reverseport 0.0.0-stage → 1.2.0

package/dist/server/EvidenceMcpServer.js

@@ -0,0 +1,216 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { McpServer, isCallToolResult, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, } from "@modelcontextprotocol/server";
+import { analysisErrorProjectionSchema } from "../contracts/errorSchemas.js";
+import { compactAdvertisedInputSchema } from "../contracts/compactInputSchema.js";
+import { transformAdvertisedInputJsonSchema } from "../contracts/toolSchemaMetadata.js";
+import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { encodeToolResult } from "./toolResultEncoding.js";
+const currentRequestSignal = new AsyncLocalStorage();
+/** Signal for the completion request currently being dispatched by the SDK. */
+export const currentMcpRequestSignal = () => currentRequestSignal.getStore();
+/** A Zod schema whose standard interface exposes a JSON Schema projection. */
+const hasAdvertisedInputJsonSchema = (value) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const standard = Reflect.get(value, "~standard");
+    if (typeof standard !== "object" || standard === null)
+        return false;
+    const jsonSchema = Reflect.get(standard, "jsonSchema");
+    return (typeof jsonSchema === "object" &&
+        jsonSchema !== null &&
+        Reflect.get(jsonSchema, "input") !== undefined);
+};
+/** Bind oversized MCP error recovery to this server's Evidence ledger. */
+export class EvidenceMcpServer extends McpServer {
+    recordEvidence;
+    delivery;
+    compactPresentation;
+    constructor(info, options, recordEvidence, delivery, compactPresentation = undefined) {
+        super(info, options);
+        this.recordEvidence = recordEvidence;
+        this.delivery = delivery;
+        this.compactPresentation = compactPresentation;
+    }
+    /**
+     * Compact the advertised input schema of every registered tool when the
+     * compact profile is active. The registered canonical schema, its parser,
+     * and output schemas are untouched; only the advertised JSON Schema
+     * projection is rendered within the provider's per-schema size budget.
+     * The signatures mirror the SDK's registrations so call sites keep their
+     * inferred handler argument types.
+     */
+    registerTool(name, config, callback) {
+        const budget = this.compactPresentation?.budgetBytes;
+        const inputSchema = budget !== undefined &&
+            config !== undefined &&
+            hasAdvertisedInputJsonSchema(config.inputSchema)
+            ? transformAdvertisedInputJsonSchema(config.inputSchema, (projected) => compactAdvertisedInputSchema(projected, budget).schema)
+            : undefined;
+        return super.registerTool(name, (inputSchema === undefined
+            ? config
+            : { ...config, inputSchema }), callback);
+    }
+    /** Preserve the SDK transport lifecycle while retaining oversized errors. */
+    connect(transport) {
+        return super.connect(new ErrorEvidenceTransport(transport, this.recordEvidence, this.delivery));
+    }
+}
+class ErrorEvidenceTransport {
+    transport;
+    recordEvidence;
+    delivery;
+    onclose;
+    onerror;
+    onmessage;
+    hasPerRequestStream;
+    pendingTools = new Map();
+    pendingCompletions = new Map();
+    constructor(transport, recordEvidence, delivery) {
+        this.transport = transport;
+        this.recordEvidence = recordEvidence;
+        this.delivery = delivery;
+        if (transport.hasPerRequestStream !== undefined)
+            this.hasPerRequestStream = transport.hasPerRequestStream;
+        transport.onmessage = (message, extra) => {
+            if (isJSONRPCRequest(message) &&
+                message.method === "tools/call" &&
+                typeof message.params?.["name"] === "string")
+                this.pendingTools.set(message.id, message.params["name"]);
+            if (isJSONRPCRequest(message) && message.method === "completion/complete")
+                this.pendingCompletions.set(message.id, new AbortController());
+            // The SDK suppresses replies after cancellation, so send() cannot release
+            // this bookkeeping. Keep transport authentication outside retained data.
