rea-agents 4.1.0 → 6.0.0

package/dist/domain/protocolCapture.js

@@ -1,217 +0,0 @@
-import { z } from "zod";
-import { jsonValueSchema } from "./jsonValue.js";
-/** Supported protocol families for structured protocol capture. */
-export const protocolFamilySchema = z.enum([
-    "grpc",
-    "protobuf",
-    "json-rpc",
-    "messagepack",
-]);
-/** A decoded field from a protocol message. */
-export const decodedFieldSchema = z.strictObject({
-    /** Field name or path within the message structure. */
-    path: z.string().min(1),
-    /** Wire type or encoding hint. */
-    wire_type: z.string().nullable(),
-    /** Decoded field value. */
-    value: jsonValueSchema.nullable(),
-    /** Whether this field value was inferred rather than decoded. */
-    inferred: z.boolean().default(false),
-});
-/** Schema inference hypothesis for a repeated message pattern. */
-export const schemaHypothesisSchema = z.strictObject({
-    /** Hypothesized field name. */
-    field_name: z.string().min(1),
-    /** Inferred type. */
-    inferred_type: z.string().min(1),
-    /** Confidence: 0-1 */
-    confidence: z.number().min(0).max(1),
-    /** Supporting evidence count. */
-    evidence_count: z.number().int().nonnegative(),
-});
-/** Result of decoding a single protocol message. */
-export const protocolMessageSchema = z.strictObject({
-    /** Monotonic sequence number. */
-    sequence: z.number().int().nonnegative(),
-    /** Timestamp in milliseconds. */
-    at_ms: z.number().int().nonnegative(),
-    /** Protocol family. */
-    family: protocolFamilySchema,
-    /** Direction of the message. */
-    direction: z.enum(["request", "response"]),
-    /** Transport endpoint or path (e.g. gRPC method path). */
-    endpoint: z.string().nullable(),
-    /** Content type of the raw payload. */
-    content_type: z.string().nullable(),
-    /** Raw payload bytes as base64. */
-    raw_payload: z.string().nullable(),
-    /** Decoded fields from the payload. */
-    decoded_fields: z.array(decodedFieldSchema).default([]),
-    /** Inferred schema hypotheses. */
-    schema_hypotheses: z.array(schemaHypothesisSchema).default([]),
-    /** Whether decoding was truncated. */
-    truncated: z.boolean().default(false),
-    /** Whether the capture producer marked credentials as redacted. */
-    credentials_redacted: z.boolean().default(false),
-});
-/** A captured protocol session with messages and inferred schemas. */
-export const protocolCaptureSchema = z.strictObject({
-    /** Protocol family for this capture. */
-    family: protocolFamilySchema,
-    /** Captured messages in order. */
-    messages: z.array(protocolMessageSchema).min(0),
-    /** Aggregated schema hypotheses across all messages. */
-    inferred_schema: z.array(schemaHypothesisSchema).default([]),
-    /** Whether any message was truncated. */
-    has_truncated: z.boolean().default(false),
-    /** Whether the capture producer marked credential content as redacted. */
-    credentials_detected: z.boolean().default(false),
-});
-/** Classification of a byte sequence as a known protocol family. */
-export function classifyProtocolFamily(contentType, path) {
-    if (contentType) {
-        if (contentType.includes("application/grpc"))
-            return "grpc";
-        if (contentType.includes("application/x-protobuf"))
-            return "protobuf";
-        if (contentType.includes("application/json-rpc"))
-            return "json-rpc";
-        if (contentType.includes("application/msgpack") ||
-            contentType.includes("application/x-msgpack"))
-            return "messagepack";
-    }
-    if (path) {
-        if (path.startsWith("/grpc.") || path.includes("/grpc/"))
-            return "grpc";
-        if (path.includes("/json-rpc") || path.includes("/jsonrpc"))
-            return "json-rpc";
-    }
-    return null;
-}
-/** Decode a JSON-RPC message from raw payload bytes. */
-export function decodeJsonRpc(rawPayload) {
-    const text = new TextDecoder().decode(rawPayload);
-    const parsed = jsonValueSchema.parse(JSON.parse(text));
-    const fields = [];
-    if (typeof parsed === "object" && parsed !== null) {
-        for (const [key, value] of Object.entries(parsed)) {
-            fields.push({
-                path: key,
-                wire_type: "json",
-                value,
-                inferred: false,
-            });
-        }
-    }
-    return { decoded_fields: fields, truncated: false };
-}
-/** Decode a MessagePack message (simplified: only checks basic structure). */
-export function decodeMessagePack(rawPayload) {
-    const fields = [];
-    // MessagePack uses a single-byte type tag
-    if (rawPayload.length === 0) {
-        return { decoded_fields: [], truncated: false };
-    }
-    const tag = rawPayload[0];
-    if (tag === undefined)
-        return { decoded_fields: [], truncated: false };
-    // Map type: 0x80-0x8f (fixmap), 0xde (map16), 0xdf (map32)
-    if ((tag >= 0x80 && tag <= 0x8f) || tag === 0xde || tag === 0xdf) {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "map",
-            inferred: false,
-        });
-    }
-    // Array type: 0x90-0x9f (fixarray), 0xdc (array16), 0xdd (array32)
