rea-agents 5.0.0 → 6.1.0

package/dist/domain/packageAnalysis.js

@@ -1,123 +0,0 @@
-import { z } from "zod";
-/** Supported Windows package formats. */
-export const packageFormatSchema = z.enum(["msix", "msi", "appx"]);
-/** A resource entry within a package. */
-export const packageResourceSchema = z.strictObject({
-    /** Resource path within the package. */
-    path: z.string().min(1),
-    /** Resource type. */
-    type: z.enum([
-        "manifest",
-        "icon",
-        "configuration",
-        "certificate",
-        "executable",
-        "library",
-        "data",
-        "other",
-    ]),
-    /** Size in bytes. */
-    size: z.number().int().nonnegative(),
-    /** SHA-256 digest. */
-    digest: z
-        .string()
-        .regex(/^[a-f0-9]{64}$/u)
-        .nullable(),
-});
-/** Digital signature information. */
-export const digitalSignatureSchema = z.strictObject({
-    /** Whether the package is signed. */
-    is_signed: z.boolean(),
-    /** Signer subject name. */
-    signer_subject: z.string().nullable(),
-    /** Certificate thumbprint. */
-    certificate_thumbprint: z.string().nullable(),
-    /** Whether the signature is valid. */
-    is_valid: z.boolean().default(false),
-    /** Whether the signature is timestamped. */
-    is_timestamped: z.boolean().default(false),
-    /** Timestamp signer if present. */
-    timestamp_signer: z.string().nullable(),
-});
-/** A Windows package manifest for static analysis. */
-export const packageManifestSchema = z.strictObject({
-    /** Package format. */
-    format: packageFormatSchema,
-    /** Package identity name. */
-    name: z.string().min(1),
-    /** Package publisher. */
-    publisher: z.string().nullable(),
-    /** Package version. */
-    version: z.string().nullable(),
-    /** Architecture. */
-    architecture: z.enum(["x86", "x64", "arm", "arm64", "neutral", "unknown"]),
-    /** Package resources. */
-    resources: z.array(packageResourceSchema).default([]),
-    /** Digital signature. */
-    signature: digitalSignatureSchema,
-    /** Whether the package is a framework. */
-    is_framework: z.boolean().default(false),
-    /** Package dependencies. */
-    dependencies: z.array(z.string()).default([]),
-    /** Capabilities declared in the manifest. */
-    capabilities: z.array(z.string()).default([]),
-});
-/** Detect package format from file extension. */
-export function detectPackageFormat(path) {
-    const lower = path.toLowerCase();
-    if (lower.endsWith(".msix"))
-        return "msix";
-    if (lower.endsWith(".msi"))
-        return "msi";
-    if (lower.endsWith(".appx"))
-        return "appx";
-    return null;
-}
-/** Check if a resource path looks like a manifest. */
-export function isManifestResource(path) {
-    const lower = path.toLowerCase();
-    return (lower.includes("appxmanifest.xml") ||
-        lower.includes("appxmanifest") ||
-        lower.includes("manifest.xml") ||
-        lower.endsWith("_manifest.xml"));
-}
-/** Check if a resource path looks like a configuration file. */
-export function isConfigurationResource(path) {
-    const lower = path.toLowerCase();
-    return (lower.endsWith(".xml") ||
-        lower.endsWith(".json") ||
-        lower.endsWith(".ini") ||
-        lower.endsWith(".config"));
-}
-/** Classify a resource by its path. */
-export function classifyResource(path) {
-    if (isManifestResource(path))
-        return "manifest";
-    const lower = path.toLowerCase();
-    if (lower.endsWith(".ico") ||
-        lower.endsWith(".png") ||
-        lower.endsWith(".jpg") ||
-        lower.endsWith(".jpeg"))
-        return "icon";
-    if (isConfigurationResource(path))
-        return "configuration";
-    if (lower.endsWith(".cer") ||
-        lower.endsWith(".pfx") ||
-        lower.endsWith(".p12"))
-        return "certificate";
-    if (lower.endsWith(".exe") || lower.endsWith(".dll"))
-        return lower.endsWith(".exe") ? "executable" : "library";
-    return "other";
-}
-/** Get all resources of a specific type. */
-export function resourcesByType(manifest, type) {
