rea-agents 3.1.0 → 3.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (590) hide show
  1. package/README.md +72 -95
  2. package/bridge/ghidra/ReaGhidraBridge.java +609 -841
  3. package/bridge/hopper_bridge.py +99 -344
  4. package/dist/application/AbortablePromise.js +6 -3
  5. package/dist/application/AnalysisSnapshotCache.js +0 -1
  6. package/dist/application/AnalysisSnapshotFiles.js +7 -7
  7. package/dist/application/AndroidApplicationService.js +1 -1
  8. package/dist/application/AppleApplicationService.js +1 -1
  9. package/dist/application/ArtifactExtraction.js +35 -54
  10. package/dist/application/ArtifactExtractionDestination.js +17 -0
  11. package/dist/application/ArtifactGraphConstruction.js +2 -17
  12. package/dist/application/ArtifactInventory/classify.js +2 -6
  13. package/dist/application/ArtifactInventory/hash.js +2 -20
  14. package/dist/application/ArtifactInventory/scanCanonical.js +8 -12
  15. package/dist/application/ArtifactInventory/scanReader.js +69 -51
  16. package/dist/application/ArtifactInventory.js +6 -14
  17. package/dist/application/AuthorizedArtifactInventory.js +3 -13
  18. package/dist/application/BinarySession.js +41 -13
  19. package/dist/application/BinarySessionComposition.js +0 -11
  20. package/dist/application/BinarySessionOpen.js +2 -1
  21. package/dist/application/BinarySessionRecords.js +5 -93
  22. package/dist/application/BinarySessionStatus.js +5 -16
  23. package/dist/application/BinaryTargetResolver.js +216 -0
  24. package/dist/application/BrowserEvidence.js +42 -58
  25. package/dist/application/BrowserObservationService.js +3 -6
  26. package/dist/application/BrowserScenarioCaptureService.js +3 -6
  27. package/dist/application/BrowserScenarioEvidence.js +3 -3
  28. package/dist/application/CallPathTracing.js +2 -36
  29. package/dist/application/CapabilityInventory.js +10 -15
  30. package/dist/application/ClientConfigurationDocument.js +27 -0
  31. package/dist/application/ClientRegistrationStatus.js +16 -13
  32. package/dist/application/CommandShimReplay.js +14 -1
  33. package/dist/application/DirectAnalysis.js +22 -46
  34. package/dist/application/DirectAnalysisStatus.js +5 -61
  35. package/dist/application/Doctor.js +11 -32
  36. package/dist/application/DoctorDiagnostics.js +1 -2
  37. package/dist/application/DoctorScope.js +1 -1
  38. package/dist/application/ElectronActiveEvidence.js +3 -8
  39. package/dist/application/ElectronActiveObservationService.js +3 -6
  40. package/dist/application/ElectronBoundaryAnalysis.js +7 -8
  41. package/dist/application/ElectronBoundaryGraphContext.js +1 -1
  42. package/dist/application/ElectronBoundaryGraphIpc.js +3 -3
  43. package/dist/application/ElectronBoundaryGraphNative.js +1 -2
  44. package/dist/application/ElectronBoundaryGraphWindows.js +6 -8
  45. package/dist/application/ElectronEvidence.js +4 -7
  46. package/dist/application/ElectronObservationService.js +5 -9
  47. package/dist/application/EnhancedLiteralTracing.js +42 -65
  48. package/dist/application/EnhancedTools.js +76 -44
  49. package/dist/application/EvidenceBundleCommands.js +11 -11
  50. package/dist/application/EvidenceBundleFiles.js +9 -15
  51. package/dist/application/EvidenceLedger.js +6 -41
  52. package/dist/application/FilesystemSnapshot.js +2 -3
  53. package/dist/application/InterfaceBuilderAnalysis.js +266 -0
  54. package/dist/application/InventoryProjectionEvidence.js +4 -2
  55. package/dist/application/InvestigationProviders.js +1 -1
  56. package/dist/application/JavaScriptApplicationEvidence.js +2 -5
  57. package/dist/application/JavaScriptApplicationEvidenceGraph.js +6 -10
  58. package/dist/application/JavaScriptApplicationService.js +6 -29
  59. package/dist/application/JavaScriptApplicationWorkflowEvidence.js +5 -5
  60. package/dist/application/JavaScriptApplicationWorkflowService.js +0 -8
  61. package/dist/application/JavaScriptArtifactAnalysis.js +38 -127
  62. package/dist/application/JavaScriptArtifactFiles.js +67 -107
  63. package/dist/application/JavaScriptArtifactGraphAccumulator.js +0 -7
  64. package/dist/application/JavaScriptArtifactGraphBuilder.js +7 -58
  65. package/dist/application/JavaScriptArtifactGraphBundlers.js +1 -6
  66. package/dist/application/JavaScriptArtifactGraphContext.js +12 -39
  67. package/dist/application/JavaScriptArtifactGraphDocuments.js +4 -11
  68. package/dist/application/JavaScriptArtifactGraphEvidence.js +0 -14
  69. package/dist/application/JavaScriptArtifactGraphFindings.js +3 -3
  70. package/dist/application/JavaScriptArtifactGraphStructure.js +16 -17
  71. package/dist/application/JavaScriptArtifactPathResolution.js +61 -49
  72. package/dist/application/JavaScriptArtifactReconstruction.js +5 -10
  73. package/dist/application/JavaScriptArtifactReconstructionInput.js +2 -14
  74. package/dist/application/JavaScriptJsonModules.js +2 -2
  75. package/dist/application/JavaScriptModuleRelationships.js +22 -27
  76. package/dist/application/JavaScriptReplayPlanning.js +9 -3
  77. package/dist/application/JavaScriptReplayService.js +6 -32
  78. package/dist/application/JavaScriptReturnShapeProjection.js +12 -42
  79. package/dist/application/JavaScriptRuntimeObservationEvidence.js +7 -8
  80. package/dist/application/JavaScriptRuntimeObservationService.js +4 -8
  81. package/dist/application/JavaScriptRuntimeReconciliationEvidence.js +2 -3
  82. package/dist/application/JavaScriptSemanticGraphBuilder.js +11 -41
  83. package/dist/application/JavaScriptSemanticGraphConstruction.js +5 -29
  84. package/dist/application/JavaScriptSemanticGraphEvidence.js +1 -1
  85. package/dist/application/JavaScriptSemanticGraphFingerprintProjection.js +1 -1
  86. package/dist/application/JavaScriptSemanticGraphFlowProjection.js +0 -13
  87. package/dist/application/JavaScriptSemanticGraphProjection.js +1 -3
  88. package/dist/application/JavaScriptSemanticTraceService.js +1 -10
  89. package/dist/application/JsonFiles.js +79 -0
  90. package/dist/application/LinuxHopper.js +11 -9
  91. package/dist/application/LoopbackReplay.js +26 -23
  92. package/dist/application/LoopbackReplayRecorder.js +29 -1
  93. package/dist/application/ManagedApplicationGraphService.js +1 -2
  94. package/dist/application/ManagedMemberComparisonService.js +11 -41
  95. package/dist/application/ManagedNativeVerificationService.js +1 -2
  96. package/dist/application/ManagedReconstructionService.js +1 -1
  97. package/dist/application/ManagedRuntimeCorrelationService.js +5 -8
  98. package/dist/application/NativeApiInspection.js +2 -7
  99. package/dist/application/NativeUiActionTrace.js +394 -0
  100. package/dist/application/NodeRuntimeCharacterizationService.js +3 -7
  101. package/dist/application/PermissionAuthority.js +15 -7
  102. package/dist/application/PermissionFailure.js +5 -0
  103. package/dist/application/ProcessCaptureAuthority.js +5 -7
  104. package/dist/application/ProcessCaptureJournal.js +3 -2
  105. package/dist/application/ProcessCaptureLifecycle.js +5 -12
  106. package/dist/application/ProcessCheckpoints.js +29 -11
  107. package/dist/application/ProcessCli.js +6 -16
  108. package/dist/application/ProcessEvidence.js +5 -7
  109. package/dist/application/ProcessHarness.js +52 -17
  110. package/dist/application/ProcessReactiveCoordinator.js +2 -4
  111. package/dist/application/ProcessReactiveEffects.js +9 -3
  112. package/dist/application/ProcessReactiveHarness.js +13 -7
  113. package/dist/application/ProcessSampling.js +2 -4
  114. package/dist/application/ProcessTimer.js +39 -0
  115. package/dist/application/ProjectPermissionStore.js +39 -96
  116. package/dist/application/RealHopperAssertions.js +20 -66
  117. package/dist/application/ReconstructionCoverageService.js +12 -58
  118. package/dist/application/ReconstructionObligationAuthority.js +2 -2
  119. package/dist/application/ReconstructionObligationCandidates.js +4 -4
  120. package/dist/application/ReconstructionObligationLedgerEvaluation.js +8 -15
  121. package/dist/application/ReconstructionObligationLedgerProjection.js +3 -7
  122. package/dist/application/ReconstructionObligationLedgerService.js +19 -38
  123. package/dist/application/ReferenceSourceImport.js +19 -45
  124. package/dist/application/ReferenceSourceImportEntries.js +2 -4
  125. package/dist/application/ReferenceSourceImportPolicy.js +5 -32
  126. package/dist/application/ReferenceSourceImportTypes.js +0 -16
  127. package/dist/application/RuntimeExecutableDiagnostics.js +55 -29
