rea-agents 2.1.0 → 2.2.0

package/dist/cliSetup.js

@@ -9,7 +9,7 @@ const promptStreams = {
     output: process.stderr,
     withGuide: true,
 };
-const agentAccessCapabilityId = "agent_access";
+const agentIntegrationCapabilityId = "agent_integration";
 /** Run the inline setup picker, exact preflight, and default-No consent. */
 export const confirmInteractiveSetup = async (actions, accessible) => {
     intro("REA setup", promptStreams);
@@ -96,29 +96,46 @@ const selectSetupActions = async (actions, accessible) => {
     if (selectedCapabilities === undefined)
         return undefined;
     const selectedCapabilityIds = new Set(selectedCapabilities);
+    const bundledSkillAction = componentActions.find(({ kind }) => kind === "install_skill");
     const selectedActionIds = componentActions
-        .filter(({ id }) => selectedCapabilityIds.has(id))
+        .filter(({ id }) => id !== bundledSkillAction?.id && selectedCapabilityIds.has(id))
         .map(({ id }) => id);
-    if (!selectedCapabilityIds.has(agentAccessCapabilityId))
+    if (!selectedCapabilityIds.has(agentIntegrationCapabilityId))
         return selectedActionIds;
+    if (clientActions.length === 0)
+        return [
+            ...(bundledSkillAction === undefined ? [] : [bundledSkillAction.id]),
+            ...selectedActionIds,
+        ];
     const selectedClients = accessible
         ? await selectClientsAccessibly(clientActions)
         : await selectClients(clientActions);
-    return selectedClients === undefined
-        ? undefined
-        : [...selectedClients, ...selectedActionIds];
+    if (selectedClients === undefined)
+        return undefined;
+    if (selectedClients.length === 0)
+        return selectedActionIds;
+    return [
+        ...selectedClients,
+        ...(bundledSkillAction === undefined ? [] : [bundledSkillAction.id]),
+        ...selectedActionIds,
+    ];
 };
 const setupCapabilities = (clientActions, componentActions) => [
-    ...(clientActions.length === 0
+    ...(clientActions.length === 0 &&
+        !componentActions.some(({ kind }) => kind === "install_skill")
         ? []
         : [
             {
-                id: agentAccessCapabilityId,
-                label: "Coding-agent access (MCP)",
-                hint: `${String(clientActions.length)} detected ${clientActions.length === 1 ? "agent" : "agents"}`,
+                id: agentIntegrationCapabilityId,
+                label: "Agent integration (MCP + guided workflow)",
+                hint: clientActions.length === 0
+                    ? "MCP registrations are aligned; installs the matching bundled skill"
+                    : `${String(clientActions.length)} detected ${clientActions.length === 1 ? "agent" : "agents"}; installs the bundled skill when needed`,
             },
         ]),
-    ...componentActions.map((action) => ({
+    ...componentActions
+        .filter(({ kind }) => kind !== "install_skill")
+        .map((action) => ({
         id: action.id,
         label: `${action.label} (${actionModality(action)})`,
         hint: `${action.operation} · ${action.target}`,
@@ -223,7 +240,7 @@ const renderReadyCapabilities = (result, readyClients) => {
         writeLine("│  CLI: rea analyze /path/to/app");
     const firstClient = readyClients[0];
     if (firstClient !== undefined)
-        writeLine(`│  Try in ${firstClient}: "Use REA to explain how a feature works in /path/to/app."`);
+        writeLine(`│  Try in ${firstClient}: "Explain how a feature works in /path/to/app and show the evidence."`);
 };
 const readyAgentClients = (result, changedClients) => {
     const alignedClients = (result.doctor.identity?.registrations ?? [])

