rea-agents 5.0.0 → 6.0.0

package/dist/domain/peInspection.js

@@ -1,197 +0,0 @@
-import { z } from "zod";
-/** PE/COFF section characteristics flags. */
-export const sectionCharacteristicsSchema = z.object({
-    /** Section contains executable code. */
-    has_code: z.boolean().default(false),
-    /** Section contains initialized data. */
-    has_initialized_data: z.boolean().default(false),
-    /** Section contains uninitialized data. */
-    has_uninitialized_data: z.boolean().default(false),
-    /** Section can be read. */
-    readable: z.boolean().default(false),
-    /** Section can be written. */
-    writable: z.boolean().default(false),
-    /** Section can be executed. */
-    executable: z.boolean().default(false),
-});
-/** PE/COFF section header. */
-export const peSectionSchema = z.strictObject({
-    name: z.string().min(1),
-    virtual_size: z.number().int().nonnegative(),
-    virtual_address: z.number().int().nonnegative(),
-    raw_size: z.number().int().nonnegative(),
-    raw_offset: z.number().int().nonnegative(),
-    characteristics: sectionCharacteristicsSchema,
-});
-/** PE import entry. */
-export const peImportSchema = z.strictObject({
-    dll: z.string().min(1),
-    function_name: z.string().min(1),
-    ordinal: z.number().int().nullable(),
-    is_delay_import: z.boolean().default(false),
-});
-/** PE export entry. */
-export const peExportSchema = z.strictObject({
-    name: z.string().min(1),
-    ordinal: z.number().int().nonnegative(),
-    rva: z.number().int().nonnegative(),
-    forwarder: z.string().nullable(),
-});
-/** PE/COFF resource entry. */
-export const peResourceSchema = z.strictObject({
-    type: z.string().min(1),
-    name: z.string().nullable(),
-    language: z.number().int().nullable(),
-    rva: z.number().int().nonnegative(),
-    size: z.number().int().nonnegative(),
-});
-/** PE debug directory entry. */
-export const peDebugEntrySchema = z.strictObject({
-    type: z.string().min(1),
-    rva: z.number().int().nonnegative(),
-    size: z.number().int().nonnegative(),
-    /** PDB GUID if this is a CodeView entry. */
-    pdb_guid: z.string().nullable(),
-    /** PDB age if this is a CodeView entry. */
-    pdb_age: z.number().int().nullable(),
-    /** PDB path if this is a CodeView entry. */
-    pdb_path: z.string().nullable(),
-});
-/** TLS callback entry. */
-export const peTlsCallbackSchema = z.strictObject({
-    callback_rva: z.number().int().nonnegative(),
-    index: z.number().int().nonnegative(),
-});
-/** Architecture/machine type. */
-export const peMachineTypeSchema = z.enum([
-    "x86",
-    "x64",
-    "arm",
-    "arm64",
-    "ia64",
-    "unknown",
-]);
-/** PE/COFF manifest for static inspection. */
-export const peManifestSchema = z.strictObject({
-    /** DOS header magic. */
-    dos_magic: z.literal(0x5a4d),
-    /** PE signature. */
-    pe_signature: z.literal(0x00004550),
-    /** Machine type. */
-    machine: peMachineTypeSchema,
-    /** Number of sections. */
-    number_of_sections: z.number().int().positive(),
-    /** Timestamp from the COFF header. */
-    timestamp: z.number().int().nullable(),
-    /** PE characteristics flags. */
-    is_dll: z.boolean().default(false),
-    is_executable: z.boolean().default(false),
-    is_console: z.boolean().default(true),
-    /** Entry point RVA. */
-    entry_point: z.number().int().nonnegative(),
-    /** Image base. */
-    image_base: z.number().int().nonnegative(),
-    /** Section alignment. */
-    section_alignment: z.number().int().positive(),
-    /** Subsystem version. */
-    subsystem_version: z.string().nullable(),
-    /** Sections. */
-    sections: z.array(peSectionSchema),
-    /** Imports. */
-    imports: z.array(peImportSchema).default([]),
-    /** Exports. */
-    exports: z.array(peExportSchema).default([]),
-    /** Resources. */
-    resources: z.array(peResourceSchema).default([]),
-    /** Debug directory entries. */
-    debug_entries: z.array(peDebugEntrySchema).default([]),
-    /** TLS callbacks. */
-    tls_callbacks: z.array(peTlsCallbackSchema).default([]),
