rea-agents 6.2.0 → 6.4.0

package/dist/domain/apple/appleApplication.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { appleBundleSchema, appleComponentSchema, applicationRoots, detectBundles, isMachOFormat, isSidecar, isWithin, platformsOf, } from "./appleBundleAnatomy.js";
+import { anatomyNameIs, anatomyTailMatches, appleBundleSchema, appleComponentSchema, applicationRoots, detectBundles, isMachOFormat, isSidecar, isWithin, platformsOf, } from "./appleBundleAnatomy.js";
+import { isSwiftRuntimeLibrary, nativeRuntimeConvention, } from "../nativeConvention.js";
 import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js";
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
@@ -166,48 +167,61 @@ const appleRootFormat = (format) => {
 };
 const classifyComponents = (entries, all, roots) => {
     const withinApp = (path) => roots.some((root) => isWithin(path, root));
-    const anatomy = (pattern) => entries.flatMap(({ path, kind, component }) => kind === "file" &&
+    const matching = (predicate) => entries.flatMap(({ path, kind, component }) => kind === "file" &&
         component !== undefined &&
         !isSidecar(path) &&
         withinApp(path) &&
-        pattern.test(path)
+        predicate(path)
         ? [component]
         : []);
+    const lastSegment = (path) => path.split("/").at(-1) ?? "";
     return {
-        bundle_metadata: all.filter(({ path }) => /(?:^|\/)Info\.plist$/u.test(path)),
+        bundle_metadata: all.filter(({ path }) => anatomyNameIs(lastSegment(path), "Info.plist")),
         executables: all.filter(({ path, format }) => withinApp(path) && isMachOFormat(format)),
         frameworks: all.filter(({ path }) => /\.framework\//u.test(path)),
         native_libraries: all.filter(({ path }) => /\.(?:dylib|so)$/iu.test(path)),
         javascript: all.filter(({ format }) => format === "javascript-bundle"),
-        signing: all.filter(({ path }) => /(?:^|\/)(?:embedded\.(?:mobileprovision|provisionprofile)|_CodeSignature\/CodeResources)$/u.test(path)),
-        privileged_helpers: anatomy(/(?:^|\/)Contents\/Library\/LaunchServices\/[^/]+$/u),
-        launchd_plists: anatomy(/(?:^|\/)Contents\/Library\/Launch(?:Agents|Daemons)\/[^/]+\.plist$/u).map((component) => ({
+        signing: all.filter(({ path }) => anatomyTailMatches(path, ["_CodeSignature", "CodeResources"]) ||
+            anatomyNameIs(lastSegment(path), "embedded.mobileprovision") ||
+            anatomyNameIs(lastSegment(path), "embedded.provisionprofile")),
+        privileged_helpers: matching((path) => anatomyTailMatches(path, ["Contents", "Library", "LaunchServices", "*"])),
+        launchd_plists: matching((path) => path.endsWith(".plist") &&
+            (anatomyTailMatches(path, [
+                "Contents",
+                "Library",
+                "LaunchAgents",
+                "*",
+            ]) ||
+                anatomyTailMatches(path, [
+                    "Contents",
+                    "Library",
+                    "LaunchDaemons",
+                    "*",
+                ]))).map((component) => ({
             ...component,
-            domain: component.path.includes("/LaunchDaemons/")
+            domain: component.path
+                .split("/")
+                .some((segment) => anatomyNameIs(segment, "LaunchDaemons"))
                 ? "daemon"
                 : "agent",
         })),
-        helpers: anatomy(/(?:^|\/)Contents\/Helpers\/[^/]+$/u),
+        helpers: matching((path) => anatomyTailMatches(path, ["Contents", "Helpers", "*"])),
     };
 };
 const deduplicateComponents = (values) => [...new Map(values.map((value) => [value.path, value])).values()].sort((left, right) => compare(left.path, right.path));
 const identifyRuntimeFamilies = (all) => {
-    const paths = all.map(({ path }) => path.toLowerCase());
     const families = new Set();
     if (all.some(({ format }) => ["mach-o", "mach-o-universal"].includes(format)))
         families.add("native");
-    if (paths.some((path) => /\.(?:dylib|framework\/[^/]+)$/u.test(path)))
+    if (all.some(({ path }) => isSwiftRuntimeLibrary(path)))
         families.add("swift-objective-c");