  128. package/dist/application/SessionProviderRouter.js +2 -2
  129. package/dist/application/Setup.js +1 -3
  130. package/dist/application/SetupClientConfiguration.js +22 -93
  131. package/dist/application/SetupRegistrationEnvironment.js +0 -7
  132. package/dist/application/StoreFileLock.js +119 -0
  133. package/dist/application/TerminalRenderer.js +2 -3
  134. package/dist/application/Uninstall.js +9 -14
  135. package/dist/application/UnknownEvidence.js +1 -1
  136. package/dist/artifacts/ArtifactPaths.js +2 -5
  137. package/dist/artifacts/ArtifactProvider.js +36 -58
  138. package/dist/artifacts/DirectoryArtifactReader.js +13 -8
  139. package/dist/artifacts/MachOSliceArtifactReader.js +1 -5
  140. package/dist/artifacts/NativeDmgArtifactReader.js +11 -11
  141. package/dist/artifacts/NibArchive.js +269 -0
  142. package/dist/artifacts/SafeOutputTree.js +15 -24
  143. package/dist/browser/BrowserProcessStartup.js +1 -2
  144. package/dist/browser/CdpAuthorizedMainFrame.js +16 -0
  145. package/dist/browser/CdpBrowserProvider.js +3 -13
  146. package/dist/browser/CdpCanonicalJsonDigest.js +9 -0
  147. package/dist/browser/CdpCaptureDocuments.js +28 -76
  148. package/dist/browser/CdpCaptureEventBodyShapes.js +13 -33
  149. package/dist/browser/CdpCaptureEventHandlers.js +22 -87
  150. package/dist/browser/CdpCaptureEvents.js +2 -8
  151. package/dist/browser/CdpCaptureStorage.js +9 -20
  152. package/dist/browser/CdpCaptureStorageFingerprints.js +85 -98
  153. package/dist/browser/CdpCaptureValues.js +21 -21
  154. package/dist/browser/CdpConnection.js +10 -25
  155. package/dist/browser/CdpElectronInspection.js +26 -50
  156. package/dist/browser/CdpElectronProvider.js +10 -35
  157. package/dist/browser/CdpElectronScriptEvents.js +8 -16
  158. package/dist/browser/CdpElectronScripts.js +6 -35
  159. package/dist/browser/CdpElectronWorkers.js +6 -10
  160. package/dist/browser/CdpEndpoint.js +25 -41
  161. package/dist/browser/CdpObservationSession.js +14 -26
  162. package/dist/browser/CdpPageCapture.js +34 -48
  163. package/dist/browser/CdpPageCaptureScripts.js +1 -19
  164. package/dist/browser/CdpPageCaptureWorkers.js +6 -10
  165. package/dist/browser/CdpSafeMetadata.js +19 -22
  166. package/dist/browser/CdpScreenshot.js +3 -5
  167. package/dist/browser/CdpTargetSession.js +1 -2
  168. package/dist/browser/CdpWebMcpDiscovery.js +13 -22
  169. package/dist/browser/ElectronFileScope.js +8 -19
  170. package/dist/browser/JavaScriptRuntimeScope.js +9 -14
  171. package/dist/browser/PlaywrightBrowserScenarioProvider.js +31 -64
  172. package/dist/browser/PlaywrightElectronActiveActions.js +54 -69
  173. package/dist/browser/PlaywrightElectronActiveProvider.js +14 -34
  174. package/dist/browser/PlaywrightExecutionBoundary.js +16 -5
  175. package/dist/browser/PlaywrightScenarioActions.js +3 -7
  176. package/dist/browser/PlaywrightScenarioArtifacts.js +23 -92
  177. package/dist/browser/PlaywrightScenarioBrowser.js +3 -5
  178. package/dist/browser/PlaywrightScenarioEvents.js +45 -94
  179. package/dist/browser/PlaywrightScenarioSession.js +14 -30
  180. package/dist/browser/PngVisualDiff.js +22 -14
  181. package/dist/browser/SensitiveTextCapture.js +0 -17
  182. package/dist/browser/V8InspectorCaptureProjection.js +7 -8
  183. package/dist/browser/V8InspectorEndpoint.js +12 -14
  184. package/dist/browser/V8InspectorProvider.js +20 -61
  185. package/dist/browser/WebSourceMapFetcher.js +56 -176
  186. package/dist/catalogIdentity.js +0 -54
  187. package/dist/cli/artifactCommands.js +49 -77
  188. package/dist/cli/coreAnalysisCommands.js +83 -133
  189. package/dist/cli/javascriptApplicationAnalysis.js +1 -9
  190. package/dist/cli/managedCommands.js +5 -270
  191. package/dist/cli/setupCommands.js +3 -12
  192. package/dist/cli/utilityCommands.js +7 -41
  193. package/dist/cli.js +0 -2
  194. package/dist/cliApplicationCommands.js +42 -112
  195. package/dist/cliBrowserAdvancedCommands.js +10 -106
  196. package/dist/cliBrowserCommands.js +15 -127
  197. package/dist/cliBrowserContext.js +30 -0
  198. package/dist/cliCommandNames.js +4 -5
  199. package/dist/cliElectronCommands.js +8 -72
  200. package/dist/cliEvidenceCommands.js +8 -77
  201. package/dist/cliJavaScriptRuntimeCommands.js +9 -91
  202. package/dist/cliJsonInput.js +4 -14
  203. package/dist/cliObservationOptions.js +11 -96
  204. package/dist/cliPolicyCommands.js +2 -17
  205. package/dist/cliProcessCommands.js +3 -3
  206. package/dist/cliSetup.js +0 -13
  207. package/dist/config/browserScenario.js +2 -2
  208. package/dist/config/environment.js +0 -9
  209. package/dist/config/parseConfig.js +1 -33
  210. package/dist/config/parsers.js +6 -27
  211. package/dist/config/passiveObservation.js +7 -77
  212. package/dist/config/permissions.js +0 -7
  213. package/dist/contracts/analysisSearchContract.js +2 -5
  214. package/dist/contracts/applicationToolContracts.js +56 -109
  215. package/dist/contracts/applicationWorkflowInputContracts.js +27 -102
  216. package/dist/contracts/artifactComparisonExample.js +58 -60
  217. package/dist/contracts/artifactToolContracts.js +20 -67
  218. package/dist/contracts/browserScenarioToolContracts.js +6 -51
  219. package/dist/contracts/browserToolContracts.js +8 -73
  220. package/dist/contracts/electronToolContracts.js +8 -108
  221. package/dist/contracts/enhancedInputs.js +23 -54
  222. package/dist/contracts/errorSchemas.js +0 -1
  223. package/dist/contracts/functionComparisonExample.js +10 -24
  224. package/dist/contracts/functionInstructionContract.js +1 -3
  225. package/dist/contracts/functionWorkflowToolContracts.js +2 -2
  226. package/dist/contracts/hopperMemoryContracts.js +3 -3
  227. package/dist/contracts/investigationExamples.js +14 -11
  228. package/dist/contracts/javascriptApplicationWorkflowExamples.js +12 -19
  229. package/dist/contracts/javascriptRuntimeObservationToolContracts.js +2 -20
  230. package/dist/contracts/javascriptRuntimeReconciliationExample.js +45 -12
  231. package/dist/contracts/managedToolContracts.js +6 -95
  232. package/dist/contracts/managedWorkflowExamples.js +77 -128
  233. package/dist/contracts/managedWorkflowToolContracts.js +51 -77
  234. package/dist/contracts/nativeToolContracts.js +7 -11
  235. package/dist/contracts/processCaptureExample.js +2 -69
  236. package/dist/contracts/promptContracts.js +49 -67
  237. package/dist/contracts/providerSelection.js +0 -1
  238. package/dist/contracts/reconstructionReadinessExample.js +1 -6
  239. package/dist/contracts/sessionStatusContract.js +1 -17
  240. package/dist/contracts/sessionToolSchemas.js +6 -15
  241. package/dist/contracts/toolContractExamples.js +11 -11
  242. package/dist/contracts/toolContractHelpers.js +0 -4
  243. package/dist/contracts/toolContracts.js +60 -71
  244. package/dist/contracts/toolEffects.js +5 -13
  245. package/dist/contracts/toolOutputSchemaGroups.js +37 -91
  246. package/dist/contracts/toolOutputSchemaPrimitives.js +16 -56
  247. package/dist/contracts/toolSchemaMetadata.js +8 -19
  248. package/dist/contracts/unknownContractExamples.js +0 -2
  249. package/dist/domain/analysisErrorPresentation.js +46 -54
  250. package/dist/domain/analysisErrorProjection.js +28 -37
  251. package/dist/domain/analysisProfile.js +3 -31
  252. package/dist/domain/analysisSnapshot.js +3 -12
  253. package/dist/domain/androidApplication.js +15 -54
  254. package/dist/domain/appleApplication.js +24 -67
  255. package/dist/domain/artifactComparison.js +11 -29
  256. package/dist/domain/artifactGraph.js +14 -44
  257. package/dist/domain/artifactInspection.js +38 -69
  258. package/dist/domain/artifactInventoryEvidence.js +27 -21
  259. package/dist/domain/binaryTarget.js +2 -221
  260. package/dist/domain/browserCaptureComparison.js +47 -24
  261. package/dist/domain/browserObservation.js +28 -193
  262. package/dist/domain/browserObservationSchemas.js +5 -23
  263. package/dist/domain/browserScenario.js +11 -14
  264. package/dist/domain/browserScenarioCapture.js +11 -12
  265. package/dist/domain/browserScenarioCaptureValues.js +146 -84
  266. package/dist/domain/browserScenarioDiff.js +2 -59
  267. package/dist/domain/browserScenarioDiffEvidence.js +51 -0
  268. package/dist/domain/browserScenarioDiffValues.js +21 -38
  269. package/dist/domain/browserScenarioValues.js +80 -109
  270. package/dist/domain/browserSession.js +4 -7
  271. package/dist/domain/bundleComparison.js +6 -32