-    /** Relocations count (not all entries). */
-    relocations_count: z.number().int().nonnegative().default(0),
-    /** Image file characteristics. */
-    image_characteristics: z.array(z.string()).default([]),
-});
-/** Parse machine type from COFF machine field. */
-export function parseMachineType(machine) {
-    switch (machine) {
-        case 0x014c:
-            return "x86";
-        case 0x8664:
-            return "x64";
-        case 0x01c0:
-        case 0x01c2:
-        case 0x01c4:
-            return "arm";
-        case 0xaa64:
-            return "arm64";
-        case 0x0200:
-            return "ia64";
-        default:
-            return "unknown";
-    }
-}
-/** Parse section characteristics flags. */
-export function parseSectionCharacteristics(characteristics) {
-    const IMAGE_SCN_CNT_CODE = 0x00000020;
-    const IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040;
-    const IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080;
-    const IMAGE_SCN_MEM_READ = 0x40000000;
-    const IMAGE_SCN_MEM_WRITE = 0x80000000;
-    const IMAGE_SCN_MEM_EXECUTE = 0x20000000;
-    return {
-        has_code: (characteristics & IMAGE_SCN_CNT_CODE) !== 0,
-        has_initialized_data: (characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA) !== 0,
-        has_uninitialized_data: (characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA) !== 0,
-        readable: (characteristics & IMAGE_SCN_MEM_READ) !== 0,
-        writable: (characteristics & IMAGE_SCN_MEM_WRITE) !== 0,
-        executable: (characteristics & IMAGE_SCN_MEM_EXECUTE) !== 0,
-    };
-}
-/** Parse image characteristics flags. */
-export function parseImageCharacteristics(characteristics) {
-    const IMAGE_DLL = 0x2000;
-    const IMAGE_EXECUTABLE = 0x0002;
-    const IMAGE_CONSOLE = 0x0003;
-    const flags = [];
-    if (characteristics & IMAGE_DLL)
-        flags.push("DLL");
-    if (characteristics & IMAGE_EXECUTABLE)
-        flags.push("Executable");
-    if ((characteristics & 0x0000000f) === IMAGE_CONSOLE)
-        flags.push("Console");
-    return flags;
-}
-/** Parse a PE debug directory type. */
-export function parseDebugType(type) {
-    switch (type) {
-        case 0:
-            return "UNKNOWN";
-        case 1:
-            return "COFF";
-        case 2:
-            return "CODEVIEW";
-        case 3:
-            return "POGO";
-        case 4:
-            return "MISC";
-        default:
-            return "UNKNOWN";
-    }
-}
-/** Check if a PE manifest has PDB debug info. */
-export function hasPdbInfo(manifest) {
-    return manifest.debug_entries.some((e) => e.pdb_guid !== null && e.pdb_path !== null);
-}
-/** Get all imported DLLs from a PE manifest. */
-export function getImportedDlls(manifest) {
-    return [...new Set(manifest.imports.map((i) => i.dll))];
-}
-/** Get all exported function names from a PE manifest. */
-export function getExportedFunctions(manifest) {
-    return manifest.exports.map((e) => e.name);
-}
-/** Count executable sections. */
-export function countExecutableSections(manifest) {
-    return manifest.sections.filter((s) => s.characteristics.executable).length;
-}

package/dist/domain/processCaptureParsing.js

@@ -1,21 +0,0 @@
-import { processCaptureSchema, } from "./processCapture.js";
-const verifiedCaptures = new WeakSet();
-const isVerifiedCapture = (capture) => verifiedCaptures.has(capture);
-const attachProof = (capture) => {
-    verifiedCaptures.add(capture);
-    if (isVerifiedCapture(capture))
-        return capture;
-    throw new TypeError("Process Capture proof ownership failed");
-};
-/** Parse unknown input and reject invalid commitments or semantics. */
-export const parseProcessCapture = (input) => {
-    const parsed = processCaptureSchema.safeParse(input);
-    if (parsed.success)
-        return attachProof(parsed.data);
-    const issues = parsed.error.issues.flatMap((issue) => issue.code === "custom"
-        ? [{ path: issue.path.join("."), message: issue.message }]
-        : []);
-    if (issues.length > 0)
-        throw new TypeError(`Invalid process capture: ${issues.map(({ path, message }) => `${path}: ${message}`).join("; ")}`);
