rea-agents 4.0.1 → 5.0.0

package/dist/android/JadxProvider.js

@@ -0,0 +1,259 @@
+import { z } from "zod";
+import { chmod, copyFile } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisOutputError, AnalysisInputError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { err, ok } from "../domain/result.js";
+import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
+import { snapshotAndroidEngine, hashAndroidFile, snapshotAndroidTarget, } from "./AndroidTargetSnapshot.js";
+import { resolveJadxConfiguration } from "./JadxConfiguration.js";
+import { JadxSession } from "./JadxSession.js";
+const OPERATION_TIMEOUT_MS = 120_000;
+const BRIDGE_SOURCE = fileURLToPath(new URL("../../bridge/android/ReaJadxBridge.java", import.meta.url));
+const waitForTurn = (predecessor, request, signal) => new Promise((resolve, reject) => {
+    const abort = () => reject(new AnalysisCancelledError(request.operation));
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted === true)
+        abort();
+    void predecessor.then(() => {
+        signal?.removeEventListener("abort", abort);
+        resolve();
+    });
+});
+const executionError = (context) => {
+    const { cause, request, timeout, signal, session } = context;
+    if (signal?.aborted === true)
+        return new AnalysisCancelledError(request.operation);
+    if (timeout.aborted)
+        return new AnalysisTimeoutError(request.operation, OPERATION_TIMEOUT_MS);
+    if (cause instanceof AnalysisError)
+        return cause;
+    const protocolFailure = session?.transport.failureReason();
+    if (protocolFailure !== undefined && protocolFailure !== null)
+        return new AnalysisOutputError(request.operation, protocolFailure, {
+            cause,
+        });
+    if (cause instanceof z.ZodError)
+        return new AnalysisOutputError(request.operation, "JADX response violated the pinned upstream protocol", { cause });
+    return new ProviderAdapterError("jadx", request.operation, {
+        cause,
+        diagnostics: {
+            reason: cause instanceof Error ? cause.message : String(cause),
+            stderr: session?.transport.diagnostics() ?? "",
+        },
+    });
+};
+const cleanup = async (session, root, previous) => {
+    const diagnostics = {
+        previous_error: previous.ok
+            ? null
+            : { tag: previous.error._tag, message: previous.error.message },
+    };
+    try {
+        await session?.close();
+    }
+    catch (cause) {
+        // Retain an uncertain workspace until the caller can resolve process ownership.
+        return err(new ProviderCleanupError("jadx", [
+            session?.transport.runId ?? "unknown",
+            ...(root === undefined ? [] : [root.path]),
+        ], {
+            ...diagnostics,
+            reason: cause instanceof Error ? cause.message : String(cause),
+            provider_cleanup: cause instanceof ProviderCleanupError
+                ? (cause.diagnostics ?? null)
+                : null,
+        }, { cause }));
+    }
+    try {
+        await root?.close();
+    }
+    catch (cause) {
+        return err(new ProviderCleanupError("jadx", [root?.path ?? "unknown"], {
+            ...diagnostics,
+            reason: cause instanceof Error ? cause.message : String(cause),
+        }, { cause }));
+    }
+    return previous;
+};
+/** One serialized, immutable APK session per REA instance, retired on idle or shutdown. */
+export class JadxProvider {
+    environment;
+    launcher;
+    #tail = Promise.resolve();
+    #cleanupFailure;
+    #retained;
+    #idle;
+    #shutdown = new AbortController();
+    #closePromise;
+    constructor(environment = process.env, launcher) {
+        this.environment = environment;
+        this.launcher = launcher;
+    }
+    /** Serialize expensive work and bind both raw and normalized results to the APK. */
+    async execute(target, request, options) {
+        if (this.#shutdown.signal.aborted)
+            return err(new AnalysisCancelledError(request.operation));
+        const signal = options?.signal === undefined
+            ? this.#shutdown.signal
+            : AbortSignal.any([options.signal, this.#shutdown.signal]);
+        const predecessor = this.#tail;
+        let release = () => { };
+        this.#tail = new Promise((resolve) => {
+            release = resolve;
+        });
+        try {
+            await waitForTurn(predecessor, request, signal);
+        }
+        catch {
+            void predecessor.then(release);
+            return err(new AnalysisCancelledError(request.operation));
+        }
+        try {
+            if (signal.aborted)
+                return err(new AnalysisCancelledError(request.operation));
+            if (this.#cleanupFailure !== undefined)
+                return err(this.#cleanupFailure);
+            clearTimeout(this.#idle);
+            const outcome = await this.#execute(target, request, { signal });
+            if (!outcome.ok && outcome.error.cleanupIncomplete)
+                this.#cleanupFailure = outcome.error;
+            if (outcome.ok)
+                this.#scheduleIdle();
+            return outcome;
+        }
+        finally {
+            release();
+        }
+    }
+    /** Cancel queued/active operations and join the owned engine and workspace cleanup. */
+    close() {
+        this.#shutdown.abort();