package/dist/contracts/electronToolContracts.js

@@ -1,12 +1,59 @@
+import { z } from "zod";
 import { toolContractMetadata } from "./toolEffects.js";
 import { evidenceResultOf } from "./toolOutputSchemas.js";
 import { electronPageInspectionSchema, electronTargetListSchema, inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../domain/electronObservation.js";
 import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
+import { JAVASCRIPT_APPLICATION_NODE_KINDS } from "../domain/javascriptApplicationGraphSchemas.js";
+import { applicationCoverageSchema } from "../domain/javascriptApplicationEvidenceSchemas.js";
 import { javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema, } from "../domain/javascriptRuntimeReconciliationSchemas.js";
 import { JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE } from "./javascriptRuntimeReconciliationExample.js";
 const listOutputSchema = evidenceResultOf(electronTargetListSchema);
 const inspectionOutputSchema = evidenceResultOf(electronPageInspectionSchema);
-const applicationOutputSchema = evidenceResultOf(javascriptApplicationAnalysisResultSchema);
+/** MCP-only response selection; analysis identity does not depend on projection. */
+export const analyzeJavaScriptApplicationToolInputSchema = analyzeJavaScriptApplicationInputSchema.extend({
+    detail: z
+        .enum(["summary", "full"])
+        .default("summary")
+        .describe("summary returns bounded findings and paged graph resource URIs; full returns the complete graph only when explicitly required"),
+});
+/** Bounded default projection for agent-facing JavaScript application analysis. */
+export const javascriptApplicationAnalysisSummarySchema = javascriptApplicationAnalysisResultSchema.omit({ graph: true }).extend({
+    unknowns: z.array(z.string().min(1).max(4_096)).max(1_000),
+    graph: z.strictObject({
+        graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+        node_count: z.number().int().min(0),
+        edge_count: z.number().int().min(0),
+        roots: z.strictObject({
+            items: z.array(z.string().regex(/^jag_node_[a-f0-9]{64}$/u)),
+            total: z.number().int().min(0),
+            truncated: z.boolean(),
+        }),
+        node_kinds: z.array(z.strictObject({
+            kind: z.enum(JAVASCRIPT_APPLICATION_NODE_KINDS),
+            count: z.number().int().min(1),
+        })),
+        top_findings: z.array(z.strictObject({
+            node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
+            kind: z.enum(JAVASCRIPT_APPLICATION_NODE_KINDS),
+            label: z.string().nullable(),
+            authority: z.string(),
+            state: z.string(),
+            confidence: z.string(),
+            location: z.json(),
+        })),
+        coverage: applicationCoverageSchema,
+        limitations: z.array(z.string()),
+        pages: z.strictObject({
+            nodes: z.string().startsWith("rea://evidence/"),
+            edges: z.string().startsWith("rea://evidence/"),
+            page_limit: z.number().int().min(1).max(500),
+        }),
+    }),
+});
+const applicationOutputSchema = evidenceResultOf(z.union([
+    javascriptApplicationAnalysisSummarySchema,
+    javascriptApplicationAnalysisResultSchema,
+]));
 const reconciliationOutputSchema = evidenceResultOf(javascriptRuntimeReconciliationResultSchema);
 const endpoint = "http://127.0.0.1:9223";
 const root = "/Applications/Example.app/Contents/Resources";
@@ -66,9 +113,9 @@ export const ELECTRON_TOOL_CONTRACTS = [
     {
         name: "analyze_javascript_application",
         ...toolContractMetadata("analyze_javascript_application"),
-        description: "Statically reconstruct one approved local ASAR or extracted JavaScript application as Evidence v2 and JavaScript Application Graph v1. Maps BrowserWindow preferences, preload and contextBridge APIs, literal and dynamic IPC, handler locations, sender-validation observations, utility processes, and requested native addon bindings without executing JavaScript; source-map contents require separate approval.",
+        description: "Statically reconstruct one approved local ASAR or extracted JavaScript application without executing it. The default summary returns architecture/security counts, top evidence-backed findings, unknowns, and paged graph resource URIs; request detail=full only when the complete graph must be returned immediately. Identical inputs are deterministic, so do not repeat the call or reread full Evidence without a specific missing detail.",
         kind: "electron-provider",
-        inputSchema: analyzeJavaScriptApplicationInputSchema,
+        inputSchema: analyzeJavaScriptApplicationToolInputSchema,
         outputSchema: applicationOutputSchema,
         examples: [
             {
@@ -78,6 +125,7 @@ export const ELECTRON_TOOL_CONTRACTS = [
                     format: "auto",
                     approved: true,
                     source_map_read_approved: false,
+                    detail: "summary",
                 },
             },
         ],