     if (all.some(({ format }) => format === "javascript-bundle"))
         families.add("javascript");
-    if (paths.some((path) => path.includes("reactnative") ||
-        path.includes("react.framework") ||
-        path.includes("hermes")))
-        families.add("react-native");
-    if (paths.some((path) => path.includes("flutter.framework") || path.includes("app.framework")))
-        families.add("flutter");
-    if (paths.some((path) => path.includes("unityframework.framework")))
-        families.add("unity");
+    for (const { path } of all) {
+        const convention = nativeRuntimeConvention(path);
+        if (convention !== null)
+            families.add(convention);
+    }
     return [...families].sort(compare);
 };
 /** Pair scripts and native code within matching application-root groups. */
@@ -243,12 +257,12 @@ const identifyBridgeCandidates = (scripts, native, roots) => {
     });
 };
 const bridgeBasis = (path) => {
-    const lower = path.toLowerCase();
-    if (lower.includes("react"))
+    const convention = nativeRuntimeConvention(path);
+    if (convention === "react-native")
         return "react-native-convention";
-    if (lower.includes("flutter") || lower.includes("app.framework"))
+    if (convention === "flutter")
         return "flutter-convention";
-    if (lower.includes("unity"))
+    if (convention === "unity")
         return "unity-convention";
     return "javascript-and-native-content";
 };
@@ -293,7 +307,10 @@ const projectionLimitations = (facts) => [
         : []),
     "Bundle roles follow path conventions. Read each info_plist_path with inspect_plist for CFBundleExecutable, identifiers, and declared services.",
     "Bundle identifiers and signing claims require dedicated plist and CMS parsing; this projection reports only exact paths and hashes.",
+    "Runtime families are inferred from inventory formats and bounded framework path conventions, not observed runtime loading.",
+    "Generic framework and dylib paths do not establish Swift or Objective-C; this inventory projection does not decode language metadata.",
     "Bridge candidates are path-based hypotheses, not observed runtime calls.",
+    "A bridge basis is inferred from the native path and is repeated for every managed component.",
 ];
 const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const digest = (value) => {

package/dist/domain/apple/appleBundleAnatomy.js

@@ -42,6 +42,42 @@ export const isSidecar = (path) => {
     return (segments.includes("__MACOSX") || (segments.at(-1) ?? "").startsWith("._"));
 };
 export const isWithin = (path, root) => root === "." || path === root || path.startsWith(`${root}/`);
+/**
+ * English (en-US) case fold used only for Apple's fixed anatomy vocabulary.
+ * Reported paths keep the archive spelling. Inventory identity stays case-sensitive.
+ */
+export const anatomyNameIs = (actual, expected) => actual.toLocaleLowerCase("en-US") === expected.toLocaleLowerCase("en-US");
+/** Directory entry that folds to one vocabulary word. The exact spelling wins. */
+export const anatomyChild = (names, expected) => {
+    if (names === undefined)
+        return null;
+    let exact;
+    let folded;
+    for (const name of names) {
+        if (name === expected)
+            exact = name;
+        else if (anatomyNameIs(name, expected) &&
+            (folded === undefined || compare(name, folded) < 0))
+            folded = name;
+    }
+    return exact ?? folded ?? null;
+};
+/**
+ * Whether `path`'s tail matches anatomy vocabulary. `*` matches one segment
+ * that is not itself a vocabulary comparison.
+ */
+export const anatomyTailMatches = (path, expected) => {
+    const actual = path.split("/");
+    if (actual.length < expected.length)
+        return false;
+    const tail = actual.slice(-expected.length);
+    return expected.every((name, index) => {
+        const segment = tail[index];
+        if (segment === undefined || segment.length === 0)
+            return false;
+        return name === "*" || anatomyNameIs(segment, name);
+    });
+};
 /**
  * Outermost iOS (`Payload/X.app`) and macOS (`X.app/Contents/…`) applications.
  * An inventoried `.app` directory is its own root, `.`.
