rea-agents 4.1.0 → 6.0.0

package/dist/domain/analysisSnapshot.js

@@ -77,11 +77,26 @@ const entrySchema = z.object({
         subject: subjectSchema.nullable(),
     }),
 });
+const workflowEntrySchema = z.object({
+    query_id: prefixedDigestSchema("query"),
+    operation: z.string().min(1),
+    parameters: jsonObjectSchema,
+    execution: z.object({
+        result: jsonValueSchema,
+        raw_result: jsonValueSchema.nullable(),
+        provider: committedProviderSchema,
+        analysis_profile: analysisProfileSchema,
+        limitations: z.array(z.string()),
+        locations: z.array(evidenceLocationSchema),
+        subject: subjectSchema.nullable(),
+    }),
+});
 /** Provider- and profile-exact cache of successful immutable analysis calls. */
 export const analysisSnapshotSchema = z.object({
     target: targetSchema,
     binding: bindingSchema,
     entries: z.array(entrySchema),
+    workflow_entries: z.array(workflowEntrySchema).optional(),
     evidence_bundle: evidenceBundleSchema,
 });
 const canonicalJson = (value) => {
@@ -122,6 +137,11 @@ export const snapshotEvidenceForQuery = (snapshot, query) => {
     if (!snapshotMatchesBinding(snapshot, target, bindingProfile))
         return undefined;
     const encodedParameters = canonicalJson(parameters);
+    const queryId = analysisQueryId(snapshot.target, snapshot.binding, operation, parameters);
+    const entry = snapshot.entries.find((candidate) => candidate.query_id === queryId);
+    const workflowEntry = snapshot.workflow_entries?.find((candidate) => candidate.query_id === queryId);
+    if (entry === undefined && workflowEntry === undefined)
+        return undefined;
     return snapshot.evidence_bundle.records.find((record) => record.subject?.digest.sha256 === target.sha256 &&
         record.operation === operation &&
         record.provider.id === provider.id &&
@@ -129,8 +149,54 @@ export const snapshotEvidenceForQuery = (snapshot, query) => {
         record.provider.version === provider.version &&
         "analysis_profile" in record &&
         analysisProfilesEqual(record.analysis_profile, evidenceProfile) &&
-        canonicalJson(record.parameters) === encodedParameters);
+        canonicalJson(record.parameters) === encodedParameters &&
+        ((entry !== undefined && evidenceMatchesEntry(record, entry, snapshot)) ||
+            (workflowEntry !== undefined &&
+                evidenceMatchesWorkflowEntry(record, workflowEntry, snapshot))));
+};
+/** Create one exact replay record for a derived application workflow result. */
+export const createAnalysisSnapshotWorkflowEntry = (input) => {
+    const { target, binding, operation, parameters, execution } = input;
+    if (execution.provider.id !== execution.analysisProfile.provider.id ||
+        execution.provider.name !== execution.analysisProfile.provider.name ||
+        execution.provider.version !== execution.analysisProfile.provider.version)
+        throw new TypeError("Workflow snapshot execution provider does not match its profile");
+    return {
+        query_id: analysisQueryId(target, binding, operation, parameters),
+        operation,
+        parameters: jsonObjectSchema.parse(parameters),
+        execution: {
+            result: execution.result,
+            raw_result: execution.rawResult,
+            provider: execution.analysisProfile.provider,
+            analysis_profile: execution.analysisProfile,
+            limitations: [...execution.limitations],
+            locations: [...execution.locations],
+            subject: execution.subject === null
+                ? null
+                : {
+                    ...execution.subject,
+                    architecture: execution.subject.architecture ?? null,
+                },
+        },
+    };
 };
+const evidenceMatchesEntry = (evidence, entry, snapshot) => isCorrespondingEvidence(evidence, snapshot) &&