package/dist/contracts/managedToolContracts.js

@@ -3,6 +3,11 @@ import { managedOutputSchemas } from "./toolOutputSchemas.js";
 import { toolContractMetadata } from "./toolEffects.js";
 /** Exact caller boundary for execution-free PE/CLI triage and identity. */
 export const managedArtifactInputSchema = z.object({
+    path: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Managed PE/CLI path to open before inspection; omit only when a managed target is already active"),
     reference_offset: z.number().int().min(0).default(0),
     reference_limit: z.number().int().min(1).max(500).default(100),
     resource_offset: z.number().int().min(0).default(0),
@@ -111,14 +116,14 @@ export const MANAGED_TOOL_CONTRACTS = [
     {
         name: "inspect_managed_artifact",
         ...toolContractMetadata("inspect_managed_artifact"),
-        description: "Classify the active PE/CLI artifact and inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns bounded pages and explicit partial or malformed coverage.",
+        description: "Open and classify an explicit managed PE/CLI path, or inspect the active managed target, then inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns bounded pages and explicit partial or malformed coverage.",
         kind: "managed-provider",
         inputSchema: managedArtifactInputSchema,
         outputSchema,
         examples: [
             {
                 title: "Example inspect managed artifact request",
-                input: {},
+                input: { path: "/tmp/Example.dll" },
             },
         ],
     },

package/dist/contracts/sessionStatusContract.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { TOOL_KINDS } from "./toolContractTypes.js";
+/** Caller observations and projection controls for binary_session. */
+export const binarySessionInputSchema = z.object({
+    detail: z
+        .enum(["summary", "capabilities", "full"])
+        .default("summary")
+        .describe("summary returns routing state; capabilities returns one filtered tool-availability page; full returns complete diagnostics only when required"),
+    capability_family: z
+        .enum(TOOL_KINDS)
+        .optional()
+        .describe("Optional tool family for detail=capabilities"),
+    cursor: z
+        .number()
+        .int()
+        .min(0)
+        .default(0)
+        .describe("Zero-based capability cursor for detail=capabilities"),
+    limit: z.number().int().min(1).max(100).default(25),
+    expected_package_version: z.string().min(1).optional(),
+    expected_catalog_digest: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/u)
+        .optional(),
+    expected_server_path: z.string().min(1).optional(),
+});

package/dist/contracts/toolContractTypes.js

@@ -1 +1,12 @@
-export {};
+/** Canonical adapter families responsible for public MCP tools. */
+export const TOOL_KINDS = [
+    "official-proxy",
+    "enhanced",
+    "native-provider",
+    "artifact-provider",
+    "managed-provider",
+    "browser-provider",
+    "electron-provider",
+    "application",
+    "session",
+];

