rea-agents 3.2.1 → 4.0.0

package/dist/doctorRuntime.js

@@ -2,12 +2,9 @@ import { systemDoctorHost, } from "./application/Doctor.js";
 import { fileURLToPath } from "node:url";
 import { inspectSystemGhidraProvider } from "./ghidra/GhidraDoctor.js";
 import { selectLinuxPrivateDisplayStrategy } from "./hopper/LinuxPrivateDisplayProbe.js";
-import { parseConfig } from "./config.js";
-import { SystemJavaScriptReplayHost } from "./replay/SystemJavaScriptReplayHost.js";
 /** Compose provider diagnostics at the outer CLI adapter boundary. */
 export const createSystemDoctorHost = () => systemDoctorHost({
     providerInspections: async () => [await inspectSystemGhidraProvider()],
-    javascriptReplayCheck: inspectJavaScriptReplay,
     linuxDemoRuntimeCheck: inspectLinuxPrivateDisplay,
 });
 const HOPPER_DEMO_HELPER_PATH = fileURLToPath(new URL("../scripts/hopper-demo-x11.py", import.meta.url));
@@ -48,41 +45,3 @@ const inspectLinuxPrivateDisplay = async () => {
                 : "Inspect the private-display diagnostic, correct the reported local condition, and rerun rea doctor --provider hopper.",
     };
 };
-const inspectJavaScriptReplay = async () => {
-    const config = parseConfig(process.env);
-    if (!config.ok)
-        return {
-            name: "javascript-replay",
-            ok: false,
-            classification: "config_drift",
-            detail: config.error.message,
-            remediation: "Fix the reported REA_JAVASCRIPT_REPLAY_* configuration.",
-        };
-    if (config.value.javascriptReplayPolicy.status === "disabled")
-        return {
-            name: "javascript-replay",
-            ok: true,
-            classification: "healthy",
-            detail: "disabled by default; no extracted-module execution path is admitted",
-        };
-    try {
-        await new SystemJavaScriptReplayHost().probe(config.value.javascriptReplayPolicy);
-        return {
-            name: "javascript-replay",
-            ok: true,
-            classification: "healthy",
-            detail: "Linux namespace, seccomp, and delegated cgroup probes passed",
-        };
-    }
-    catch (cause) {
-        return {
-            name: "javascript-replay",
-            ok: false,
-            classification: process.platform === "linux"
-                ? "missing_dependency"
-                : "unsupported_host",
-            detail: cause instanceof Error ? cause.message : "sandbox probe failed",
-            remediation: "Install and configure compatible Bubblewrap and systemd user cgroup delegation, or disable controlled replay.",
-        };
-    }
-};