+            if (isJSONRPCNotification(message) &&
+                message.method === "notifications/cancelled") {
+                const id = message.params?.["requestId"];
+                if (typeof id === "string" || typeof id === "number") {
+                    this.pendingTools.delete(id);
+                    this.pendingCompletions.get(id)?.abort();
+                    this.pendingCompletions.delete(id);
+                }
+            }
+            const completion = isJSONRPCRequest(message) && message.method === "completion/complete"
+                ? this.pendingCompletions.get(message.id)
+                : undefined;
+            if (completion === undefined)
+                this.onmessage?.(message, extra);
+            else
+                currentRequestSignal.run(completion.signal, () => this.onmessage?.(message, extra));
+        };
+        transport.onerror = (error) => this.onerror?.(error);
+        transport.onclose = () => {
+            this.pendingTools.clear();
+            for (const completion of this.pendingCompletions.values())
+                completion.abort();
+            this.pendingCompletions.clear();
+            this.onclose?.();
+        };
+    }
+    get sessionId() {
+        return this.transport.sessionId;
+    }
+    set sessionId(value) {
+        this.transport.sessionId = value;
+    }
+    start() {
+        return this.transport.start();
+    }
+    async close() {
+        try {
+            await this.transport.close();
+        }
+        finally {
+            this.pendingTools.clear();
+            for (const completion of this.pendingCompletions.values())
+                completion.abort();
+            this.pendingCompletions.clear();
+        }
+    }
+    setProtocolVersion(version) {
+        this.transport.setProtocolVersion?.(version);
+    }
+    setSupportedProtocolVersions(versions) {
+        this.transport.setSupportedProtocolVersions?.(versions);
+    }
+    async send(message, options) {
+        const id = "id" in message &&
+            (typeof message.id === "string" || typeof message.id === "number")
+            ? message.id
+            : undefined;
+        const tool = id === undefined ? undefined : this.pendingTools.get(id);
+        try {
+            const recovered = this.recoverError(message, tool);
+            if (isJSONRPCResultResponse(recovered) &&
+                isCallToolResult(recovered.result) &&
+                recovered.result.isError === true) {
+                // Keep the complete typed JSON in content. Error projections are not
+                // success outputSchema data; oversized recovery must consume their
+                // private structured carrier before it is removed from the wire.
+                const { structuredContent: _diagnostic, ...result } = recovered.result;
+                await this.transport.send({ ...recovered, result }, options);
+            }
+            else
+                await this.transport.send(recovered, options);
+        }
+        finally {
+            if (!isJSONRPCRequest(message) && id !== undefined) {
+                this.pendingTools.delete(id);
+                this.pendingCompletions.delete(id);
+            }
+        }
+    }
+    recoverError(message, tool) {
+        if (!isJSONRPCResultResponse(message) ||
+            !isCallToolResult(message.result) ||
+            message.result.isError !== true ||
+            message.result.structuredContent === undefined)
+            return message;
+        const structured = jsonObjectSchema.parse(message.result.structuredContent);
+        const budget = this.delivery.resultBudgetBytes;
+        // The delivered error omits structuredContent, so only its text counts.
+        const encoded = encodeToolResult(structured, budget, "text");
+        if (encoded.ok)
+            return message;
+        const operation = tool ?? "mcp_tool_error";
+        const originalError = analysisErrorProjectionSchema.safeParse(structured["error"]);
+        // Retain the already projected diagnostic. Transport authentication and raw
+        // request arguments are deliberately excluded: the application owns their
+        // explicit sensitivity policy, and its error projection is authoritative.
+        const evidence = createEvidence(undefined, { id: "rea-mcp", name: "REA MCP delivery", version: "1" }, {
+            operation: "mcp_tool_error",
+            parameters: { tool_name: operation },
+            result: structured,
+            rawResult: jsonObjectSchema.parse(message.result),
+        });
+        const recorded = this.recordEvidence?.(evidence);
+        const retained = recorded !== undefined && recorded.ok;
+        const failure = new AnalysisResourceConstraintError(operation, "transport", "The tool failed, but its complete error response exceeds the MCP response budget.", {
+            boundary: "mcp-response",
+            ...(originalError.success
+                ? { original_error_code: originalError.data.code }
+                : {}),
+            result_budget_bytes: budget,
+            response_bytes_at_least: encoded.bytesAtLeast,
+            constraint: encoded.constraint,
+            ...(retained
+                ? {
+                    evidence_reference: {
+                        kind: "retained-evidence",
+                        evidence_id: evidence.evidence_id,
+                    },
+                }
+                : { retention: recorded === undefined ? "unavailable" : "failed" }),
+            ...(recorded !== undefined && !recorded.ok
+                ? { retention_error: projectAnalysisError(recorded.error) }
+                : {}),
+        }, {
+            remediationAction: retained
+                ? "Export the retained original error through export_evidence_bundle to a caller-selected path. The connection remains usable."
