rea-agents 5.0.0 → 6.0.0

package/dist/domain/customProtocolCapture.js

@@ -1,137 +0,0 @@
-import { z } from "zod";
-import { jsonValueSchema } from "./jsonValue.js";
-/** Supported transport types for custom protocol capture. */
-export const transportTypeSchema = z.enum([
-    "tcp",
-    "udp",
-    "ipc",
-    "unix-socket",
-    "named-pipe",
-    "xpc",
-]);
-/** Direction of a protocol frame. */
-export const frameDirectionSchema = z.enum(["sent", "received", "intercepted"]);
-/** A captured protocol frame. */
-export const protocolFrameSchema = z.strictObject({
-    /** Monotonic sequence number. */
-    sequence: z.number().int().nonnegative(),
-    /** Timestamp in milliseconds. */
-    at_ms: z.number().int().nonnegative(),
-    /** Transport type. */
-    transport: transportTypeSchema,
-    /** Direction of the frame. */
-    direction: frameDirectionSchema,
-    /** Source process identity. */
-    source_pid: z.number().int().nullable(),
-    /** Destination process identity. */
-    dest_pid: z.number().int().nullable(),
-    /** Endpoint address (IP:port, socket path, pipe name). */
-    source_endpoint: z.string().nullable(),
-    /** Destination endpoint. */
-    dest_endpoint: z.string().nullable(),
-    /** Raw frame data as base64. */
-    raw_data: z.string().nullable(),
-    /** Decoded/parsed frame content if known. */
-    decoded_content: jsonValueSchema.nullable(),
-    /** Frame size in bytes. */
-    size: z.number().int().nonnegative(),
-    /** Whether the frame was truncated. */
-    truncated: z.boolean().default(false),
-});
-/** Authentication flow stage. */
-export const authStageSchema = z.enum([
-    "init",
-    "challenge",
-    "response",
-    "token_exchange",
-    "renewal",
-    "revocation",
-    "failure",
-    "success",
-]);
-/** Token lifecycle event. */
-export const tokenLifecycleEventSchema = z.enum([
-    "issued",
-    "refreshed",
-    "expired",
-    "revoked",
-    "renewed",
-]);
-/** A captured authentication flow event. */
-export const authFlowEventSchema = z.strictObject({
-    /** Monotonic sequence number. */
-    sequence: z.number().int().nonnegative(),
-    /** Timestamp in milliseconds. */
-    at_ms: z.number().int().nonnegative(),
-    /** Authentication stage. */
-    stage: authStageSchema,
-    /** Protocol used. */
-    protocol: z.string().min(1),
-    /** Token type if applicable. */
-    token_type: z.string().nullable(),
-    /** Token lifecycle event. */
-    token_lifecycle: tokenLifecycleEventSchema.nullable(),
-    /** Correlation ID linking challenge-response pairs. */
-    correlation_id: z.string().nullable(),
-    /** Whether the capture producer marked credentials as redacted. */
-    credentials_redacted: z.boolean().default(false),
-    /** Whether the authentication succeeded. */
-    succeeded: z.boolean().default(false),
-    /** Error message if authentication failed. */
-    error: z.string().nullable(),
-});
-/** A captured protocol session. */
-export const customProtocolCaptureSchema = z.strictObject({
-    /** Transport type for this session. */
-    transport: transportTypeSchema,
-    /** Captured frames in order. */
-    frames: z.array(protocolFrameSchema),
-    /** Authentication flow events. */
-    auth_events: z.array(authFlowEventSchema).default([]),
-    /** Whether any frame was truncated. */
-    has_truncated: z.boolean().default(false),
-    /** Whether the capture producer detected credential content. */
-    credentials_detected: z.boolean().default(false),
-});
-/** Correlate a frame with process identity. */
-export function correlateProcessIdentity(frame, pid) {
-    return frame.source_pid === pid || frame.dest_pid === pid;
-}
-/** Check if a frame contains credential-like content. */
-export function looksLikeCredentialFrame(frame) {
-    const patterns = [
-        "password",
-        "token",
-        "secret",
