rea-agents 2.1.0 → 2.3.0

package/dist/contracts/toolOutputSchemaPrimitives.js

@@ -64,11 +64,50 @@ const providerCapability = z.object({
     }),
     limitations: z.array(z.string()),
 });
-const providerIdentity = z.object({
+export const providerIdentity = z.object({
     id: z.string(),
     name: z.string(),
     version: z.string().nullable(),
 });
+const processCoordinates = {
+    launcher_pid: z.number().int().min(1),
+    process_group_id: z.number().int().min(1),
+};
+const processLineageObservation = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("unavailable"),
+        observed_at: z.iso.datetime(),
+        ...processCoordinates,
+        reason: z.string().min(1),
+    }),
+    z.object({
+        status: z.literal("verified"),
+        observed_at: z.iso.datetime(),
+        schema_version: z.literal(1),
+        ...processCoordinates,
+        launcher_parent_pid: z.number().int().min(0),
+        descendants: z.array(z.object({
+            pid: z.number().int().min(1),
+            parent_pid: z.number().int().min(0),
+            process_group_id: z.number().int().min(1),
+        })),
+    }),
+]);
+const analysisRun = z
+    .object({
+    run_id: z.string().uuid(),
+    process_lineage: z.discriminatedUnion("status", [
+        z.object({ status: z.literal("not_observed") }),
+        z.object({
+            status: z.literal("snapshots"),
+            snapshots: z.array(z.object({
+                provider: providerIdentity,
+                observation: processLineageObservation,
+            })),
+        }),
+    ]),
+})
+    .nullable();
 const providerRejectionCode = z.enum(PROVIDER_REJECTION_CODES);
 const providerDiagnostics = z.record(z.string(), z.json());
 const providerAvailability = z.discriminatedUnion("status", [
@@ -111,10 +150,42 @@ const providerTargetSupport = z.discriminatedUnion("status", [
         diagnostics: providerDiagnostics,
     }),
 ]);
+export const toolAvailability = z.object({
+    name: z.string(),
+    surface: z.string(),
+    available: z.boolean(),
+    reason: z.enum([
+        "available",
+        "target_required",
+        "provider_missing",
+        "provider_unavailable",
+        "target_unsupported",
+        "unsupported_host",
+        "policy_disabled",
+    ]),
+    remediation: z.string().nullable(),
+    effects: z.strictObject({
+        mutatesTarget: z.boolean(),
+        mutatesSession: z.boolean(),
+        writesFilesystem: z.boolean(),
+        launchesProcess: z.boolean(),
+        accessesNetwork: z.boolean(),
+        changesUiState: z.boolean(),
+        mayDiscardData: z.boolean(),
+        idempotent: z.boolean(),
+    }),
+    annotations: z.object({
+        read_only: z.boolean(),
+        destructive: z.boolean(),
+        idempotent: z.boolean(),
+        open_world: z.boolean(),
+    }),
+});
 export const sessionProvider = z.object({
     provider: providerIdentity,
     providers: z.array(providerIdentity),
     capabilities: z.array(providerCapability),
+    analysis_run: analysisRun,
     analysis_provider_binding: z
         .object({
         provider: providerIdentity,
@@ -133,37 +204,7 @@ export const sessionProvider = z.object({
         selected: z.boolean(),
         capabilities: z.array(providerCapability),
     })),
-    tool_availability: z.array(z.object({
-        name: z.string(),
-        surface: z.string(),
-        available: z.boolean(),
-        reason: z.enum([
-            "available",
-            "target_required",
-            "provider_missing",
-            "provider_unavailable",
-            "target_unsupported",
-            "unsupported_host",
-            "policy_disabled",
-        ]),
-        remediation: z.string().nullable(),
-        effects: z.strictObject({
-            mutatesTarget: z.boolean(),
-            mutatesSession: z.boolean(),
-            writesFilesystem: z.boolean(),
-            launchesProcess: z.boolean(),
-            accessesNetwork: z.boolean(),
-            changesUiState: z.boolean(),
-            mayDiscardData: z.boolean(),
-            idempotent: z.boolean(),
-        }),
-        annotations: z.object({
-            read_only: z.boolean(),
-            destructive: z.boolean(),
-            idempotent: z.boolean(),
-            open_world: z.boolean(),
-        }),
-    })),
+    tool_availability: z.array(toolAvailability),
     client_features: z.object({
         elicitation_form: z.boolean(),
         elicitation_url: z.boolean(),