+                : "Restart REA with a larger REA_MCP_MAX_RESPONSE_BYTES and matching client receive buffer, then retry. The original error could not be retained by this server.",
+        });
+        return { ...message, result: this.delivery.toErrorToolResult(failure) };
+    }
+}

package/dist/server/admittedToolOperation.js

@@ -0,0 +1,9 @@
+/** Run one complete tool workflow inside session admission when supplied. */
+export const runAdmittedToolOperation = async (server, admission, operationName, signal, operation) => {
+    if (admission === undefined)
+        return operation();
+    const admitted = await admission(operationName, signal, operation);
+    return admitted.ok
+        ? admitted.value
+        : server.delivery.toErrorToolResult(admitted.error);
+};

package/dist/server/analysisAdmission.js

@@ -0,0 +1,8 @@
+import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import { err, ok } from "../domain/result.js";
+/** Run against the source's explicit owner, admitting session-scoped work. */
+export const withAdmittedAnalysis = (source) => source.kind === "session"
+    ? (operationName, signal, operation) => source.session.withAdmittedAnalysis(operationName, signal, operation)
+    : async (operationName, signal, operation) => signal?.aborted === true
+        ? err(new AnalysisCancelledError(operationName))
+        : ok(await operation(source.analysis));

package/dist/server/contractToolHandler.js

@@ -0,0 +1,21 @@
+import { logToolExecution } from "./toolLogging.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
+/**
+ * Bind one service-backed handler to its exact named contract through the
+ * shared log/execute/record/deliver workflow.
+ */
+export const createContractToolHandler = (server, service, logger, recordEvidence, withAdmittedAnalysis) => (contract) => createEvidenceToolHandler(server, (input, options) => service.execute(contract.name, input, options), logger, recordEvidence, withAdmittedAnalysis)(contract);
+/** Bind a named Evidence-producing operation to shared logging and delivery. */
+export const createEvidenceToolHandler = (server, operation, logger, recordEvidence, withAdmittedAnalysis) => (contract) => {
+    const name = contract.name;
+    return async (input, context) => {
+        const executeAndRecord = async () => {
+            const result = await logToolExecution(logger, name, () => operation(input, { signal: context.mcpReq.signal }));
+            if (!result.ok)
+                return server.delivery.toCallToolResult(result, contract);
+            const recorded = recordEvidence?.(result.value);
+            return server.delivery.toEvidenceToolResult(result.value, contract, recorded);
+        };
+        return runAdmittedToolOperation(server, withAdmittedAnalysis, name, context.mcpReq.signal, executeAndRecord);
+    };
+};

package/dist/server/createServer.js

@@ -0,0 +1,344 @@
+import { createWasmArtifactService } from "../composition/wasm.js";
+import { registerWasmTools } from "./registerWasmTools.js";
+import { snapshotEnvironment } from "../process/snapshotEnvironment.js";
+import { createPeResourcesService } from "../composition/binaryDiagnostics.js";
+import { registerPeResourcesTool } from "./registerPeResourcesTool.js";
+import { createEvmInterfaceService } from "../composition/evm.js";
+import { registerEvmTools } from "./registerEvmTools.js";
+import { registerRecordedCrashTools } from "./registerRecordedCrashTools.js";
+import { createRecordedCrashService } from "../composition/binaryDiagnostics.js";
+import { createGoBinaryService } from "../composition/go.js";
+import { registerGoTools } from "./registerGoTools.js";
+import { registerAnalysisViewTool } from "./registerAnalysisViewTool.js";
+import { registerBinaryDiagnosticsTools } from "./registerBinaryDiagnosticsTools.js";
+import { createBinaryLayoutService } from "../composition/binaryDiagnostics.js";
+import { EvidenceMcpServer } from "./EvidenceMcpServer.js";
+import { createToolResultDelivery, } from "./toolResult.js";
+import { parseMcpResponseBudget } from "../config/mcpResponseBudget.js";
+import { COMPACT_INPUT_SCHEMA_BUDGET_BYTES, parseMcpInputSchemaProfile, } from "../config/mcpInputSchemaProfile.js";
+import { isAbsolute } from "node:path";
+import { PRODUCT_IDENTITY } from "../identity.js";
+import { silentLogger } from "../logger.js";
+import { registerApplicationTools } from "./registerApplicationTools.js";