+    canonicalJson({
+        query: evidenceQueryKey(evidence),
+        normalized_result: evidence.normalized_result,
+        raw_result: evidence.raw_result,
+        limitations: evidence.limitations,
+        locations: evidence.locations,
+        subject: evidence.subject === null
+            ? null
+            : {
+                local_path: evidence.subject.local_path,
+                sha256: evidence.subject.digest.sha256,
+                format: evidence.subject.format,
+                architecture: evidence.subject.architecture,
+            },
+    }) === entryEvidenceKey(entry, snapshot.binding);
 /** Compute the stable lookup key for one provider/profile-specific query. */
 export const analysisQueryId = (target, binding, operation, parameters) => `query_${createHash("sha256")
     .update(canonicalJson({ target, binding, operation, parameters }))
@@ -171,7 +237,9 @@ export const parseAnalysisSnapshot = (input) => {
         throw new TypeError("Analysis snapshot evidence contains records for another target");
     const ids = new Set();
     const boundEntries = [];
+    const boundWorkflowEntries = [];
     const index = createEvidenceIndex(parsed);
+    const workflowIndex = createWorkflowEvidenceIndex(parsed);
     for (const entry of parsed.entries) {
         if (entry.execution.provider.id !== parsed.binding.provider.id ||
             entry.execution.provider.name !== parsed.binding.provider.name ||
@@ -192,10 +260,41 @@ export const parseAnalysisSnapshot = (input) => {
         }
         boundEntries.push(entry);
     }
+    for (const entry of parsed.workflow_entries ?? []) {
+        if (entry.execution.provider.id !==
+            entry.execution.analysis_profile.provider.id ||
+            entry.execution.provider.name !==
+                entry.execution.analysis_profile.provider.name ||
+            entry.execution.provider.version !==
+                entry.execution.analysis_profile.provider.version)
+            throw new TypeError("Analysis snapshot workflow entry provider does not match its profile");
+        const expected = analysisQueryId(parsed.target, parsed.binding, entry.operation, entry.parameters);
+        if (entry.query_id !== expected)
+            throw new TypeError("Analysis snapshot workflow query identifier does not match");
+        if (ids.has(entry.query_id))
+            throw new TypeError("Analysis snapshot contains duplicate queries");
+        ids.add(entry.query_id);
+        if (!workflowEntryHasMatchingEvidence(entry, workflowIndex)) {
+            if (workflowEntryHasCorrespondingEvidence(entry, workflowIndex))
+                throw new TypeError(`Analysis snapshot workflow entry ${entry.operation} differs from its Evidence record`);
+            continue;
+        }
+        boundWorkflowEntries.push(entry);
+    }
     const sorted = [...parsed.entries].sort((left, right) => left.query_id.localeCompare(right.query_id));
     if (JSON.stringify(parsed.entries) !== JSON.stringify(sorted))
         throw new TypeError("Analysis snapshot entries are not canonical");
-    return { ...parsed, entries: boundEntries };
+    const sortedWorkflows = [...(parsed.workflow_entries ?? [])].sort((left, right) => left.query_id.localeCompare(right.query_id));
+    if (parsed.workflow_entries !== undefined &&
+        JSON.stringify(parsed.workflow_entries) !== JSON.stringify(sortedWorkflows))
+        throw new TypeError("Analysis snapshot workflow entries are not canonical");
+    return {
+        ...parsed,
+        entries: boundEntries,
+        ...(parsed.workflow_entries === undefined
+            ? {}
+            : { workflow_entries: boundWorkflowEntries }),
+    };
 };
 const createEvidenceIndex = (snapshot) => {
     const matching = new Set();
@@ -259,5 +358,70 @@ const entryEvidenceKey = (entry, binding) => canonicalJson({