package/dist/domain/analysisErrorPresentation.js

@@ -1,4 +1,4 @@
-import { AnalysisInputError, ArtifactOperationError, BinaryTargetError, BrowserObservationError, ConfigurationError, EvidenceFileError, EvidenceIntegrityError, HopperRemoteError, HopperProcessError, HopperStartError, HopperTimeoutError, NoBinaryOpenError, PermissionRequiredError, ProviderSelectionError, ReplayPlanStaleError, UnknownRegistryError, } from "./errors.js";
+import { AnalysisInputError, ArtifactOperationError, BinaryTargetError, BrowserObservationError, ConfigurationError, EvidenceFileError, EvidenceIntegrityError, HopperRemoteError, HopperProcessError, HopperStartError, HopperTimeoutError, NoBinaryOpenError, ProviderSelectionError, UnknownRegistryError, } from "./errors.js";
 export const analysisErrorRemediationAction = (error) => {
     if (error instanceof HopperTimeoutError)
         return error.providerState === "busy"
@@ -16,25 +16,9 @@ export const analysisErrorRemediationAction = (error) => {
         return "Correct the listed arguments and retry.";
     if (error instanceof UnknownRegistryError && error.reason === "not-found")
         return "Check that the unknown_id belongs to this session, then retry.";
-    if (error instanceof ReplayPlanStaleError)
-        return "Review the rebuilt replay plan and explicitly approve its new digest.";
-    if (error instanceof PermissionRequiredError) {
-        switch (error.remediation) {
-            case "configure":
-                return "Add the exact missing scope beneath the administrator ceiling, then retry.";
-            case "elicit":
-                return "Approve the exact missing scope, then retry the operation.";
-            case "restart":
-                return "Add the exact missing scope to the administrator configuration, then restart the registered MCP server or client.";
-        }
-    }
     return analysisErrorUserMessage(error);
 };
 export const analysisErrorCategory = (error) => {
-    if (error instanceof ReplayPlanStaleError)
-        return "integrity_mismatch";
-    if (error instanceof PermissionRequiredError)
-        return "permission_required";
     if (error instanceof ProviderSelectionError &&
         error.reason === "provider_unavailable")
         return "unavailable";
@@ -44,7 +28,7 @@ export const analysisErrorCategory = (error) => {
         return browserErrorCategory(error.reason);
     if (error instanceof HopperRemoteError &&
         error.diagnosticType === "authorization")
-        return "permission_required";
+        return "unavailable";
     if (error instanceof HopperProcessError || error instanceof HopperStartError)
         return "unavailable";
     if (error instanceof ArtifactOperationError)
@@ -69,7 +53,7 @@ const artifactErrorCategory = (reason) => {
         return "truncated";
     if (reason === "cancelled")
         return "cancelled";
-    if (reason === "policy" || reason === "unavailable")
+    if (reason === "unavailable")
         return "unavailable";
     return "execution_failure";
 };
@@ -86,10 +70,6 @@ const STATIC_ERROR_CATEGORIES = {
     BinaryTargetError: "unavailable",
 };
 export const analysisErrorUserMessage = (error) => {
-    if (error instanceof ReplayPlanStaleError)
-        return "The controlled replay plan changed before execution. Refresh the current state and try again.";
-    if (error instanceof PermissionRequiredError)
-        return "This operation needs additional local permission. Review the requested scope and remediation.";
     if (error instanceof AnalysisInputError)
         return "Analysis input is invalid. Check the arguments and try again.";
     const hopperMessage = hopperErrorUserMessage(error);
@@ -184,10 +164,8 @@ const artifactMessage = (reason) => {
         return "Artifact is too large to process safely. Narrow the requested path or use a smaller artifact.";
     if (reason === "path")
         return "Artifact contains an unsafe or conflicting internal path. Inspect the reported path and correct the artifact before retrying.";
-    if (reason === "policy")
-        return "Artifact integrity continuation is disabled by policy. Configure REA_ARTIFACT_INTEGRITY_CONTINUE_ENABLED=true and retry only if continuing after mismatches is approved.";
     if (reason === "unavailable")
-        return "Artifact processing is unavailable for the current target or policy. Check artifact support and required approvals.";
+        return "Artifact processing is unavailable for the current target or host. Check artifact support and required tools.";
     if (reason === "format" || reason === "integrity")
         return "Artifact is invalid or has changed. Get a fresh copy and try again.";
     return "Artifact could not be read or written. Check file access and try again.";
@@ -225,8 +203,6 @@ const KNOWN_ERROR_TAGS = {
     ConfigurationError: true,
     NoBinaryOpenError: true,
     BinaryTargetError: true,
-    PermissionRequiredError: true,
-    ReplayPlanStaleError: true,
 };
 export const assertKnownAnalysisErrorTag = (tag) => {
     if (KNOWN_ERROR_TAGS[tag] !== true)