+import { registerArtifactTools } from "./registerArtifactTools.js";
+import { registerBrowserScenarioTool } from "./registerBrowserScenarioTool.js";
+import { registerBrowserTools } from "./registerBrowserTools.js";
+import { registerWebScriptTool } from "./registerWebScriptTool.js";
+import { registerWebModuleTool } from "./registerWebModuleTool.js";
+import { createWebModuleTraceService } from "../composition/webModules.js";
+import { createWebSourceLocationService } from "../composition/webSourceLocations.js";
+import { registerWebSourceLocationTool } from "./registerWebSourceLocationTool.js";
+import { createWebRuntimeService } from "../composition/webRuntime.js";
+import { registerWebRuntimeTools } from "./registerWebRuntimeTools.js";
+import { createWebNetworkCaptureService } from "../composition/webNetworkCaptures.js";
+import { registerWebNetworkCaptureTool } from "./registerWebNetworkCaptureTool.js";
+import { registerJavaScriptRecoveryTool } from "./registerJavaScriptRecoveryTool.js";
+import { JavaScriptRecoveryService } from "../application/javascript/JavaScriptRecoveryService.js";
+import { createJavaScriptRecoveryProvider } from "../composition/javascriptRecovery.js";
+import { registerElectronTools } from "./registerElectronTools.js";
+import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
+import { registerEnhancedTools } from "./registerEnhancedTools.js";
+import { registerJavaScriptRuntimeObservationTools } from "./registerJavaScriptRuntimeObservationTools.js";
+import { registerManagedTools } from "./registerManagedTools.js";
+import { registerFirmwareTools } from "./registerFirmwareTools.js";
+import { FirmwareAnalysisService } from "../application/firmware/FirmwareAnalysisService.js";
+import { createFirmwareAnalysisProvider } from "../composition/firmware.js";
+import { registerAndroidTools } from "./registerAndroidTools.js";
+import { registerApktoolTools } from "./registerApktoolTools.js";
+import { registerJebTools } from "./registerJebTools.js";
+import { registerAdbTools } from "./registerAdbTools.js";
+import { AndroidAnalysisService } from "../application/android/AndroidAnalysisService.js";
+import { JebAnalysisService } from "../application/jeb/JebAnalysisService.js";
+import { ApktoolResourceAnalysisService } from "../application/apktool/ApktoolResourceAnalysisService.js";
+import { createAndroidAnalysisProvider } from "../composition/android.js";
+import { createApktoolResourceAnalysisProvider } from "../composition/apktool.js";
+import { createJebAnalysisProvider } from "../composition/jeb.js";
+import { AdbDeviceAnalysisService } from "../application/adb/AdbDeviceAnalysisService.js";
+import { createAdbDeviceAnalysisProvider } from "../composition/adb.js";
+import { registerManagedWorkflowTools } from "./registerManagedWorkflowTools.js";
+import { NATIVE_TOOL_CONTRACTS } from "../contracts/native/nativeToolContracts.js";
+import { registerEvidenceTools } from "./registerEvidenceTools.js";
+import { registerOfficialTools } from "./registerOfficialTools.js";
+import { registerGuidedPrompts } from "./registerPrompts.js";
+import { registerSessionTools } from "./registerSessionTools.js";
+import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
+import { withAdmittedAnalysis, } from "./analysisAdmission.js";
+const TARGET_FREE_INSTRUCTIONS = "Deep-analysis tools for local artifacts, native binaries, managed code, browser pages, and runtimes. Use the tool that directly answers the question; binary_session reports status, capabilities and why a tool is unavailable. Native executable or library: open_binary, then binary_overview, search_procedures or search_strings, then analyze_function (one dossier per function) or procedure_pseudo_code, and xrefs; close_binary when done. .NET: inspect_managed_artifact. APK code: inspect_android_package. Electron or JavaScript directories: analyze_javascript_application. Open browser page: list_browser_targets. For large results pass detail: summary and page with inspect_analysis_view. Results include inline Evidence and report their coverage and limitations.";
+const ACTIVE_TARGET_INSTRUCTIONS = "Deep analysis of the active reverse-engineering target. Use the analysis tool that answers the question directly. Search with search_procedures or search_strings before listing everything; analyze_function provides a function dossier, focused procedure tools return individual facets, and xrefs shows references. For large results pass detail: summary and page with inspect_analysis_view.";