-    return manifest.resources.filter((r) => r.type === type);
-}
-/** Get the total size of all resources. */
-export function totalResourceSize(manifest) {
-    return manifest.resources.reduce((sum, r) => sum + r.size, 0);
-}
-/** Check if a package has a valid signature. */
-export function hasValidSignature(manifest) {
-    return manifest.signature.is_signed && manifest.signature.is_valid;
-}

package/dist/domain/peInspection.js

@@ -1,197 +0,0 @@
-import { z } from "zod";
-/** PE/COFF section characteristics flags. */
-export const sectionCharacteristicsSchema = z.object({
-    /** Section contains executable code. */
-    has_code: z.boolean().default(false),
-    /** Section contains initialized data. */
-    has_initialized_data: z.boolean().default(false),
-    /** Section contains uninitialized data. */
-    has_uninitialized_data: z.boolean().default(false),
-    /** Section can be read. */
-    readable: z.boolean().default(false),
-    /** Section can be written. */
-    writable: z.boolean().default(false),
-    /** Section can be executed. */
-    executable: z.boolean().default(false),
-});
-/** PE/COFF section header. */
-export const peSectionSchema = z.strictObject({
-    name: z.string().min(1),
-    virtual_size: z.number().int().nonnegative(),
-    virtual_address: z.number().int().nonnegative(),
-    raw_size: z.number().int().nonnegative(),
-    raw_offset: z.number().int().nonnegative(),
-    characteristics: sectionCharacteristicsSchema,
-});
-/** PE import entry. */
-export const peImportSchema = z.strictObject({
-    dll: z.string().min(1),
-    function_name: z.string().min(1),
-    ordinal: z.number().int().nullable(),
-    is_delay_import: z.boolean().default(false),
-});
-/** PE export entry. */
-export const peExportSchema = z.strictObject({
-    name: z.string().min(1),
-    ordinal: z.number().int().nonnegative(),
-    rva: z.number().int().nonnegative(),
-    forwarder: z.string().nullable(),
-});
-/** PE/COFF resource entry. */
-export const peResourceSchema = z.strictObject({
-    type: z.string().min(1),
-    name: z.string().nullable(),
-    language: z.number().int().nullable(),
-    rva: z.number().int().nonnegative(),
-    size: z.number().int().nonnegative(),
-});
-/** PE debug directory entry. */
-export const peDebugEntrySchema = z.strictObject({
-    type: z.string().min(1),
-    rva: z.number().int().nonnegative(),
-    size: z.number().int().nonnegative(),
-    /** PDB GUID if this is a CodeView entry. */
-    pdb_guid: z.string().nullable(),
-    /** PDB age if this is a CodeView entry. */
-    pdb_age: z.number().int().nullable(),
-    /** PDB path if this is a CodeView entry. */
-    pdb_path: z.string().nullable(),
-});
-/** TLS callback entry. */
-export const peTlsCallbackSchema = z.strictObject({
-    callback_rva: z.number().int().nonnegative(),
-    index: z.number().int().nonnegative(),
-});
-/** Architecture/machine type. */
-export const peMachineTypeSchema = z.enum([
-    "x86",
-    "x64",
-    "arm",
-    "arm64",
-    "ia64",
-    "unknown",
-]);
-/** PE/COFF manifest for static inspection. */
-export const peManifestSchema = z.strictObject({
-    /** DOS header magic. */
-    dos_magic: z.literal(0x5a4d),
-    /** PE signature. */
-    pe_signature: z.literal(0x00004550),
-    /** Machine type. */
-    machine: peMachineTypeSchema,
-    /** Number of sections. */
-    number_of_sections: z.number().int().positive(),
-    /** Timestamp from the COFF header. */
-    timestamp: z.number().int().nullable(),
-    /** PE characteristics flags. */
-    is_dll: z.boolean().default(false),
-    is_executable: z.boolean().default(false),
-    is_console: z.boolean().default(true),
-    /** Entry point RVA. */
-    entry_point: z.number().int().nonnegative(),
-    /** Image base. */
-    image_base: z.number().int().nonnegative(),
-    /** Section alignment. */
-    section_alignment: z.number().int().positive(),
-    /** Subsystem version. */
-    subsystem_version: z.string().nullable(),
-    /** Sections. */
-    sections: z.array(peSectionSchema),
-    /** Imports. */
-    imports: z.array(peImportSchema).default([]),
-    /** Exports. */