package/dist/domain/analysisErrorProjection.js

@@ -1,4 +1,4 @@
-import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisTimeoutError, ArtifactOperationError, BinaryTargetError, BrowserObservationError, EvidenceFileError, EvidenceReferenceError, HopperCancelledError, HopperProcessError, HopperRemoteError, HopperTimeoutError, PermissionRequiredError, ProviderAdapterError, ProviderSelectionError, ReplayPlanStaleError, UnknownRegistryError, } from "./errors.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisTimeoutError, ArtifactOperationError, BinaryTargetError, BrowserObservationError, EvidenceFileError, EvidenceReferenceError, HopperCancelledError, HopperProcessError, HopperRemoteError, HopperTimeoutError, ProviderAdapterError, ProviderSelectionError, UnknownRegistryError, } from "./errors.js";
 import { analysisErrorCategory, analysisErrorRemediationAction, analysisErrorUserMessage, assertKnownAnalysisErrorTag, } from "./analysisErrorPresentation.js";
 /** Project expected failures into exhaustive, secret-safe caller fields. */
 export const projectAnalysisError = (error) => {
@@ -12,11 +12,6 @@ export const projectAnalysisError = (error) => {
         retryable: RETRYABLE_CODES.has(code),
         remediation: {
             action: analysisErrorRemediationAction(error),
-            restart_required: error instanceof PermissionRequiredError &&
-                error.remediation === "restart",
-            ...(error instanceof PermissionRequiredError
-                ? { elicitation_supported: error.remediation === "elicit" }
-                : {}),
         },
         ...(details === undefined ? {} : { details }),
     };
@@ -24,10 +19,6 @@ export const projectAnalysisError = (error) => {
 const errorCode = (error) => {
     if (error.cleanupIncomplete)
         return "cleanup_incomplete";
-    if (error instanceof ReplayPlanStaleError)
-        return "plan_stale";
-    if (error instanceof PermissionRequiredError)
-        return "permission_required";
     if (error instanceof ProviderSelectionError)
         return error.reason === "provider_unavailable"
             ? "provider_unavailable"
@@ -81,8 +72,6 @@ const processCaptureCode = (error) => {
         return "cleanup_incomplete";
     if (error.userCategory === "cancelled")
         return "cancelled";
-    if (error.userCategory === "permission_required")
-        return "permission_required";
     return "process_capture_failed";
 };
 const STATIC_ERROR_CODES = {
@@ -109,10 +98,8 @@ const staticErrorCode = (tag) => {
         case "ArtifactOperationError":
         case "BrowserObservationError":
         case "EvidenceFileError":
-        case "PermissionRequiredError":
         case "ProcessCaptureError":
         case "ProviderSelectionError":
-        case "ReplayPlanStaleError":
         case "UnknownRegistryError":
             throw new TypeError(`Unhandled specialized analysis error: ${tag}`);
         default:
@@ -143,19 +130,6 @@ const requestErrorDetails = (error) => {
             expected: error.expected,
             actual: error.actual,
         };
-    if (error instanceof ReplayPlanStaleError)
-        return {
-            approved_plan_digest: error.approvedDigest,
-            actual_plan_digest: error.actualDigest,
-            application_code_admitted: false,
-        };
-    if (error instanceof PermissionRequiredError)
-        return {
-            capability: error.requested.capability,
-            requested: scopeDetails(error.requested),
-            missing: missingScopeDetails(error.missing),
-            ceiling: error.ceiling === null ? null : scopeDetails(error.ceiling),
-        };
     return undefined;
 };
 const artifactStateErrorDetails = (error) => {
@@ -208,8 +182,22 @@ const providerErrorDetails = (error) => {
                 ? {}
                 : { diagnostics: error.diagnostics }),
         };
-    if (error instanceof BrowserObservationError)
-        return { operation: error.operation, reason: error.reason };
+    if (error instanceof BrowserObservationError) {
+        const primaryReason = primaryBrowserFailureReason(error);
+        return {
+            operation: error.operation,
+            reason: error.reason,
+            ...(error.cleanupIncomplete
+                ? {
+                    cleanup: "incomplete",
+                    resources: [...error.cleanupResources],
+                    ...(primaryReason === undefined
+                        ? {}
+                        : { primary_reason: primaryReason }),
+                }
+                : {}),
+        };
+    }
     if (error instanceof HopperRemoteError)
         return {
             stage: "analysis",
@@ -233,6 +221,22 @@ const providerErrorDetails = (error) => {
         };
     return undefined;
 };
+const primaryBrowserFailureReason = (error) => {
+    if (!(error.cause instanceof AggregateError))
+        return undefined;
+    const primary = error.cause.errors[0];
+    if (primary instanceof BrowserObservationError)
+        return primary.reason;
+    if (primary instanceof AnalysisCancelledError)
+        return "cancelled";
+    if (primary instanceof AnalysisTimeoutError)
+        return "timeout";
+    if (typeof primary === "object" && primary !== null && "_tag" in primary)
+        return typeof primary._tag === "string"
+            ? primary._tag
+            : "execution_failure";
+    return "execution_failure";
+};
 const lifecycleErrorDetails = (error) => {
     if (error instanceof AnalysisCancelledError)
         return { operation: error.operation, cleanup: "complete" };
@@ -260,27 +264,6 @@ const lifecycleErrorDetails = (error) => {
         return { path: error.path };
     return undefined;
 };
-const scopeDetails = (scope) => ({
-    capability: scope.capability,
-    roots: [...scope.roots],
-    executables: [...scope.executables],
-    environment_names: [...scope.environment_names],
-    ...(scope.origins === undefined ? {} : { origins: [...scope.origins] }),
-    network: scope.network,
-    mount: scope.mount,
-});
-const missingScopeDetails = (scope) => ({
-    ...(scope.roots === undefined ? {} : { roots: [...scope.roots] }),
-    ...(scope.executables === undefined
-        ? {}
-        : { executables: [...scope.executables] }),
-    ...(scope.environment_names === undefined
-        ? {}
-        : { environment_names: [...scope.environment_names] }),
-    ...(scope.origins === undefined ? {} : { origins: [...scope.origins] }),
-    ...(scope.network === undefined ? {} : { network: scope.network }),
-    ...(scope.mount === undefined ? {} : { mount: scope.mount }),
-});
 const RETRYABLE_CODES = new Set([
     "invalid_request",
     "provider_timeout",