-        "api_key",
-        "apikey",
-        "authorization",
-        "credential",
-    ];
-    const content = JSON.stringify(frame.decoded_content ?? "").toLowerCase();
-    return patterns.some((p) => content.includes(p));
-}
-/** Filter frames by transport type. */
-export function framesByTransport(frames, transport) {
-    return frames.filter((f) => f.transport === transport);
-}
-/** Get all authentication flow events for a specific protocol. */
-export function authEventsByProtocol(events, protocol) {
-    return events.filter((e) => e.protocol === protocol);
-}
-/** Get successful authentication events. */
-export function successfulAuthEvents(events) {
-    return events.filter((e) => e.succeeded);
-}
-/** Get failed authentication events. */
-export function failedAuthEvents(events) {
-    return events.filter((e) => !e.succeeded);
-}
-/** Compute the duration of an authentication flow in milliseconds. */
-export function authFlowDuration(events) {
-    const first = events.at(0);
-    const last = events.at(-1);
-    if (first === undefined || last === undefined)
-        return null;
-    return last.at_ms - first.at_ms;
-}

package/dist/domain/eventProcessTree.js

@@ -1,225 +0,0 @@
-import { z } from "zod";
-/** Event types for event-backed process-tree capture. */
-export const processEventTypeSchema = z.enum([
-    "spawn",
-    "exit",
-    "re_exec",
-    "reparent",
-    "signal",
-    "name_change",
-    "thread_create",
-    "thread_exit",
-]);
-/** A single event-backed process-tree event. */
-export const processTreeEventSchema = z.strictObject({
-    /** Monotonic event sequence number. */
-    sequence: z.number().int().nonnegative(),
-    /** Event timestamp in milliseconds. */
-    at_ms: z.number().int().nonnegative(),
-    /** Event type. */
-    type: processEventTypeSchema,
-    /** Process ID. */
-    pid: z.number().int().positive(),
-    /** Parent process ID. */
-    ppid: z.number().int().nullable(),
-    /** Process name if known. */
-    process_name: z.string().nullable(),
-    /** Executable path if known. */
-    executable: z.string().nullable(),
-    /** Command line arguments. */
-    arguments: z.array(z.string()).default([]),
-    /** Previous PID (for reparent events). */
-    previous_pid: z.number().int().nullable(),
-    /** Previous PPID (for reparent events). */
-    previous_ppid: z.number().int().nullable(),
-    /** Exit code (for exit events). */
-    exit_code: z.number().int().nullable(),
-    /** Signal number (for signal events). */
-    signal: z.number().int().nullable(),
-    /** Thread ID (for thread events). */
-    tid: z.number().int().nullable(),
-});
-/** Process node in a reconstructed tree. */
-export const processNodeSchema = z.strictObject({
-    pid: z.number().int().positive(),
-    ppid: z.number().int().nullable(),
-    process_name: z.string().nullable(),
-    executable: z.string().nullable(),
-    arguments: z.array(z.string()).default([]),
-    children: z.array(z.number().int()).default([]),
-    spawn_time_ms: z.number().int().nullable(),
-    exit_time_ms: z.number().int().nullable(),
-    exit_code: z.number().int().nullable(),
-    is_re_exec: z.boolean().default(false),
-    is_reparented: z.boolean().default(false),
-    previous_ppid: z.number().int().nullable(),
-});
-/** Result of event-backed process-tree reconstruction. */
-export const processTreeReconstructionSchema = z.strictObject({
-    /** Root PID of the process tree. */
-    root_pid: z.number().int().positive(),
-    /** All reconstructed process nodes. */
-    processes: z.array(processNodeSchema).min(0),
-    /** Events that were consumed. */
-    events_consumed: z.number().int().nonnegative(),
-    /** Events that could not be matched. */
-    events_unmatched: z.number().int().nonnegative(),
-    /** Short-lived descendants that were missed by sampling. */