  272. package/dist/domain/bytecodeProvider.js +20 -19
  273. package/dist/domain/callPath.js +47 -167
  274. package/dist/domain/callPathSchemas.js +79 -0
  275. package/dist/domain/changedBehavior.js +34 -60
  276. package/dist/domain/completionLedgerGeneration.js +8 -14
  277. package/dist/domain/conformancePackage.js +126 -97
  278. package/dist/domain/conformanceReplay.js +36 -8
  279. package/dist/domain/conformanceTrustGate.js +23 -14
  280. package/dist/domain/customProtocolCapture.js +1 -1
  281. package/dist/domain/electronActiveObservation.js +70 -103
  282. package/dist/domain/electronObservation.js +14 -80
  283. package/dist/domain/electronStaticAnalysisBrowser.js +36 -46
  284. package/dist/domain/electronStaticAnalysisIpc.js +38 -14
  285. package/dist/domain/electronStaticAnalysisNative.js +1 -8
  286. package/dist/domain/electronStaticAnalysisValues.js +10 -17
  287. package/dist/domain/errors.js +33 -54
  288. package/dist/domain/eventProcessTree.js +20 -12
  289. package/dist/domain/evidence.js +2 -10
  290. package/dist/domain/evidenceBundle.js +3 -5
  291. package/dist/domain/evidenceCompletionLedger.js +6 -8
  292. package/dist/domain/functionComparison.js +4 -14
  293. package/dist/domain/functionComparisonNormalization.js +4 -11
  294. package/dist/domain/functionComparisonResults.js +25 -15
  295. package/dist/domain/functionComparisonSchemas.js +49 -33
  296. package/dist/domain/functionDossierEvidence.js +31 -156
  297. package/dist/domain/hopperStartupFailure.js +1 -1
  298. package/dist/domain/hopperValues.js +15 -136
  299. package/dist/domain/interfaceBuilderGraph.js +654 -0
  300. package/dist/domain/javascriptApplicationAnalysis.js +8 -112
  301. package/dist/domain/javascriptApplicationChangeGraph.js +22 -82
  302. package/dist/domain/javascriptApplicationEvidenceSchemas.js +59 -47
  303. package/dist/domain/javascriptApplicationGraph.js +3 -13
  304. package/dist/domain/javascriptApplicationGraphSchemas.js +12 -34
  305. package/dist/domain/javascriptApplicationVersionComparison.js +26 -30
  306. package/dist/domain/javascriptApplicationVersionComparisonSchemas.js +123 -68
  307. package/dist/domain/javascriptApplicationVersionItems.js +120 -53
  308. package/dist/domain/javascriptApplicationVersionKeys.js +24 -11
  309. package/dist/domain/javascriptAstFingerprint.js +25 -58
  310. package/dist/domain/javascriptAstValues.js +9 -0
  311. package/dist/domain/javascriptExportInstrumentation.js +2 -4
  312. package/dist/domain/javascriptExportShapeComparison.js +6 -7
  313. package/dist/domain/javascriptExportShapeComparisonSchemas.js +68 -75
  314. package/dist/domain/javascriptExportShapeSelection.js +17 -19
  315. package/dist/domain/javascriptFeatureSeed.js +20 -12
  316. package/dist/domain/javascriptFeatureTrace.js +13 -67
  317. package/dist/domain/javascriptFeatureTraceSchemas.js +24 -52
  318. package/dist/domain/javascriptFeatureTraversal.js +1 -44
  319. package/dist/domain/javascriptNativeHandoff.js +1 -1
  320. package/dist/domain/javascriptReplay.js +24 -41
  321. package/dist/domain/javascriptRuntimeLoadState.js +3 -8
  322. package/dist/domain/javascriptRuntimeObservation.js +42 -103
  323. package/dist/domain/javascriptRuntimeReconciliation.js +1 -3
  324. package/dist/domain/javascriptRuntimeReconciliationActive.js +8 -17
  325. package/dist/domain/javascriptRuntimeReconciliationGraph.js +10 -23
  326. package/dist/domain/javascriptRuntimeReconciliationMatching.js +18 -12
  327. package/dist/domain/javascriptRuntimeReconciliationParsing.js +16 -45
  328. package/dist/domain/javascriptRuntimeReconciliationResult.js +4 -5
  329. package/dist/domain/javascriptRuntimeReconciliationRuntime.js +8 -12
  330. package/dist/domain/javascriptRuntimeReconciliationSchemas.js +33 -48
  331. package/dist/domain/javascriptRuntimeStaticCandidates.js +3 -3
  332. package/dist/domain/javascriptSemanticAnalysis.js +12 -45
  333. package/dist/domain/javascriptSemanticAsyncEffects.js +1 -9
  334. package/dist/domain/javascriptSemanticCallResolution.js +6 -16
  335. package/dist/domain/javascriptSemanticCalls.js +5 -32
  336. package/dist/domain/javascriptSemanticChildProcesses.js +1 -11
  337. package/dist/domain/javascriptSemanticCoverage.js +11 -0
  338. package/dist/domain/javascriptSemanticDataEffectHelpers.js +1 -8
  339. package/dist/domain/javascriptSemanticDataEffects.js +1 -11
  340. package/dist/domain/javascriptSemanticFingerprints.js +3 -5
  341. package/dist/domain/javascriptSemanticGraphSchemas.js +25 -51
  342. package/dist/domain/javascriptSemanticGraphSerialization.js +2 -13
  343. package/dist/domain/javascriptSemanticIr.js +1 -29
  344. package/dist/domain/javascriptSemanticObjects.js +1 -5
  345. package/dist/domain/javascriptSemanticPrimitives.js +2 -9
  346. package/dist/domain/javascriptSemanticProjection.js +0 -18
  347. package/dist/domain/javascriptSemanticPromises.js +9 -16
  348. package/dist/domain/javascriptSemanticProvenance.js +16 -19
  349. package/dist/domain/javascriptSemanticQuery.js +17 -139
  350. package/dist/domain/javascriptSemanticQueryAssessment.js +9 -37
  351. package/dist/domain/javascriptSemanticQueryIdentity.js +2 -23
  352. package/dist/domain/javascriptSemanticQuerySchemas.js +14 -107
  353. package/dist/domain/javascriptSemanticResources.js +1 -6
  354. package/dist/domain/javascriptSemanticReturns.js +10 -27
  355. package/dist/domain/javascriptSemanticValueTypes.js +1 -0
  356. package/dist/domain/javascriptSemanticValues.js +44 -62
  357. package/dist/domain/javascriptStaticAnalysis.js +21 -43
  358. package/dist/domain/javascriptStaticAnalysisBundler.js +34 -93
  359. package/dist/domain/javascriptStaticAnalysisCalls.js +17 -16
  360. package/dist/domain/javascriptStaticAnalysisFindings.js +3 -19
  361. package/dist/domain/javascriptStaticAnalysisHelpers.js +47 -88
  362. package/dist/domain/javascriptStaticAnalysisState.js +1 -5
  363. package/dist/domain/javascriptStaticAnalysisTypes.js +1 -0
  364. package/dist/domain/jsonShape.js +7 -33
  365. package/dist/domain/localPath.js +7 -0
  366. package/dist/domain/managedApplicationGraph.js +9 -41
  367. package/dist/domain/managedApplicationGraphCoverage.js +24 -156
  368. package/dist/domain/managedApplicationGraphNodes.js +10 -13
  369. package/dist/domain/managedArtifact.js +14 -27
  370. package/dist/domain/managedMemberComparison.js +90 -92
  371. package/dist/domain/managedMemberComparisonCoverage.js +11 -33
  372. package/dist/domain/managedMemberComparisonItems.js +221 -0
  373. package/dist/domain/managedMemberComparisonMatch.js +8 -208
  374. package/dist/domain/managedNativeVerification.js +3 -6
  375. package/dist/domain/managedNativeVerificationMatch.js +55 -59
  376. package/dist/domain/managedNativeVerificationSchemas.js +83 -47
  377. package/dist/domain/managedReconstruction.js +19 -23
  378. package/dist/domain/managedRuntimeCorrelation.js +6 -9
  379. package/dist/domain/nativeApiBoundary.js +2 -7
  380. package/dist/domain/nativeInspection.js +0 -2
  381. package/dist/domain/nativeInvestigationGraph.js +351 -0
  382. package/dist/domain/nativeValueFlow.js +61 -0
  383. package/dist/domain/nodeRuntimeCharacterization.js +1 -5
  384. package/dist/domain/objcSwiftMetadata.js +254 -0
  385. package/dist/domain/peInspection.js +1 -1
  386. package/dist/domain/permissionPolicy.js +13 -0
  387. package/dist/domain/processCapture.js +76 -113
  388. package/dist/domain/processCaptureExample.js +68 -0
  389. package/dist/domain/processCaptureParsing.js +21 -0
  390. package/dist/domain/processCaptureReactiveSchema.js +68 -0
  391. package/dist/domain/processCaptureValidation.js +1 -7
  392. package/dist/domain/processComparison.js +3 -12
  393. package/dist/domain/processReactiveMatching.js +29 -50
  394. package/dist/domain/processReactiveRuntime.js +4 -8
  395. package/dist/domain/processReactiveScenario.js +28 -94
  396. package/dist/domain/processReactiveScenarioPreflight.js +5 -30
  397. package/dist/domain/processReactiveTransition.js +33 -18
  398. package/dist/domain/processScenario.js +56 -90
  399. package/dist/domain/processTraceComparison.js +0 -8
  400. package/dist/domain/processTraceEvaluation.js +14 -4
  401. package/dist/domain/processTraceSpecification.js +11 -17
  402. package/dist/domain/protocolCapture.js +3 -3
  403. package/dist/domain/reconstructionCoverage.js +62 -129
  404. package/dist/domain/reconstructionCoverageEvaluation.js +17 -17