package/dist/doctorRuntime.js

@@ -1,12 +1,53 @@
 import { systemDoctorHost, } from "./application/Doctor.js";
+import { fileURLToPath } from "node:url";
 import { inspectSystemGhidraProvider } from "./ghidra/GhidraDoctor.js";
+import { selectLinuxPrivateDisplayStrategy } from "./hopper/LinuxPrivateDisplayProbe.js";
 import { parseConfig } from "./config.js";
 import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
 /** Compose provider diagnostics at the outer CLI adapter boundary. */
 export const createSystemDoctorHost = () => systemDoctorHost({
     providerInspections: async () => [await inspectSystemGhidraProvider()],
     javascriptReplayCheck: inspectJavaScriptReplay,
+    linuxDemoRuntimeCheck: inspectLinuxPrivateDisplay,
 });
+const HOPPER_DEMO_HELPER_PATH = fileURLToPath(new URL("../scripts/hopper-demo-x11.py", import.meta.url));
+const inspectLinuxPrivateDisplay = async () => {
+    const selection = await selectLinuxPrivateDisplayStrategy({
+        helperPath: HOPPER_DEMO_HELPER_PATH,
+    });
+    const value = selection.diagnostic;
+    const detail = [
+        `strategy=${selection.strategy}`,
+        `socket_directory=${value.socket_directory}`,
+        `mode=${value.socket_directory_mode ?? "unknown"}`,
+        `mount_read_only=${String(value.mount_read_only)}`,
+        `effective_mode=${value.effective_socket_directory_mode ?? "unknown"}`,
+        `effective_mount_read_only=${String(value.effective_mount_read_only)}`,
+        `wsl=${String(value.wsl)}`,
+    ].join("; ");
+    if (selection.ok)
+        return {
+            name: "hopper-demo-runtime",
+            ok: true,
+            classification: "healthy",
+            detail,
+            details: { private_display: { ...value } },
+        };
+    const missingDependency = value.failure_code === "runtime_dependency_unavailable" ||
+        value.failure_code === "x11_authorization_failed";
+    return {
+        name: "hopper-demo-runtime",
+        ok: false,
+        classification: missingDependency ? "missing_dependency" : "config_drift",
+        detail,
+        details: { private_display: { ...value } },
+        remediation: value.failure_code === "x11_socket_directory_unusable"
+            ? "Enable unprivileged user and mount namespaces, or provide a writable mode-1777 /tmp/.X11-unix directory. Do not mutate the current host mount with sudo; then rerun rea doctor --provider hopper."
+            : missingDependency
+                ? "Install Xvfb, xauth, Python 3, libX11, and libXtst, then rerun rea doctor --provider hopper."
+                : "Inspect the private-display diagnostic, correct the reported local condition, and rerun rea doctor --provider hopper.",
+    };
+};
 const inspectJavaScriptReplay = async () => {
     const config = parseConfig(process.env);
     if (!config.ok)

package/dist/domain/analysisErrorPresentation.js

@@ -5,9 +5,11 @@ export const analysisErrorRemediationAction = (error) => {
     if (error instanceof ReplayPlanStaleError)
         return "Review the rebuilt replay plan and explicitly approve its new digest.";
     if (error instanceof PermissionRequiredError)
-        return error.elicitationSupported
-            ? "Approve the exact missing scope, then retry the operation."
-            : "Add the exact missing scope beneath the administrator ceiling, then retry.";
+        return error.restartRequired
+            ? "Add the exact missing scope to the administrator configuration, then restart the registered MCP server or client."
+            : error.elicitationSupported
+                ? "Approve the exact missing scope, then retry the operation."
+                : "Add the exact missing scope beneath the administrator ceiling, then retry.";
     return analysisErrorUserMessage(error);
 };
 export const analysisErrorCategory = (error) => {

package/dist/domain/analysisErrorProjection.js

@@ -230,7 +230,13 @@ const providerErrorDetails = (error) => {
     if (error instanceof HopperRemoteError)
         return { provider_code: error.code, diagnostic_type: error.diagnosticType };
     if (error instanceof HopperProcessError && error.failureCode !== undefined)
-        return { failure_code: error.failureCode, exit_code: error.exitCode };
+        return {
+            failure_code: error.failureCode,
+            exit_code: error.exitCode,
+            ...(error.diagnostic === undefined
+                ? {}
+                : { diagnostics: { ...error.diagnostic } }),
+        };
     return undefined;
 };
 const lifecycleErrorDetails = (error) => {