-    throw parsed.error;
-};

package/dist/domain/protocolCapture.js

@@ -1,217 +0,0 @@
-import { z } from "zod";
-import { jsonValueSchema } from "./jsonValue.js";
-/** Supported protocol families for structured protocol capture. */
-export const protocolFamilySchema = z.enum([
-    "grpc",
-    "protobuf",
-    "json-rpc",
-    "messagepack",
-]);
-/** A decoded field from a protocol message. */
-export const decodedFieldSchema = z.strictObject({
-    /** Field name or path within the message structure. */
-    path: z.string().min(1),
-    /** Wire type or encoding hint. */
-    wire_type: z.string().nullable(),
-    /** Decoded field value. */
-    value: jsonValueSchema.nullable(),
-    /** Whether this field value was inferred rather than decoded. */
-    inferred: z.boolean().default(false),
-});
-/** Schema inference hypothesis for a repeated message pattern. */
-export const schemaHypothesisSchema = z.strictObject({
-    /** Hypothesized field name. */
-    field_name: z.string().min(1),
-    /** Inferred type. */
-    inferred_type: z.string().min(1),
-    /** Confidence: 0-1 */
-    confidence: z.number().min(0).max(1),
-    /** Supporting evidence count. */
-    evidence_count: z.number().int().nonnegative(),
-});
-/** Result of decoding a single protocol message. */
-export const protocolMessageSchema = z.strictObject({
-    /** Monotonic sequence number. */
-    sequence: z.number().int().nonnegative(),
-    /** Timestamp in milliseconds. */
-    at_ms: z.number().int().nonnegative(),
-    /** Protocol family. */
-    family: protocolFamilySchema,
-    /** Direction of the message. */
-    direction: z.enum(["request", "response"]),
-    /** Transport endpoint or path (e.g. gRPC method path). */
-    endpoint: z.string().nullable(),
-    /** Content type of the raw payload. */
-    content_type: z.string().nullable(),
-    /** Raw payload bytes as base64. */
-    raw_payload: z.string().nullable(),
-    /** Decoded fields from the payload. */
-    decoded_fields: z.array(decodedFieldSchema).default([]),
-    /** Inferred schema hypotheses. */
-    schema_hypotheses: z.array(schemaHypothesisSchema).default([]),
-    /** Whether decoding was truncated. */
-    truncated: z.boolean().default(false),
-    /** Whether the capture producer marked credentials as redacted. */
-    credentials_redacted: z.boolean().default(false),
-});
-/** A captured protocol session with messages and inferred schemas. */
-export const protocolCaptureSchema = z.strictObject({
-    /** Protocol family for this capture. */
-    family: protocolFamilySchema,
-    /** Captured messages in order. */
-    messages: z.array(protocolMessageSchema).min(0),
-    /** Aggregated schema hypotheses across all messages. */
-    inferred_schema: z.array(schemaHypothesisSchema).default([]),
-    /** Whether any message was truncated. */
-    has_truncated: z.boolean().default(false),
-    /** Whether the capture producer marked credential content as redacted. */
-    credentials_detected: z.boolean().default(false),
-});
-/** Classification of a byte sequence as a known protocol family. */
-export function classifyProtocolFamily(contentType, path) {
-    if (contentType) {
-        if (contentType.includes("application/grpc"))
-            return "grpc";
-        if (contentType.includes("application/x-protobuf"))
-            return "protobuf";
-        if (contentType.includes("application/json-rpc"))
-            return "json-rpc";
-        if (contentType.includes("application/msgpack") ||
-            contentType.includes("application/x-msgpack"))
-            return "messagepack";
-    }
-    if (path) {
-        if (path.startsWith("/grpc.") || path.includes("/grpc/"))
-            return "grpc";
-        if (path.includes("/json-rpc") || path.includes("/jsonrpc"))
-            return "json-rpc";
-    }
-    return null;
-}
-/** Decode a JSON-RPC message from raw payload bytes. */
-export function decodeJsonRpc(rawPayload) {
-    const text = new TextDecoder().decode(rawPayload);
-    const parsed = jsonValueSchema.parse(JSON.parse(text));