             architecture: entry.execution.subject.architecture,
         },
 });
+const workflowEntryQueryKey = (entry) => canonicalJson({
+    operation: entry.operation,
+    parameters: entry.parameters,
+    provider: entry.execution.provider,
+    analysis_profile: entry.execution.analysis_profile,
+});
+const workflowEntryEvidenceKey = (entry) => canonicalJson({
+    query: workflowEntryQueryKey(entry),
+    normalized_result: entry.execution.result,
+    raw_result: entry.execution.raw_result,
+    limitations: entry.execution.limitations,
+    locations: entry.execution.locations,
+    subject: entry.execution.subject === null
+        ? null
+        : {
+            local_path: entry.execution.subject.path,
+            sha256: entry.execution.subject.sha256,
+            format: entry.execution.subject.format,
+            architecture: entry.execution.subject.architecture,
+        },
+});
+const isWorkflowEvidence = (evidence, snapshot, entry) => evidence.predicate_type === "rea.analysis" &&
+    evidence.confidence === "derived" &&
+    evidence.authority === "shipped-artifact" &&
+    evidence.subject?.digest.sha256 === snapshot.target.sha256 &&
+    "analysis_profile" in evidence &&
+    analysisProfilesEqual(evidence.analysis_profile, entry.execution.analysis_profile) &&
+    evidence.provider.id === entry.execution.provider.id &&
+    evidence.provider.name === entry.execution.provider.name &&
+    evidence.provider.version === entry.execution.provider.version;
+const createWorkflowEvidenceIndex = (snapshot) => {
+    const matching = new Set();
+    const corresponding = new Set();
+    for (const evidence of snapshot.evidence_bundle.records) {
+        if (evidence.predicate_type !== "rea.analysis" ||
+            evidence.confidence !== "derived" ||
+            evidence.authority !== "shipped-artifact" ||
+            evidence.subject?.digest.sha256 !== snapshot.target.sha256 ||
+            !("analysis_profile" in evidence))
+            continue;
+        corresponding.add(evidenceQueryKey(evidence));
+        matching.add(canonicalJson(evidenceContentProjection(evidence)));
+    }
+    return { matching, corresponding };
+};
+const workflowEntryHasMatchingEvidence = (entry, index) => index.matching.has(workflowEntryEvidenceKey(entry));
+const workflowEntryHasCorrespondingEvidence = (entry, index) => index.corresponding.has(workflowEntryQueryKey(entry));
+const evidenceMatchesWorkflowEntry = (evidence, entry, snapshot) => isWorkflowEvidence(evidence, snapshot, entry) &&
+    canonicalJson(evidenceContentProjection(evidence)) ===
+        workflowEntryEvidenceKey(entry);
+const evidenceContentProjection = (evidence) => ({
+    query: evidenceQueryKey(evidence),
+    normalized_result: evidence.normalized_result,
+    raw_result: evidence.raw_result,
+    limitations: evidence.limitations,
+    locations: evidence.locations,
+    subject: evidence.subject === null
+        ? null
+        : {
+            local_path: evidence.subject.local_path,
+            sha256: evidence.subject.digest.sha256,
+            format: evidence.subject.format,
+            architecture: evidence.subject.architecture,
+        },
+});
 /** Serialize a validated snapshot with byte-stable canonical entry ordering. */
 export const serializeAnalysisSnapshot = (snapshot) => `${canonicalJson(parseAnalysisSnapshot(snapshot))}\n`;

package/dist/domain/{androidApplication.js → android/androidApplication.js}

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
-import { evidenceSchema } from "./evidence.js";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js";
+import { evidenceSchema } from "../evidence.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const componentSchema = z.strictObject({
@@ -86,6 +86,7 @@ export const projectAndroidApplication = (input) => {
             ? ["Source inventory pages are incomplete; absence is unknown."]