  405. package/dist/domain/reconstructionObligationLedgerSchemas.js +45 -72
  406. package/dist/domain/reconstructionReadiness.js +1 -2
  407. package/dist/domain/reconstructionReadinessSchemas.js +36 -38
  408. package/dist/domain/reconstructionUnknowns.js +3 -3
  409. package/dist/domain/reconstructionVerification.js +13 -47
  410. package/dist/domain/reconstructionVerificationSchemas.js +50 -38
  411. package/dist/domain/referenceSourceGraph.js +53 -61
  412. package/dist/domain/referenceSourceImportParsing.js +1 -5
  413. package/dist/domain/replayMachine.js +19 -31
  414. package/dist/domain/replayMachineRun.js +15 -63
  415. package/dist/domain/replayMachineRuntime.js +41 -41
  416. package/dist/domain/replayMachineValues.js +84 -0
  417. package/dist/domain/residualUnknown.js +25 -30
  418. package/dist/domain/runtimeCharacterization.js +15 -16
  419. package/dist/domain/runtimeIdentification.js +48 -47
  420. package/dist/domain/sourceToBundleComparison.js +9 -85
  421. package/dist/domain/sourceToBundleComparisonSchemas.js +17 -42
  422. package/dist/domain/sourceToBundleSignals.js +4 -15
  423. package/dist/domain/staticRuntimeCorrelation.js +37 -49
  424. package/dist/domain/symbolAnalysis.js +10 -19
  425. package/dist/domain/unicodeCodePointOrder.js +12 -0
  426. package/dist/domain/webBundleAnalysis.js +70 -99
  427. package/dist/domain/webBundleAnalyzer.js +2 -4
  428. package/dist/domain/webBundleAnalyzerAst.js +0 -13
  429. package/dist/domain/webBundleAnalyzerInspection.js +26 -52
  430. package/dist/domain/webBundleAnalyzerResult.js +7 -24
  431. package/dist/domain/webCaptureDiff.js +33 -73
  432. package/dist/domain/webCaptureDiffSchemas.js +86 -0
  433. package/dist/domain/webContentArtifact.js +1 -10
  434. package/dist/domain/webMcpDiscovery.js +3 -14
  435. package/dist/domain/webScreenshot.js +58 -34
  436. package/dist/domain/zipPackageFormat.js +7 -0
  437. package/dist/dotnet/ManagedArtifactInspector.js +17 -50
  438. package/dist/dotnet/ManagedMemberInspector.js +27 -58
  439. package/dist/dotnet/ManagedMemberInspectorCore.js +14 -51
  440. package/dist/dotnet/ManagedMemberInstructionDecoder.js +2 -2
  441. package/dist/dotnet/ManagedMemberRows.js +16 -16
  442. package/dist/dotnet/ManagedMetadataHeaps.js +26 -8
  443. package/dist/dotnet/ManagedMetadataInventory.js +21 -30
  444. package/dist/dotnet/ManagedMetadataInventoryRows.js +57 -63
  445. package/dist/dotnet/ManagedMetadataLayout.js +3 -5
  446. package/dist/dotnet/ManagedMethodBodyReader.js +5 -30
  447. package/dist/dotnet/ManagedNativeBoundaryHelpers.js +19 -49
  448. package/dist/dotnet/ManagedNativeBoundaryInspector.js +13 -41
  449. package/dist/dotnet/ManagedPeReader.js +2 -2
  450. package/dist/dotnet/ManagedStaticProvider.js +13 -71
  451. package/dist/generatedMcpToolCatalog.js +1 -1
  452. package/dist/generatedPackageMetadata.js +1 -1
  453. package/dist/ghidra/GhidraAnalysisProfile.js +3 -8
  454. package/dist/ghidra/GhidraClient.js +4 -12
  455. package/dist/ghidra/GhidraClientWire.js +9 -5
  456. package/dist/ghidra/GhidraDefaults.js +0 -18
  457. package/dist/ghidra/GhidraDiagnostics.js +0 -2
  458. package/dist/ghidra/GhidraDoctor.js +16 -12
  459. package/dist/ghidra/GhidraFunctionValues.js +65 -108
  460. package/dist/ghidra/GhidraInstallation.js +98 -42
  461. package/dist/ghidra/GhidraInventoryValues.js +16 -85
  462. package/dist/ghidra/GhidraLauncher.js +0 -8
  463. package/dist/ghidra/GhidraProvider.js +15 -22
  464. package/dist/ghidra/GhidraProviderCapabilities.js +6 -47
  465. package/dist/ghidra/GhidraRequestQueue.js +6 -30
  466. package/dist/ghidra/GhidraResponseBuffer.js +1 -7
  467. package/dist/ghidra/GhidraSessionValues.js +0 -2
  468. package/dist/ghidra/GhidraTransport.js +4 -7
  469. package/dist/ghidra/protocol.js +2 -2
  470. package/dist/hopper/BridgeLauncher.js +112 -36
  471. package/dist/hopper/HopperAnalysisProfile.js +1 -1
  472. package/dist/hopper/HopperCleanup.js +6 -3
  473. package/dist/hopper/HopperClient.js +4 -7
  474. package/dist/hopper/HopperProcessDiagnostic.js +2 -2
  475. package/dist/hopper/HopperProvider.js +0 -16
  476. package/dist/hopper/HopperRequestQueue.js +21 -40
  477. package/dist/hopper/HopperResponseStream.js +1 -9
  478. package/dist/hopper/HopperSessionValues.js +3 -2
  479. package/dist/hopper/HopperTargetLease.js +119 -0
  480. package/dist/hopper/LinuxPrivateDisplayDiagnostic.js +24 -31
  481. package/dist/hopper/LinuxPrivateDisplayProbe.js +5 -16
  482. package/dist/hopper/protocol.js +6 -4
  483. package/dist/main/reload.js +0 -3
  484. package/dist/main/shutdown.js +1 -1
  485. package/dist/main/state.js +0 -9
  486. package/dist/main/transport.js +0 -5
  487. package/dist/mcpDoctor.js +25 -45
  488. package/dist/native/CommandRunner.js +18 -25
  489. package/dist/native/NativeMacOSProvider.js +13 -38
  490. package/dist/native/NativeMachoInspection.js +1 -1
  491. package/dist/process/BoundedFileBytes.js +17 -0
  492. package/dist/process/ExecFileOutput.js +11 -0
  493. package/dist/process/PendingOperations.js +8 -6
  494. package/dist/process/ProcessOwnership.js +3 -2
  495. package/dist/process/ProcessOwnershipObservation.js +0 -1
  496. package/dist/process/ProviderProcess.js +7 -28
  497. package/dist/reference/ReferenceSourceReader.js +8 -24
  498. package/dist/reference/ReferenceSourceReaderEntries.js +11 -39
  499. package/dist/reference/ReferenceSourceReaderFile.js +13 -31
  500. package/dist/reference/ReferenceSourceReaderPaths.js +3 -18
  501. package/dist/reference/ReferenceSourceReaderValidate.js +3 -6
  502. package/dist/replay/JavaScriptReplayWorker.js +3 -5
  503. package/dist/replay/LinuxJavaScriptReplayRunner.js +33 -29
  504. package/dist/replay/LinuxJavaScriptReplaySandbox.js +0 -19
  505. package/dist/replay/LinuxRuntimeClosure.js +1 -3
  506. package/dist/replay/ReplayOutcome.js +1 -3
  507. package/dist/replay/ReplayProcessLifecycle.js +32 -7
  508. package/dist/replay/ReplaySeccompFile.js +29 -0
  509. package/dist/replay/ReplayWorkerProtocol.js +0 -2
  510. package/dist/replay/SystemJavaScriptReplayHost.js +45 -74
  511. package/dist/server/ProcessCaptureElicitation.js +4 -8
  512. package/dist/server/createServer.js +6 -44
  513. package/dist/server/promptCompletion.js +37 -61
  514. package/dist/server/recordDerivedEvidence.js +1 -1
  515. package/dist/server/registerApplicationTools/characterization.js +4 -8
  516. package/dist/server/registerApplicationTools/compareExportShapes.js +5 -10
  517. package/dist/server/registerApplicationTools/compareSourceToBundle.js +6 -10
  518. package/dist/server/registerApplicationTools/compareVersions.js +5 -10
  519. package/dist/server/registerApplicationTools/controlledReplay.js +3 -5
  520. package/dist/server/registerApplicationTools/coverage.js +6 -71
  521. package/dist/server/registerApplicationTools/helpers.js +1 -13
  522. package/dist/server/registerApplicationTools/obligationLedger.js +3 -2
  523. package/dist/server/registerApplicationTools/traceFeature.js +5 -9
  524. package/dist/server/registerApplicationTools/traceSemantics.js +5 -8
  525. package/dist/server/registerApplicationTools.js +0 -2
  526. package/dist/server/registerArtifactComparisonTool.js +23 -27
  527. package/dist/server/registerBrowserScenarioTool.js +4 -4
  528. package/dist/server/registerBrowserTools.js +5 -8
  529. package/dist/server/registerBundleComparisonTool.js +5 -7
  530. package/dist/server/registerCloseLifecycleTool.js +2 -16
  531. package/dist/server/registerElectronTools.js +10 -29
  532. package/dist/server/registerEnhancedTools.js +10 -11
  533. package/dist/server/registerEvidenceTools.js +15 -22
  534. package/dist/server/registerFunctionComparisonTool.js +30 -25
  535. package/dist/server/registerInvestigationTools/helpers.js +3 -32
  536. package/dist/server/registerInvestigationTools.js +20 -116
  537. package/dist/server/registerJavaScriptRuntimeObservationTools.js +6 -4
  538. package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js +15 -17
  539. package/dist/server/registerManagedWorkflowTools/evidence.js +19 -35
  540. package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js +3 -8
  541. package/dist/server/registerManagedWorkflowTools/planManagedRuntimeCorrelation.js +3 -8
  542. package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js +10 -14
  543. package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js +9 -15