package/dist/domain/analysisProfile.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { jsonObjectSchema } from "./jsonValue.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
 /** Concrete provider identity committed by an analysis profile. */
 export const committedProviderSchema = z.object({
     id: z.string().min(1),

package/dist/domain/analysisSnapshot.js

@@ -5,13 +5,15 @@ import { analysisProfileSchema, analysisProfilesEqual, committedProviderSchema,
 import { evidenceBundleForTarget, evidenceBundleSchema, parseEvidenceBundle, } from "./evidenceBundle.js";
 import { evidenceLocationSchema, } from "./evidence.js";
 import { jsonObjectSchema, jsonValueSchema, } from "./jsonValue.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const architectureSchema = z.enum(["x86", "x86_64", "arm", "arm64"]);
 const formatSchema = z.enum([
     "analysis-database",
     "mach-o",
     "elf",
     "pe",
+    "dos-mz",
     "zip",
     "ipa",
     "apk",
@@ -62,7 +64,7 @@ const bindingSchema = z
         });
 });
 const entrySchema = z.object({
-    query_id: z.string().regex(/^query_[a-f0-9]{64}$/u),
+    query_id: prefixedDigestSchema("query"),
     operation: z.string().min(1),
     parameters: jsonObjectSchema,
     execution: z.object({
@@ -167,6 +169,8 @@ export const parseAnalysisSnapshot = (input) => {
     if (JSON.stringify(evidenceBundleForTarget(parsed.evidence_bundle, parsed.target.sha256)) !== JSON.stringify(parsed.evidence_bundle))
         throw new TypeError("Analysis snapshot evidence contains records for another target");
     const ids = new Set();
+    const boundEntries = [];
+    const index = createEvidenceIndex(parsed);
     for (const entry of parsed.entries) {
         if (entry.execution.provider.id !== parsed.binding.provider.id ||
             entry.execution.provider.name !== parsed.binding.provider.name ||
@@ -178,11 +182,81 @@ export const parseAnalysisSnapshot = (input) => {
         if (ids.has(entry.query_id))
             throw new TypeError("Analysis snapshot contains duplicate queries");
         ids.add(entry.query_id);
+        if (!entryHasMatchingEvidence(entry, parsed, index)) {
+            if (entryHasCorrespondingEvidence(entry, parsed, index))
+                throw new TypeError(`Analysis snapshot entry ${entry.operation} differs from its Evidence record`);
+            // Older snapshots may contain cache entries without profile-bound Evidence.
+            // Keep their Evidence bundle, but never replay those unbound values.
+            continue;
+        }
+        boundEntries.push(entry);
     }
     const sorted = [...parsed.entries].sort((left, right) => left.query_id.localeCompare(right.query_id));
     if (JSON.stringify(parsed.entries) !== JSON.stringify(sorted))
         throw new TypeError("Analysis snapshot entries are not canonical");
-    return parsed;
+    return { ...parsed, entries: boundEntries };
 };
+const createEvidenceIndex = (snapshot) => {
+    const matching = new Set();
+    const corresponding = new Set();
+    for (const evidence of snapshot.evidence_bundle.records) {
+        if (!isCorrespondingEvidence(evidence, snapshot))
+            continue;
+        const query = evidenceQueryKey(evidence);
+        corresponding.add(query);
+        matching.add(canonicalJson({
+            query,
+            normalized_result: evidence.normalized_result,
+            raw_result: evidence.raw_result,
+            limitations: evidence.limitations,
+            locations: evidence.locations,
+            subject: evidence.subject === null
+                ? null
+                : {
+                    local_path: evidence.subject.local_path,
+                    sha256: evidence.subject.digest.sha256,
+                    format: evidence.subject.format,
+                    architecture: evidence.subject.architecture,
+                },
+        }));
+    }
+    const result = { matching, corresponding };
+    return result;
+};
+const entryHasMatchingEvidence = (entry, snapshot, index) => index.matching.has(entryEvidenceKey(entry, snapshot.binding));
+const entryHasCorrespondingEvidence = (entry, snapshot, index) => index.corresponding.has(entryQueryKey(entry, snapshot.binding));
+const isCorrespondingEvidence = (evidence, snapshot) => evidence.predicate_type === "rea.analysis" &&
+    evidence.confidence === "observed" &&
+    evidence.authority === "shipped-artifact" &&
+    evidence.subject?.digest.sha256 === snapshot.target.sha256 &&
+    "analysis_profile" in evidence &&
+    analysisProfilesEqual(evidence.analysis_profile, snapshot.binding.analysis_profile);
+const evidenceQueryKey = (evidence) => canonicalJson({
+    operation: evidence.operation,
+    parameters: evidence.parameters,
+    provider: evidence.provider,
+    analysis_profile: "analysis_profile" in evidence ? evidence.analysis_profile : null,
+});
+const entryQueryKey = (entry, binding) => canonicalJson({
+    operation: entry.operation,
+    parameters: entry.parameters,
+    provider: entry.execution.provider,
+    analysis_profile: binding.analysis_profile,
+});
+const entryEvidenceKey = (entry, binding) => canonicalJson({
+    query: entryQueryKey(entry, binding),
+    normalized_result: entry.execution.result,
+    raw_result: entry.execution.raw_result,
+    limitations: entry.execution.limitations,
+    locations: entry.execution.locations,
+    subject: entry.execution.subject === null
+        ? null
+        : {
+            local_path: entry.execution.subject.path,
+            sha256: entry.execution.subject.sha256,
+            format: entry.execution.subject.format,
+            architecture: entry.execution.subject.architecture,
+        },
+});
 /** Serialize a validated snapshot with byte-stable canonical entry ordering. */
 export const serializeAnalysisSnapshot = (snapshot) => `${canonicalJson(parseAnalysisSnapshot(snapshot))}\n`;