             : []),
         "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
+        "Runtime families are inferred from inventory formats and paths; filename suffixes do not establish valid DEX or JVM class bytes.",
         "Bridge candidates are path-based hypotheses, not decoded JNI declarations or observed runtime calls.",
     ];
     const withoutId = {
@@ -123,9 +124,9 @@ const classify = (all) => ({
 const runtimeFamilies = (all) => {
     const paths = all.map(({ path }) => path.toLowerCase());
     const families = new Set();
-    if (all.some(({ path, format }) => format === "dex" || path.endsWith(".dex")))
+    if (all.some(({ path, format }) => format === "dex" || path.toLowerCase().endsWith(".dex")))
         families.add("dalvik-art");
-    if (all.some(({ path, format }) => format === "jvm-class" || path.endsWith(".class")))
+    if (all.some(({ path, format }) => format === "jvm-class" || path.toLowerCase().endsWith(".class")))
         families.add("java-kotlin");
     if (all.some(({ format }) => format === "elf"))
         families.add("native");

package/dist/domain/apple/appleApplication.js

@@ -0,0 +1,277 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { appleBundleSchema, appleComponentSchema, applicationRoots, detectBundles, isMachOFormat, isSidecar, isWithin, platformsOf, } from "./appleBundleAnatomy.js";
+import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js";
+import { evidenceSchema } from "../evidence.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const pathSchema = z.string().min(1);
+const APPLE_ROOT_FORMATS = ["ipa", "directory", "zip", "dmg"];
+/** Authenticated artifact inventory pages projected as one Apple application. */
+export const appleApplicationProjectionInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1),
+});
+/** Deterministic, execution-free Apple application inventory projection. */
+export const appleApplicationProjectionResultSchema = z.strictObject({
+    projection_id: prefixedDigestSchema("aap"),
+    root_sha256: digestSchema,
+    root_format: z.enum(APPLE_ROOT_FORMATS),
+    platforms: z.array(z.enum(["ios", "macos"])),
+    source_evidence_ids: z.array(evidenceIdSchema).min(1),
+    application_roots: z.array(pathSchema),
+    bundles: z.array(appleBundleSchema),
+    components: z.strictObject({
+        bundle_metadata: z.array(appleComponentSchema),
+        executables: z.array(appleComponentSchema),
+        frameworks: z.array(appleComponentSchema),
+        native_libraries: z.array(appleComponentSchema),
+        javascript: z.array(appleComponentSchema),
+        signing: z.array(appleComponentSchema),
+        privileged_helpers: z.array(appleComponentSchema),
+        launchd_plists: z.array(appleComponentSchema.extend({ domain: z.enum(["agent", "daemon"]) })),
+        helpers: z.array(appleComponentSchema),
+    }),
+    symlinks: z.array(pathSchema),
+    runtime_families: z.array(z.enum([
+        "native",
+        "swift-objective-c",
+        "javascript",
+        "react-native",
+        "flutter",
+        "unity",
+    ])),
+    bridge_candidates: z.array(z.strictObject({
+        source_path: pathSchema,
+        native_path: pathSchema,
+        basis: z.enum([
+            "javascript-and-native-content",
+            "react-native-convention",
+            "flutter-convention",
+            "unity-convention",
+        ]),
+    })),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inventory", "partial"]),
+        inventory_complete: z.boolean(),
+    }),
+    limitations: z.array(z.string().min(1)),
+});
+/** Project exact Apple application paths and hashes without parsing or executing target code. */
+export const projectAppleApplication = (input) => {
+    const parsed = appleApplicationProjectionInputSchema.parse(input);
+    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
+    const rootFormat = appleRootFormat(inventory.manifest.root_format);
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    const entries = inventory.occurrences
+        .filter(({ logical_path: path }) => path !== ".")
+        .map((occurrence) => {
+        if (occurrence.artifact_id === null)
+            return {
+                path: occurrence.logical_path,
+                kind: occurrence.entry_kind,
+                component: undefined,
+            };
+        const node = nodes.get(occurrence.artifact_id);
+        if (node === undefined)
+            throw new TypeError("Apple application occurrence has no artifact node");
+        return {
+            path: occurrence.logical_path,
+            kind: occurrence.entry_kind,
+            component: {