  544. package/dist/server/registerOfficialTools.js +1 -43
  545. package/dist/server/registerProcessComparisonTool.js +33 -23
  546. package/dist/server/registerPrompts.js +19 -17
  547. package/dist/server/registerSessionRecordTools.js +10 -156
  548. package/dist/server/registerSessionStatusTool.js +6 -69
  549. package/dist/server/registerSessionTools.js +10 -51
  550. package/dist/server/sessionAvailabilityPolicy.js +0 -2
  551. package/dist/server/sessionEvidence.js +9 -15
  552. package/dist/server/sessionToolPolicies.js +0 -8
  553. package/dist/server/toolResult.js +14 -50
  554. package/dist/serverIdentity.js +0 -20
  555. package/install.sh +1 -1
  556. package/package.json +11 -7
  557. package/scripts/electron-active-hook.cjs +23 -55
  558. package/scripts/hopper-demo-x11.py +13 -32
  559. package/skills/reverse-engineer-anything/SKILL.md +47 -12
  560. package/skills/reverse-engineer-anything/references/evidence-workflows.md +6 -4
  561. package/skills/reverse-engineer-anything/references/javascript-applications.md +13 -13
  562. package/skills/reverse-engineer-anything/references/native-and-artifacts.md +12 -8
  563. package/dist/application/ApplicationWorkflowEvidenceResolver.js +0 -188
  564. package/dist/application/BoundedJsonFiles.js +0 -86
  565. package/dist/application/CrossVersionInventory.js +0 -129
  566. package/dist/application/CrossVersionInvestigation.js +0 -301
  567. package/dist/application/CrossVersionInvestigationCollections.js +0 -23
  568. package/dist/application/CrossVersionInvestigationEvidence.js +0 -64
  569. package/dist/application/CrossVersionInvestigationReplay.js +0 -170
  570. package/dist/application/DeferredFileAuthorization.js +0 -61
  571. package/dist/application/DoctorProjection.js +0 -43
  572. package/dist/application/EnhancedToolPagination.js +0 -22
  573. package/dist/application/EvidenceReferenceResolver.js +0 -26
  574. package/dist/application/InvestigationWorkspaceStore.js +0 -204
  575. package/dist/application/ProcessPairedExperiment.js +0 -72
  576. package/dist/application/ReconstructionCoverageWorkspaceStore.js +0 -31
  577. package/dist/application/ReconstructionReadinessService.js +0 -48
  578. package/dist/cliInvestigationCommands.js +0 -173
  579. package/dist/domain/boundedCartesianProjection.js +0 -15
  580. package/dist/domain/investigationWorkspace.js +0 -347
  581. package/dist/domain/jsonLimits.js +0 -26
  582. package/dist/domain/knownPageCoverage.js +0 -29
  583. package/dist/domain/processPairedExperiment.js +0 -128
  584. package/dist/server/javascriptApplicationResult.js +0 -106
  585. package/dist/server/permissionFailure.js +0 -12
  586. package/dist/server/registerApplicationTools/readiness.js +0 -50
  587. package/dist/server/registerEvidenceResources.js +0 -315
  588. package/dist/server/registerJavaScriptApplicationGraphResource.js +0 -65
  589. package/dist/server/registerReconstructionObligationLedgerResource.js +0 -32
  590. package/dist/server/registerReconstructionReadinessResource.js +0 -32
@@ -2,34 +2,27 @@ import { createHash } from "node:crypto";
2
2
  import canonicalize from "canonicalize";
3
3
  import { z } from "zod";
4
4
  import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
5
- import { projectBoundedCartesian } from "./boundedCartesianProjection.js";
6
5
  import { evidenceSchema } from "./evidence.js";
7
6
  const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
8
7
  const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
9
- const boundedPathSchema = z.string().min(1).max(4_096);
8
+ const pathSchema = z.string().min(1);
10
9
  const componentSchema = z.strictObject({
11
- path: boundedPathSchema,
10
+ path: pathSchema,
12
11
  artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
13
12
  sha256: digestSchema,
14
- format: z.string().min(1).max(100),
13
+ format: z.string().min(1),
15
14
  });
16
15
  /** Authenticated artifact inventory pages projected as one Apple application. */
17
16
  export const appleApplicationProjectionInputSchema = z.strictObject({
18
- inventory_evidence: z.array(evidenceSchema).min(1).max(100),
19
- limits: z
20
- .strictObject({
21
- max_components: z.number().int().min(1).max(10_000).default(1_000),
22
- })
23
- .default({ max_components: 1_000 }),
17
+ inventory_evidence: z.array(evidenceSchema).min(1),
24
18
  });
25
19
  /** Deterministic, execution-free Apple application inventory projection. */
26
20
  export const appleApplicationProjectionResultSchema = z.strictObject({
27
- schema_version: z.literal(1),
28
21
  projection_id: z.string().regex(/^aap_[a-f0-9]{64}$/u),
29
22
  root_sha256: digestSchema,
30
23
  root_format: z.literal("ipa"),
31
- source_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
32
- application_roots: z.array(boundedPathSchema),
24
+ source_evidence_ids: z.array(evidenceIdSchema).min(1),
25
+ application_roots: z.array(pathSchema),
33
26
  components: z.strictObject({
34
27
  bundle_metadata: z.array(componentSchema),
35
28
  executables: z.array(componentSchema),
@@ -47,8 +40,8 @@ export const appleApplicationProjectionResultSchema = z.strictObject({
47
40
  "unity",
48
41
  ])),
49
42
  bridge_candidates: z.array(z.strictObject({
50
- source_path: boundedPathSchema,
51
- native_path: boundedPathSchema,
43
+ source_path: pathSchema,
44
+ native_path: pathSchema,
52
45
  basis: z.enum([
53
46
  "javascript-and-native-content",
54
47
  "react-native-convention",
@@ -57,12 +50,10 @@ export const appleApplicationProjectionResultSchema = z.strictObject({
57
50
  ]),
58
51
  })),
59
52
  coverage: z.strictObject({
60
- status: z.enum(["complete-within-inventory", "partial", "truncated"]),
53
+ status: z.enum(["complete-within-inventory", "partial"]),
61
54
  inventory_complete: z.boolean(),
62
- omitted_components: z.number().int().min(0),
63
- omitted_bridge_candidates: z.number().int().min(0),
64
55
  }),
65
- limitations: z.array(z.string().min(1).max(4_096)).max(100),
56
+ limitations: z.array(z.string().min(1)),
66
57
  });
67
58
  /** Project exact IPA paths and hashes without parsing or executing target code. */
68
59
  export const projectAppleApplication = (input) => {
@@ -91,34 +82,27 @@ export const projectAppleApplication = (input) => {
91
82
  })),
92
83
  ].sort(compare);
93
84
  const classified = classifyComponents(all, roots);
94
- const retained = retainComponents(classified, parsed.limits.max_components);
95
- const omitted = componentCount(classified) - componentCount(retained);
96
85
  const runtimeFamilies = identifyRuntimeFamilies(all);
97
- const bridgeProjection = identifyBridgeCandidates(retained.javascript, deduplicateComponents([
98
- ...retained.executables,
99
- ...retained.native_libraries,
100
- ]), parsed.limits.max_components);
101
- const limitations = projectionLimitations(inventory.complete, omitted, bridgeProjection.omitted, roots);
86
+ const bridgeProjection = identifyBridgeCandidates(classified.javascript, deduplicateComponents([
87
+ ...classified.executables,
88
+ ...classified.native_libraries,
89
+ ]));
90
+ const limitations = projectionLimitations(inventory.complete, roots);
102
91
  const withoutId = {
103
- schema_version: 1,
104
92
  root_sha256: inventory.manifest.root_sha256,
105
93
  root_format: "ipa",
106
94
  source_evidence_ids: evidence
107
95
  .map(({ evidence_id: id }) => id)
108
96
  .sort(compare),
109
97
  application_roots: roots,
110
- components: retained,
98
+ components: classified,
111
99
  runtime_families: runtimeFamilies,
112
100
  bridge_candidates: bridgeProjection.candidates,
113
101
  coverage: {
114
- status: omitted > 0 || bridgeProjection.omitted > 0
115
- ? "truncated"
116
- : inventory.complete
117
- ? "complete-within-inventory"
118
- : "partial",
102
+ status: inventory.complete
103
+ ? "complete-within-inventory"
104
+ : "partial",
119
105
  inventory_complete: inventory.complete,
120
- omitted_components: omitted,
121
- omitted_bridge_candidates: bridgeProjection.omitted,
122
106
  },
123
107
  limitations,
124
108
  };
@@ -138,19 +122,6 @@ const classifyComponents = (all, roots) => {
138
122
  signing: all.filter(({ path }) => /(?:^|\/)(?:embedded\.mobileprovision|_CodeSignature\/CodeResources)$/u.test(path)),
139
123
  };
140
124
  };
141
- const retainComponents = (groups, maximum) => {
142
- let remaining = maximum;
143
- // SAFETY: the projection preserves every key from Groups and replaces only
144
- // each readonly Component array with a bounded mutable Component array.