-    short_lived_descendants: z.number().int().nonnegative(),
-    /** Whether any re-exec was detected. */
-    has_re_exec: z.boolean().default(false),
-    /** Whether any reparenting was detected. */
-    has_reparenting: z.boolean().default(false),
-});
-const applyProcessTreeEvent = (event, state) => {
-    let node = state.nodes.get(event.pid);
-    switch (event.type) {
-        case "spawn": {
-            if (!node) {
-                node = {
-                    pid: event.pid,
-                    ppid: event.ppid,
-                    process_name: event.process_name,
-                    executable: event.executable,
-                    arguments: event.arguments,
-                    children: [],
-                    spawn_time_ms: event.at_ms,
-                    exit_time_ms: null,
-                    exit_code: null,
-                    is_re_exec: false,
-                    is_reparented: false,
-                    previous_ppid: null,
-                };
-                state.nodes.set(event.pid, node);
-            }
-            if (event.ppid !== null) {
-                const parentChildren = state.children.get(event.ppid) ?? [];
-                parentChildren.push(event.pid);
-                state.children.set(event.ppid, parentChildren);
-            }
-            break;
-        }
-        case "exit":
-            if (node) {
-                node.exit_time_ms = event.at_ms;
-                node.exit_code = event.exit_code;
-                if (node.spawn_time_ms !== null &&
-                    event.at_ms - node.spawn_time_ms < 100)
-                    state.shortLivedDescendants++;
-            }
-            else
-                state.eventsUnmatched++;
-            break;
-        case "re_exec":
-            if (node) {
-                node.is_re_exec = true;
-                node.executable = event.executable ?? node.executable;
-                node.arguments = event.arguments;
-                state.hasReExec = true;
-            }
-            else
-                state.eventsUnmatched++;
-            break;
-        case "reparent":
-            if (node) {
-                node.previous_ppid = node.ppid;
-                node.ppid = event.ppid;
-                node.is_reparented = true;
-                state.hasReparenting = true;
-            }
-            else
-                state.eventsUnmatched++;
-            break;
-        case "signal":
-        case "name_change":
-        case "thread_create":
-        case "thread_exit":
-            // These events are recorded but don't modify the tree structure.
-            break;
-    }
-};
-/** Reconstruct a process tree from event-backed capture. */
-export function reconstructProcessTree(events, rootPid) {
-    const nodes = new Map();
-    const children = new Map();
-    let eventsConsumed = 0;
-    const state = {
-        nodes,
-        children,
-        eventsUnmatched: 0,
-        hasReExec: false,
-        hasReparenting: false,
-        shortLivedDescendants: 0,
-    };
-    const sorted = [...events].sort((a, b) => a.at_ms - b.at_ms);
-    for (const event of sorted) {
-        eventsConsumed++;
-        applyProcessTreeEvent(event, state);
-    }
-    // Attach children to nodes
-    for (const [pid, childPids] of children) {
-        const node = nodes.get(pid);
-        if (node)
-            node.children = childPids;
-    }
-    return {
-        root_pid: rootPid,
-        processes: [...nodes.values()],
-        events_consumed: eventsConsumed,
-        events_unmatched: state.eventsUnmatched,
-        short_lived_descendants: state.shortLivedDescendants,
-        has_re_exec: state.hasReExec,
-        has_reparenting: state.hasReparenting,
-    };
-}
-/** Get all descendant PIDs of a given root PID. */
-export function getDescendants(processes, rootPid) {
-    const byPid = new Map(processes.map((p) => [p.pid, p]));