+        clearTimeout(this.#idle);
+        this.#closePromise ??= this.#tail.then(() => this.#retire());
+        return this.#closePromise;
+    }
+    async #retire() {
+        if (this.#cleanupFailure !== undefined)
+            throw this.#cleanupFailure;
+        const retained = this.#retained;
+        this.#retained = undefined;
+        const result = await cleanup(retained?.session, retained?.root, ok(undefined));
+        if (!result.ok) {
+            this.#cleanupFailure = result.error;
+            throw result.error;
+        }
+    }
+    #scheduleIdle() {
+        this.#idle = setTimeout(() => {
+            const retirement = this.#tail.then(() => this.#retire());
+            this.#tail = retirement.catch(() => undefined);
+        }, 60_000);
+        this.#idle.unref();
+    }
+    async #execute(target, request, options) {
+        const timeout = AbortSignal.timeout(OPERATION_TIMEOUT_MS);
+        const signal = options?.signal === undefined
+            ? timeout
+            : AbortSignal.any([options.signal, timeout]);
+        let root;
+        let session;
+        let outcome;
+        try {
+            if (target.format !== "apk")
+                throw new AnalysisCapabilityUnavailableError("jadx", request.operation, `Target ${target.path} is ${target.format}; provide one standalone APK.`);
+            const configuration = await resolveJadxConfiguration(this.environment, request.operation);
+            signal.throwIfAborted();
+            const jarHash = await hashAndroidFile(configuration.jar);
+            const bridgeHash = await hashAndroidFile(BRIDGE_SOURCE);
+            if ((await hashAndroidFile(target.path)) !== target.sha256)
+                throw new AnalysisInputError(request.operation, undefined, [
+                    {
+                        path: ["path"],
+                        reason: "invalid_value",
+                        message: "APK bytes changed after admission; retry against a stable file.",
+                    },
+                ]);
+            const key = JSON.stringify({
+                path: target.path,
+                sha256: target.sha256,
+                jar: configuration.jar,
+                jarHash,
+                bridgeHash,
+                java: configuration.java,
+                arguments: configuration.jvmArguments,
+                options: [
+                    this.environment.JAVA_TOOL_OPTIONS,
+                    this.environment._JAVA_OPTIONS,
+                    this.environment.JDK_JAVA_OPTIONS,
+                    this.environment.PATH,
+                    this.environment.JAVA_HOME,
+                ],
+            });
+            if (this.#retained !== undefined && this.#retained.key !== key)
+                await this.#retire();
+            let retained = this.#retained;
+            if (retained === undefined) {
+                root = await PrivateRuntimeRoot.create({ prefix: "rea-android-" });
+                const engine = await snapshotAndroidEngine(configuration.jar, jarHash, root.path, request.operation);
+                const snapshot = await snapshotAndroidTarget(target.path, target.sha256, root.path, request.operation);
+                const bridge = join(root.path, "ReaJadxBridge.java");
+                await copyFile(BRIDGE_SOURCE, bridge);
+                await chmod(bridge, 0o400);
+                if ((await hashAndroidFile(bridge)) !== bridgeHash)
+                    throw new AnalysisCapabilityUnavailableError("jadx", request.operation, "REA Android bridge bytes changed during admission; retry with a stable installation.");
+                signal.throwIfAborted();
+                session = new JadxSession({
+                    command: configuration.java,
+                    arguments: [
+                        ...configuration.jvmArguments,
+                        "--class-path",
+                        engine.path,
+                        bridge,
+                    ],
+                    cwd: root.path,
+                    hostEnvironment: this.environment,
+                }, this.launcher);
+                retained = {
+                    key,
+                    root,
+                    session,
+                    snapshot,
+                    jarHash: engine.sha256,
+                    bridgeHash,
+                };
+            }
+            root = retained.root;
+            session = retained.session;
+            const { snapshot } = retained;
+            outcome = ok(await session.execute({
+                request,
+                target,
+                snapshot,
+                jarHash: retained.jarHash,
+                bridgeHash: retained.bridgeHash,
+                signal,
+            }));
+            signal.throwIfAborted();
+            this.#retained = retained;
+            return outcome;
+        }
+        catch (cause) {
+            outcome = err(executionError({
+                cause,
+                request,
+                timeout,
+                signal: options?.signal,
+                session,
+            }));
+        }
+        // An existing session also needs retirement when admission fails before selection.
+        root ??= this.#retained?.root;
+        session ??= this.#retained?.session;
+        this.#retained = undefined;
+        return cleanup(session, root, outcome);
+    }
+}