145
- return Object.fromEntries(Object.entries(groups).map(([key, values]) => {
146
- const retained = [...values]
147
- .sort((left, right) => compare(left.path, right.path))
148
- .slice(0, remaining);
149
- remaining -= retained.length;
150
- return [key, retained];
151
- }));
152
- };
153
- const componentCount = (groups) => Object.values(groups).reduce((total, values) => total + values.length, 0);
154
125
  const deduplicateComponents = (values) => [...new Map(values.map((value) => [value.path, value])).values()].sort((left, right) => compare(left.path, right.path));
155
126
  const identifyRuntimeFamilies = (all) => {
156
127
  const paths = all.map(({ path }) => path.toLowerCase());
@@ -171,17 +142,13 @@ const identifyRuntimeFamilies = (all) => {
171
142
  families.add("unity");
172
143
  return [...families].sort(compare);
173
144
  };
174
- const identifyBridgeCandidates = (scripts, native, maximum) => {
175
- const projection = projectBoundedCartesian(scripts, native, maximum, (script, item) => ({
145
+ const identifyBridgeCandidates = (scripts, native) => ({
146
+ candidates: scripts.flatMap((script) => native.map((item) => ({
176
147
  source_path: script.path,
177
148
  native_path: item.path,
178
149
  basis: bridgeBasis(item.path),
179
- }));
180
- return {
181
- candidates: projection.values,
182
- omitted: projection.omitted,
183
- };
184
- };
150
+ }))),
151
+ });
185
152
  const bridgeBasis = (path) => {
186
153
  const lower = path.toLowerCase();
187
154
  if (lower.includes("react"))
@@ -192,20 +159,10 @@ const bridgeBasis = (path) => {
192
159
  return "unity-convention";
193
160
  return "javascript-and-native-content";
194
161
  };
195
- const projectionLimitations = (complete, omitted, omittedBridges, roots) => [
162
+ const projectionLimitations = (complete, roots) => [
196
163
  ...(!complete
197
164
  ? ["Source inventory pages are incomplete; absence is unknown."]
198
165
  : []),
199
- ...(omitted > 0
200
- ? [
201
- `${String(omitted)} component observations were omitted by the projection limit.`,
202
- ]
203
- : []),
204
- ...(omittedBridges > 0
205
- ? [
206
- `${String(omittedBridges)} bridge hypotheses were omitted by the projection limit.`,
207
- ]
208
- : []),
209
166
  ...(roots.length === 0
210
167
  ? [
211
168
  "No Payload/*.app directory was present in the supplied inventory pages.",
@@ -1,6 +1,7 @@
1
1
  import canonicalize from "canonicalize";
2
2
  import { z } from "zod";
3
3
  import {} from "./artifactGraph.js";
4
+ import { evidenceSchema } from "./evidence.js";
4
5
  import { parseArtifactInventoryEvidence, } from "./artifactInventoryEvidence.js";
5
6
  const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
6
7
  const comparisonStatusSchema = z.enum([
@@ -32,20 +33,14 @@ const comparisonDimensionSchema = z.enum([
32
33
  ]);
33
34
  /** Strict Evidence-backed input for deterministic artifact comparison. */
34
35
  export const artifactComparisonInputSchema = z.strictObject({
35
- left_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
36
- right_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
37
- offset: z.number().int().min(0).default(0),
38
- limit: z.number().int().min(1).max(500).default(100),
39
- unknown_registry_approved: z
40
- .literal(true)
41
- .optional()
42
- .describe("Explicit approval to record incomplete or differing evidence"),
36
+ left: evidenceSchema,
37
+ right: evidenceSchema,
43
38
  });
44
39
  /** One path-classified artifact change with citations to both observations. */
45
40
  const artifactChangeSchema = z.object({
46
41
  classification: changeKindSchema,
47
- logical_path: z.string().min(1).max(4_096),
48
- dimensions: z.array(comparisonDimensionSchema).min(1).max(8),
42
+ logical_path: z.string().min(1),
43
+ dimensions: z.array(comparisonDimensionSchema).min(1),
49
44
  left_occurrence_id: z
50
45
  .string()
51
46
  .regex(/^occ_[a-f0-9]{64}$/u)
@@ -62,9 +57,9 @@ const artifactChangeSchema = z.object({
62
57
  .string()
63
58
  .regex(/^art_[a-f0-9]{64}$/u)
64
59
  .nullable(),
65
- evidence_links: z.array(evidenceIdSchema).min(2).max(200),
60
+ evidence_links: z.array(evidenceIdSchema).min(2),
66
61
  });
67
- /** Bounded deterministic artifact comparison with an independently paged delta. */
62
+ /** Deterministic artifact comparison with every change returned inline. */
68
63
  export const artifactComparisonResultSchema = z.object({
69
64
  status: comparisonStatusSchema,
70
65
  left_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
@@ -77,17 +72,11 @@ export const artifactComparisonResultSchema = z.object({
77
72
  unknown: z.number().int().min(0),
78
73
  contradiction: z.number().int().min(0).default(0),
79
74
  }),
80
- changes: z.object({
81
- items: z.array(artifactChangeSchema).max(500),
82
- offset: z.number().int().min(0),
83
- limit: z.number().int().min(1).max(500),
84
- total: z.number().int().min(0),
85
- next_offset: z.number().int().min(0).nullable(),
86
- }),
75
+ changes: z.array(artifactChangeSchema),
87
76
  limitations: z.array(z.string()),
88
77
  });
89
- /** Compare complete inventory pages without treating missing evidence as equality. */
90
- export const compareArtifacts = (leftEvidence, rightEvidence, offset, limit) => {
78
+ /** Compare complete inventory evidence without treating missing evidence as equality. */
79
+ export const compareArtifacts = (leftEvidence, rightEvidence) => {
91
80
  const left = parseArtifactInventoryEvidence(leftEvidence);
92
81
  const right = parseArtifactInventoryEvidence(rightEvidence);
93
82
  const leftComplete = left.inventory.complete;
@@ -105,7 +94,6 @@ export const compareArtifacts = (leftEvidence, rightEvidence, offset, limit) =>
105
94
  ...right.evidence.map(({ evidence_id: id }) => id),
106
95
  ], leftCovered && rightCovered);
107
96
  const summary = summarize(left.inventory, right.inventory, changes, leftCovered && rightCovered);
108
- const page = changes.slice(offset, offset + limit);
109
97
  return artifactComparisonResultSchema.parse({
110
98
  status: !leftComplete || !rightComplete
111
99
  ? "truncated"
@@ -121,13 +109,7 @@ export const compareArtifacts = (leftEvidence, rightEvidence, offset, limit) =>
121
109
  left_manifest_id: left.inventory.manifest.manifest_id,
122
110
  right_manifest_id: right.inventory.manifest.manifest_id,
123
111
  summary,
124
- changes: {
125
- items: page,
126
- offset,
127
- limit,
128
- total: changes.length,
129
- next_offset: offset + page.length < changes.length ? offset + page.length : null,
130
- },
112
+ changes,
131
113
  limitations: [...new Set(limitations)].sort((a, b) => a.localeCompare(b)),
132
114
  });
133
115
  };
@@ -9,7 +9,6 @@ const contradictionIdSchema = z.string().regex(/^ic_[a-f0-9]{64}$/u);
9
9
  const boundedRelativePathSchema = z
10
10
  .string()
11
11
  .min(1)
12
- .max(4_096)
13
12
  .refine((path) => !path.startsWith("/") &&
14
13
  !path.includes("\\") &&
15
14
  path.split("/").every((part) => part !== "" && part !== ".."), "Expected a normalized relative POSIX path without traversal");
@@ -53,28 +52,19 @@ const artifactFormatSchema = z.enum([
53
52
  "file",
54
53
  "unknown",
55
54
  ]);
56
- /** Exact bounded policy applied while discovering or extracting artifacts. */
57
- const artifactTraversalLimitsSchema = z.object({
58
- max_entries: z.number().int().min(1).max(1_000_000),
59
- max_total_bytes: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
60
- max_entry_bytes: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
61
- max_compression_ratio: z.number().min(1).max(100_000),
62
- max_depth: z.number().int().min(0).max(100),
63
- max_path_bytes: z.number().int().min(1).max(65_535),
64
- });
65
55
  /** File byte interval for an artifact derived without writing it to disk. */