package/dist/domain/androidApplication.js

@@ -0,0 +1,206 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
+import { projectBoundedCartesian } from "./boundedCartesianProjection.js";
+import { evidenceSchema } from "./evidence.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const pathSchema = z.string().min(1).max(4_096);
+const componentSchema = z.strictObject({
+    path: pathSchema,
+    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    sha256: digestSchema,
+    format: z.string().min(1).max(100),
+});
+/** Authenticated APK inventory pages projected as one Android application. */
+export const androidApplicationProjectionInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1).max(100),
+    limits: z
+        .strictObject({
+        max_components: z.number().int().min(1).max(10_000).default(1_000),
+    })
+        .default({ max_components: 1_000 }),
+});
+/** Deterministic, execution-free Android application inventory projection. */
+export const androidApplicationProjectionResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    projection_id: z.string().regex(/^adp_[a-f0-9]{64}$/u),
+    root_sha256: digestSchema,
+    root_format: z.literal("apk"),
+    source_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    components: z.strictObject({
+        manifests: z.array(componentSchema),
+        resources: z.array(componentSchema),
+        dex: z.array(componentSchema),
+        jvm_classes: z.array(componentSchema),
+        native_libraries: z.array(componentSchema),
+        javascript: z.array(componentSchema),
+        signing: z.array(componentSchema),
+    }),
+    runtime_families: z.array(z.enum([
+        "dalvik-art",
+        "java-kotlin",
+        "native",
+        "javascript",
+        "react-native",
+        "flutter",
+        "unity",
+    ])),
+    bridge_candidates: z.array(z.strictObject({
+        managed_path: pathSchema,
+        native_path: pathSchema,
+        basis: z.enum([
+            "managed-and-native-content",
+            "jni-library-convention",
+            "react-native-convention",
+            "flutter-convention",
+            "unity-convention",
+        ]),
+    })),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inventory", "partial", "truncated"]),
+        inventory_complete: z.boolean(),
+        omitted_components: z.number().int().min(0),
+        omitted_bridge_candidates: z.number().int().min(0),
+    }),
+    limitations: z.array(z.string().min(1).max(4_096)).max(100),
+});
+/** Project exact APK paths and hashes without decoding or executing target code. */
+export const projectAndroidApplication = (input) => {
+    const parsed = androidApplicationProjectionInputSchema.parse(input);
+    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
+    if (inventory.manifest.root_format !== "apk")
+        throw new TypeError("Android application projection requires APK Evidence");
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    const all = inventory.occurrences
+        .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
+        .map((occurrence) => {
+        const node = nodes.get(occurrence.artifact_id ?? "");
+        if (node === undefined)
+            throw new TypeError("Android application occurrence has no artifact node");
+        return {
+            path: occurrence.logical_path,
+            artifact_id: node.artifact_id,
+            sha256: node.sha256,
+            format: node.format,
+        };
+    });
+    const classified = classify(all);
+    const components = retain(classified, parsed.limits.max_components);
+    const omittedComponents = count(classified) - count(components);
+    const bridgeProjection = bridgeCandidates([...components.dex, ...components.jvm_classes], components.native_libraries, parsed.limits.max_components);
+    const limitations = [
+        ...(!inventory.complete
+            ? ["Source inventory pages are incomplete; absence is unknown."]
+            : []),
+        ...(omittedComponents > 0
+            ? [
+                `${String(omittedComponents)} component observations were omitted by the projection limit.`,
+            ]
+            : []),
+        ...(bridgeProjection.omitted > 0
+            ? [
+                `${String(bridgeProjection.omitted)} bridge hypotheses were omitted by the projection limit.`,
+            ]
+            : []),