package/dist/android/JadxRelease.js

@@ -0,0 +1,27 @@
+/** Audited upstream release; source remains unmodified in the Git submodule. */
+export const JADX_RELEASE = Object.freeze({
+    version: "0.7.1",
+    revision: "5844800a486d2248fa949b74c9896285f5b54de2",
+    sha256: "6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75",
+    url: "https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar",
+});
+/** Identity of REA's metadata bridge, distinct from the producing engine. */
+export const JADX_BRIDGE_IDENTITY = Object.freeze({
+    name: "rea-jadx-bridge",
+    version: "1",
+});
+/** Remediation when `REA_JADX_MCP_JAR` is missing or not an absolute path. */
+export const JADX_JAR_CONFIGURATION_REMEDIATION = `Set REA_JADX_MCP_JAR to the absolute path of a caller-supplied jadx-headless-mcp ${JADX_RELEASE.version} JAR. REA does not download or install it.`;
+/** Producing engine identity used by Evidence and the generated product catalog. */
+export const JADX_PROVIDER_IDENTITY = Object.freeze({
+    id: "jadx",
+    name: "JADX headless",
+    version: JADX_RELEASE.version,
+});
+/** Audited engine coverage, kept outside portable Android semantics. */
+export const JADX_LIMITATIONS = [
+    "Static decompiler observations do not establish runtime behavior; the APK is never executed.",
+    "Method signatures use provider display types; exact DEX descriptors and instruction offsets are unavailable. Overload indices are local to this engine and artifact.",
+    "Class inventories use parsed metadata before code generation, including synthetic members that may be omitted from decompiled source. Source positions remain unknown.",
+    "Manifest summary fields are extracted by the upstream engine; decoded XML is retained for verification. APK signatures, split APKs, native libraries and Android runtime capture are not verified by this provider.",
+];