-    else if ((tag >= 0x90 && tag <= 0x9f) || tag === 0xdc || tag === 0xdd) {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "array",
-            inferred: false,
-        });
-    }
-    else {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "unknown",
-            inferred: true,
-        });
-    }
-    return {
-        decoded_fields: fields,
-        truncated: false,
-    };
-}
-/** Decode a gRPC frame (5-byte header + protobuf payload). */
-export function decodeGrpcFrame(rawPayload) {
-    // gRPC uses a 5-byte prefix: 1 byte compressed flag + 4 byte length
-    if (rawPayload.length < 5) {
-        return {
-            decoded_fields: [
-                {
-                    path: "error",
-                    wire_type: "grpc",
-                    value: "frame too short",
-                    inferred: false,
-                },
-            ],
-            truncated: false,
-        };
-    }
-    const compressed = rawPayload[0] !== 0;
-    const length = ((rawPayload[1] ?? 0) << 24) |
-        ((rawPayload[2] ?? 0) << 16) |
-        ((rawPayload[3] ?? 0) << 8) |
-        (rawPayload[4] ?? 0);
-    return {
-        decoded_fields: [
-            {
-                path: "compressed",
-                wire_type: "grpc",
-                value: compressed,
-                inferred: false,
-            },
-            {
-                path: "message_length",
-                wire_type: "grpc",
-                value: length,
-                inferred: false,
-            },
-        ],
-        truncated: false,
-    };
-}
-/** Infer schema hypotheses from a set of decoded messages. */
-export function inferMessageSchema(messages) {
-    const fieldCounts = new Map();
-    for (const msg of messages) {
-        for (const field of msg.decoded_fields) {
-            const existing = fieldCounts.get(field.path);
-            if (existing) {
-                existing.count++;
-                if (field.wire_type)
-                    existing.types.add(field.wire_type);
-            }
-            else {
-                fieldCounts.set(field.path, {
-                    count: 1,
-                    types: new Set(field.wire_type ?? "unknown"),
-                });
-            }
-        }
-    }
-    const hypotheses = [];
-    for (const [field_name, data] of fieldCounts) {
-        hypotheses.push({
-            field_name,
-            inferred_type: [...data.types].join("|"),
-            confidence: Math.min(1, data.count / messages.length || 0),
-            evidence_count: data.count,
-        });
-    }
-    return hypotheses;
-}

package/dist/domain/runtimeIdentification.js

@@ -1,212 +0,0 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
-import { z } from "zod";
-import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
-import { evidenceSchema } from "./evidence.js";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
-const evidenceIdSchema = prefixedDigestSchema("ev");
-const runtimeFamilySchema = z.enum([
-    "android",
-    "apple",
-    "javascript",
-    "jvm",
-    "native",
-    "webassembly",
-]);
-const observationSchema = z.strictObject({
-    path: z.string().min(1),
-    artifact_id: prefixedDigestSchema("art"),
-    sha256: digestSchema,
-    format: z.string().min(1),
-});
-const runtimeObservationShape = {
-    family: runtimeFamilySchema,
-    observations: z.array(observationSchema),
-};
-const identifiedRuntimeSchema = z.discriminatedUnion("inspection", [
-    z.strictObject({
-        ...runtimeObservationShape,
-        inspection: z.literal("available"),
-        provider_id: z.string().min(1),
-        reason: z.null(),
-    }),
-    z.strictObject({
-        ...runtimeObservationShape,
-        inspection: z.literal("provider-missing"),
-        provider_id: z.null(),
-        reason: z.string().min(1),
-    }),
-    z.strictObject({
-        ...runtimeObservationShape,
-        inspection: z.literal("provider-selection-required"),
-        provider_id: z.null(),
-        reason: z.string().min(1),
-    }),
-]);
-/** Authenticated artifact inventory pages to classify by runtime family. */
-const runtimeIdentificationInputSchema = z.strictObject({
-    inventory_evidence: z.array(evidenceSchema).min(1),
-});
-/** Provider-neutral runtime identification with explicit tooling availability. */
-export const runtimeIdentificationResultSchema = z.strictObject({
-    identification_id: prefixedDigestSchema("rid"),
-    root_sha256: digestSchema,
-    root_format: z.string().min(1),
-    source_evidence_ids: z.array(evidenceIdSchema).min(1),
-    runtimes: z.array(identifiedRuntimeSchema),
-    coverage: z.strictObject({
-        status: z.enum(["complete-within-inventory", "partial"]),
-        inventory_complete: z.boolean(),
-    }),
-    limitations: z.array(z.string().min(1)),
-});
-const PROVIDERS = {
-    android: {
-        inspection: "available",
-        id: "rea-android-application",
-        reason: null,
-    },
-    apple: { inspection: "available", id: "rea-apple-application", reason: null },
-    javascript: {
-        inspection: "available",
-        id: "rea-javascript-application",
-        reason: null,
-    },
-    jvm: {
-        inspection: "provider-missing",
-        id: null,