+        "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
+        "Bridge candidates are path-based hypotheses, not decoded JNI declarations or observed runtime calls.",
+    ];
+    const withoutId = {
+        schema_version: 1,
+        root_sha256: inventory.manifest.root_sha256,
+        root_format: "apk",
+        source_evidence_ids: evidence
+            .map(({ evidence_id: id }) => id)
+            .sort(compare),
+        components,
+        runtime_families: runtimeFamilies(all),
+        bridge_candidates: bridgeProjection.candidates,
+        coverage: {
+            status: omittedComponents > 0 || bridgeProjection.omitted > 0
+                ? "truncated"
+                : inventory.complete
+                    ? "complete-within-inventory"
+                    : "partial",
+            inventory_complete: inventory.complete,
+            omitted_components: omittedComponents,
+            omitted_bridge_candidates: bridgeProjection.omitted,
+        },
+        limitations,
+    };
+    return androidApplicationProjectionResultSchema.parse({
+        ...withoutId,
+        projection_id: `adp_${digest(withoutId)}`,
+    });
+};
+const classify = (all) => ({
+    manifests: all.filter(({ path, format }) => format === "android-manifest" ||
+        /(?:^|\/)AndroidManifest\.xml$/u.test(path)),
+    resources: all.filter(({ path, format }) => format === "android-resources" || /(?:^|\/)resources\.arsc$/u.test(path)),
+    dex: all.filter(({ path, format }) => format === "dex" || /(?:^|\/)[^/]+\.dex$/iu.test(path)),
+    jvm_classes: all.filter(({ path, format }) => format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path)),
+    native_libraries: all.filter(({ path, format }) => format === "elf" || /(?:^|\/)lib\/[^/]+\/[^/]+\.so$/iu.test(path)),
+    javascript: all.filter(({ format }) => format === "javascript-bundle"),
+    signing: all.filter(({ path }) => /^META-INF\/[^/]+\.(?:MF|RSA|DSA|EC|SF)$/iu.test(path)),
+});
+const retain = (groups, maximum) => {
+    let remaining = maximum;
+    return Object.fromEntries(Object.entries(groups).map(([key, values]) => {
+        const selected = [...values]
+            .sort((left, right) => compare(left.path, right.path))
+            .slice(0, remaining);
+        remaining -= selected.length;
+        return [key, selected];
+    }));
+};
+const count = (groups) => Object.values(groups).reduce((total, values) => total + values.length, 0);
+const runtimeFamilies = (all) => {
+    const paths = all.map(({ path }) => path.toLowerCase());
+    const families = new Set();
+    if (all.some(({ path, format }) => format === "dex" || path.endsWith(".dex")))
+        families.add("dalvik-art");
+    if (all.some(({ path, format }) => format === "jvm-class" || path.endsWith(".class")))
+        families.add("java-kotlin");
+    if (all.some(({ format }) => format === "elf"))
+        families.add("native");
+    if (all.some(({ format }) => format === "javascript-bundle"))
+        families.add("javascript");
+    if (paths.some((path) => path.includes("reactnative") || path.includes("hermes")))
+        families.add("react-native");
+    if (paths.some((path) => path.includes("libflutter.so")))
+        families.add("flutter");
+    if (paths.some((path) => path.includes("libunity.so")))
+        families.add("unity");
+    return [...families].sort(compare);
+};
+const bridgeCandidates = (managed, native, maximum) => {
+    const projection = projectBoundedCartesian(managed, native, maximum, (source, target) => ({
+        managed_path: source.path,
+        native_path: target.path,
+        basis: bridgeBasis(target.path),
+    }));
+    return {
+        candidates: projection.values,
+        omitted: projection.omitted,
+    };
+};
+const bridgeBasis = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.includes("react") || lower.includes("hermes"))
+        return "react-native-convention";
+    if (lower.includes("flutter"))
+        return "flutter-convention";
+    if (lower.includes("unity"))
+        return "unity-convention";
+    if (/lib\/[^/]+\/lib[^/]+\.so$/u.test(lower))
+        return "jni-library-convention";
+    return "managed-and-native-content";
+};
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Android application projection is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/domain/appleApplication.js