package/dist/android/JadxSession.js

@@ -0,0 +1,111 @@
+import { Client } from "@modelcontextprotocol/client";
+import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
+import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { analyzeJadxRequest } from "./JadxAnalysis.js";
+import { JadxMcpTransport } from "./JadxMcpTransport.js";
+import { jadxLoadSchema, jadxRuntimeSchema, parseJadxEnvelope, parseJadxJson, } from "./JadxProtocol.js";
+import { JADX_BRIDGE_IDENTITY, JADX_RELEASE, JADX_PROVIDER_IDENTITY, JADX_LIMITATIONS, } from "./JadxRelease.js";
+/** One owned engine connection; its wire protocol stays inside the Android adapter. */
+export class JadxSession {
+    transport;
+    #client = new Client({ name: "rea-android-adapter", version: "1" });
+    #loaded;
+    constructor(options, launcher) {
+        this.transport = new JadxMcpTransport(options, launcher);
+    }
+    /** Analyze one admitted immutable APK, checking producer identity and selectors. */
+    async execute(context) {
+        const { request, target, snapshot, jarHash, signal } = context;
+        const abort = () => {
+            void this.transport.close().catch(() => undefined);
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        try {
+            signal.throwIfAborted();
+            this.transport.beginOperation();
+            const raw = [];
+            if (this.#loaded === undefined)
+                await this.#client.connect(this.transport, { timeout: 30_000 });
+            const server = this.#client.getServerVersion();
+            if (server?.name !== JADX_BRIDGE_IDENTITY.name ||
+                server.version !== JADX_BRIDGE_IDENTITY.version)
+                throw new AnalysisCapabilityUnavailableError("jadx", request.operation, `Expected ${JADX_BRIDGE_IDENTITY.name} ${JADX_BRIDGE_IDENTITY.version}; server reported ${server?.name ?? "unknown"} ${server?.version ?? "unknown"}.`);
+            const tools = this.#tools(request, target, signal, raw);
+            const runtime = jadxRuntimeSchema.parse(await tools.json("rea_jvm_status", {}));
+            if (runtime.engine_reported_version !== JADX_RELEASE.version)
+                throw new AnalysisCapabilityUnavailableError("jadx", request.operation, `Expected engine ${JADX_RELEASE.version}; JAR reported ${runtime.engine_reported_version}.`);
+            const loaded = this.#loaded ??
+                jadxLoadSchema.parse(await tools.json("load_apk", {
+                    path: snapshot,
+                    threads: 1,
+                    resources: "full",
+                }));
+            if (loaded.apk_path !== snapshot)
+                throw new AnalysisOutputError(request.operation, "JADX loaded a different APK path than the admitted snapshot");
+            this.#loaded = loaded;
+            const engine = {
+                name: "jadx-headless-mcp",
+                version: runtime.engine_reported_version,
+                artifact_sha256: jarHash,
+                source_revision: jarHash === JADX_RELEASE.sha256 ? JADX_RELEASE.revision : null,
+                worker_count: 1,
+                heap_limit_mib: Math.floor(runtime.max_heap_bytes / (1024 * 1024)) || null,
+            };
+            const result = await analyzeJadxRequest(tools, request, loaded, engine);
+            return createAnalysisExecution(result, JADX_PROVIDER_IDENTITY, {
+                rawResult: {
+                    server,
+                    bridge_sha256: context.bridgeHash,
+                    jar_sha256: jarHash,
+                    loaded,
+                    calls: raw,
+                },
+                subject: target,
+                limitations: JADX_LIMITATIONS,
+                locations: request.operation === "inspect_android_package"
+                    ? [{ kind: "artifact-path", path: "AndroidManifest.xml" }]
+                    : [],
+            });
+        }
+        finally {
+            signal.removeEventListener("abort", abort);
+        }
+    }
+    /** Join owned cleanup even if SDK connection teardown itself fails. */
+    async close() {
+        try {
+            await this.#client.close();
+        }
+        finally {
+            await this.transport.close();
+        }
+    }
+    #tools(request, target, signal, raw) {
+        const call = async (name, input) => {
+            signal.throwIfAborted();
+            const response = await this.#client.callTool({ name, arguments: input }, { timeout: 120_000, signal });
+            const envelope = parseJadxEnvelope(response, request.operation);
+            raw.push({
+                operation: name,
+                input,
+                response: jsonValueSchema.parse(response),
+            });
+            if (envelope.failed)
+                throw new ProviderAdapterError("jadx", request.operation, {
+                    diagnostics: {
+                        upstream_operation: name,
+                        reason: envelope.text,
+                        target_path: target.path,
+                        target_sha256: target.sha256,
+                    },
+                });
+            return envelope.text;
+        };
+        return {
+            text: call,
+            json: async (name, input) => parseJadxJson(await call(name, input), request.operation),
+        };
+    }
+}

