires closing and reopening it first.", openBinaryInputSchema),
+			session("close_binary", "Drain earlier provider requests, optionally write a provider-neutral analysis snapshot atomically to the caller-supplied path, then close the active target and every provider resource started for it. Later provider requests wait until this lifecycle operation finishes. Existing files require explicit overwrite; a failed save leaves the session open so cached analysis is not lost. Metadata edits prevent immutable snapshot saves until the session is recreated; export_evidence_bundle preserves mutable observations before closing without a snapshot.", closeBinaryInputSchema),
+			session("binary_session", "Report the complete current target, provider, capability availability, client-feature, analysis, and server-identity status without starting analysis.", binarySessionInputSchema),
+			session("export_evidence_bundle", "Atomically write the session's deterministic Evidence bundle to the requested local path. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering.", exportEvidenceBundleInputSchema),
+			session("import_evidence_bundle", "Read the JSON bundle at the supplied local path, validate every Evidence ID and canonical manifest, then atomically merge it. Imported content is data only and is never executed.", importEvidenceBundleInputSchema),
+			session("capture_process_scenario", "Run one caller-selected command under a PTY and return process capture Evidence with residual unknowns. The renderer admits at most 1,000,000 combined terminal cells, computed as columns × (rows + scrollback); every resize uses the selected scrollback and must fit the same budget. Supply a smaller terminal shape when that product is too large; dimensions are never clamped. A command name resolves through the inherited PATH; the working directory defaults to the caller's current directory; host environment variables are inherited with scenario overrides. Environment keys cannot contain '=' or NUL, and REA_PROCESS_RUN_ID is reserved for process ownership. Filesystem snapshots are opt-in through filesystem_observation_paths. A positive finalization_ms makes a timeout or idle deadline send SIGTERM to the captured root through its start identity, keep observing, and send SIGKILL once after the interval; exit.finalization records each attempt with its delivery result and the observed exit, and cancellation still ends the run at once. The target runs with the current user's permissions; this is not a security sandbox.", processScenarioSchema),
+			session("compare_process_captures", "Compare two compatible process capture observations across terminal, interaction, lifecycle, process, filesystem, command-shim, HTTP, and WebSocket evidence. Optional trace_spec validates exact events against an explicit partial order or finite trace language; concurrency is never inferred from timestamps or broad sorting. Missing, journal-free, or truncated observations are never treated as equivalent.", processComparisonInputSchema),
+			session("compare_artifacts", "Compare complete artifact inventories by logical occurrence path, content identity, metadata, and graph relations. Pass the inventory Evidence nested in each inspect_artifact result as left and right. Every delta cites both inputs, and gaps yield truncated or unknown, never equivalence. Returns every change inline.", artifactComparisonInputSchema),
+			session("compare_functions", "Compare two explicit sets of analyze_function Evidence across identity, exact provider text, calls, references, strings, and address-normalized CFG topology. Missing or provider-incompatible facets remain truncated or unknown; every conclusion cites both Evidence sets.", functionComparisonInputSchema),
+			session("compare_bundles", "Compare two canonical Evidence bundles by exact record membership, explicit one-to-one observation pairs, and complete residual-unknown revision histories. Missing bundle members describe omission only, never behavioral equivalence; output is digest-anchored and returns every change inline.", bundleComparisonInputSchema),
+			session("find_changed_behavior", "Aggregate validated process and artifact comparison Evidence. Runtime observations remain distinct from static behavior candidates; missing or incomplete comparisons produce unresolved findings, never causal claims. Returns every finding inline.", changedBehaviorInputSchema),
+			session("build_call_path", "Build every shortest direct-callee path inline from complete analyze_function Evidence records using exact canonical addresses. Missing dossiers and provider mixing remain unknown; every node and edge cites source Evidence.", callPathInputSchema),
+			session("correlate_static_and_runtime", "Evaluate every explicit caller-declared hypothesis between exact static comparison findings and runtime comparison dimensions. Similar names or paths are never auto-matched, consistent cochange never proves causality, and unknown or truncated inputs remain unresolved. Returns all correlations and their complete Evidence closure inline.", staticRuntimeCorrelationInputSchema),