@@ -0,0 +1,221 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
+import { projectBoundedCartesian } from "./boundedCartesianProjection.js";
+import { evidenceSchema } from "./evidence.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const boundedPathSchema = z.string().min(1).max(4_096);
+const componentSchema = z.strictObject({
+    path: boundedPathSchema,
+    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    sha256: digestSchema,
+    format: z.string().min(1).max(100),
+});
+/** Authenticated artifact inventory pages projected as one Apple application. */
+export const appleApplicationProjectionInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1).max(100),
+    limits: z
+        .strictObject({
+        max_components: z.number().int().min(1).max(10_000).default(1_000),
+    })
+        .default({ max_components: 1_000 }),
+});
+/** Deterministic, execution-free Apple application inventory projection. */
+export const appleApplicationProjectionResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    projection_id: z.string().regex(/^aap_[a-f0-9]{64}$/u),
+    root_sha256: digestSchema,
+    root_format: z.literal("ipa"),
+    source_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    application_roots: z.array(boundedPathSchema),
+    components: z.strictObject({
+        bundle_metadata: z.array(componentSchema),
+        executables: z.array(componentSchema),
+        frameworks: z.array(componentSchema),
+        native_libraries: z.array(componentSchema),
+        javascript: z.array(componentSchema),
+        signing: z.array(componentSchema),
+    }),
+    runtime_families: z.array(z.enum([
+        "native",
+        "swift-objective-c",
+        "javascript",
+        "react-native",
+        "flutter",
+        "unity",
+    ])),
+    bridge_candidates: z.array(z.strictObject({
+        source_path: boundedPathSchema,
+        native_path: boundedPathSchema,
+        basis: z.enum([
+            "javascript-and-native-content",
+            "react-native-convention",
+            "flutter-convention",
+            "unity-convention",
+        ]),
+    })),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inventory", "partial", "truncated"]),
+        inventory_complete: z.boolean(),
+        omitted_components: z.number().int().min(0),
+        omitted_bridge_candidates: z.number().int().min(0),
+    }),
+    limitations: z.array(z.string().min(1).max(4_096)).max(100),
+});
+/** Project exact IPA paths and hashes without parsing or executing target code. */
+export const projectAppleApplication = (input) => {
+    const parsed = appleApplicationProjectionInputSchema.parse(input);
+    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
+    if (inventory.manifest.root_format !== "ipa")
+        throw new TypeError("Apple application projection requires IPA Evidence");
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    const all = inventory.occurrences
+        .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
+        .map((occurrence) => {
+        const node = nodes.get(occurrence.artifact_id ?? "");
+        if (node === undefined)
+            throw new TypeError("Apple application occurrence has no artifact node");
+        return {
+            path: occurrence.logical_path,
+            artifact_id: node.artifact_id,
+            sha256: node.sha256,
+            format: node.format,
+        };
+    });
+    const roots = [
+        ...new Set(inventory.occurrences.flatMap(({ logical_path: path }) => {
+            const match = /^(Payload\/[^/]+\.app)(?:\/|$)/u.exec(path);
+            return match?.[1] === undefined ? [] : [match[1]];
+        })),
+    ].sort(compare);
+    const classified = classifyComponents(all, roots);
+    const retained = retainComponents(classified, parsed.limits.max_components);
+    const omitted = componentCount(classified) - componentCount(retained);
+    const runtimeFamilies = identifyRuntimeFamilies(all);
+    const bridgeProjection = identifyBridgeCandidates(retained.javascript, deduplicateComponents([
+        ...retained.executables,
+        ...retained.native_libraries,
+    ]), parsed.limits.max_components);
+    const limitations = projectionLimitations(inventory.complete, omitted, bridgeProjection.omitted, roots);
+    const withoutId = {
+        schema_version: 1,
+        root_sha256: inventory.manifest.root_sha256,
+        root_format: "ipa",
+        source_evidence_ids: evidence
+            .map(({ evidence_id: id }) => id)
+            .sort(compare),
+        application_roots: roots,
+        components: retained,
+        runtime_families: runtimeFamilies,
+        bridge_candidates: bridgeProjection.candidates,
+        coverage: {
+            status: omitted > 0 || bridgeProjection.omitted > 0
+                ? "truncated"
+                : inventory.complete
+                    ? "complete-within-inventory"
+                    : "partial",
+            inventory_complete: inventory.complete,