package/dist/application/AnalysisContextQueries.js

@@ -1,4 +1,5 @@
-import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import {} from "../domain/analysisErrorBase.js";
 import { parseDocuments } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 const parameters = (document, address) => ({

package/dist/application/AppBundleExecutable.js

@@ -0,0 +1,141 @@
+import { execFile } from "node:child_process";
+import { lstat, readdir, readFile, realpath, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { BinaryTargetError } from "../domain/configurationErrors.js";
+import { isPathWithinRoot } from "../domain/localPath.js";
+import { parseXmlPropertyList } from "../domain/propertyListKeys.js";
+import { err, ok } from "../domain/result.js";
+const execFileAsync = promisify(execFile);
+const BUNDLE_LAYOUTS = [
+    // macOS bundles keep both under Contents.
+    {
+        plist: ["Contents", "Info.plist"],
+        programs: ["Contents", "MacOS"],
+        programsLabel: "Contents/MacOS",
+    },
+    // iOS-style bundles, as extracted from an IPA, keep both at the root.
+    { plist: ["Info.plist"], programs: [], programsLabel: "the bundle root" },
+];
+/**
+ * Resolve an app bundle directory to its declared program file. macOS and
+ * flat iOS-style layouts are read directly. An iOS app installed on a Mac is
+ * a wrapper whose `Wrapper` directory holds the iOS bundle; that bundle is
+ * found by listing `Wrapper`, never by following the `WrappedBundle` link.
+ */
+export const resolveAppBundleExecutable = async (path) => {
+    const layout = await presentLayout(path);
+    if (layout !== undefined)
+        return resolveLayoutExecutable(path, layout);
+    const wrapped = await wrappedBundle(path);
+    if (wrapped !== undefined) {
+        const wrappedLayout = await presentLayout(wrapped);
+        if (wrappedLayout !== undefined)
+            return resolveLayoutExecutable(wrapped, wrappedLayout);
+    }
+    return err(new BinaryTargetError(path, "app has no readable CFBundleExecutable", {
+        cause: new Error("No Contents/Info.plist, root Info.plist, or single Wrapper/*.app bundle was found"),
+    }));
+};
+const presentLayout = async (bundle) => {
+    for (const layout of BUNDLE_LAYOUTS)
+        if (await layoutPlistPresent(join(bundle, ...layout.plist)))
+            return layout;
+    return undefined;
+};
+/**
+ * Whether a layout's Info.plist exists. Readable symlinks count, as they did
+ * when the plist was read directly; any failure other than absence, such as
+ * a permission denial, is left for the caller to report.
+ */
+const layoutPlistPresent = async (path) => {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch (cause) {
+        if (isAbsence(cause))
+            return false;
+        throw cause;
+    }
+};
+const isAbsence = (cause) => {
+    const code = cause instanceof Error ? Reflect.get(cause, "code") : undefined;
+    return code === "ENOENT" || code === "ENOTDIR";
+};
+/** The single real `.app` directory inside an iOS-on-Mac `Wrapper`. */
+const wrappedBundle = async (bundle) => {
+    const wrapper = join(bundle, "Wrapper");
+    try {
+        if (!(await lstat(wrapper)).isDirectory())
+            return undefined;
+    }
+    catch (cause) {
+        if (isAbsence(cause))
+            return undefined;
+        throw cause;
+    }
+    const apps = (await readdir(wrapper, { withFileTypes: true })).filter((entry) => entry.isDirectory() && entry.name.toLowerCase().endsWith(".app"));
+    const [app] = apps;
+    return apps.length === 1 && app !== undefined
+        ? join(wrapper, app.name)
+        : undefined;
+};
+const resolveLayoutExecutable = async (bundle, layout) => {
+    const plistPath = join(bundle, ...layout.plist);
+    let name;
+    try {
+        const plist = await readFile(plistPath);
+        name =
+            plist.subarray(0, 6).toString("ascii") === "bplist"
+                ? await readBinaryPlistExecutable(plistPath)
+                : parseXmlPlistExecutable(plist.toString("utf8"));
+    }
+    catch (cause) {
+        return err(new BinaryTargetError(bundle, "app has no readable CFBundleExecutable", {
+            cause,
+        }));
+    }
+    if (!isSafeExecutableName(name))
+        return err(new BinaryTargetError(bundle, "app has an unsafe CFBundleExecutable"));
+    const programs = join(bundle, ...layout.programs);
+    const executable = join(programs, name);
+    try {
+        const [canonicalPrograms, canonicalExecutable] = await Promise.all([
+            realpath(programs),
+            realpath(executable),
+        ]);
+        if (!isPathWithinRoot(canonicalPrograms, canonicalExecutable))
+            return err(new BinaryTargetError(bundle, `app program file leaves ${layout.programsLabel}`));
+        return ok({ executable: canonicalExecutable, infoPlist: plistPath });
+    }
+    catch (cause) {
+        return err(new BinaryTargetError(bundle, "app program file is missing", { cause }));
+    }
+};
+/** Decode the top-level executable name with an XML parser, not a pattern. */
+const parseXmlPlistExecutable = (plist) => {
+    // An unrelated `__proto__` entry must not make the bundle unreadable.
+    const { value } = parseXmlPropertyList(plist);
+    const executable = executableEntrySchema.safeParse(value);
+    if (!executable.success)
+        throw new Error("CFBundleExecutable is missing");
+    return executable.data.CFBundleExecutable;
+};
+const executableEntrySchema = z.looseObject({ CFBundleExecutable: z.string() });
+const readBinaryPlistExecutable = async (plistPath) => 
+// `-n` strips only the newline plutil appends; it requires macOS 12+.
+(await execFileAsync("/usr/bin/plutil", [
+    "-extract",
+    "CFBundleExecutable",
+    "raw",
+    "-n",
+    "-o",
+    "-",
+    plistPath,
+])).stdout;
+const isSafeExecutableName = (name) => name.length > 0 &&
+    name !== "." &&
+    name !== ".." &&
+    !name.includes("\0") &&
+    !/[/\\]/u.test(name);