-    const fields = [];
-    if (typeof parsed === "object" && parsed !== null) {
-        for (const [key, value] of Object.entries(parsed)) {
-            fields.push({
-                path: key,
-                wire_type: "json",
-                value,
-                inferred: false,
-            });
-        }
-    }
-    return { decoded_fields: fields, truncated: false };
-}
-/** Decode a MessagePack message (simplified: only checks basic structure). */
-export function decodeMessagePack(rawPayload) {
-    const fields = [];
-    // MessagePack uses a single-byte type tag
-    if (rawPayload.length === 0) {
-        return { decoded_fields: [], truncated: false };
-    }
-    const tag = rawPayload[0];
-    if (tag === undefined)
-        return { decoded_fields: [], truncated: false };
-    // Map type: 0x80-0x8f (fixmap), 0xde (map16), 0xdf (map32)
-    if ((tag >= 0x80 && tag <= 0x8f) || tag === 0xde || tag === 0xdf) {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "map",
-            inferred: false,
-        });
-    }
-    // Array type: 0x90-0x9f (fixarray), 0xdc (array16), 0xdd (array32)
-    else if ((tag >= 0x90 && tag <= 0x9f) || tag === 0xdc || tag === 0xdd) {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "array",
-            inferred: false,
-        });
-    }
-    else {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "unknown",
-            inferred: true,
-        });
-    }
-    return {
-        decoded_fields: fields,
-        truncated: false,
-    };
-}
-/** Decode a gRPC frame (5-byte header + protobuf payload). */
-export function decodeGrpcFrame(rawPayload) {
-    // gRPC uses a 5-byte prefix: 1 byte compressed flag + 4 byte length
-    if (rawPayload.length < 5) {
-        return {
-            decoded_fields: [
-                {
-                    path: "error",
-                    wire_type: "grpc",
-                    value: "frame too short",
-                    inferred: false,
-                },
-            ],
-            truncated: false,
-        };
-    }
-    const compressed = rawPayload[0] !== 0;
-    const length = ((rawPayload[1] ?? 0) << 24) |
-        ((rawPayload[2] ?? 0) << 16) |
-        ((rawPayload[3] ?? 0) << 8) |
-        (rawPayload[4] ?? 0);
-    return {
-        decoded_fields: [
-            {
-                path: "compressed",
-                wire_type: "grpc",
-                value: compressed,
-                inferred: false,
-            },
-            {
-                path: "message_length",
-                wire_type: "grpc",
-                value: length,
-                inferred: false,
-            },
-        ],
-        truncated: false,
-    };
-}
-/** Infer schema hypotheses from a set of decoded messages. */
-export function inferMessageSchema(messages) {
-    const fieldCounts = new Map();
-    for (const msg of messages) {
-        for (const field of msg.decoded_fields) {
-            const existing = fieldCounts.get(field.path);
-            if (existing) {
-                existing.count++;
-                if (field.wire_type)
-                    existing.types.add(field.wire_type);
-            }
-            else {
-                fieldCounts.set(field.path, {
-                    count: 1,
-                    types: new Set(field.wire_type ?? "unknown"),
-                });
-            }
-        }
-    }
-    const hypotheses = [];
-    for (const [field_name, data] of fieldCounts) {
-        hypotheses.push({
-            field_name,
-            inferred_type: [...data.types].join("|"),
-            confidence: Math.min(1, data.count / messages.length || 0),
-            evidence_count: data.count,
-        });
-    }
-    return hypotheses;
-}

package/dist/domain/runtimeIdentification.js

@@ -1,212 +0,0 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
-import { z } from "zod";
-import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
-import { evidenceSchema } from "./evidence.js";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
-const evidenceIdSchema = prefixedDigestSchema("ev");