@@ -55,13 +91,16 @@ export const applicationRoots = (entries, subject) => {
     for (const { path } of entries) {
         if (isSidecar(path))
             continue;
-        const ios = /^(Payload\/[^/]+\.app)(?:\/|$)/u.exec(path);
-        if (ios?.[1] !== undefined) {
-            found.add(ios[1]);
+        const segments = path.split("/");
+        const app = segments[1];
+        if (anatomyNameIs(segments[0] ?? "", "Payload") &&
+            app !== undefined &&
+            /\.app$/iu.test(app)) {
+            found.add(`${segments[0]}/${app}`);
             continue;
         }
-        const segments = path.split("/");
-        const index = segments.findIndex((segment, position) => /\.app$/iu.test(segment) && segments[position + 1] === "Contents");
+        const index = segments.findIndex((segment, position) => /\.app$/iu.test(segment) &&
+            anatomyNameIs(segments[position + 1] ?? "", "Contents"));
         if (index >= 0)
             found.add(segments.slice(0, index + 1).join("/"));
     }
@@ -142,9 +181,9 @@ const enclosingBundle = (path, bundles) => {
 };
 const bundleLayout = (bundle, tree) => {
     const names = tree.children.get(directoryOf(bundle));
-    if (names?.has("Contents") === true)
+    if (anatomyChild(names, "Contents") !== null)
         return "macos-deep";
-    if (names?.has("Versions") === true)
+    if (anatomyChild(names, "Versions") !== null)
         return "versioned-framework";
     return "shallow";
 };
@@ -163,15 +202,18 @@ const bundleRole = (bundle) => {
     if (name.endsWith(".dext"))
         return "driver-extension";
     if (name.endsWith(".bundle")) {
-        if (container === "PlugIns")
+        if (anatomyNameIs(container ?? "", "PlugIns"))
             return "plug-in";
-        return container === "Resources" ? "resource-bundle" : "bundle";
+        return anatomyNameIs(container ?? "", "Resources")
+            ? "resource-bundle"
+            : "bundle";
     }
     if (!name.endsWith(".app"))
         return "plug-in";
-    if (container === "LoginItems" && segments.at(-3) === "Library")
+    if (anatomyNameIs(container ?? "", "LoginItems") &&
+        anatomyNameIs(segments.at(-3) ?? "", "Library"))
         return "login-item";
-    if (container === "Helpers")
+    if (anatomyNameIs(container ?? "", "Helpers"))
         return "helper-application";
     return "nested-application";
 };
@@ -183,42 +225,67 @@ const directFiles = (directory, tree) => [...(tree.children.get(directory) ?? []
 /** Content directories; `Versions/Current` is a symlink outside the inventory. */
 const contentDirectories = (bundle, layout, tree) => {
     const directory = directoryOf(bundle);
-    if (layout === "macos-deep")
-        return [joinPath(directory, "Contents")];
+    if (layout === "macos-deep") {
+        const contents = namedChild(tree, directory, "Contents");
+        return contents === null ? [] : [contents];
+    }
     if (layout === "shallow")
         return [directory];
-    const versions = joinPath(directory, "Versions");
+    const versions = namedChild(tree, directory, "Versions");
+    if (versions === null)
+        return [];
     // Only real version directories count: Current is a symlink, and files
     // such as .DS_Store are not versions.
     return [...(tree.children.get(versions) ?? [])]
-        .filter((version) => version !== "Current")
+        .filter((version) => !anatomyNameIs(version, "Current"))
         .map((version) => joinPath(versions, version))
         .filter((version) => tree.directories.has(version))
         .sort(compare);
 };
+/** Child path using the archive's spelling of one anatomy name. */
+const namedChild = (tree, directory, expected) => {
+    const name = anatomyChild(tree.children.get(directory), expected);
+    return name === null ? null : joinPath(directory, name);
+};
 const infoPlistPath = (bundle, layout, tree) => {
     const directories = contentDirectories(bundle, layout, tree);
     // With several real versions, Versions/Current (a symlink outside the
     // inventory) decides which plist applies, so the plist stays unknown.