+            omitted_components: omitted,
+            omitted_bridge_candidates: bridgeProjection.omitted,
+        },
+        limitations,
+    };
+    return appleApplicationProjectionResultSchema.parse({
+        ...withoutId,
+        projection_id: `aap_${digest(withoutId)}`,
+    });
+};
+const classifyComponents = (all, roots) => {
+    const withinApp = (path) => roots.some((root) => path.startsWith(`${root}/`));
+    return {
+        bundle_metadata: all.filter(({ path }) => /(?:^|\/)Info\.plist$/u.test(path)),
+        executables: all.filter(({ path, format }) => withinApp(path) && ["mach-o", "mach-o-universal"].includes(format)),
+        frameworks: all.filter(({ path }) => /\.framework\//u.test(path)),
+        native_libraries: all.filter(({ path }) => /\.(?:dylib|so)$/iu.test(path)),
+        javascript: all.filter(({ format }) => format === "javascript-bundle"),
+        signing: all.filter(({ path }) => /(?:^|\/)(?:embedded\.mobileprovision|_CodeSignature\/CodeResources)$/u.test(path)),
+    };
+};
+const retainComponents = (groups, maximum) => {
+    let remaining = maximum;
+    return Object.fromEntries(Object.entries(groups).map(([key, values]) => {
+        const retained = [...values]
+            .sort((left, right) => compare(left.path, right.path))
+            .slice(0, remaining);
+        remaining -= retained.length;
+        return [key, retained];
+    }));
+};
+const componentCount = (groups) => Object.values(groups).reduce((total, values) => total + values.length, 0);
+const deduplicateComponents = (values) => [...new Map(values.map((value) => [value.path, value])).values()].sort((left, right) => compare(left.path, right.path));
+const identifyRuntimeFamilies = (all) => {
+    const paths = all.map(({ path }) => path.toLowerCase());
+    const families = new Set();
+    if (all.some(({ format }) => ["mach-o", "mach-o-universal"].includes(format)))
+        families.add("native");
+    if (paths.some((path) => /\.(?:dylib|framework\/[^/]+)$/u.test(path)))
+        families.add("swift-objective-c");
+    if (all.some(({ format }) => format === "javascript-bundle"))
+        families.add("javascript");
+    if (paths.some((path) => path.includes("reactnative") ||
+        path.includes("react.framework") ||
+        path.includes("hermes")))
+        families.add("react-native");
+    if (paths.some((path) => path.includes("flutter.framework") || path.includes("app.framework")))
+        families.add("flutter");
+    if (paths.some((path) => path.includes("unityframework.framework")))
+        families.add("unity");
+    return [...families].sort(compare);
+};
+const identifyBridgeCandidates = (scripts, native, maximum) => {
+    const projection = projectBoundedCartesian(scripts, native, maximum, (script, item) => ({
+        source_path: script.path,
+        native_path: item.path,
+        basis: bridgeBasis(item.path),
+    }));
+    return {
+        candidates: projection.values,
+        omitted: projection.omitted,
+    };
+};
+const bridgeBasis = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.includes("react"))
+        return "react-native-convention";
+    if (lower.includes("flutter") || lower.includes("app.framework"))
+        return "flutter-convention";
+    if (lower.includes("unity"))
+        return "unity-convention";
+    return "javascript-and-native-content";
+};
+const projectionLimitations = (complete, omitted, omittedBridges, roots) => [
+    ...(!complete
+        ? ["Source inventory pages are incomplete; absence is unknown."]
+        : []),
+    ...(omitted > 0
+        ? [
+            `${String(omitted)} component observations were omitted by the projection limit.`,
+        ]
+        : []),
+    ...(omittedBridges > 0
+        ? [
+            `${String(omittedBridges)} bridge hypotheses were omitted by the projection limit.`,
+        ]
+        : []),
+    ...(roots.length === 0
+        ? [
+            "No Payload/*.app directory was present in the supplied inventory pages.",
+        ]
+        : []),
+    "Bundle identifiers and signing claims require dedicated plist and CMS parsing; this projection reports only exact paths and hashes.",
+    "Bridge candidates are path-based hypotheses, not observed runtime calls.",
+];
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Apple application projection is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/domain/boundedCartesianProjection.js

@@ -0,0 +1,15 @@
+/** Project a Cartesian product without materializing values beyond the output limit. */
+export const projectBoundedCartesian = (left, right, maximum, project) => {
+    const values = [];
+    for (const leftValue of left) {
+        for (const rightValue of right) {
+            if (values.length === maximum)
+                return {
+                    values,
+                    omitted: left.length * right.length - values.length,
+                };
+            values.push(project(leftValue, rightValue));
+        }
+    }
+    return { values, omitted: 0 };
+};