rea-agents 2.0.0 → 2.2.0

package/dist/domain/androidApplication.js

@@ -0,0 +1,206 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
+import { projectBoundedCartesian } from "./boundedCartesianProjection.js";
+import { evidenceSchema } from "./evidence.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const pathSchema = z.string().min(1).max(4_096);
+const componentSchema = z.strictObject({
+    path: pathSchema,
+    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    sha256: digestSchema,
+    format: z.string().min(1).max(100),
+});
+/** Authenticated APK inventory pages projected as one Android application. */
+export const androidApplicationProjectionInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1).max(100),
+    limits: z
+        .strictObject({
+        max_components: z.number().int().min(1).max(10_000).default(1_000),
+    })
+        .default({ max_components: 1_000 }),
+});
+/** Deterministic, execution-free Android application inventory projection. */
+export const androidApplicationProjectionResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    projection_id: z.string().regex(/^adp_[a-f0-9]{64}$/u),
+    root_sha256: digestSchema,
+    root_format: z.literal("apk"),
+    source_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    components: z.strictObject({
+        manifests: z.array(componentSchema),
+        resources: z.array(componentSchema),
+        dex: z.array(componentSchema),
+        jvm_classes: z.array(componentSchema),
+        native_libraries: z.array(componentSchema),
+        javascript: z.array(componentSchema),
+        signing: z.array(componentSchema),
+    }),
+    runtime_families: z.array(z.enum([
+        "dalvik-art",
+        "java-kotlin",
+        "native",
+        "javascript",
+        "react-native",
+        "flutter",
+        "unity",
+    ])),
+    bridge_candidates: z.array(z.strictObject({
+        managed_path: pathSchema,
+        native_path: pathSchema,
+        basis: z.enum([
+            "managed-and-native-content",
+            "jni-library-convention",
+            "react-native-convention",
+            "flutter-convention",
+            "unity-convention",
+        ]),
+    })),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inventory", "partial", "truncated"]),
+        inventory_complete: z.boolean(),
+        omitted_components: z.number().int().min(0),
+        omitted_bridge_candidates: z.number().int().min(0),
+    }),
+    limitations: z.array(z.string().min(1).max(4_096)).max(100),
+});
+/** Project exact APK paths and hashes without decoding or executing target code. */
+export const projectAndroidApplication = (input) => {
+    const parsed = androidApplicationProjectionInputSchema.parse(input);
+    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
+    if (inventory.manifest.root_format !== "apk")
+        throw new TypeError("Android application projection requires APK Evidence");
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    const all = inventory.occurrences
+        .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
+        .map((occurrence) => {
+        const node = nodes.get(occurrence.artifact_id ?? "");
+        if (node === undefined)
+            throw new TypeError("Android application occurrence has no artifact node");
+        return {
+            path: occurrence.logical_path,
+            artifact_id: node.artifact_id,
+            sha256: node.sha256,
+            format: node.format,
+        };
+    });
+    const classified = classify(all);
+    const components = retain(classified, parsed.limits.max_components);
+    const omittedComponents = count(classified) - count(components);
+    const bridgeProjection = bridgeCandidates([...components.dex, ...components.jvm_classes], components.native_libraries, parsed.limits.max_components);
+    const limitations = [
+        ...(!inventory.complete
+            ? ["Source inventory pages are incomplete; absence is unknown."]