+			session("verify_reconstruction", "Verify a finite typed behavioral and structural specification against a canonical Evidence bundle. Pass means every declared claim has complete comparable authority—not global source equivalence; changed claims fail and missing, limited, or unresolved evidence stays unknown.", reconstructionVerificationInputSchema),
+			session("list_unknowns", "List every current residual-unknown head in deterministic ID order, with optional exact status, severity, and domain filters. Results are complete and inline. This is read-only; unresolved, contradicted, and non-truth dispositions remain distinct.", listUnknownsInputSchema),
+			session("record_unknown", "Create one deterministic residual unknown and immutable mutation evidence. Validates all evidence and relationship references, and rejects duplicate stable identity.", recordUnknownInputSchema),
+			session("update_unknown", "Append one immutable full-state revision and mutation evidence. Requires exact expected_revision; stale concurrent writers fail instead of overwriting newer analysis.", updateUnknownInputSchema),
+			session("verify_unknown_resolution", "Revalidate the current residual-unknown head against live bundled evidence, exact authority/confidence/environment requirements, and revision integrity. Withdrawn and out-of-scope dispositions are not truth claims.", verifyUnknownResolutionInputSchema),
+			session("get_evidence_bundle", "Return every retained Evidence record and residual unknown as a complete canonical bundle by default. detail=summary discovers retained records without copying or transferring their payloads; optionally filter by exact Evidence ID, operation, target SHA-256, analysis-profile digest or canonical native procedure address. Metadata distinguishes complete record retention from native value-flow truncation or unavailable/unknown coverage. Use a discovered evidence_id with inspect_analysis_view without restarting a provider. Filters apply only to summary delivery. Call with detail: summary first; the complete bundle can be very large.", getEvidenceBundleInputSchema),
+			session("get_navigation_context", "Return the selected document, current address, and containing/current procedure in one provider-neutral result. The result reflects sequential provider observations, not an atomic cursor snapshot; a cursor outside any procedure returns procedure: null.", navigationContextInputSchema),
+			session("inspect_address_context", "Inspect one explicit reproducible address for its analyzed name, containing procedure, regular and inline comments, and matching bookmarks. Each unsupported facet returns a typed unavailable outcome; use xrefs, assembly, or pseudocode for those deeper views.", addressContextInputSchema)
+		];
+	})))();
+}
+
+//#endregion
+//#region dist/contracts/toolContracts.js
+var TOOL_CONTRACTS, toolContract;
+function init_toolContracts() {
+	return (init_toolContracts = __esmMin((() => {
+		init_wasmToolContracts();
+		init_evmToolContracts();
+		init_goToolContracts();
+		init_analysisViewToolContracts();
+		init_binaryDiagnosticsToolContracts();
+		init_nativeToolContracts();
+		init_artifactToolContracts();
+		init_managedToolContracts();
+		init_firmwareToolContracts();
+		init_androidToolContracts();
+		init_apktoolToolContracts();
+		init_jebToolContracts();
+		init_adbToolContracts();
+		init_managedWorkflowToolContracts();
+		init_browserProviderToolContracts();
+		init_electronToolContracts();
+		init_javascriptRuntimeObservationToolContracts();
+		init_applicationToolContracts();
+		init_webScriptToolContracts();
+		init_webRuntimeToolContracts();
+		init_webNetworkCaptureToolContracts();
+		init_javascriptRecoveryToolContracts();
+		init_officialToolContracts();
+		init_enhancedToolContracts();
+		init_sessionToolContracts();
+		TOOL_CONTRACTS = [
+			...OFFICIAL_TOOL_CONTRACTS,
+			...ENHANCED_TOOL_CONTRACTS,
+			...NATIVE_TOOL_CONTRACTS,
+			...BINARY_DIAGNOSTICS_TOOL_CONTRACTS,
+			...ANALYSIS_VIEW_TOOL_CONTRACTS,
+			...ARTIFACT_TOOL_CONTRACTS,
+			...EVM_TOOL_CONTRACTS,
+			...GO_TOOL_CONTRACTS,
+			...WASM_TOOL_CONTRACTS,
+			...MANAGED_TOOL_CONTRACTS,
+			...ANDROID_TOOL_CONTRACTS,
+			...APKTOOL_TOOL_CONTRACTS,
+			...JEB_TOOL_CONTRACTS,
+			...ADB_TOOL_CONTRACTS,
+			...FIRMWARE_TOOL_CONTRACTS,
+			...MANAGED_WORKFLOW_TOOL_CONTRACTS,
+			...BROWSER_PROVIDER_TOOL_CONTRACTS,
+			...ELECTRON_TOOL_CONTRACTS,
+			...JAVASCRIPT_RUNTIME_OBSERVATION_TOOL_CONTRACTS,
+			...APPLICATION_TOOL_CONTRACTS,
+			...WEB_SCRIPT_TOOL_CONTRACTS,
+			...WEB_RUNTIME_TOOL_CONTRACTS,
+			...WEB_NETWORK_CAPTURE_TOOL_CONTRACTS,
+			...JAVASCRIPT_RECOVERY_TOOL_CONTRACTS,
+			...SESSION_TOOL_CONTRACTS
+		];
+		toolContract = (name) => {
+			const contract = TOOL_CONTRACTS.find((candidate) => candidate.name === name);
+			if (contract === undefined) throw new Error(`Missing tool contract: ${name}`);
+			return contract;
+		};
+	})))();
+}
+
+//#endregion
+export { ARTIFACT_ANALYSIS_OPERATIONS, ENHANCED_TOOL_CONTRACTS, OFFICIAL_TOOL_CONTRACTS, TOOL_CONTRACTS, analysisSearchInput, artifactExtractionExecutionSchema, artifactInventoryInputSchema, init_analysisSearchContract, init_artifactToolContracts, init_enhancedToolContracts, init_officialToolContracts, init_toolContracts, toolContract };