     if (directories.length !== 1)
         return null;
-    const candidates = directories
-        .map((directory) => joinPath(directory, layout === "versioned-framework"
-        ? "Resources/Info.plist"
-        : "Info.plist"))
-        .filter((path) => tree.files.has(path));
-    return candidates.length === 1 ? (candidates[0] ?? null) : null;
+    const directory = directories[0];
+    if (directory === undefined)
+        return null;
+    const parent = layout === "versioned-framework"
+        ? namedChild(tree, directory, "Resources")
+        : directory;
+    if (parent === null)
+        return null;
+    const info = namedChild(tree, parent, "Info.plist");
+    return info !== null && tree.files.has(info) ? info : null;
 };
 const executableCandidates = (bundle, layout, tree) => contentDirectories(bundle, layout, tree)
-    .flatMap((directory) => directFiles(layout === "macos-deep" ? joinPath(directory, "MacOS") : directory, tree))
+    .flatMap((directory) => {
+    const executableDirectory = layout === "macos-deep"
+        ? namedChild(tree, directory, "MacOS")
+        : directory;
+    return executableDirectory === null
+        ? []
+        : directFiles(executableDirectory, tree);
+})
     .filter((path) => MACH_O_FORMATS.includes(tree.files.get(path)?.format ?? ""));
 const signingPaths = (bundle, layout, tree) => contentDirectories(bundle, layout, tree)
-    .flatMap((directory) => [
-    joinPath(directory, "_CodeSignature/CodeResources"),
-    joinPath(directory, "embedded.provisionprofile"),
-    joinPath(directory, "embedded.mobileprovision"),
-])
-    .filter((path) => tree.files.has(path))
+    .flatMap((directory) => {
+    const signature = namedChild(tree, directory, "_CodeSignature");
+    return [
+        signature === null
+            ? null
+            : namedChild(tree, signature, "CodeResources"),
+        namedChild(tree, directory, "embedded.provisionprofile"),
+        namedChild(tree, directory, "embedded.mobileprovision"),
+    ];
+})
+    .filter((path) => path !== null && tree.files.has(path))
     .sort(compare);
 /** Platforms of application roots whose layout was observed, not assumed. */
 export const platformsOf = (bundles) => [

package/dist/domain/apple/dyldPaths.js

@@ -11,6 +11,8 @@ export const resolveTreePath = async (view, input) => {
     let hops = 0;
     while (pending.length > 0) {
         const segment = pending.shift() ?? "";
+        if (segment === ".")
+            continue;
         if (segment === "..") {
             if (resolved.length === 0)
                 return { kind: "escapes" };
@@ -40,7 +42,13 @@ export const resolveTreePath = async (view, input) => {
         ? { kind: "file", path: resolved.join("/") }
         : { kind: "not-file" };
 };
-const segmentsOf = (path) => path.split("/").filter((segment) => segment !== "" && segment !== ".");
+const segmentsOf = (path) => {
+    const segments = path.split("/").filter((segment) => segment !== "");
+    // a trailing slash requires a directory, just like a final dot component.
+    if (path.endsWith("/"))
+        segments.push(".");
+    return segments;
+};
 export const directoryOf = (path) => {
     const index = path.lastIndexOf("/");
     return index < 0 ? "" : path.slice(0, index);

package/dist/domain/apple/dylibResolution.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { compatibleSlice, directoryOf, expandPrefix, joinPath, resolveTreePath, } from "./dyldPaths.js";
+import { compatibleSlice, directoryOf, expandPrefix, resolveTreePath, } from "./dyldPaths.js";
 import { digestSchema } from "../digests.js";
 import { hasApplicableDyldOverrides, embeddedDyldOverrides, } from "./dyldEnvironment.js";
 import { DYLIB_RESOLUTION_LIMITATIONS, deriveFindings, } from "./dylibResolutionFindings.js";
@@ -8,7 +8,7 @@ import { DYLIB_RESOLUTION_LIMITATIONS, deriveFindings, } from "./dylibResolution
  * `/`, none of them `.` or `..`, without backslash or NUL. Advertised schema
  * patterns avoid look-around, which RE2 and Rust validators reject.