+            : []),
+        ...(omittedComponents > 0
+            ? [
+                `${String(omittedComponents)} component observations were omitted by the projection limit.`,
+            ]
+            : []),
+        ...(bridgeProjection.omitted > 0
+            ? [
+                `${String(bridgeProjection.omitted)} bridge hypotheses were omitted by the projection limit.`,
+            ]
+            : []),
+        "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
+        "Bridge candidates are path-based hypotheses, not decoded JNI declarations or observed runtime calls.",
+    ];
+    const withoutId = {
+        schema_version: 1,
+        root_sha256: inventory.manifest.root_sha256,
+        root_format: "apk",
+        source_evidence_ids: evidence
+            .map(({ evidence_id: id }) => id)
+            .sort(compare),
+        components,
+        runtime_families: runtimeFamilies(all),
+        bridge_candidates: bridgeProjection.candidates,
+        coverage: {
+            status: omittedComponents > 0 || bridgeProjection.omitted > 0
+                ? "truncated"
+                : inventory.complete
+                    ? "complete-within-inventory"
+                    : "partial",
+            inventory_complete: inventory.complete,
+            omitted_components: omittedComponents,
+            omitted_bridge_candidates: bridgeProjection.omitted,
+        },
+        limitations,
+    };
+    return androidApplicationProjectionResultSchema.parse({
+        ...withoutId,
+        projection_id: `adp_${digest(withoutId)}`,
+    });
+};
+const classify = (all) => ({
+    manifests: all.filter(({ path, format }) => format === "android-manifest" ||
+        /(?:^|\/)AndroidManifest\.xml$/u.test(path)),
+    resources: all.filter(({ path, format }) => format === "android-resources" || /(?:^|\/)resources\.arsc$/u.test(path)),
+    dex: all.filter(({ path, format }) => format === "dex" || /(?:^|\/)[^/]+\.dex$/iu.test(path)),
+    jvm_classes: all.filter(({ path, format }) => format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path)),
+    native_libraries: all.filter(({ path, format }) => format === "elf" || /(?:^|\/)lib\/[^/]+\/[^/]+\.so$/iu.test(path)),
+    javascript: all.filter(({ format }) => format === "javascript-bundle"),
+    signing: all.filter(({ path }) => /^META-INF\/[^/]+\.(?:MF|RSA|DSA|EC|SF)$/iu.test(path)),
+});
+const retain = (groups, maximum) => {
+    let remaining = maximum;
+    return Object.fromEntries(Object.entries(groups).map(([key, values]) => {
+        const selected = [...values]
+            .sort((left, right) => compare(left.path, right.path))
+            .slice(0, remaining);
+        remaining -= selected.length;
+        return [key, selected];
+    }));
+};
+const count = (groups) => Object.values(groups).reduce((total, values) => total + values.length, 0);
+const runtimeFamilies = (all) => {
+    const paths = all.map(({ path }) => path.toLowerCase());
+    const families = new Set();
+    if (all.some(({ path, format }) => format === "dex" || path.endsWith(".dex")))
+        families.add("dalvik-art");
+    if (all.some(({ path, format }) => format === "jvm-class" || path.endsWith(".class")))
+        families.add("java-kotlin");
+    if (all.some(({ format }) => format === "elf"))
+        families.add("native");
+    if (all.some(({ format }) => format === "javascript-bundle"))
+        families.add("javascript");
+    if (paths.some((path) => path.includes("reactnative") || path.includes("hermes")))
+        families.add("react-native");
+    if (paths.some((path) => path.includes("libflutter.so")))
+        families.add("flutter");
+    if (paths.some((path) => path.includes("libunity.so")))
+        families.add("unity");
+    return [...families].sort(compare);
+};
+const bridgeCandidates = (managed, native, maximum) => {
+    const projection = projectBoundedCartesian(managed, native, maximum, (source, target) => ({
+        managed_path: source.path,
+        native_path: target.path,
+        basis: bridgeBasis(target.path),
+    }));
+    return {
+        candidates: projection.values,
+        omitted: projection.omitted,
+    };
+};
+const bridgeBasis = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.includes("react") || lower.includes("hermes"))
+        return "react-native-convention";
+    if (lower.includes("flutter"))
+        return "flutter-convention";
+    if (lower.includes("unity"))