package/dist/application/ArtifactExtraction.js

@@ -1,4 +1,5 @@
 import { lstat, realpath } from "node:fs/promises";
+import { canonicalDigest } from "../domain/comparisonSemantics.js";
 import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
 import { ArtifactPathRegistry, normalizeArtifactPath, } from "../artifacts/ArtifactPaths.js";
 import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
@@ -8,7 +9,6 @@ import { ZipArtifactReader } from "../artifacts/ZipArtifactReader.js";
 import { MachOSliceArtifactReader } from "../artifacts/MachOSliceArtifactReader.js";
 import { artifactExtractionResultSchema, } from "../domain/artifactGraph.js";
 import { scanArtifactInventory } from "./ArtifactInventory.js";
-import { digestCanonical } from "./ArtifactGraphConstruction.js";
 /** Extract every regular inventory occurrence into an exclusively owned absent root. */
 export const extractArtifact = async (input, signal) => {
     const sourcePath = await realpath(input.inputPath);
@@ -86,7 +86,10 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
     }
     catch (cause) {
         if (!readerClosed)
-            await reader.close().catch(() => undefined);
+            await reader.close().catch((cause) => {
+                // best-effort cleanup: reader close must not mask the extraction failure.
+                void cause;
+            });
         await output.rollback();
         throw cause;
     }
@@ -97,14 +100,14 @@ const createExtractionResult = (input, inventory, selected, extracted) => {
         selected_occurrence_ids: selected
             .map(({ occurrence }) => occurrence.occurrence_id)
             .sort((left, right) => left.localeCompare(right)),
-        files_sha256: digestCanonical(extracted),
+        files_sha256: canonicalDigest(extracted, "Artifact"),
         output_root_alias: "$OUTPUT_ROOT",
     };
     return artifactExtractionResultSchema.parse({
         manifest: inventory.manifest,
         extraction_manifest: {
             ...extractionSemantic,
-            extraction_id: `aex_${digestCanonical(extractionSemantic)}`,
+            extraction_id: `aex_${canonicalDigest(extractionSemantic, "Artifact")}`,
         },
         output_root: input.outputRoot,
         artifacts: extracted,