  */
-const ROOT_RELATIVE_PATH = /^(?:[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.\.[^\x2f\\\u0000]+)(?:\x2f(?:[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.\.[^\x2f\\\u0000]+))*$/u;
+const ROOT_RELATIVE_PATH = /^(?:[^\x2f\\\x00.][^\x2f\\\x00]*|\.[^\x2f\\\x00.][^\x2f\\\x00]*|\.\.[^\x2f\\\x00]+)(?:\x2f(?:[^\x2f\\\x00.][^\x2f\\\x00]*|\.[^\x2f\\\x00.][^\x2f\\\x00]*|\.\.[^\x2f\\\x00]+))*$/u;
 const rootRelativePathSchema = z
     .string()
     .min(1)
@@ -169,7 +169,7 @@ const candidateTemplates = (dependency, loader, context) => {
             scope: base.scope,
             path: base.scope === "outside"
                 ? `${base.path.replace(/\/+$/u, "")}/${rest}`
-                : joinPath(base.path, rest),
+                : `${base.path}${base.path === "" ? "" : "/"}${rest}`,
         };
         return { expansion, source: "rpath", rpath, rpathOwner: owner };
     }));

package/dist/domain/apple/interfaceBuilderGraph.js

@@ -30,13 +30,16 @@ export const buildInterfaceBuilderAnalysis = (input) => {
     let omittedHierarchyReferences = 0;
     for (const document of input.documents.slice(0, input.limits.max_documents)) {
         const parsed = parseInterfaceBuilderRecords(document.raw);
-        const prefix = `ib:${document.relativePath}:`;
+        const prefix = `ib:${JSON.stringify(document.relativePath)}:`;
+        const graphId = (kind, parts = []) => `${prefix}${kind}:${JSON.stringify(parts)}`;
         const rootId = `${prefix}root`;
         const objectIds = new Set(parsed.objects.map(({ id }) => id));
         const evidenceFor = (description) => [
             {
                 kind: "interface_builder_resource",
-                description: `${document.relativePath}: ${description}`,
+                // artifact_path names the archive; repeating it here cost a path per
+                // node and edge.
+                description,
                 location: { address: null, file_offset: null },
                 artifact_path: document.relativePath,
                 artifact_sha256: document.archiveSha256,
@@ -66,7 +69,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
         addNode(rootNode);
         let documentObjectCount = 0;
         for (const object of parsed.objects.slice(0, input.limits.max_objects)) {
-            const id = `${prefix}object:${object.id}`;
+            const id = graphId("object", [object.id]);
             const kind = object.kind === "other" ? "unknown" : object.kind;
             if (!addNode({
                 id,
@@ -88,7 +91,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
         let hierarchyEdgeCount = 0;
         let documentOmittedConnections = 0;
         let documentOmittedHierarchyEdges = 0;
-        const objectNodeId = (objectId) => `${prefix}object:${objectId}`;
+        const objectNodeId = (objectId) => graphId("object", [objectId]);
         const addEdge = (edge, isHierarchy) => {
             if (isHierarchy
                 ? hierarchyEdgeCount >= input.limits.max_objects
@@ -181,7 +184,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                     const known = objectIds.has(objectId);
                     const childId = known
                         ? objectNodeId(objectId)
-                        : `${prefix}unknown:${objectId}`;
+                        : graphId("unknown", [objectId]);
                     if (!known &&
                         !addNode({
                             id: childId,
@@ -192,7 +195,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                             evidence: evidenceFor(`hierarchy item ${objectId}`),
                         }))
                         hierarchyTruncated = true;
-                    connect(`${prefix}hierarchy:${parentId}:${childId}`, parentId, childId, "contains", `hierarchy ${objectId}`);
+                    connect(graphId("hierarchy", [parentId, childId]), parentId, childId, "contains", `hierarchy ${objectId}`);
                     nextParent = childId;
                     hierarchyCount += 1;
                 }
@@ -216,10 +219,10 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                 });
             const destinationId = item.destination_id === null ? null : objectNodeId(item.destination_id);
             if (item.kind === "action") {
-                const actionId = `${prefix}action:${item.id}`;
+                const actionId = graphId("action", [item.id]);
                 const selectorId = item.label === null
                     ? null
-                    : `${prefix}selector:${item.destination_id ?? "unknown"}:${item.label}`;
+                    : graphId("selector", [item.destination_id, item.label]);
                 addNode({
                     id: actionId,
                     kind: "action",
@@ -232,7 +235,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                     },
                     evidence: evidenceFor(`action ${item.id}`),
                 });
-                connect(`${actionId}:source`, sourceId, actionId, "target_action", `action source ${item.source_id}`);
+                connect(graphId("action-edge", [item.id, "source"]), sourceId, actionId, "target_action", `action source ${item.source_id}`);