package/dist/contracts/toolContracts.js

@@ -21,6 +21,8 @@ import { ELECTRON_TOOL_CONTRACTS } from "./electronToolContracts.js";
 import { APPLICATION_TOOL_CONTRACTS } from "./applicationToolContracts.js";
 import { closeBinaryInputSchema, openBinaryInputSchema, } from "./sessionLifecycleInputs.js";
 import { toolContractMetadata } from "./toolEffects.js";
+import { binarySessionInputSchema } from "./sessionStatusContract.js";
+export { binarySessionInputSchema } from "./sessionStatusContract.js";
 const document = z.string().optional().describe("The document name");
 const address = z
     .string()
@@ -149,15 +151,6 @@ export const ENHANCED_TOOL_CONTRACTS = [
     enhanced("analyze_function", "Preferred bounded analysis for one procedure symbol or address. Returns identity, provider-specific pseudocode, optional assembly, comments, calls, typed-or-explicitly-unavailable references, referenced strings/names, and local CFG blocks with exact truncation metadata.", enhancedInputSchemas.analyze_function),
     enhanced("trace_feature", "Trace a bounded literal feature query through matching strings and procedures, xrefs, and truthful containing-procedure resolution. Returns the operation budget, truncation, and residual unknowns; unknown_registry_approved: true records them durably without inferring reference kinds.", enhancedInputSchemas.trace_feature),
 ];
-/** Caller observations used to compare a live server with expected identity. */
-export const binarySessionInputSchema = z.object({
-    expected_package_version: z.string().min(1).optional(),
-    expected_catalog_digest: z
-        .string()
-        .regex(/^[a-f0-9]{64}$/u)
-        .optional(),
-    expected_server_path: z.string().min(1).optional(),
-});
 /** Session-owned Evidence bundle export options. */
 export const exportEvidenceBundleInputSchema = z.strictObject({
     path: z.string().min(1).optional(),
@@ -193,7 +186,7 @@ export const verifyUnknownResolutionInputSchema = z.strictObject({
 export const SESSION_TOOL_CONTRACTS = [
     session("open_binary", "Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. An optional snapshot v2 is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly.", openBinaryInputSchema),
     session("close_binary", "Optionally write a provider-neutral analysis snapshot atomically, then close the active target and every provider resource started for it. Snapshot files require an operator-approved root and explicit overwrite; a failed save leaves the session open so cached analysis is not lost.", closeBinaryInputSchema),
-    session("binary_session", "Report deterministic deep-provider candidates, host availability, target support, the immutable active binding/profile, capability descriptors, and whether a target is open. Candidate discovery never starts an analysis process; use rejection codes and local diagnostics before choosing provider_id.", binarySessionInputSchema),
+    session("binary_session", "Report compact target, provider, and alignment state without starting analysis. The default summary is the routing check agents should use; detail=capabilities returns one family-filtered availability page, while detail=full is reserved for complete provider diagnostics.", binarySessionInputSchema),
     session("export_evidence_bundle", "Return the session's deterministic Evidence v2 bundle, or atomically write it beneath an operator-approved root. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering.", exportEvidenceBundleInputSchema),
     session("import_evidence_bundle", "Read a bounded local JSON bundle beneath an operator-approved root, validate every Evidence v2 ID and canonical manifest, then atomically merge it. Imported content is data only and is never executed.", importEvidenceBundleInputSchema),
     session("capture_process_scenario", "Run one bounded process under a PTY using operator-approved executable and working roots. Produces Process Capture v4; legacy v3 captures cannot be upgraded and must be recaptured with this tool. Requires approved: true; unknown_registry_approved: true separately records capture residuals. Captures raw and xterm-rendered terminal frames, scripted interactions, lifecycle filesystem checkpoints, process ownership, declarative command shims, and loopback replay. Disabled unless operator policy enables it; not a security sandbox.", processScenarioSchema),