66
56
  const artifactByteRangeSchema = z.object({
67
57
  offset: z.number().int().min(0),
68
58
  length: z.number().int().min(0),
69
59
  });
70
- /** Bounded external command provenance, including observable side effects. */
60
+ /** External command provenance, including observable side effects. */
71
61
  const artifactCommandSchema = z.object({
72
62
  tool: z.string().min(1),
73
- arguments: z.array(z.string().max(4_096)).max(1_024),
63
+ arguments: z.array(z.string()),
74
64
  tool_version: z.string().nullable(),
75
65
  executable_sha256: sha256Schema.nullable(),
76
66
  exit_code: z.number().int().nullable(),
77
- effects: z.array(z.enum(["read", "write", "mount"])).max(3),
67
+ effects: z.array(z.enum(["read", "write", "mount"])),
78
68
  });
79
69
  /** One content-addressed application artifact in deterministic manifest order. */
80
70
  const artifactNodeSchema = z.object({
@@ -110,12 +100,7 @@ const artifactOccurrenceSchema = z.object({
110
100
  .nullable(),
111
101
  executable: z.boolean(),
112
102
  encrypted: z.boolean(),
113
- hash_status: z.enum([
114
- "verified",
115
- "mismatched",
116
- "not-hashed-limit",
117
- "unavailable",
118
- ]),
103
+ hash_status: z.enum(["verified", "mismatched", "not-hashed", "unavailable"]),
119
104
  source_location: artifactByteRangeSchema.nullable(),
120
105
  limitations: z.array(z.string()),
121
106
  });
@@ -154,7 +139,6 @@ const artifactEdgeSchema = z.object({
154
139
  });
155
140
  /** Stable cryptographic commitment and counts for a complete artifact graph. */
156
141
  const artifactGraphManifestSchema = z.object({
157
- schema_version: z.literal(1),
158
142
  manifest_id: manifestIdSchema,
159
143
  root_artifact_id: artifactIdSchema,
160
144
  root_sha256: sha256Schema,
@@ -164,26 +148,14 @@ const artifactGraphManifestSchema = z.object({
164
148
  occurrence_count: z.number().int().min(1),
165
149
  edge_count: z.number().int().min(0),
166
150
  });
167
- /** Independently bounded offset page used for deterministic graph traversal. */
168
- const artifactPageSchema = (item) => z.object({
169
- items: z.array(item).max(500),
170
- offset: z.number().int().min(0),
171
- limit: z.number().int().min(1).max(500),
172
- total: z.number().int().min(0),
173
- next_offset: z.number().int().min(0).nullable(),
174
- });
175
- /** Inventory observation containing stable manifest identity and bounded pages. */
151
+ /** Complete inventory observation containing the stable artifact graph. */
176
152
  export const artifactInventoryResultSchema = z.object({
177
153
  manifest: artifactGraphManifestSchema,
178
- nodes: artifactPageSchema(artifactNodeSchema),
179
- occurrences: artifactPageSchema(artifactOccurrenceSchema),
180
- edges: artifactPageSchema(artifactEdgeSchema),
181
- limits: artifactTraversalLimitsSchema,
182
- provenance: z.array(artifactCommandSchema).max(256),
183
- integrity_contradictions: z
184
- .array(integrityContradictionSchema)
185
- .max(100)
186
- .default([]),
154
+ nodes: z.array(artifactNodeSchema),
155
+ occurrences: z.array(artifactOccurrenceSchema),
156
+ edges: z.array(artifactEdgeSchema),
157
+ provenance: z.array(artifactCommandSchema),
158
+ integrity_contradictions: z.array(integrityContradictionSchema).default([]),
187
159
  limitations: z.array(z.string()),
188
160
  });
189
161
  /** One safely materialized artifact beneath caller-approved output root. */
@@ -196,10 +168,9 @@ const extractedArtifactSchema = z.object({
196
168
  });
197
169
  /** Path-independent commitment to one selected extraction operation. */
198
170
  const artifactExtractionManifestSchema = z.object({
199
- schema_version: z.literal(1),
200
171
  extraction_id: extractionIdSchema,
201
172
  source_manifest_id: manifestIdSchema,
202
- selected_occurrence_ids: z.array(occurrenceIdSchema).min(1).max(500),
173
+ selected_occurrence_ids: z.array(occurrenceIdSchema).min(1),
203
174
  files_sha256: sha256Schema,
204
175
  output_root_alias: z.literal("$OUTPUT_ROOT"),
205
176
  });
@@ -208,14 +179,13 @@ export const artifactExtractionResultSchema = z.object({
208
179
  manifest: artifactGraphManifestSchema,
209
180
  extraction_manifest: artifactExtractionManifestSchema,
210
181
  output_root: z.string().min(1),
211
- artifacts: artifactPageSchema(extractedArtifactSchema),
182
+ artifacts: z.array(extractedArtifactSchema),
212
183
  containment_verified: z.boolean(),
213
184
  cleanup: z.object({
214
185
  attempted: z.boolean(),
215
186
  verified: z.boolean(),
216
- residual_paths: z.array(boundedRelativePathSchema).max(500),
187
+ residual_paths: z.array(boundedRelativePathSchema),
217
188
  }),
218
- limits: artifactTraversalLimitsSchema,
219
- provenance: z.array(artifactCommandSchema).max(256),
189
+ provenance: z.array(artifactCommandSchema),
220
190
  limitations: z.array(z.string()),
221
191
  });
@@ -4,22 +4,13 @@ import { z } from "zod";
4
4
  import { artifactInventoryResultSchema, } from "./artifactGraph.js";
5
5
  import { evidenceSchema, parseEvidence } from "./evidence.js";
6
6
  import { jsonValueSchema } from "./jsonValue.js";
7
- const boundedTextSchema = z.string().min(1).max(4_096);
7
+ const textSchema = z.string().min(1);
8
8
  const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
9
9
  const artifactIdSchema = z.string().regex(/^art_[a-f0-9]{64}$/u);
10
- const inspectionLimitsSchema = z.strictObject({
11
- max_observations: z.number().int().min(1).max(500).default(100),
12
- max_relationships: z.number().int().min(1).max(500).default(100),
13
- max_hypotheses: z.number().int().min(1).max(100).default(20),
14
- max_unexplored_branches: z.number().int().min(1).max(100).default(20),
15
- max_next_probes: z.number().int().min(1).max(50).default(20),
16
- max_substeps: z.literal(1).default(1),
17
- });
18
- export const artifactInspectionLimitsSchema = inspectionLimitsSchema;
19
10
  const inspectionObservationSchema = z.strictObject({
20
11
  observation_id: z.string().regex(/^aio_[a-f0-9]{64}$/u),
21
12
  kind: z.enum(["root-manifest", "artifact", "occurrence", "integrity"]),
22
- subject: boundedTextSchema,
13
+ subject: textSchema,
23
14
  value: jsonValueSchema,
24
15
  evidence_id: evidenceIdSchema,
25
16
  });
@@ -37,27 +28,27 @@ const inspectionRelationshipSchema = z.strictObject({
37
28
  source_artifact_id: artifactIdSchema,
38
29
  target_artifact_id: artifactIdSchema,
39
30
  occurrence_id: z.string().regex(/^occ_[a-f0-9]{64}$/u),
40
- logical_path: boundedTextSchema.nullable(),
31
+ logical_path: textSchema.nullable(),
41
32
  evidence_id: evidenceIdSchema,
42
33
  });
43
34
  const inspectionHypothesisSchema = z.strictObject({
44
35
  hypothesis_id: z.string().regex(/^aih_[a-f0-9]{64}$/u),
45
- statement: boundedTextSchema,
36
+ statement: textSchema,
46
37
  confidence: z.enum(["medium", "low"]),
47
- basis_evidence_ids: z.array(evidenceIdSchema).min(1).max(8),
48
- limitation: boundedTextSchema,
38
+ basis_evidence_ids: z.array(evidenceIdSchema).min(1),
39
+ limitation: textSchema,
49
40
  });
50
41
  const inspectionContradictionSchema = z.strictObject({
51
42
  contradiction_id: z.string().regex(/^aic_[a-f0-9]{64}$/u),
52
- statement: boundedTextSchema,
43
+ statement: textSchema,
53
44
  occurrence_id: z.string().regex(/^occ_[a-f0-9]{64}$/u),
54
45
  declared_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
55
46
  observed_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
56
47
  evidence_id: evidenceIdSchema,
57
48
  });
58
49
  const nextProbeSchema = z.strictObject({
59
- operation: z.string().min(1).max(128),
60
- rationale: boundedTextSchema,
50
+ operation: textSchema,
51
+ rationale: textSchema,
61
52
  authority: z.enum([
62
53
  "artifact-bytes",
63
54
  "managed-static-analysis",