+                path: occurrence.logical_path,
+                artifact_id: node.artifact_id,
+                sha256: node.sha256,
+                format: node.format,
+            },
+        };
+    });
+    const inventoried = entries.flatMap(({ component }) => component === undefined ? [] : [component]);
+    const roots = applicationRoots(entries, {
+        name: evidence[0]?.subject?.name ?? "",
+        format: rootFormat,
+    });
+    const { all, unattributed } = attributeComponents(inventoried, roots, rootFormat);
+    const bundles = detectBundles(entries, roots);
+    const classified = classifyComponents(entries, all, roots);
+    const runtimeFamilies = identifyRuntimeFamilies(all);
+    const bridgeProjection = identifyBridgeCandidates(classified.javascript, deduplicateComponents([
+        ...classified.executables,
+        ...classified.native_libraries,
+    ]), roots);
+    const uninventoriedImage = rootFormat === "dmg" && inventory.occurrences.length === 1;
+    const complete = inventory.complete && !uninventoriedImage;
+    const limitations = projectionLimitations({
+        complete: inventory.complete,
+        uninventoriedImage,
+        roots,
+        bundles,
+        sidecars: entries.some(({ path }) => isSidecar(path)),
+        symlinks: entries.some(({ kind }) => kind === "symlink"),
+        unattributed,
+    });
+    const withoutId = {
+        root_sha256: inventory.manifest.root_sha256,
+        root_format: rootFormat,
+        platforms: platformsOf(bundles),
+        source_evidence_ids: evidence
+            .map(({ evidence_id: id }) => id)
+            .sort(compare),
+        application_roots: roots,
+        bundles,
+        components: classified,
+        symlinks: entries
+            .filter(({ kind }) => kind === "symlink")
+            .map(({ path }) => path)
+            .sort(compare),
+        runtime_families: runtimeFamilies,
+        bridge_candidates: bridgeProjection.candidates,
+        coverage: {
+            status: complete
+                ? "complete-within-inventory"
+                : "partial",
+            inventory_complete: inventory.complete,
+        },
+        limitations,
+    };
+    return appleApplicationProjectionResultSchema.parse({
+        ...withoutId,
+        projection_id: `aap_${digest(withoutId)}`,
+    });
+};
+/**
+ * IPA projection keeps every archive component, as before. Directory, ZIP,
+ * and DMG inventories can hold installers and other siblings, so only
+ * components inside an application root are attributed to it.
+ */
+const attributeComponents = (inventoried, roots, rootFormat) => {
+    if (rootFormat === "ipa")
+        return { all: [...inventoried], unattributed: 0 };
+    const visible = inventoried.filter(({ path }) => !isSidecar(path));
+    const all = visible.filter(({ path }) => roots.some((root) => isWithin(path, root)));
+    return { all, unattributed: visible.length - all.length };
+};
+const appleRootFormat = (format) => {
+    const root = APPLE_ROOT_FORMATS.find((candidate) => candidate === format);
+    if (root === undefined)
+        throw new TypeError(`Apple application projection requires IPA, directory, ZIP, or DMG inventory Evidence (got ${format})`);
+    return root;
+};
+const classifyComponents = (entries, all, roots) => {
+    const withinApp = (path) => roots.some((root) => isWithin(path, root));
+    const anatomy = (pattern) => entries.flatMap(({ path, kind, component }) => kind === "file" &&
+        component !== undefined &&
+        !isSidecar(path) &&
+        withinApp(path) &&
+        pattern.test(path)
+        ? [component]
+        : []);
+    return {
+        bundle_metadata: all.filter(({ path }) => /(?:^|\/)Info\.plist$/u.test(path)),
+        executables: all.filter(({ path, format }) => withinApp(path) && isMachOFormat(format)),
+        frameworks: all.filter(({ path }) => /\.framework\//u.test(path)),
+        native_libraries: all.filter(({ path }) => /\.(?:dylib|so)$/iu.test(path)),
+        javascript: all.filter(({ format }) => format === "javascript-bundle"),
+        signing: all.filter(({ path }) => /(?:^|\/)(?:embedded\.(?:mobileprovision|provisionprofile)|_CodeSignature\/CodeResources)$/u.test(path)),
+        privileged_helpers: anatomy(/(?:^|\/)Contents\/Library\/LaunchServices\/[^/]+$/u),
+        launchd_plists: anatomy(/(?:^|\/)Contents\/Library\/Launch(?:Agents|Daemons)\/[^/]+\.plist$/u).map((component) => ({
+            ...component,
+            domain: component.path.includes("/LaunchDaemons/")
+                ? "daemon"
+                : "agent",
+        })),
+        helpers: anatomy(/(?:^|\/)Contents\/Helpers\/[^/]+$/u),