package/dist/domain/androidApplication.js

@@ -3,12 +3,13 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
 import { evidenceSchema } from "./evidence.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const componentSchema = z.strictObject({
     path: pathSchema,
-    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    artifact_id: prefixedDigestSchema("art"),
     sha256: digestSchema,
     format: z.string().min(1),
 });
@@ -18,7 +19,7 @@ export const androidApplicationProjectionInputSchema = z.strictObject({
 });
 /** Deterministic, execution-free Android application inventory projection. */
 export const androidApplicationProjectionResultSchema = z.strictObject({
-    projection_id: z.string().regex(/^adp_[a-f0-9]{64}$/u),
+    projection_id: prefixedDigestSchema("adp"),
     root_sha256: digestSchema,
     root_format: z.literal("apk"),
     source_evidence_ids: z.array(evidenceIdSchema).min(1),

package/dist/domain/appleApplication.js

@@ -3,12 +3,13 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
 import { evidenceSchema } from "./evidence.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const componentSchema = z.strictObject({
     path: pathSchema,
-    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    artifact_id: prefixedDigestSchema("art"),
     sha256: digestSchema,
     format: z.string().min(1),
 });
@@ -18,7 +19,7 @@ export const appleApplicationProjectionInputSchema = z.strictObject({
 });
 /** Deterministic, execution-free Apple application inventory projection. */
 export const appleApplicationProjectionResultSchema = z.strictObject({
-    projection_id: z.string().regex(/^aap_[a-f0-9]{64}$/u),
+    projection_id: prefixedDigestSchema("aap"),
     root_sha256: digestSchema,
     root_format: z.literal("ipa"),
     source_evidence_ids: z.array(evidenceIdSchema).min(1),