-const runtimeFamilySchema = z.enum([
-    "android",
-    "apple",
-    "javascript",
-    "jvm",
-    "native",
-    "webassembly",
-]);
-const observationSchema = z.strictObject({
-    path: z.string().min(1),
-    artifact_id: prefixedDigestSchema("art"),
-    sha256: digestSchema,
-    format: z.string().min(1),
-});
-const runtimeObservationShape = {
-    family: runtimeFamilySchema,
-    observations: z.array(observationSchema),
-};
-const identifiedRuntimeSchema = z.discriminatedUnion("inspection", [
-    z.strictObject({
-        ...runtimeObservationShape,
-        inspection: z.literal("available"),
-        provider_id: z.string().min(1),
-        reason: z.null(),
-    }),
-    z.strictObject({
-        ...runtimeObservationShape,
-        inspection: z.literal("provider-missing"),
-        provider_id: z.null(),
-        reason: z.string().min(1),
-    }),
-    z.strictObject({
-        ...runtimeObservationShape,
-        inspection: z.literal("provider-selection-required"),
-        provider_id: z.null(),
-        reason: z.string().min(1),
-    }),
-]);
-/** Authenticated artifact inventory pages to classify by runtime family. */
-const runtimeIdentificationInputSchema = z.strictObject({
-    inventory_evidence: z.array(evidenceSchema).min(1),
-});
-/** Provider-neutral runtime identification with explicit tooling availability. */
-export const runtimeIdentificationResultSchema = z.strictObject({
-    identification_id: prefixedDigestSchema("rid"),
-    root_sha256: digestSchema,
-    root_format: z.string().min(1),
-    source_evidence_ids: z.array(evidenceIdSchema).min(1),
-    runtimes: z.array(identifiedRuntimeSchema),
-    coverage: z.strictObject({
-        status: z.enum(["complete-within-inventory", "partial"]),
-        inventory_complete: z.boolean(),
-    }),
-    limitations: z.array(z.string().min(1)),
-});
-const PROVIDERS = {
-    android: {
-        inspection: "available",
-        id: "rea-android-application",
-        reason: null,
-    },
-    apple: { inspection: "available", id: "rea-apple-application", reason: null },
-    javascript: {
-        inspection: "available",
-        id: "rea-javascript-application",
-        reason: null,
-    },
-    jvm: {
-        inspection: "provider-missing",
-        id: null,
-        reason: "Install or configure a JVM bytecode-analysis provider.",
-    },
-    native: {
-        inspection: "provider-selection-required",
-        id: null,
-        reason: "Select an available native deep-analysis provider for this target and host.",
-    },
-    webassembly: {
-        inspection: "provider-missing",
-        id: null,
-        reason: "Install or configure a WebAssembly semantic-analysis provider.",
-    },
-};
-/** Identify runtime families without executing or semantically decoding target bytes. */
-export const identifyRuntimes = (input) => {
-    const parsed = runtimeIdentificationInputSchema.parse(input);
-    const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
-    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
-    const grouped = new Map();
-    const add = (family, observation) => {
-        const observations = grouped.get(family) ?? [];
-        observations.push(observation);
-        grouped.set(family, observations);
-    };
-    for (const occurrence of inventory.occurrences) {
-        if (occurrence.artifact_id === null)
-            continue;
-        const node = nodes.get(occurrence.artifact_id);
-        if (node === undefined)
-            throw new TypeError("Runtime observation has no artifact node");
-        const observation = {
-            path: occurrence.logical_path,
-            artifact_id: node.artifact_id,
-            sha256: node.sha256,
-            format: node.format,
-        };
-        for (const family of familiesFor(node.format, occurrence.logical_path))
-            add(family, observation);
-    }
-    const rootObservation = inventory.nodes.find(({ sha256 }) => sha256 === inventory.manifest.root_sha256);
-    if (rootObservation !== undefined)
-        for (const family of familiesFor(inventory.manifest.root_format, "."))