+const installSessionToolAvailability = (session, options, environment) => {
+    if (session === undefined)
+        return undefined;
+    const linux = process.platform === "linux";
+    const linuxX64 = linux && process.arch === "x64";
+    const pwntools = linuxX64 && isAbsolute(environment.REA_PWNTOOLS_PYTHON ?? "");
+    const policy = sessionAvailabilityPolicy(options.availabilityPolicy, {
+        optionalProviderLoadFailures: options.optionalProviderLoadFailures,
+        optionalFeatures: {
+            wasmArtifactEnabled: options.wasmArtifact !== undefined ||
+                isAbsolute(environment.REA_WABT_BIN_DIRECTORY ?? ""),
+            evmInterfaceEnabled: options.evmInterface !== undefined || linuxX64,
+            webModuleResolutionEnabled: options.webModuleTrace !== undefined ||
+                isAbsolute(environment.REA_BROWSER_EXECUTABLE ?? ""),
+            recordedCrashEnabled: options.recordedCrash !== undefined || pwntools,
+            binaryLayoutEnabled: options.binaryLayout !== undefined || pwntools,
+            firmwareInspectionEnabled: options.firmwareAnalysis !== undefined ||
+                (linux && isAbsolute(environment.REA_BINWALK_COMMAND ?? "")),
+            firmwareExtractionEnabled: options.firmwareAnalysis !== undefined ||
+                (linux && isAbsolute(environment.REA_UNBLOB_COMMAND ?? "")),
+            browserObservationEnabled: options.browserObservation !== undefined,
+            javascriptRecoveryEnabled: options.javascriptRecovery !== undefined ||
+                (linuxX64 && isAbsolute(environment.REA_WAKARU_COMMAND ?? "")),
+            browserScenarioEnabled: options.browserScenarioCapture !== undefined,
+            electronObservationEnabled: options.electronObservation !== undefined,
+            electronAutomationEnabled: options.electronActiveObservation !== undefined,
+            v8InspectorObservationEnabled: options.javascriptRuntimeObservation !== undefined,
+        },
+    });
+    return {
+        policy,
+    };
+};
+const createMcpServer = (session, delivery, compactPresentation) => new EvidenceMcpServer({
+    name: PRODUCT_IDENTITY.mcpServerKey,
+    version: PRODUCT_IDENTITY.packageVersion,
+}, {
+    capabilities: {},
+    instructions: session === undefined
+        ? ACTIVE_TARGET_INSTRUCTIONS
+        : TARGET_FREE_INSTRUCTIONS,
+}, session === undefined
+    ? undefined
+    : (evidence) => session.recordEvidence(evidence), delivery, compactPresentation);
+/**
+ * Construct one MCP server without acquiring subprocess resources.
+ * Supplying a session adds target lifecycle tools; omitting it retains the
+ * fixed-target seam used by focused tests and embedders.
+ */
+export const createServer = (source, options = {}) => {
+    const session = source.kind === "session" ? source.session : undefined;
+    const analysis = source.kind === "session" ? source.session : source.analysis;
+    const environment = snapshotEnvironment(options.environment ?? process.env);
+    const delivery = selectToolResultDelivery(environment, options.delivery);
+    const evmInterface = options.evmInterface ?? createEvmInterfaceService(environment);
+    const webSourceLocation = options.webSourceLocation ?? createWebSourceLocationService(environment);
+    const webModuleTrace = options.webModuleTrace ?? createWebModuleTraceService(environment);
+    const javascriptRecovery = options.javascriptRecovery ?? createJavaScriptRecoveryProvider(environment);
+    const artifactResources = new ArtifactResourceScope();
+    const firmwareAnalysis = new FirmwareAnalysisService(options.firmwareAnalysis ?? createFirmwareAnalysisProvider(environment));
+    const selectedOptions = {
+        ...options,
+        environment,
+        delivery,
+        evmInterface,
+        webSourceLocation,
+        webModuleTrace,
+        javascriptRecovery,
+    };
+    const startedAt = new Date().toISOString();
+    const logger = options.logger ?? silentLogger;
+    const server = createMcpServer(session, delivery, selectCompactInputSchemaPresentation(environment));
+    const android = options.androidAnalysis ?? createAndroidAnalysisProvider(environment);
+    const wasmArtifact = options.wasmArtifact ?? createWasmArtifactService(environment);
+    const apktool = options.apktoolAnalysis ??