package/dist/contracts/toolOutputSchemaGroups.js

@@ -19,7 +19,7 @@ import { callPathResultSchema } from "../domain/callPath.js";
 import { staticRuntimeCorrelationResultSchema } from "../domain/staticRuntimeCorrelation.js";
 import { reconstructionVerificationResultSchema } from "../domain/reconstructionVerification.js";
 import { analysisErrorProjectionSchema } from "./errorSchemas.js";
-import { addressList, addressedEntry, bounded, containingProcedureResolution, functionDossierOutput, graphNode, lifecycleResultOf, nullableText, pageOutput, procedureIdentity, procedureInfoOutput, evidenceResultOf as resultOf, searchPageOutput, segmentOutput, sessionProvider, symbolDiscoveryOutput, targetFormatSchema, targetKindSchema, } from "./toolOutputSchemaPrimitives.js";
+import { addressList, addressedEntry, bounded, containingProcedureResolution, functionDossierOutput, graphNode, lifecycleResultOf, nullableText, pageOutput, procedureIdentity, procedureInfoOutput, evidenceResultOf as resultOf, searchPageOutput, segmentOutput, sessionProvider, providerIdentity, toolAvailability, symbolDiscoveryOutput, targetFormatSchema, targetKindSchema, } from "./toolOutputSchemaPrimitives.js";
 /** Exact structured-content schemas shared by direct analysis providers. */
 export const officialOutputSchemas = {
     address_name: resultOf(nullableText),
@@ -190,15 +190,57 @@ export const sessionOutputSchemas = {
         }),
     ])),
     binary_session: lifecycleResultOf(z.union([
-        sessionProvider.extend({ open: z.literal(false) }),
-        sessionProvider.extend({
-            open: z.literal(true),
-            path: z.string(),
-            format: targetFormatSchema,
-            kind: targetKindSchema,
-            sha256: z.string().regex(/^[a-f0-9]{64}$/u),
-            architecture: z.enum(["x86", "x86_64", "arm", "arm64"]).nullable(),
+        z.object({
+            view: z.literal("summary"),
+            open: z.boolean(),
+            provider: providerIdentity,
+            active_provider: providerIdentity.nullable(),
+            target: z
+                .object({
+                path: z.string(),
+                format: targetFormatSchema,
+                kind: targetKindSchema,
+                sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+                architecture: z.enum(["x86", "x86_64", "arm", "arm64"]).nullable(),
+            })
+                .nullable(),
+            alignment: z.object({
+                state: z.enum(["aligned", "mcp_server_restart_required", "unknown"]),
+                reasons: z.array(z.string()),
+                remediation: z.string().nullable(),
+            }),
+            recommended_actions: z.array(z.string()),
+        }),
+        z.object({
+            view: z.literal("capabilities"),
+            open: z.boolean(),
+            provider: providerIdentity,
+            active_provider: providerIdentity.nullable(),
+            capability_family: z.string().nullable(),
+            capabilities: z.object({
+                items: z.array(toolAvailability),
+                cursor: z.number().int().min(0),
+                limit: z.number().int().min(1),
+                total: z.number().int().min(0),
+                next_cursor: z.number().int().min(0).nullable(),
+                has_more: z.boolean(),
+            }),
         }),
+        z.union([
+            sessionProvider.extend({
+                view: z.literal("full"),
+                open: z.literal(false),
+            }),
+            sessionProvider.extend({
+                view: z.literal("full"),
+                open: z.literal(true),
+                path: z.string(),
+                format: targetFormatSchema,
+                kind: targetKindSchema,
+                sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+                architecture: z.enum(["x86", "x86_64", "arm", "arm64"]).nullable(),
+            }),
+        ]),
     ])),
     export_evidence_bundle: lifecycleResultOf(z.union([
         evidenceBundleSchema,

package/dist/contracts/toolOutputSchemaPrimitives.js

@@ -64,7 +64,7 @@ const providerCapability = z.object({
     }),
     limitations: z.array(z.string()),
 });
-const providerIdentity = z.object({
+export const providerIdentity = z.object({
     id: z.string(),
     name: z.string(),
     version: z.string().nullable(),
@@ -111,6 +111,37 @@ const providerTargetSupport = z.discriminatedUnion("status", [
         diagnostics: providerDiagnostics,
     }),
 ]);
+export const toolAvailability = z.object({
+    name: z.string(),
+    surface: z.string(),
+    available: z.boolean(),
+    reason: z.enum([
+        "available",
+        "target_required",
+        "provider_missing",
+        "provider_unavailable",
+        "target_unsupported",
+        "unsupported_host",
+        "policy_disabled",
+    ]),
+    remediation: z.string().nullable(),
+    effects: z.strictObject({
+        mutatesTarget: z.boolean(),
+        mutatesSession: z.boolean(),
+        writesFilesystem: z.boolean(),
+        launchesProcess: z.boolean(),
+        accessesNetwork: z.boolean(),
+        changesUiState: z.boolean(),
+        mayDiscardData: z.boolean(),
+        idempotent: z.boolean(),
+    }),
+    annotations: z.object({
+        read_only: z.boolean(),
+        destructive: z.boolean(),
+        idempotent: z.boolean(),
+        open_world: z.boolean(),
+    }),
+});
 export const sessionProvider = z.object({
     provider: providerIdentity,
     providers: z.array(providerIdentity),
@@ -133,37 +164,7 @@ export const sessionProvider = z.object({
         selected: z.boolean(),
         capabilities: z.array(providerCapability),
     })),
-    tool_availability: z.array(z.object({
-        name: z.string(),
-        surface: z.string(),
-        available: z.boolean(),
-        reason: z.enum([
-            "available",
-            "target_required",
-            "provider_missing",
-            "provider_unavailable",
-            "target_unsupported",
-            "unsupported_host",
-            "policy_disabled",
-        ]),
-        remediation: z.string().nullable(),
-        effects: z.strictObject({
-            mutatesTarget: z.boolean(),
-            mutatesSession: z.boolean(),
-            writesFilesystem: z.boolean(),
-            launchesProcess: z.boolean(),
-            accessesNetwork: z.boolean(),
-            changesUiState: z.boolean(),
-            mayDiscardData: z.boolean(),
-            idempotent: z.boolean(),
-        }),
-        annotations: z.object({
-            read_only: z.boolean(),
-            destructive: z.boolean(),
-            idempotent: z.boolean(),
-            open_world: z.boolean(),
-        }),
-    })),
+    tool_availability: z.array(toolAvailability),
     client_features: z.object({
         elicitation_form: z.boolean(),
         elicitation_url: z.boolean(),