-    const visited = new Set();
-    const result = [];
-    const queue = [rootPid];
-    for (let head = 0; head < queue.length; head += 1) {
-        const pid = queue[head];
-        if (pid === undefined)
-            continue;
-        if (visited.has(pid))
-            continue;
-        visited.add(pid);
-        const node = byPid.get(pid);
-        if (node) {
-            for (const child of node.children) {
-                if (!visited.has(child)) {
-                    result.push(child);
-                    queue.push(child);
-                }
-            }
-        }
-    }
-    return result;
-}
-/** Check if a process tree contains a specific PID. */
-export function containsProcess(processes, pid) {
-    return processes.some((p) => p.pid === pid);
-}
-/** Get the maximum tree depth from the root. */
-export function maxTreeDepth(processes, rootPid) {
-    const byPid = new Map(processes.map((p) => [p.pid, p]));
-    const pending = [{ pid: rootPid, depth: 0 }];
-    const visited = new Set();
-    let maximumDepth = 0;
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (!current || visited.has(current.pid))
-            continue;
-        visited.add(current.pid);
-        const node = byPid.get(current.pid);
-        if (!node || node.children.length === 0)
-            continue;
-        const childDepth = current.depth + 1;
-        maximumDepth = Math.max(maximumDepth, childDepth);
-        for (const childPid of node.children)
-            if (!visited.has(childPid))
-                pending.push({ pid: childPid, depth: childDepth });
-    }
-    return maximumDepth;
-}

package/dist/domain/mobileApplicationInvestigation.js

@@ -1,159 +0,0 @@
-import { z } from "zod";
-/** Supported mobile artifact formats. */
-export const mobileArtifactFormatSchema = z.enum([
-    "apk",
-    "aab",
-    "ipa",
-    "dex",
-    "native_lib",
-]);
-/** Mobile platform. */
-export const mobilePlatformSchema = z.enum([
-    "android",
-    "ios",
-    "cross_platform",
-]);
-/** Android manifest entry. */
-export const androidManifestSchema = z.strictObject({
-    package_name: z.string().min(1),
-    version_name: z.string().nullable(),
-    version_code: z.number().int().nullable(),
-    min_sdk: z.number().int().nullable(),
-    target_sdk: z.number().int().nullable(),
-    permissions: z.array(z.string()).default([]),
-    activities: z.array(z.string()).default([]),
-    services: z.array(z.string()).default([]),
-    receivers: z.array(z.string()).default([]),
-    providers: z.array(z.string()).default([]),
-});
-/** iOS app manifest (Info.plist). */
-export const iosManifestSchema = z.strictObject({
-    bundle_identifier: z.string().min(1),
-    bundle_version: z.string().nullable(),
-    short_version: z.string().nullable(),
-    minimum_os_version: z.string().nullable(),
-    supported_platforms: z.array(z.string()).default([]),
-    ui_required_device_capabilities: z.array(z.string()).default([]),
-    app_permissions: z.array(z.string()).default([]),
-});
-/** Signing information. */
-export const signingInfoSchema = z.strictObject({
-    is_signed: z.boolean().default(false),
-    signer_identity: z.string().nullable(),
-    certificate_fingerprint: z.string().nullable(),
-    signature_scheme: z.string().nullable(),
-    is_debuggable: z.boolean().default(false),
-});
-/** Native library entry. */
-export const nativeLibrarySchema = z.strictObject({
-    path: z.string().min(1),
-    architecture: z.string().nullable(),
-    size: z.number().int().nonnegative(),
-    digest: z
-        .string()
-        .regex(/^[a-f0-9]{64}$/u)
-        .nullable(),
-});
-/** Resource entry within a mobile artifact. */
-export const mobileResourceSchema = z.strictObject({
-    path: z.string().min(1),
-    type: z.enum([
-        "layout",
-        "drawable",
-        "string",
-        "asset",
-        "raw",
-        "native_lib",