+        return "unity-convention";
+    if (/lib\/[^/]+\/lib[^/]+\.so$/u.test(lower))
+        return "jni-library-convention";
+    return "managed-and-native-content";
+};
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Android application projection is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/domain/appleApplication.js

@@ -0,0 +1,221 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
+import { projectBoundedCartesian } from "./boundedCartesianProjection.js";
+import { evidenceSchema } from "./evidence.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const boundedPathSchema = z.string().min(1).max(4_096);
+const componentSchema = z.strictObject({
+    path: boundedPathSchema,
+    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    sha256: digestSchema,
+    format: z.string().min(1).max(100),
+});
+/** Authenticated artifact inventory pages projected as one Apple application. */
+export const appleApplicationProjectionInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1).max(100),
+    limits: z
+        .strictObject({
+        max_components: z.number().int().min(1).max(10_000).default(1_000),
+    })
+        .default({ max_components: 1_000 }),
+});
+/** Deterministic, execution-free Apple application inventory projection. */
+export const appleApplicationProjectionResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    projection_id: z.string().regex(/^aap_[a-f0-9]{64}$/u),
+    root_sha256: digestSchema,
+    root_format: z.literal("ipa"),
+    source_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    application_roots: z.array(boundedPathSchema),
+    components: z.strictObject({
+        bundle_metadata: z.array(componentSchema),
+        executables: z.array(componentSchema),
+        frameworks: z.array(componentSchema),
+        native_libraries: z.array(componentSchema),
+        javascript: z.array(componentSchema),
+        signing: z.array(componentSchema),
+    }),
+    runtime_families: z.array(z.enum([
+        "native",
+        "swift-objective-c",
+        "javascript",
+        "react-native",
+        "flutter",
+        "unity",
+    ])),
+    bridge_candidates: z.array(z.strictObject({
+        source_path: boundedPathSchema,
+        native_path: boundedPathSchema,
+        basis: z.enum([
+            "javascript-and-native-content",
+            "react-native-convention",
+            "flutter-convention",
+            "unity-convention",
+        ]),
+    })),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inventory", "partial", "truncated"]),
+        inventory_complete: z.boolean(),
+        omitted_components: z.number().int().min(0),
+        omitted_bridge_candidates: z.number().int().min(0),
+    }),
+    limitations: z.array(z.string().min(1).max(4_096)).max(100),
+});
+/** Project exact IPA paths and hashes without parsing or executing target code. */
+export const projectAppleApplication = (input) => {
+    const parsed = appleApplicationProjectionInputSchema.parse(input);
+    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
+    if (inventory.manifest.root_format !== "ipa")
+        throw new TypeError("Apple application projection requires IPA Evidence");
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    const all = inventory.occurrences
+        .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
+        .map((occurrence) => {
+        const node = nodes.get(occurrence.artifact_id ?? "");
+        if (node === undefined)
+            throw new TypeError("Apple application occurrence has no artifact node");
+        return {
+            path: occurrence.logical_path,
+            artifact_id: node.artifact_id,
+            sha256: node.sha256,
+            format: node.format,
+        };
+    });
+    const roots = [
+        ...new Set(inventory.occurrences.flatMap(({ logical_path: path }) => {
+            const match = /^(Payload\/[^/]+\.app)(?:\/|$)/u.exec(path);
+            return match?.[1] === undefined ? [] : [match[1]];
+        })),
+    ].sort(compare);
+    const classified = classifyComponents(all, roots);
+    const retained = retainComponents(classified, parsed.limits.max_components);
+    const omitted = componentCount(classified) - componentCount(retained);
+    const runtimeFamilies = identifyRuntimeFamilies(all);
+    const bridgeProjection = identifyBridgeCandidates(retained.javascript, deduplicateComponents([
+        ...retained.executables,