package/dist/domain/androidApplication.js

@@ -0,0 +1,206 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
+import { projectBoundedCartesian } from "./boundedCartesianProjection.js";
+import { evidenceSchema } from "./evidence.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const pathSchema = z.string().min(1).max(4_096);
+const componentSchema = z.strictObject({
+    path: pathSchema,
+    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    sha256: digestSchema,
+    format: z.string().min(1).max(100),
+});
+/** Authenticated APK inventory pages projected as one Android application. */
+export const androidApplicationProjectionInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1).max(100),
+    limits: z
+        .strictObject({
+        max_components: z.number().int().min(1).max(10_000).default(1_000),
+    })
+        .default({ max_components: 1_000 }),
+});
+/** Deterministic, execution-free Android application inventory projection. */
+export const androidApplicationProjectionResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    projection_id: z.string().regex(/^adp_[a-f0-9]{64}$/u),
+    root_sha256: digestSchema,
+    root_format: z.literal("apk"),
+    source_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    components: z.strictObject({
+        manifests: z.array(componentSchema),
+        resources: z.array(componentSchema),
+        dex: z.array(componentSchema),
+        jvm_classes: z.array(componentSchema),
+        native_libraries: z.array(componentSchema),
+        javascript: z.array(componentSchema),
+        signing: z.array(componentSchema),
+    }),
+    runtime_families: z.array(z.enum([
+        "dalvik-art",
+        "java-kotlin",
+        "native",
+        "javascript",
+        "react-native",
+        "flutter",
+        "unity",
+    ])),
+    bridge_candidates: z.array(z.strictObject({
+        managed_path: pathSchema,
+        native_path: pathSchema,
+        basis: z.enum([
+            "managed-and-native-content",
+            "jni-library-convention",
+            "react-native-convention",
+            "flutter-convention",
+            "unity-convention",
+        ]),
+    })),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inventory", "partial", "truncated"]),
+        inventory_complete: z.boolean(),
+        omitted_components: z.number().int().min(0),
+        omitted_bridge_candidates: z.number().int().min(0),
+    }),
+    limitations: z.array(z.string().min(1).max(4_096)).max(100),
+});
+/** Project exact APK paths and hashes without decoding or executing target code. */
+export const projectAndroidApplication = (input) => {
+    const parsed = androidApplicationProjectionInputSchema.parse(input);
+    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
+    if (inventory.manifest.root_format !== "apk")
+        throw new TypeError("Android application projection requires APK Evidence");
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    const all = inventory.occurrences
+        .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
+        .map((occurrence) => {
+        const node = nodes.get(occurrence.artifact_id ?? "");
+        if (node === undefined)
+            throw new TypeError("Android application occurrence has no artifact node");
+        return {
+            path: occurrence.logical_path,
+            artifact_id: node.artifact_id,
+            sha256: node.sha256,
+            format: node.format,
+        };
+    });
+    const classified = classify(all);
+    const components = retain(classified, parsed.limits.max_components);
+    const omittedComponents = count(classified) - count(components);
+    const bridgeProjection = bridgeCandidates([...components.dex, ...components.jvm_classes], components.native_libraries, parsed.limits.max_components);
+    const limitations = [
+        ...(!inventory.complete
+            ? ["Source inventory pages are incomplete; absence is unknown."]
+            : []),
+        ...(omittedComponents > 0
+            ? [
+                `${String(omittedComponents)} component observations were omitted by the projection limit.`,
+            ]
+            : []),
+        ...(bridgeProjection.omitted > 0
+            ? [
+                `${String(bridgeProjection.omitted)} bridge hypotheses were omitted by the projection limit.`,
+            ]