+        createApktoolResourceAnalysisProvider(environment);
+    const jeb = options.jebAnalysis ?? createJebAnalysisProvider(environment);
+    const adbDevice = options.adbDeviceAnalysis ?? createAdbDeviceAnalysisProvider(environment);
+    let providerClose;
+    const closeProviders = () => {
+        providerClose ??= Promise.allSettled([
+            android.close(),
+            wasmArtifact.close(),
+            apktool.close(),
+            jeb.close(),
+            adbDevice.close(),
+            evmInterface.close(),
+            webSourceLocation.close(),
+            webModuleTrace.close(),
+            javascriptRecovery.close?.() ?? Promise.resolve(),
+            artifactResources.close(),
+            firmwareAnalysis.close(),
+            options.browserScenarioCapture?.close?.() ?? Promise.resolve(),
+        ])
+            .then((results) => {
+            const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+            if (failures.length > 0)
+                throw new AggregateError(failures, "REA provider cleanup failed");
+        })
+            .catch((cause) => {
+            providerClose = undefined;
+            throw cause;
+        });
+        return providerClose;
+    };
+    const availability = installSessionToolAvailability(session, options, environment);
+    const toolLogger = logger.child({ layer: "server" });
+    const { evidenceById, activeTarget, recordEvidence, recordEvidenceWithUnknown, } = createSessionRecorders(server, session);
+    const analysisAdmission = withAdmittedAnalysis(source);
+    const toolContext = {
+        server,
+        session,
+        options: selectedOptions,
+        environment,
+        logger: toolLogger,
+        evidenceById,
+        activeTarget,
+        recordEvidence,
+        recordEvidenceWithUnknown,
+        withAdmittedAnalysis: analysisAdmission,
+        artifactResources,
+    };
+    registerBinaryAnalysisTools(toolContext);
+    const previousOnclose = server.server.onclose;
+    server.server.onclose = () => {
+        previousOnclose?.();
+        void closeProviders().catch((cause) => {
+            logger.error({ error: cause instanceof Error ? cause.message : String(cause) }, "Provider cleanup failed during server shutdown");
+        });
+    };
+    const closeServer = server.close.bind(server);
+    server.close = async () => {
+        const results = await Promise.allSettled([closeServer(), closeProviders()]);
+        for (const result of results)
+            if (result.status === "rejected")
+                throw result.reason;
+    };
+    registerConfiguredAnalysisTools(toolContext, android, wasmArtifact, jeb, firmwareAnalysis);
+    registerAdbTools(server, new AdbDeviceAnalysisService(adbDevice), toolLogger, recordEvidence, analysisAdmission);
+    registerApktoolTools(server, new ApktoolResourceAnalysisService(apktool), toolLogger, recordEvidence, analysisAdmission);
+    registerObservationTools(toolContext);
+    registerGuidedPrompts(server, analysis, session);
+    if (session !== undefined) {
+        registerSessionTools(server, session, toolLogger, {
+            ...selectedOptions,
+            artifactResources,
+            ...(availability === undefined
+                ? {}
+                : { availabilityPolicy: availability.policy }),
+            androidAnalysisAvailability: (signal) => android.inspectAvailability(signal),
+            startedAt,
+        });
+    }
+    return server;
+};
+const selectToolResultDelivery = (environment, selected) => {
+    if (selected !== undefined)
+        return selected;
+    const configured = parseMcpResponseBudget(environment.REA_MCP_MAX_RESPONSE_BYTES);
+    if (!configured.ok)
+        throw configured.error;
+    return createToolResultDelivery(configured.value);
+};
+const selectCompactInputSchemaPresentation = (environment) => {
+    const configured = parseMcpInputSchemaProfile(environment.REA_MCP_INPUT_SCHEMA_PROFILE);
+    if (!configured.ok)
+        throw configured.error;
+    return configured.value === "compact"
+        ? { budgetBytes: COMPACT_INPUT_SCHEMA_BUDGET_BYTES }
+        : undefined;
+};
+const registerConfiguredAnalysisTools = ({ server, options, environment, logger: toolLogger, evidenceById, recordEvidence, withAdmittedAnalysis, }, android, wasmArtifact, jeb, firmwareAnalysis) => {