@@ -67,24 +58,19 @@ const nextProbeSchema = z.strictObject({
67
58
  });
68
59
  const unexploredBranchSchema = z.strictObject({
69
60
  branch_id: z.string().regex(/^aib_[a-f0-9]{64}$/u),
70
- reason: z.enum([
71
- "page-limit",
72
- "format-specific-analysis-required",
73
- "unknown-format",
74
- ]),
75
- detail: boundedTextSchema,
61
+ reason: z.enum(["format-specific-analysis-required", "unknown-format"]),
62
+ detail: textSchema,
76
63
  next_probe: nextProbeSchema.nullable(),
77
64
  evidence_id: evidenceIdSchema,
78
65
  });
79
66
  /** Provider-neutral inspection result with its atomic source Evidence. */
80
67
  export const artifactInspectionResultSchema = z.strictObject({
81
- schema_version: z.literal(1),
82
68
  inspection_id: z.string().regex(/^ai_[a-f0-9]{64}$/u),
83
69
  subject: z.strictObject({
84
70
  manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
85
71
  root_artifact_id: artifactIdSchema,
86
72
  root_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
87
- root_format: z.string().min(1).max(128),
73
+ root_format: textSchema,
88
74
  }),
89
75
  substeps: z
90
76
  .array(z.strictObject({
@@ -94,14 +80,13 @@ export const artifactInspectionResultSchema = z.strictObject({
94
80
  evidence_id: evidenceIdSchema,
95
81
  evidence: evidenceSchema,
96
82
  }))
97
- .min(1)
98
- .max(1),
99
- observations: z.array(inspectionObservationSchema).max(500),
100
- derived_relationships: z.array(inspectionRelationshipSchema).max(500),
101
- hypotheses: z.array(inspectionHypothesisSchema).max(100),
102
- contradictions: z.array(inspectionContradictionSchema).max(100),
103
- unexplored_branches: z.array(unexploredBranchSchema).max(100),
104
- next_probes: z.array(nextProbeSchema).max(50),
83
+ .min(1),
84
+ observations: z.array(inspectionObservationSchema),
85
+ derived_relationships: z.array(inspectionRelationshipSchema),
86
+ hypotheses: z.array(inspectionHypothesisSchema),
87
+ contradictions: z.array(inspectionContradictionSchema),
88
+ unexplored_branches: z.array(unexploredBranchSchema),
89
+ next_probes: z.array(nextProbeSchema),
105
90
  coverage: z.strictObject({
106
91
  status: z.enum(["complete-within-substeps", "partial", "truncated"]),
107
92
  substeps_completed: z.literal(1),
@@ -116,11 +101,11 @@ export const artifactInspectionResultSchema = z.strictObject({
116
101
  next_probes_retained: z.number().int().min(0),
117
102
  next_probes_omitted: z.number().int().min(0),
118
103
  }),
119
- evidence_links: z.array(evidenceIdSchema).min(1).max(1),
120
- limitations: z.array(boundedTextSchema).max(1_000),
104
+ evidence_links: z.array(evidenceIdSchema).min(1),
105
+ limitations: z.array(textSchema),
121
106
  });
122
107
  /** Project one successful inventory Evidence record into an inspection report. */
123
- export const createArtifactInspection = (inventoryInput, limits) => {
108
+ export const createArtifactInspection = (inventoryInput) => {
124
109
  const inventoryEvidence = parseInventoryEvidence(inventoryInput);
125
110
  const inventory = artifactInventoryResultSchema.parse(inventoryEvidence.normalized_result);
126
111
  const observations = allObservations(inventory, inventoryEvidence.evidence_id);
@@ -129,21 +114,20 @@ export const createArtifactInspection = (inventoryInput, limits) => {
129
114
  const nextProbes = probesFor(inventory);
130
115
  const branches = allUnexploredBranches(inventory, inventoryEvidence.evidence_id, nextProbes);
131
116
  const retained = {
132
- observations: observations.slice(0, limits.max_observations),
133
- relationships: relationships.slice(0, limits.max_relationships),
134
- hypotheses: hypotheses.slice(0, limits.max_hypotheses),
135
- branches: branches.slice(0, limits.max_unexplored_branches),
136
- probes: nextProbes.slice(0, limits.max_next_probes),
117
+ observations,
118
+ relationships,
119
+ hypotheses,
120
+ branches,
121
+ probes: nextProbes,
137
122
  };
138
123
  const omissions = {
139
- observations: observations.length - retained.observations.length,
140
- relationships: relationships.length - retained.relationships.length,
141
- hypotheses: hypotheses.length - retained.hypotheses.length,
142
- branches: branches.length - retained.branches.length,
143
- probes: nextProbes.length - retained.probes.length,
124
+ observations: 0,
125
+ relationships: 0,
126
+ hypotheses: 0,
127
+ branches: 0,
128
+ probes: 0,
144
129
  };
145
130
  const semantic = {
146
- schema_version: 1,
147
131
  subject: {
148
132
  manifest_id: inventory.manifest.manifest_id,
149
133
  root_artifact_id: inventory.manifest.root_artifact_id,
@@ -201,8 +185,8 @@ const parseInventoryEvidence = (input) => {
201
185
  };
202
186
  const allObservations = (inventory, evidenceId) => [
203
187
  observation("root-manifest", inventory.manifest.root_artifact_id, inventory.manifest, evidenceId),
204
- ...inventory.nodes.items.map((node) => observation("artifact", node.artifact_id, node, evidenceId)),
205
- ...inventory.occurrences.items.map((occurrence) => observation("occurrence", occurrence.occurrence_id, occurrence, evidenceId)),
188
+ ...inventory.nodes.map((node) => observation("artifact", node.artifact_id, node, evidenceId)),
189
+ ...inventory.occurrences.map((occurrence) => observation("occurrence", occurrence.occurrence_id, occurrence, evidenceId)),
206
190
  ...inventory.integrity_contradictions.map((value) => observation("integrity", value.contradiction_id, value, evidenceId)),
207
191
  ];
208
192
  const observation = (kind, subject, value, evidenceId) => {
@@ -214,7 +198,7 @@ const observation = (kind, subject, value, evidenceId) => {
214
198
  };
215
199
  return { observation_id: `aio_${digestCanonical(semantic)}`, ...semantic };
216
200
  };
217
- const allRelationships = (inventory, evidenceId) => inventory.edges.items.map((edge) => {
201
+ const allRelationships = (inventory, evidenceId) => inventory.edges.map((edge) => {
218
202
  const semantic = {
219
203
  relation: edge.relation,
220
204
  source_artifact_id: edge.parent_artifact_id,
@@ -303,16 +287,7 @@ const probesFor = (inventory) => {
303
287
  return [];
304
288
  };
305
289
  const allUnexploredBranches = (inventory, evidenceId, nextProbes) => {
306
- const pages = [
307
- ["nodes", inventory.nodes.next_offset],
308
- ["occurrences", inventory.occurrences.next_offset],
309
- ["relationships", inventory.edges.next_offset],
310
- ];
311
- const branches = pages.flatMap(([collection, nextOffset]) => nextOffset === null
312
- ? []
313
- : [
314
- branch("page-limit", `${collection} continue at offset ${String(nextOffset)}.`, null, evidenceId),
315
- ]);
290
+ const branches = [];
316
291
  branches.push(...nextProbes.map((probe) => branch("format-specific-analysis-required", `${probe.operation} was not run by provider-neutral artifact inspection.`, probe, evidenceId)));
317
292
  if (inventory.manifest.root_format === "unknown")
318
293
  branches.push(branch("unknown-format", "Artifact bytes did not match an admitted format classifier.", null, evidenceId));
@@ -327,16 +302,10 @@ const branch = (reason, detail, nextProbe, evidenceId) => {
327
302
  };
328
303
  return { branch_id: `aib_${digestCanonical(semantic)}`, ...semantic };
329
304
  };
330
- const inspectionCoverage = (inventory, omissions) => {
305
+ const inspectionCoverage = (_inventory, omissions) => {
331
306
  if (Object.values(omissions).some((count) => count > 0))
332
307
  return "truncated";
333
- return [
334
- inventory.nodes.next_offset,
335
- inventory.occurrences.next_offset,
336
- inventory.edges.next_offset,
337
- ].some((offset) => offset !== null)
338
- ? "partial"
339
- : "complete-within-substeps";
308
+ return "complete-within-substeps";
340
309
  };
341
310
  const digestCanonical = (value) => {
342
311
  const encoded = canonicalize(value);