+            : []),
+        "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
+        "Bridge candidates are path-based hypotheses, not decoded JNI declarations or observed runtime calls.",
+    ];
+    const withoutId = {
+        schema_version: 1,
+        root_sha256: inventory.manifest.root_sha256,
+        root_format: "apk",
+        source_evidence_ids: evidence
+            .map(({ evidence_id: id }) => id)
+            .sort(compare),
+        components,
+        runtime_families: runtimeFamilies(all),
+        bridge_candidates: bridgeProjection.candidates,
+        coverage: {
+            status: omittedComponents > 0 || bridgeProjection.omitted > 0
+                ? "truncated"
+                : inventory.complete
+                    ? "complete-within-inventory"
+                    : "partial",
+            inventory_complete: inventory.complete,
+            omitted_components: omittedComponents,
+            omitted_bridge_candidates: bridgeProjection.omitted,
+        },
+        limitations,
+    };
+    return androidApplicationProjectionResultSchema.parse({
+        ...withoutId,
+        projection_id: `adp_${digest(withoutId)}`,
+    });
+};
+const classify = (all) => ({
+    manifests: all.filter(({ path, format }) => format === "android-manifest" ||
+        /(?:^|\/)AndroidManifest\.xml$/u.test(path)),
+    resources: all.filter(({ path, format }) => format === "android-resources" || /(?:^|\/)resources\.arsc$/u.test(path)),
+    dex: all.filter(({ path, format }) => format === "dex" || /(?:^|\/)[^/]+\.dex$/iu.test(path)),
+    jvm_classes: all.filter(({ path, format }) => format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path)),
+    native_libraries: all.filter(({ path, format }) => format === "elf" || /(?:^|\/)lib\/[^/]+\/[^/]+\.so$/iu.test(path)),
+    javascript: all.filter(({ format }) => format === "javascript-bundle"),
+    signing: all.filter(({ path }) => /^META-INF\/[^/]+\.(?:MF|RSA|DSA|EC|SF)$/iu.test(path)),
+});
+const retain = (groups, maximum) => {
+    let remaining = maximum;
+    return Object.fromEntries(Object.entries(groups).map(([key, values]) => {
+        const selected = [...values]
+            .sort((left, right) => compare(left.path, right.path))
+            .slice(0, remaining);
+        remaining -= selected.length;
+        return [key, selected];
+    }));
+};
+const count = (groups) => Object.values(groups).reduce((total, values) => total + values.length, 0);
+const runtimeFamilies = (all) => {
+    const paths = all.map(({ path }) => path.toLowerCase());
+    const families = new Set();
+    if (all.some(({ path, format }) => format === "dex" || path.endsWith(".dex")))
+        families.add("dalvik-art");
+    if (all.some(({ path, format }) => format === "jvm-class" || path.endsWith(".class")))
+        families.add("java-kotlin");
+    if (all.some(({ format }) => format === "elf"))
+        families.add("native");
+    if (all.some(({ format }) => format === "javascript-bundle"))
+        families.add("javascript");
+    if (paths.some((path) => path.includes("reactnative") || path.includes("hermes")))
+        families.add("react-native");
+    if (paths.some((path) => path.includes("libflutter.so")))
+        families.add("flutter");
+    if (paths.some((path) => path.includes("libunity.so")))
+        families.add("unity");
+    return [...families].sort(compare);
+};
+const bridgeCandidates = (managed, native, maximum) => {
+    const projection = projectBoundedCartesian(managed, native, maximum, (source, target) => ({
+        managed_path: source.path,
+        native_path: target.path,
+        basis: bridgeBasis(target.path),
+    }));
+    return {
+        candidates: projection.values,
+        omitted: projection.omitted,
+    };
+};
+const bridgeBasis = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.includes("react") || lower.includes("hermes"))
+        return "react-native-convention";
+    if (lower.includes("flutter"))
+        return "flutter-convention";
+    if (lower.includes("unity"))
+        return "unity-convention";
+    if (/lib\/[^/]+\/lib[^/]+\.so$/u.test(lower))
+        return "jni-library-convention";
+    return "managed-and-native-content";
+};
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Android application projection is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};