+        ...retained.native_libraries,
+    ]), parsed.limits.max_components);
+    const limitations = projectionLimitations(inventory.complete, omitted, bridgeProjection.omitted, roots);
+    const withoutId = {
+        schema_version: 1,
+        root_sha256: inventory.manifest.root_sha256,
+        root_format: "ipa",
+        source_evidence_ids: evidence
+            .map(({ evidence_id: id }) => id)
+            .sort(compare),
+        application_roots: roots,
+        components: retained,
+        runtime_families: runtimeFamilies,
+        bridge_candidates: bridgeProjection.candidates,
+        coverage: {
+            status: omitted > 0 || bridgeProjection.omitted > 0
+                ? "truncated"
+                : inventory.complete
+                    ? "complete-within-inventory"
+                    : "partial",
+            inventory_complete: inventory.complete,
+            omitted_components: omitted,
+            omitted_bridge_candidates: bridgeProjection.omitted,
+        },
+        limitations,
+    };
+    return appleApplicationProjectionResultSchema.parse({
+        ...withoutId,
+        projection_id: `aap_${digest(withoutId)}`,
+    });
+};
+const classifyComponents = (all, roots) => {
+    const withinApp = (path) => roots.some((root) => path.startsWith(`${root}/`));
+    return {
+        bundle_metadata: all.filter(({ path }) => /(?:^|\/)Info\.plist$/u.test(path)),
+        executables: all.filter(({ path, format }) => withinApp(path) && ["mach-o", "mach-o-universal"].includes(format)),
+        frameworks: all.filter(({ path }) => /\.framework\//u.test(path)),
+        native_libraries: all.filter(({ path }) => /\.(?:dylib|so)$/iu.test(path)),
+        javascript: all.filter(({ format }) => format === "javascript-bundle"),
+        signing: all.filter(({ path }) => /(?:^|\/)(?:embedded\.mobileprovision|_CodeSignature\/CodeResources)$/u.test(path)),
+    };
+};
+const retainComponents = (groups, maximum) => {
+    let remaining = maximum;
+    return Object.fromEntries(Object.entries(groups).map(([key, values]) => {
+        const retained = [...values]
+            .sort((left, right) => compare(left.path, right.path))
+            .slice(0, remaining);
+        remaining -= retained.length;
+        return [key, retained];
+    }));
+};
+const componentCount = (groups) => Object.values(groups).reduce((total, values) => total + values.length, 0);
+const deduplicateComponents = (values) => [...new Map(values.map((value) => [value.path, value])).values()].sort((left, right) => compare(left.path, right.path));
+const identifyRuntimeFamilies = (all) => {
+    const paths = all.map(({ path }) => path.toLowerCase());
+    const families = new Set();
+    if (all.some(({ format }) => ["mach-o", "mach-o-universal"].includes(format)))
+        families.add("native");
+    if (paths.some((path) => /\.(?:dylib|framework\/[^/]+)$/u.test(path)))
+        families.add("swift-objective-c");
+    if (all.some(({ format }) => format === "javascript-bundle"))
+        families.add("javascript");
+    if (paths.some((path) => path.includes("reactnative") ||
+        path.includes("react.framework") ||
+        path.includes("hermes")))
+        families.add("react-native");
+    if (paths.some((path) => path.includes("flutter.framework") || path.includes("app.framework")))
+        families.add("flutter");
+    if (paths.some((path) => path.includes("unityframework.framework")))
+        families.add("unity");
+    return [...families].sort(compare);
+};
+const identifyBridgeCandidates = (scripts, native, maximum) => {
+    const projection = projectBoundedCartesian(scripts, native, maximum, (script, item) => ({
+        source_path: script.path,
+        native_path: item.path,
+        basis: bridgeBasis(item.path),
+    }));
+    return {
+        candidates: projection.values,
+        omitted: projection.omitted,
+    };
+};
+const bridgeBasis = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.includes("react"))
+        return "react-native-convention";
+    if (lower.includes("flutter") || lower.includes("app.framework"))
+        return "flutter-convention";
+    if (lower.includes("unity"))
+        return "unity-convention";
+    return "javascript-and-native-content";
+};
+const projectionLimitations = (complete, omitted, omittedBridges, roots) => [
+    ...(!complete
+        ? ["Source inventory pages are incomplete; absence is unknown."]