+    registerAndroidTools(server, new AndroidAnalysisService(android), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerJebTools(server, new JebAnalysisService(jeb), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerBinaryDiagnosticsTools(server, options.binaryLayout ?? createBinaryLayoutService(environment), toolLogger, recordEvidence, evidenceById, withAdmittedAnalysis);
+    registerAnalysisViewTool(server, toolLogger, evidenceById, recordEvidence, withAdmittedAnalysis);
+    registerPeResourcesTool(server, createPeResourcesService(), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerGoTools(server, options.goBinary ?? createGoBinaryService(), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerWasmTools(server, wasmArtifact, toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerEvmTools(server, options.evmInterface ?? createEvmInterfaceService(environment), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerRecordedCrashTools(server, options.recordedCrash ?? createRecordedCrashService(environment), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerFirmwareTools(server, firmwareAnalysis, toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerWebModuleTool(server, options.webModuleTrace ?? createWebModuleTraceService(environment), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerWebSourceLocationTool(server, options.webSourceLocation ?? createWebSourceLocationService(environment), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerWebRuntimeTools(server, options.webRuntime ?? createWebRuntimeService(), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerWebNetworkCaptureTool(server, options.webNetworkCapture ?? createWebNetworkCaptureService(environment), toolLogger, recordEvidence, withAdmittedAnalysis);
+    registerJavaScriptRecoveryTool(server, new JavaScriptRecoveryService(options.javascriptRecovery ??
+        createJavaScriptRecoveryProvider(environment)), toolLogger, recordEvidence, withAdmittedAnalysis);
+};
+const createSessionRecorders = (server, session) => ({
+    evidenceById: session === undefined
+        ? undefined
+        : (evidenceId) => session.evidenceForAnalysis?.(evidenceId) ??
+            session.evidenceById(evidenceId),
+    activeTarget: session === undefined ? undefined : () => session.activeTarget(),
+    recordEvidence: session === undefined
+        ? undefined
+        : (evidence) => session.recordEvidence(evidence),
+    recordEvidenceWithUnknown: session === undefined
+        ? undefined
+        : (evidence, input) => session.recordEvidenceWithUnknown(evidence, input),
+});
+const registerBinaryAnalysisTools = ({ server, session, logger, activeTarget, recordEvidence, recordEvidenceWithUnknown, withAdmittedAnalysis, }) => {
+    const recordUnknown = session === undefined
+        ? undefined
+        : (input) => session.recordUnknown(input);
+    const analysisOptions = {
+        logger,
+        activeTarget,
+        recordEvidence,
+        recordUnknown,
+        withAdmittedAnalysis,
+    };
+    registerOfficialTools(server, analysisOptions);
+    registerEnhancedTools(server, {
+        ...analysisOptions,
+        analysisProfile: session === undefined ? undefined : () => session.analysisProfile(),
+        allowsSnapshotReplay: session === undefined
+            ? undefined
+            : (operation) => session.allowsSnapshotReplay(operation),
+        recordWorkflowSnapshot: session === undefined
+            ? undefined
+            : (input) => session.recordWorkflowSnapshot(input),
+    });
+    const evidenceOptions = {
+        logger,
+        activeTarget,
+        recordEvidence,
+        withAdmittedAnalysis,
+    };
+    registerEvidenceTools(server, NATIVE_TOOL_CONTRACTS, evidenceOptions);
+    registerArtifactTools(server, evidenceOptions);
+    registerManagedTools(server, evidenceOptions);
+    if (session !== undefined)
+        registerManagedWorkflowTools(server, {
+            logger,
+            recordEvidence,
+            recordEvidenceWithUnknown,
+            session,
+            withAdmittedAnalysis,
+        });
+};
+const registerObservationTools = ({ evidenceById, server, options, logger, recordEvidence, recordEvidenceWithUnknown, withAdmittedAnalysis, artifactResources, }) => {