-        "manifest",
-        "entitlements",
-        "provisioning",
-        "other",
-    ]),
-    size: z.number().int().nonnegative(),
-});
-/** Static analysis result for a mobile artifact. */
-export const mobileArtifactManifestSchema = z.strictObject({
-    format: mobileArtifactFormatSchema,
-    platform: mobilePlatformSchema,
-    app_name: z.string().nullable(),
-    android_manifest: androidManifestSchema.nullable(),
-    ios_manifest: iosManifestSchema.nullable(),
-    signing: signingInfoSchema,
-    resources: z.array(mobileResourceSchema).default([]),
-    native_libraries: z.array(nativeLibrarySchema).default([]),
-    total_size: z.number().int().nonnegative(),
-    architectures: z.array(z.string()).default([]),
-});
-/** Detect mobile artifact format from file extension. */
-export function detectMobileFormat(path) {
-    const lower = path.toLowerCase();
-    if (lower.endsWith(".apk"))
-        return "apk";
-    if (lower.endsWith(".aab"))
-        return "aab";
-    if (lower.endsWith(".ipa"))
-        return "ipa";
-    if (lower.endsWith(".dex"))
-        return "dex";
-    if (lower.endsWith(".so") || lower.endsWith(".dylib") || lower.endsWith(".a"))
-        return "native_lib";
-    return null;
-}
-/** Detect platform from format. */
-export function detectPlatform(format) {
-    switch (format) {
-        case "apk":
-        case "aab":
-        case "dex":
-            return "android";
-        case "ipa":
-            return "ios";
-        case "native_lib":
-            return "cross_platform";
-    }
-}
-/** Classify a resource by its path. */
-export function classifyMobileResource(path) {
-    const lower = path.toLowerCase();
-    if (lower.includes("androidmanifest.xml"))
-        return "manifest";
-    if (lower.includes(".entitlements"))
-        return "entitlements";
-    if (lower.includes("provisioning") || lower.includes(".mobileprovision"))
-        return "provisioning";
-    if (lower.includes("/layout/"))
-        return "layout";
-    if (lower.includes("/drawable/") || lower.includes("/mipmap/"))
-        return "drawable";
-    if (lower.includes("/values/"))
-        return "string";
-    if (lower.includes("assets/") || lower.includes("raw/"))
-        return "asset";
-    if (lower.endsWith(".so") || lower.endsWith(".dylib"))
-        return "native_lib";
-    if (lower.endsWith(".xml"))
-        return "layout";
-    return "other";
-}
-/** Get all native libraries for a specific architecture. */
-export function nativeLibsByArchitecture(manifest, arch) {
-    return manifest.native_libraries.filter((l) => l.architecture === arch);
-}
-/** Check if an Android artifact has internet permission. */
-export function hasInternetPermission(manifest) {
-    if (!manifest.android_manifest)
-        return false;
-    return manifest.android_manifest.permissions.some((p) => p.includes("INTERNET") || p.includes("android.permission.INTERNET"));
-}
-/** Get all unique architectures across native libraries. */
-export function getAllArchitectures(manifest) {
-    const archs = new Set();
-    for (const lib of manifest.native_libraries) {
-        if (lib.architecture)
-            archs.add(lib.architecture);
-    }
-    for (const arch of manifest.architectures) {
-        archs.add(arch);
-    }
-    return [...archs];
-}

package/dist/domain/packageAnalysis.js

@@ -1,123 +0,0 @@
-import { z } from "zod";
-/** Supported Windows package formats. */
-export const packageFormatSchema = z.enum(["msix", "msi", "appx"]);
-/** A resource entry within a package. */
-export const packageResourceSchema = z.strictObject({
-    /** Resource path within the package. */
-    path: z.string().min(1),
-    /** Resource type. */
-    type: z.enum([
-        "manifest",
-        "icon",
-        "configuration",
-        "certificate",
-        "executable",
-        "library",
-        "data",
-        "other",