-    exports: z.array(peExportSchema).default([]),
-    /** Resources. */
-    resources: z.array(peResourceSchema).default([]),
-    /** Debug directory entries. */
-    debug_entries: z.array(peDebugEntrySchema).default([]),
-    /** TLS callbacks. */
-    tls_callbacks: z.array(peTlsCallbackSchema).default([]),
-    /** Relocations count (not all entries). */
-    relocations_count: z.number().int().nonnegative().default(0),
-    /** Image file characteristics. */
-    image_characteristics: z.array(z.string()).default([]),
-});
-/** Parse machine type from COFF machine field. */
-export function parseMachineType(machine) {
-    switch (machine) {
-        case 0x014c:
-            return "x86";
-        case 0x8664:
-            return "x64";
-        case 0x01c0:
-        case 0x01c2:
-        case 0x01c4:
-            return "arm";
-        case 0xaa64:
-            return "arm64";
-        case 0x0200:
-            return "ia64";
-        default:
-            return "unknown";
-    }
-}
-/** Parse section characteristics flags. */
-export function parseSectionCharacteristics(characteristics) {
-    const IMAGE_SCN_CNT_CODE = 0x00000020;
-    const IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040;
-    const IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080;
-    const IMAGE_SCN_MEM_READ = 0x40000000;
-    const IMAGE_SCN_MEM_WRITE = 0x80000000;
-    const IMAGE_SCN_MEM_EXECUTE = 0x20000000;
-    return {
-        has_code: (characteristics & IMAGE_SCN_CNT_CODE) !== 0,
-        has_initialized_data: (characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA) !== 0,
-        has_uninitialized_data: (characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA) !== 0,
-        readable: (characteristics & IMAGE_SCN_MEM_READ) !== 0,
-        writable: (characteristics & IMAGE_SCN_MEM_WRITE) !== 0,
-        executable: (characteristics & IMAGE_SCN_MEM_EXECUTE) !== 0,
-    };
-}
-/** Parse image characteristics flags. */
-export function parseImageCharacteristics(characteristics) {
-    const IMAGE_DLL = 0x2000;
-    const IMAGE_EXECUTABLE = 0x0002;
-    const IMAGE_CONSOLE = 0x0003;
-    const flags = [];
-    if (characteristics & IMAGE_DLL)
-        flags.push("DLL");
-    if (characteristics & IMAGE_EXECUTABLE)
-        flags.push("Executable");
-    if ((characteristics & 0x0000000f) === IMAGE_CONSOLE)
-        flags.push("Console");
-    return flags;
-}
-/** Parse a PE debug directory type. */
-export function parseDebugType(type) {
-    switch (type) {
-        case 0:
-            return "UNKNOWN";
-        case 1:
-            return "COFF";
-        case 2:
-            return "CODEVIEW";
-        case 3:
-            return "POGO";
-        case 4:
-            return "MISC";
-        default:
-            return "UNKNOWN";
-    }
-}
-/** Check if a PE manifest has PDB debug info. */
-export function hasPdbInfo(manifest) {
-    return manifest.debug_entries.some((e) => e.pdb_guid !== null && e.pdb_path !== null);
-}
-/** Get all imported DLLs from a PE manifest. */
-export function getImportedDlls(manifest) {
-    return [...new Set(manifest.imports.map((i) => i.dll))];
-}
-/** Get all exported function names from a PE manifest. */
-export function getExportedFunctions(manifest) {
-    return manifest.exports.map((e) => e.name);
-}
-/** Count executable sections. */
-export function countExecutableSections(manifest) {
-    return manifest.sections.filter((s) => s.characteristics.executable).length;
-}

package/dist/domain/processCaptureParsing.js

@@ -1,21 +0,0 @@
-import { processCaptureSchema, } from "./processCapture.js";
-const verifiedCaptures = new WeakSet();
-const isVerifiedCapture = (capture) => verifiedCaptures.has(capture);
-const attachProof = (capture) => {
-    verifiedCaptures.add(capture);
-    if (isVerifiedCapture(capture))
-        return capture;
-    throw new TypeError("Process Capture proof ownership failed");
-};
-/** Parse unknown input and reject invalid commitments or semantics. */
-export const parseProcessCapture = (input) => {
-    const parsed = processCaptureSchema.safeParse(input);