+        : []),
+    ...(omitted > 0
+        ? [
+            `${String(omitted)} component observations were omitted by the projection limit.`,
+        ]
+        : []),
+    ...(omittedBridges > 0
+        ? [
+            `${String(omittedBridges)} bridge hypotheses were omitted by the projection limit.`,
+        ]
+        : []),
+    ...(roots.length === 0
+        ? [
+            "No Payload/*.app directory was present in the supplied inventory pages.",
+        ]
+        : []),
+    "Bundle identifiers and signing claims require dedicated plist and CMS parsing; this projection reports only exact paths and hashes.",
+    "Bridge candidates are path-based hypotheses, not observed runtime calls.",
+];
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Apple application projection is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/domain/artifactComparison.js

@@ -161,39 +161,58 @@ const compareOccurrences = (left, right, evidenceLinks, complete) => {
     }
     return output;
 };
-const classifyPath = (input) => {
-    const base = {
-        logical_path: input.path,
-        left_occurrence_id: input.leftOccurrence?.occurrence_id ?? null,
-        right_occurrence_id: input.rightOccurrence?.occurrence_id ?? null,
-        left_artifact_id: input.leftOccurrence?.artifact_id ?? null,
-        right_artifact_id: input.rightOccurrence?.artifact_id ?? null,
-        evidence_links: [...input.evidenceLinks],
-    };
+const buildArtifactChangeBase = (input) => ({
+    logical_path: input.path,
+    left_occurrence_id: input.leftOccurrence?.occurrence_id ?? null,
+    right_occurrence_id: input.rightOccurrence?.occurrence_id ?? null,
+    left_artifact_id: input.leftOccurrence?.artifact_id ?? null,
+    right_artifact_id: input.rightOccurrence?.artifact_id ?? null,
+    evidence_links: [...input.evidenceLinks],
+});
+const classifyPresence = (input) => {
     if (input.leftOccurrence === undefined)
         return {
-            ...base,
+            ...buildArtifactChangeBase(input),
             classification: input.complete ? "added" : "unknown",
             dimensions: [input.complete ? "content" : "availability"],
         };
     if (input.rightOccurrence === undefined)
         return {
-            ...base,
+            ...buildArtifactChangeBase(input),
             classification: input.complete ? "removed" : "unknown",
             dimensions: [input.complete ? "content" : "availability"],
         };
-    if (input.leftOccurrence.hash_status === "mismatched" ||
-        input.rightOccurrence.hash_status === "mismatched")
+    return null;
+};
+const classifyIntegrity = (input, base) => {
+    if (input.leftOccurrence?.hash_status === "mismatched" ||
+        input.rightOccurrence?.hash_status === "mismatched")
         return {
             ...base,
             classification: "contradiction",
             dimensions: ["integrity"],
         };
-    if (input.leftOccurrence.hash_status !== "verified" ||
-        input.rightOccurrence.hash_status !== "verified" ||
+    return null;
+};
+const classifyAvailability = (input, base) => {
+    if (input.leftOccurrence?.hash_status !== "verified" ||
+        input.rightOccurrence?.hash_status !== "verified" ||
         input.leftNode === undefined ||
         input.rightNode === undefined)
         return { ...base, classification: "unknown", dimensions: ["availability"] };
+    return null;
+};
+const classifyPath = (input) => {
+    const presence = classifyPresence(input);
+    if (presence !== null)
+        return presence;
+    const base = buildArtifactChangeBase(input);
+    const integrity = classifyIntegrity(input, base);
+    if (integrity !== null)
+        return integrity;
+    const availability = classifyAvailability(input, base);
+    if (availability !== null)
+        return availability;
     const dimensions = changedDimensions(input);
     return dimensions.length === 0
         ? null