-    ]),
-    /** Size in bytes. */
-    size: z.number().int().nonnegative(),
-    /** SHA-256 digest. */
-    digest: z
-        .string()
-        .regex(/^[a-f0-9]{64}$/u)
-        .nullable(),
-});
-/** Digital signature information. */
-export const digitalSignatureSchema = z.strictObject({
-    /** Whether the package is signed. */
-    is_signed: z.boolean(),
-    /** Signer subject name. */
-    signer_subject: z.string().nullable(),
-    /** Certificate thumbprint. */
-    certificate_thumbprint: z.string().nullable(),
-    /** Whether the signature is valid. */
-    is_valid: z.boolean().default(false),
-    /** Whether the signature is timestamped. */
-    is_timestamped: z.boolean().default(false),
-    /** Timestamp signer if present. */
-    timestamp_signer: z.string().nullable(),
-});
-/** A Windows package manifest for static analysis. */
-export const packageManifestSchema = z.strictObject({
-    /** Package format. */
-    format: packageFormatSchema,
-    /** Package identity name. */
-    name: z.string().min(1),
-    /** Package publisher. */
-    publisher: z.string().nullable(),
-    /** Package version. */
-    version: z.string().nullable(),
-    /** Architecture. */
-    architecture: z.enum(["x86", "x64", "arm", "arm64", "neutral", "unknown"]),
-    /** Package resources. */
-    resources: z.array(packageResourceSchema).default([]),
-    /** Digital signature. */
-    signature: digitalSignatureSchema,
-    /** Whether the package is a framework. */
-    is_framework: z.boolean().default(false),
-    /** Package dependencies. */
-    dependencies: z.array(z.string()).default([]),
-    /** Capabilities declared in the manifest. */
-    capabilities: z.array(z.string()).default([]),
-});
-/** Detect package format from file extension. */
-export function detectPackageFormat(path) {
-    const lower = path.toLowerCase();
-    if (lower.endsWith(".msix"))
-        return "msix";
-    if (lower.endsWith(".msi"))
-        return "msi";
-    if (lower.endsWith(".appx"))
-        return "appx";
-    return null;
-}
-/** Check if a resource path looks like a manifest. */
-export function isManifestResource(path) {
-    const lower = path.toLowerCase();
-    return (lower.includes("appxmanifest.xml") ||
-        lower.includes("appxmanifest") ||
-        lower.includes("manifest.xml") ||
-        lower.endsWith("_manifest.xml"));
-}
-/** Check if a resource path looks like a configuration file. */
-export function isConfigurationResource(path) {
-    const lower = path.toLowerCase();
-    return (lower.endsWith(".xml") ||
-        lower.endsWith(".json") ||
-        lower.endsWith(".ini") ||
-        lower.endsWith(".config"));
-}
-/** Classify a resource by its path. */
-export function classifyResource(path) {
-    if (isManifestResource(path))
-        return "manifest";
-    const lower = path.toLowerCase();
-    if (lower.endsWith(".ico") ||
-        lower.endsWith(".png") ||
-        lower.endsWith(".jpg") ||
-        lower.endsWith(".jpeg"))
-        return "icon";
-    if (isConfigurationResource(path))
-        return "configuration";
-    if (lower.endsWith(".cer") ||
-        lower.endsWith(".pfx") ||
-        lower.endsWith(".p12"))
-        return "certificate";
-    if (lower.endsWith(".exe") || lower.endsWith(".dll"))
-        return lower.endsWith(".exe") ? "executable" : "library";
-    return "other";
-}
-/** Get all resources of a specific type. */
-export function resourcesByType(manifest, type) {
-    return manifest.resources.filter((r) => r.type === type);
-}
-/** Get the total size of all resources. */
-export function totalResourceSize(manifest) {
-    return manifest.resources.reduce((sum, r) => sum + r.size, 0);
-}
-/** Check if a package has a valid signature. */
-export function hasValidSignature(manifest) {
-    return manifest.signature.is_signed && manifest.signature.is_valid;
-}