package/dist/domain/appleAssetCatalog.js

@@ -0,0 +1,127 @@
+import { z } from "zod";
+import { jsonValueSchema } from "./jsonValue.js";
+import { AnalysisOutputError } from "./errors.js";
+/** Caller-controlled page bounds for compiled Apple asset metadata. */
+export const appleAssetCatalogInputSchema = z.strictObject({
+    offset: z.number().int().min(0).default(0),
+    limit: z.number().int().min(1).max(10_000).default(1_000),
+});
+const catalogSchema = z.strictObject({
+    path: z.string().min(1),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    record_count: z.number().int().nonnegative(),
+});
+const recordSchema = z.strictObject({
+    catalog_path: z.string().min(1),
+    catalog_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    index: z.number().int().nonnegative(),
+    kind: z.enum(["catalog", "rendition"]),
+    asset_name: z.string().nullable(),
+    rendition_name: z.string().nullable(),
+    metadata: z.record(z.string(), jsonValueSchema),
+});
+const resourceKeyMatchSchema = z.strictObject({
+    source_node_id: z.string().min(1),
+    source_path: z.string().min(1),
+    source_archive_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    field: z.string().min(1),
+    key: z.string().min(1),
+    status: z.enum(["matched", "ambiguous", "unmatched"]),
+    renditions: z.array(z.strictObject({
+        catalog_path: z.string().min(1),
+        catalog_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+        record_index: z.number().int().nonnegative(),
+        rendition_name: z.string().nullable(),
+    })),
+});
+/** Normalized result returned by asset catalog inspection. */
+export const appleAssetCatalogResultSchema = z.strictObject({
+    target_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    catalogs: z.array(catalogSchema),
+    total_records: z.number().int().nonnegative(),
+    offset: z.number().int().nonnegative(),
+    limit: z.number().int().positive(),
+    records: z.array(recordSchema),
+    resource_key_matches: z.array(resourceKeyMatchSchema),
+    next_offset: z.number().int().nonnegative().nullable(),
+    truncated: z.boolean(),
+    limitations: z.array(z.string()),
+});
+/** Parse assetutil JSON records without discarding format-specific metadata. */
+export const parseAppleAssetCatalogRecords = (value) => {
+    if (!Array.isArray(value))
+        throw new AnalysisOutputError("inspect_asset_catalog", "assetutil output must be a JSON array");
+    return value.map((record, index) => {
+        const parsed = z.record(z.string(), jsonValueSchema).safeParse(record);
+        if (!parsed.success)
+            throw new AnalysisOutputError("inspect_asset_catalog", `assetutil record ${index} is not a JSON object`, { cause: parsed.error });
+        return parsed.data;
+    });
+};
+/** Project catalog records and apply stable global pagination. */
+export const projectAppleAssetCatalogPage = (input) => {
+    const all = input.catalogs.flatMap((catalog) => catalog.records.map((metadata, index) => ({
+        catalog_path: catalog.path,
+        catalog_sha256: catalog.sha256,
+        index,
+        kind: typeof metadata.RenditionName === "string" ||
+            typeof metadata.Name === "string"
+            ? "rendition"
+            : "catalog",
+        asset_name: typeof metadata.Name === "string" ? metadata.Name : null,
+        rendition_name: typeof metadata.RenditionName === "string"
+            ? metadata.RenditionName
+            : null,
+        metadata,
+    })));
+    const records = all.slice(input.offset, input.offset + input.limit);
+    const next = input.offset + records.length;
+    const recordsByAssetName = new Map();
+    for (const record of all) {
+        if (record.kind !== "rendition" || record.asset_name === null)
+            continue;
+        const matches = recordsByAssetName.get(record.asset_name) ?? [];
+        matches.push(record);
+        recordsByAssetName.set(record.asset_name, matches);
+    }
+    const resourceKeyMatches = (input.resourceReferences ?? []).map((source) => {
+        const matches = recordsByAssetName.get(source.key) ?? [];
+        return {
+            source_node_id: source.sourceNodeId,
+            source_path: source.sourcePath,
+            source_archive_sha256: source.sourceArchiveSha256,
+            field: source.field,
+            key: source.key,
+            status: matches.length === 0
+                ? "unmatched"
+                : matches.length === 1
+                    ? "matched"
+                    : "ambiguous",
+            renditions: matches.map((record) => ({
+                catalog_path: record.catalog_path,
+                catalog_sha256: record.catalog_sha256,
+                record_index: record.index,
+                rendition_name: record.rendition_name,
+            })),
+        };
+    });
+    return appleAssetCatalogResultSchema.parse({
+        target_sha256: input.targetSha256,
+        catalogs: input.catalogs.map(({ path, sha256, records: catalogRecords }) => ({
+            path,
+            sha256,
+            record_count: catalogRecords.length,
+        })),
+        total_records: all.length,
+        offset: input.offset,
+        limit: input.limit,
+        records,
+        resource_key_matches: resourceKeyMatches,
+        next_offset: next < all.length ? next : null,
+        truncated: input.offset > 0 || next < all.length,
+        limitations: [
+            "Rendition metadata is reported as emitted by the installed assetutil version; private fields and platform-specific interpretations are not normalized.",
+            "Asset catalog inspection does not decode or extract rendition image bytes.",
+        ],
+    });
+};