-    if (parsed.success)
-        return attachProof(parsed.data);
-    const issues = parsed.error.issues.flatMap((issue) => issue.code === "custom"
-        ? [{ path: issue.path.join("."), message: issue.message }]
-        : []);
-    if (issues.length > 0)
-        throw new TypeError(`Invalid process capture: ${issues.map(({ path, message }) => `${path}: ${message}`).join("; ")}`);
-    throw parsed.error;
-};

package/dist/domain/protocolCapture.js

@@ -1,217 +0,0 @@
-import { z } from "zod";
-import { jsonValueSchema } from "./jsonValue.js";
-/** Supported protocol families for structured protocol capture. */
-export const protocolFamilySchema = z.enum([
-    "grpc",
-    "protobuf",
-    "json-rpc",
-    "messagepack",
-]);
-/** A decoded field from a protocol message. */
-export const decodedFieldSchema = z.strictObject({
-    /** Field name or path within the message structure. */
-    path: z.string().min(1),
-    /** Wire type or encoding hint. */
-    wire_type: z.string().nullable(),
-    /** Decoded field value. */
-    value: jsonValueSchema.nullable(),
-    /** Whether this field value was inferred rather than decoded. */
-    inferred: z.boolean().default(false),
-});
-/** Schema inference hypothesis for a repeated message pattern. */
-export const schemaHypothesisSchema = z.strictObject({
-    /** Hypothesized field name. */
-    field_name: z.string().min(1),
-    /** Inferred type. */
-    inferred_type: z.string().min(1),
-    /** Confidence: 0-1 */
-    confidence: z.number().min(0).max(1),
-    /** Supporting evidence count. */
-    evidence_count: z.number().int().nonnegative(),
-});
-/** Result of decoding a single protocol message. */
-export const protocolMessageSchema = z.strictObject({
-    /** Monotonic sequence number. */
-    sequence: z.number().int().nonnegative(),
-    /** Timestamp in milliseconds. */
-    at_ms: z.number().int().nonnegative(),
-    /** Protocol family. */
-    family: protocolFamilySchema,
-    /** Direction of the message. */
-    direction: z.enum(["request", "response"]),
-    /** Transport endpoint or path (e.g. gRPC method path). */
-    endpoint: z.string().nullable(),
-    /** Content type of the raw payload. */
-    content_type: z.string().nullable(),
-    /** Raw payload bytes as base64. */
-    raw_payload: z.string().nullable(),
-    /** Decoded fields from the payload. */
-    decoded_fields: z.array(decodedFieldSchema).default([]),
-    /** Inferred schema hypotheses. */
-    schema_hypotheses: z.array(schemaHypothesisSchema).default([]),
-    /** Whether decoding was truncated. */
-    truncated: z.boolean().default(false),
-    /** Whether the capture producer marked credentials as redacted. */
-    credentials_redacted: z.boolean().default(false),
-});
-/** A captured protocol session with messages and inferred schemas. */
-export const protocolCaptureSchema = z.strictObject({
-    /** Protocol family for this capture. */
-    family: protocolFamilySchema,
-    /** Captured messages in order. */
-    messages: z.array(protocolMessageSchema).min(0),
-    /** Aggregated schema hypotheses across all messages. */
-    inferred_schema: z.array(schemaHypothesisSchema).default([]),
-    /** Whether any message was truncated. */
-    has_truncated: z.boolean().default(false),
-    /** Whether the capture producer marked credential content as redacted. */
-    credentials_detected: z.boolean().default(false),
-});
-/** Classification of a byte sequence as a known protocol family. */
-export function classifyProtocolFamily(contentType, path) {
-    if (contentType) {
-        if (contentType.includes("application/grpc"))
-            return "grpc";
-        if (contentType.includes("application/x-protobuf"))
-            return "protobuf";
-        if (contentType.includes("application/json-rpc"))
-            return "json-rpc";
-        if (contentType.includes("application/msgpack") ||
-            contentType.includes("application/x-msgpack"))
-            return "messagepack";
-    }
-    if (path) {
-        if (path.startsWith("/grpc.") || path.includes("/grpc/"))
-            return "grpc";
