fix(cli): reuse firmware and web module input constraints

Derive extraction limits and web module fields from the shared contracts. Reject empty or NUL-containing local paths before CLI path resolution, preserve firmware relative-path handling, and apply the advertised extraction defaults.

Validate advertised JSON Schemas with Ajv and check the registered parser defaults; prune redundant schema-shape and description assertions.

src/cli/webModuleCommands.ts

@@ -3,10 +3,14 @@ import { createWebModuleTraceService } from "../composition/webModules.js";
 import { CLI_COMMANDS } from "../cliCommandNames.js";
 import { logCliCommand } from "../cliLogging.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { webModuleTraceInputSchema } from "../domain/webModuleTrace.js";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
 import { withCommandCancellation } from "./commandCancellation.js";
 
+const importMapInputSchema =
+  webModuleTraceInputSchema.shape.import_map.unwrap();
+
 /** Expose the same selected-context module trace through the CLI. */
 export const registerWebModuleCommands = (
   cli: CliInstance,
@@ -18,9 +22,7 @@ export const registerWebModuleCommands = (
     description:
       "Trace one captured script's native imports to URLs and captured source candidates",
     args: z.object({
-      manifestPath: z
-        .string()
-        .describe("Absolute export_web_scripts manifest path"),
+      manifestPath: webModuleTraceInputSchema.shape.manifest_path,
       scriptIndex: z.coerce
         .number()
         .int()
@@ -28,18 +30,15 @@ export const registerWebModuleCommands = (
         .describe("Zero-based manifest script index"),
     }),
     options: z.object({
-      importerUrl: z
-        .string()
-        .optional()
-        .describe("Explicit HTTP(S) importer URL"),
-      importMapPath: z
-        .string()
-        .optional()
-        .describe("Absolute local import-map JSON"),
-      importMapBaseUrl: z
-        .string()
-        .optional()
-        .describe("HTTP(S) import-map base URL"),
+      importerUrl: webModuleTraceInputSchema.shape.importer_url,
+      importMapPath: importMapInputSchema.shape.path
+        .describe(
+          "Absolute local import-map JSON path; requires --import-map-base-url",
+        )
+        .optional(),
+      importMapBaseUrl: importMapInputSchema.shape.base_url
+        .describe("HTTP(S) import-map base URL; requires --import-map-path")
+        .optional(),
     }),
     run: ({ args, options }) =>
       withCommandCancellation(async (signal) => {