+    const common = { logger, recordEvidence, withAdmittedAnalysis };
+    registerWebScriptTool(server, { ...common, artifactResources });
+    registerBrowserTools(server, {
+        ...common,
+        browser: options.browserObservation,
+        loadFailure: options.optionalProviderLoadFailures?.browserObservation,
+    });
+    registerBrowserScenarioTool(server, {
+        ...common,
+        provider: options.browserScenarioCapture,
+        loadFailure: options.optionalProviderLoadFailures?.browserScenarioCapture,
+    });
+    registerElectronTools(server, {
+        ...common,
+        artifactResources,
+        evidenceById,
+        electron: options.electronObservation,
+        electronActive: options.electronActiveObservation,
+        observationLoadFailure: options.optionalProviderLoadFailures?.electronObservation,
+        activeLoadFailure: options.optionalProviderLoadFailures?.electronActiveObservation,
+    });
+    registerJavaScriptRuntimeObservationTools(server, {
+        ...common,
+        runtime: options.javascriptRuntimeObservation,
+        loadFailure: options.optionalProviderLoadFailures?.javascriptRuntimeObservation,
+    });
+    registerApplicationTools(server, {
+        evidenceById,
+        logger,
+        recordEvidence,
+        recordEvidenceWithUnknown,
+        withAdmittedAnalysis,
+    });
+};

package/dist/server/lifecycleProgress.js

@@ -0,0 +1,10 @@
+/** Report one lifecycle operation start through the shared monotonic boundary. */
+export const reportLifecycleStart = (progress, phase, message = "started") => progress.report({ phase, completed: 0, total: 1, message });
+/** Report one lifecycle operation's terminal disposition. */
+export const reportLifecycleEnd = (progress, phase, succeeded) => progress.report({
+    phase,
+    completed: 1,
+    total: 1,
+    message: succeeded ? "completed" : "failed",
+    terminal: true,
+});

package/dist/server/mcpClientMetadata.js

@@ -0,0 +1,42 @@
+import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, PROTOCOL_VERSION_META_KEY, } from "@modelcontextprotocol/server";
+/**
+ * Client metadata for the current request. A 2026-era request carries it in
+ * its per-request envelope; a 2025-era connection sends no envelope, so its
+ * `initialize` handshake supplies the values.
+ */
+export const mcpClientMetadata = (context, connection) => {
+    const envelope = context.mcpReq.envelope;
+    // The SDK deprecates these accessors only in favor of the envelope, which
+    // 2025-era requests do not carry; they still return initialize values.
+    const value = (key, initialized) => envelope === undefined ? initialized() : mcpEnvelopeValue(envelope, key);
+    const client = implementation(value(CLIENT_INFO_META_KEY, () => connection.getClientVersion()));
+    const protocolVersion = value(PROTOCOL_VERSION_META_KEY, () => connection.getNegotiatedProtocolVersion());
+    return {
+        ...(client === undefined ? {} : { client }),
+        clientFeatures: capabilityFeatures(value(CLIENT_CAPABILITIES_META_KEY, () => connection.getClientCapabilities())),
+        ...(typeof protocolVersion === "string" ? { protocolVersion } : {}),
+    };
+};
+/** Read an SDK-defined metadata key from the SDK's currently opaque envelope type. */
+export const mcpEnvelopeValue = (envelope, key) => (envelope === undefined ? undefined : Reflect.get(envelope, key));
+const implementation = (value) => isRecord(value) &&
+    typeof value.name === "string" &&
+    typeof value.version === "string"
+    ? { name: value.name, version: value.version }
+    : undefined;
+const capabilityFeatures = (value) => {
+    const capabilities = isRecord(value) ? value : {};
+    const elicitation = isRecord(capabilities.elicitation)
+        ? capabilities.elicitation
+        : undefined;
+    return {
+        // A declared capability without modes retains the protocol's form-only
+        // compatibility rule; a missing capability still grants no support.
+        elicitation_form: elicitation !== undefined &&
+            (elicitation.form !== undefined || elicitation.url === undefined),
+        elicitation_url: elicitation?.url !== undefined,
+        roots: capabilities.roots !== undefined,
+        sampling: capabilities.sampling !== undefined,
+    };
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);