package/dist/domain/artifactComparison.js

@@ -1,9 +1,10 @@
-import canonicalize from "canonicalize";
 import { z } from "zod";
 import {} from "./artifactGraph.js";
 import { evidenceSchema } from "./evidence.js";
 import { parseArtifactInventoryEvidence, } from "./artifactInventoryEvidence.js";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+import { canonicalJson } from "./comparisonSemantics.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const comparisonStatusSchema = z.enum([
     "unchanged",
     "added",
@@ -62,8 +63,8 @@ const artifactChangeSchema = z.object({
 /** Deterministic artifact comparison with every change returned inline. */
 export const artifactComparisonResultSchema = z.object({
     status: comparisonStatusSchema,
-    left_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
-    right_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
+    left_manifest_id: prefixedDigestSchema("agm"),
+    right_manifest_id: prefixedDigestSchema("agm"),
     summary: z.object({
         unchanged: z.number().int().min(0),
         added: z.number().int().min(0),
@@ -234,12 +235,6 @@ const metadataChanged = (input, left, right) => left.media_type !== right.media_
     JSON.stringify(left.limitations) !== JSON.stringify(right.limitations) ||
     JSON.stringify(input.leftOccurrence?.limitations) !==
         JSON.stringify(input.rightOccurrence?.limitations);
-const canonicalJson = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Artifact comparison could not canonicalize graph data");
-    return encoded;
-};
 const nodeFor = (occurrence, nodes) => occurrence?.artifact_id === null || occurrence?.artifact_id === undefined
     ? undefined
     : nodes.get(occurrence.artifact_id);
@@ -282,7 +277,8 @@ const summarize = (left, right, changes, covered) => {
         counts[change.classification] += 1;
     return {
         unchanged: covered
-            ? Math.max(0, Math.min(left.occurrences.length, right.occurrences.length) -
+            ? Math.max(0, left.occurrences.length -
+                counts.removed -
                 counts.changed -
                 counts.contradiction -
                 counts.unknown)

package/dist/domain/artifactGraph.js

@@ -1,11 +1,12 @@
 import { z } from "zod";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const sha256Schema = z.string().regex(/^[a-f0-9]{64}$/u);
-const artifactIdSchema = z.string().regex(/^art_[a-f0-9]{64}$/u);
-const occurrenceIdSchema = z.string().regex(/^occ_[a-f0-9]{64}$/u);
-const edgeIdSchema = z.string().regex(/^edge_[a-f0-9]{64}$/u);
-const manifestIdSchema = z.string().regex(/^agm_[a-f0-9]{64}$/u);
-const extractionIdSchema = z.string().regex(/^aex_[a-f0-9]{64}$/u);
-const contradictionIdSchema = z.string().regex(/^ic_[a-f0-9]{64}$/u);
+const artifactIdSchema = prefixedDigestSchema("art");
+const occurrenceIdSchema = prefixedDigestSchema("occ");
+const edgeIdSchema = prefixedDigestSchema("edge");
+const manifestIdSchema = prefixedDigestSchema("agm");
+const extractionIdSchema = prefixedDigestSchema("aex");
+const contradictionIdSchema = prefixedDigestSchema("ic");
 const boundedRelativePathSchema = z
     .string()
     .min(1)
@@ -40,6 +41,7 @@ const artifactFormatSchema = z.enum([
     "mach-o",
     "elf",
     "pe",
+    "dos-mz",
     "hopper",
     "analysis-database",
     "ipa",