-            add(family, {
-                path: ".",
-                artifact_id: rootObservation.artifact_id,
-                sha256: rootObservation.sha256,
-                format: rootObservation.format,
-            });
-    const runtimes = [...grouped.entries()]
-        .sort(([left], [right]) => compare(left, right))
-        .map(([family, values]) => {
-        const unique = deduplicate(values);
-        const provider = providerFor(family, inventory.manifest.root_format);
-        return {
-            family,
-            ...runtimeInspection(provider),
-            observations: unique,
-        };
-    });
-    const limitations = [
-        ...(!inventory.complete
-            ? [
-                "Source inventory pages are incomplete; absent runtimes remain unknown.",
-            ]
-            : []),
-        "Runtime families are identified from exact artifact formats and paths; semantic claims require the named provider.",
-    ];
-    const withoutId = {
-        root_sha256: inventory.manifest.root_sha256,
-        root_format: inventory.manifest.root_format,
-        source_evidence_ids: evidence
-            .map(({ evidence_id: id }) => id)
-            .sort(compare),
-        runtimes,
-        coverage: {
-            status: inventory.complete
-                ? "complete-within-inventory"
-                : "partial",
-            inventory_complete: inventory.complete,
-        },
-        limitations,
-    };
-    return runtimeIdentificationResultSchema.parse({
-        ...withoutId,
-        identification_id: `rid_${digest(withoutId)}`,
-    });
-};
-const providerFor = (family, rootFormat) => family === "android" && rootFormat !== "apk"
-    ? {
-        inspection: "provider-selection-required",
-        id: null,
-        reason: "Extract or select an APK root before using the Android application provider.",
-    }
-    : PROVIDERS[family];
-const runtimeInspection = (provider) => provider.inspection === "available"
-    ? {
-        inspection: provider.inspection,
-        provider_id: provider.id,
-        reason: null,
-    }
-    : {
-        inspection: provider.inspection,
-        provider_id: null,
-        reason: provider.reason,
-    };
-const familiesFor = (format, path) => {
-    const families = new Set();
-    if (format === "apk" ||
-        format === "dex" ||
-        /(?:^|\/)[^/]+\.dex$/iu.test(path) ||
-        /(?:^|\/)AndroidManifest\.xml$/u.test(path))
-        families.add("android");
-    if (format === "ipa")
-        families.add("apple");
-    if (format === "javascript-bundle")
-        families.add("javascript");
-    if (format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path))
-        families.add("jvm");
-    if (["elf", "mach-o", "mach-o-universal", "pe", "dos-mz", "dos-com"].includes(format))
-        families.add("native");
-    if (format === "webassembly" || /(?:^|\/)[^/]+\.wasm$/iu.test(path))
-        families.add("webassembly");
-    return [...families];
-};
-const deduplicate = (values) => [
-    ...new Map(values.map((value) => [`${value.path}\0${value.artifact_id}`, value])).values(),
-].sort((left, right) => compare(left.path, right.path));
-const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
-const digest = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Runtime identification is not canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};