+    };
+};
+const deduplicateComponents = (values) => [...new Map(values.map((value) => [value.path, value])).values()].sort((left, right) => compare(left.path, right.path));
+const identifyRuntimeFamilies = (all) => {
+    const paths = all.map(({ path }) => path.toLowerCase());
+    const families = new Set();
+    if (all.some(({ format }) => ["mach-o", "mach-o-universal"].includes(format)))
+        families.add("native");
+    if (paths.some((path) => /\.(?:dylib|framework\/[^/]+)$/u.test(path)))
+        families.add("swift-objective-c");
+    if (all.some(({ format }) => format === "javascript-bundle"))
+        families.add("javascript");
+    if (paths.some((path) => path.includes("reactnative") ||
+        path.includes("react.framework") ||
+        path.includes("hermes")))
+        families.add("react-native");
+    if (paths.some((path) => path.includes("flutter.framework") || path.includes("app.framework")))
+        families.add("flutter");
+    if (paths.some((path) => path.includes("unityframework.framework")))
+        families.add("unity");
+    return [...families].sort(compare);
+};
+/** Pair scripts and native code only within the same application root. */
+const identifyBridgeCandidates = (scripts, native, roots) => {
+    const owner = (path) => roots.find((root) => isWithin(path, root)) ?? null;
+    return {
+        candidates: scripts.flatMap((script) => {
+            const root = owner(script.path);
+            return native
+                .filter(({ path }) => owner(path) === root)
+                .map((item) => ({
+                source_path: script.path,
+                native_path: item.path,
+                basis: bridgeBasis(item.path),
+            }));
+        }),
+    };
+};
+const bridgeBasis = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.includes("react"))
+        return "react-native-convention";
+    if (lower.includes("flutter") || lower.includes("app.framework"))
+        return "flutter-convention";
+    if (lower.includes("unity"))
+        return "unity-convention";
+    return "javascript-and-native-content";
+};
+const projectionLimitations = (facts) => [
+    ...(!facts.complete
+        ? ["Source inventory pages are incomplete; absence is unknown."]
+        : []),
+    ...(facts.uninventoriedImage
+        ? [
+            "The DMG's contents were not inventoried on this host; bundle absence is unknown.",
+        ]
+        : []),
+    ...(facts.roots.length === 0
+        ? [
+            "No application bundle (Payload/*.app or *.app/Contents) was present in the supplied inventory pages.",
+        ]
+        : []),
+    ...(facts.bundles.some(({ layout, info_plist_path: plist }) => layout === "versioned-framework" && plist === null)
+        ? [
+            "A versioned framework has several version directories or no Versions/*/Resources/Info.plist; the Info.plist that Versions/Current selects is unknown because symlink targets are not inventoried.",
+        ]
+        : []),
+    ...(facts.symlinks
+        ? [
+            "Symlinks are reported by path only; their targets are not inventoried, so bundles are reported at their real paths.",
+        ]
+        : []),
+    ...(facts.unattributed > 0
+        ? [
+            `${facts.unattributed} inventoried entries outside every application root are not attributed to the application.`,
+        ]
+        : []),
+    ...(facts.sidecars
+        ? [
+            "AppleDouble sidecar entries (._* files and __MACOSX/) describe neighbouring files and are excluded from bundle roles.",
+        ]
+        : []),
+    "Bundle roles follow path conventions. Read each info_plist_path with inspect_plist for CFBundleExecutable, identifiers, and declared services.",
+    "Bundle identifiers and signing claims require dedicated plist and CMS parsing; this projection reports only exact paths and hashes.",
+    "Bridge candidates are path-based hypotheses, not observed runtime calls.",
+];
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Apple application projection is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/domain/{appleAssetCatalog.js → apple/appleAssetCatalog.js}

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { jsonValueSchema } from "./jsonValue.js";
-import { AnalysisOutputError } from "./analysisErrorCore.js";
+import { jsonValueSchema } from "../jsonValue.js";
+import { AnalysisOutputError } from "../analysisErrorCore.js";
 /** Caller-controlled page bounds for compiled Apple asset metadata. */
 export const appleAssetCatalogInputSchema = z.strictObject({
     offset: z.number().int().min(0).default(0),