-        if (path.includes("/json-rpc") || path.includes("/jsonrpc"))
-            return "json-rpc";
-    }
-    return null;
-}
-/** Decode a JSON-RPC message from raw payload bytes. */
-export function decodeJsonRpc(rawPayload) {
-    const text = new TextDecoder().decode(rawPayload);
-    const parsed = jsonValueSchema.parse(JSON.parse(text));
-    const fields = [];
-    if (typeof parsed === "object" && parsed !== null) {
-        for (const [key, value] of Object.entries(parsed)) {
-            fields.push({
-                path: key,
-                wire_type: "json",
-                value,
-                inferred: false,
-            });
-        }
-    }
-    return { decoded_fields: fields, truncated: false };
-}
-/** Decode a MessagePack message (simplified: only checks basic structure). */
-export function decodeMessagePack(rawPayload) {
-    const fields = [];
-    // MessagePack uses a single-byte type tag
-    if (rawPayload.length === 0) {
-        return { decoded_fields: [], truncated: false };
-    }
-    const tag = rawPayload[0];
-    if (tag === undefined)
-        return { decoded_fields: [], truncated: false };
-    // Map type: 0x80-0x8f (fixmap), 0xde (map16), 0xdf (map32)
-    if ((tag >= 0x80 && tag <= 0x8f) || tag === 0xde || tag === 0xdf) {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "map",
-            inferred: false,
-        });
-    }
-    // Array type: 0x90-0x9f (fixarray), 0xdc (array16), 0xdd (array32)
-    else if ((tag >= 0x90 && tag <= 0x9f) || tag === 0xdc || tag === 0xdd) {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "array",
-            inferred: false,
-        });
-    }
-    else {
-        fields.push({
-            path: "type",
-            wire_type: "msgpack",
-            value: "unknown",
-            inferred: true,
-        });
-    }
-    return {
-        decoded_fields: fields,
-        truncated: false,
-    };
-}
-/** Decode a gRPC frame (5-byte header + protobuf payload). */
-export function decodeGrpcFrame(rawPayload) {
-    // gRPC uses a 5-byte prefix: 1 byte compressed flag + 4 byte length
-    if (rawPayload.length < 5) {
-        return {
-            decoded_fields: [
-                {
-                    path: "error",
-                    wire_type: "grpc",
-                    value: "frame too short",
-                    inferred: false,
-                },
-            ],
-            truncated: false,
-        };
-    }
-    const compressed = rawPayload[0] !== 0;
-    const length = ((rawPayload[1] ?? 0) << 24) |
-        ((rawPayload[2] ?? 0) << 16) |
-        ((rawPayload[3] ?? 0) << 8) |
-        (rawPayload[4] ?? 0);
-    return {
-        decoded_fields: [
-            {
-                path: "compressed",
-                wire_type: "grpc",
-                value: compressed,
-                inferred: false,
-            },
-            {
-                path: "message_length",
-                wire_type: "grpc",
-                value: length,
-                inferred: false,
-            },
-        ],
-        truncated: false,
-    };
-}
-/** Infer schema hypotheses from a set of decoded messages. */
-export function inferMessageSchema(messages) {
-    const fieldCounts = new Map();
-    for (const msg of messages) {
-        for (const field of msg.decoded_fields) {
-            const existing = fieldCounts.get(field.path);
-            if (existing) {
-                existing.count++;
-                if (field.wire_type)
-                    existing.types.add(field.wire_type);
-            }
-            else {
-                fieldCounts.set(field.path, {
-                    count: 1,
-                    types: new Set(field.wire_type ?? "unknown"),
-                });
-            }
-        }
-    }
-    const hypotheses = [];
-    for (const [field_name, data] of fieldCounts) {
-        hypotheses.push({
-            field_name,
-            inferred_type: [...data.types].join("|"),
-            confidence: Math.min(1, data.count / messages.length || 0),
-            evidence_count: data.count,
-        });
-    }
-    return hypotheses;
-}