-        reason: "Install or configure a JVM bytecode-analysis provider.",
-    },
-    native: {
-        inspection: "provider-selection-required",
-        id: null,
-        reason: "Select an available native deep-analysis provider for this target and host.",
-    },
-    webassembly: {
-        inspection: "provider-missing",
-        id: null,
-        reason: "Install or configure a WebAssembly semantic-analysis provider.",
-    },
-};
-/** Identify runtime families without executing or semantically decoding target bytes. */
-export const identifyRuntimes = (input) => {
-    const parsed = runtimeIdentificationInputSchema.parse(input);
-    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
-    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
-    const grouped = new Map();
-    const add = (family, observation) => {
-        const observations = grouped.get(family) ?? [];
-        observations.push(observation);
-        grouped.set(family, observations);
-    };
-    for (const occurrence of inventory.occurrences) {
-        if (occurrence.artifact_id === null)
-            continue;
-        const node = nodes.get(occurrence.artifact_id);
-        if (node === undefined)
-            throw new TypeError("Runtime observation has no artifact node");
-        const observation = {
-            path: occurrence.logical_path,
-            artifact_id: node.artifact_id,
-            sha256: node.sha256,
-            format: node.format,
-        };
-        for (const family of familiesFor(node.format, occurrence.logical_path))
-            add(family, observation);
-    }
-    const rootObservation = inventory.nodes.find(({ sha256 }) => sha256 === inventory.manifest.root_sha256);
-    if (rootObservation !== undefined)
-        for (const family of familiesFor(inventory.manifest.root_format, "."))
-            add(family, {
-                path: ".",
-                artifact_id: rootObservation.artifact_id,
-                sha256: rootObservation.sha256,
-                format: rootObservation.format,
-            });
-    const runtimes = [...grouped.entries()]
-        .sort(([left], [right]) => compare(left, right))
-        .map(([family, values]) => {
-        const unique = deduplicate(values);
-        const provider = providerFor(family, inventory.manifest.root_format);
-        return {
-            family,
-            ...runtimeInspection(provider),
-            observations: unique,
-        };
-    });
-    const limitations = [
-        ...(!inventory.complete
-            ? [
-                "Source inventory pages are incomplete; absent runtimes remain unknown.",
-            ]
-            : []),
-        "Runtime families are identified from exact artifact formats and paths; semantic claims require the named provider.",
-    ];
-    const withoutId = {
-        root_sha256: inventory.manifest.root_sha256,
-        root_format: inventory.manifest.root_format,
-        source_evidence_ids: evidence
-            .map(({ evidence_id: id }) => id)
-            .sort(compare),
-        runtimes,
-        coverage: {
-            status: inventory.complete
-                ? "complete-within-inventory"
-                : "partial",
-            inventory_complete: inventory.complete,
-        },
-        limitations,
-    };
-    return runtimeIdentificationResultSchema.parse({
-        ...withoutId,
-        identification_id: `rid_${digest(withoutId)}`,
-    });
-};
-const providerFor = (family, rootFormat) => family === "android" && rootFormat !== "apk"
-    ? {
-        inspection: "provider-selection-required",
-        id: null,
-        reason: "Extract or select an APK root before using the Android application provider.",
-    }
-    : PROVIDERS[family];
-const runtimeInspection = (provider) => provider.inspection === "available"
-    ? {
-        inspection: provider.inspection,
-        provider_id: provider.id,
-        reason: null,
-    }
-    : {
-        inspection: provider.inspection,
-        provider_id: null,
-        reason: provider.reason,
-    };
-const familiesFor = (format, path) => {
-    const families = new Set();
-    if (format === "apk" ||
-        format === "dex" ||
-        /(?:^|\/)[^/]+\.dex$/iu.test(path) ||
-        /(?:^|\/)AndroidManifest\.xml$/u.test(path))
-        families.add("android");
-    if (format === "ipa")
-        families.add("apple");
-    if (format === "javascript-bundle")
-        families.add("javascript");
-    if (format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path))
-        families.add("jvm");
-    if (["elf", "mach-o", "mach-o-universal", "pe", "dos-mz", "dos-com"].includes(format))
-        families.add("native");
-    if (format === "webassembly" || /(?:^|\/)[^/]+\.wasm$/iu.test(path))
-        families.add("webassembly");
-    return [...families];
-};
-const deduplicate = (values) => [
-    ...new Map(values.map((value) => [`${value.path}\0${value.artifact_id}`, value])).values(),
-].sort((left, right) => compare(left.path, right.path));
-const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
-const digest = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Runtime identification is not canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};