                 if (selectorId !== null) {
                     addNode({
                         id: selectorId,
@@ -242,15 +245,15 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                         attributes: { destination_id: item.destination_id },
                         evidence: evidenceFor(`selector ${item.label}`),
                     });
-                    connect(`${actionId}:selector`, actionId, selectorId, "target_action", `selector ${item.label}`);
+                    connect(graphId("action-edge", [item.id, "selector"]), actionId, selectorId, "target_action", `selector ${item.label}`);
                 }
                 if (destinationId === null || !nodes.has(destinationId))
-                    connect(`${actionId}:destination`, actionId, null, "target_action", `action destination ${item.destination_id ?? "missing"}`, "destination_object_missing_or_external");
+                    connect(graphId("action-edge", [item.id, "destination"]), actionId, null, "target_action", `action destination ${item.destination_id ?? "missing"}`, "destination_object_missing_or_external");
                 else
-                    connect(`${actionId}:destination`, actionId, destinationId, "target_action", `action destination ${item.destination_id}`);
+                    connect(graphId("action-edge", [item.id, "destination"]), actionId, destinationId, "target_action", `action destination ${item.destination_id}`);
             }
             else if (item.kind === "outlet") {
-                const outletId = `${prefix}outlet:${item.id}`;
+                const outletId = graphId("outlet", [item.id]);
                 addNode({
                     id: outletId,
                     kind: "outlet",
@@ -259,20 +262,20 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                     attributes: item.attributes,
                     evidence: evidenceFor(`outlet ${item.id}`),
                 });
-                connect(`${outletId}:source`, sourceId, outletId, "contains", `outlet source ${item.source_id}`);
+                connect(graphId("outlet-edge", [item.id, "source"]), sourceId, outletId, "contains", `outlet source ${item.source_id}`);
                 if (destinationId === null || !nodes.has(destinationId))
-                    connect(`${outletId}:destination`, outletId, null, "outlet_to", `outlet ${item.label ?? item.id}`, "destination_object_missing_or_external");
+                    connect(graphId("outlet-edge", [item.id, "destination"]), outletId, null, "outlet_to", `outlet ${item.label ?? item.id}`, "destination_object_missing_or_external");
                 else
-                    connect(`${outletId}:destination`, outletId, destinationId, "outlet_to", `outlet ${item.label ?? item.id}`);
+                    connect(graphId("outlet-edge", [item.id, "destination"]), outletId, destinationId, "outlet_to", `outlet ${item.label ?? item.id}`);
             }
             else if (item.kind === "segue") {
                 if (destinationId === null || !nodes.has(destinationId))
-                    connect(`${prefix}segue:${index}`, sourceId, null, "segue_to", `segue ${item.label ?? item.id}`, "destination_scene_missing");
+                    connect(graphId("segue", [index]), sourceId, null, "segue_to", `segue ${item.label ?? item.id}`, "destination_scene_missing");
                 else
-                    connect(`${prefix}segue:${index}`, sourceId, destinationId, "segue_to", `segue ${item.label ?? item.id}`);
+                    connect(graphId("segue", [index]), sourceId, destinationId, "segue_to", `segue ${item.label ?? item.id}`);
             }
             else {
-                connect(`${prefix}unknown-connection:${index}`, sourceId, null, "contains", `connection type ${item.kind}`, "unsupported_connection_type");
+                connect(graphId("unknown-connection", [index]), sourceId, null, "contains", `connection type ${item.kind}`, "unsupported_connection_type");
             }
         }
         const objectsTruncated = parsed.omittedObjects > 0 || parsed.objects.length > documentObjectCount;

package/dist/domain/apple/interfaceBuilderKeyedArchive.js

@@ -44,12 +44,21 @@ export const parseInterfaceBuilderRecords = (value) => {
         const attributes = record(raw);
         const className = firstString(attributes["customClass"], attributes["class"], attributes["isa"]);
         const label = firstString(attributes["label"], attributes["title"], attributes["name"], className);
+        // class_name, name, and id already carry these values; repeating them in
+        // attributes doubled them on every graph node.
+        const carried = new Set();
+        if (attributes["customClass"] === className)
+            carried.add("customClass");
+        if (attributes["label"] === label)
+            carried.add("label");
+        if (attributes["objectID"] === id)
+            carried.add("objectID");
         objects.push(objectNode.parse({
             id,
             kind: classifyObject(className),
             class_name: className,
             name: label ?? id,
-            attributes: jsonSafeRecord(attributes),
+            attributes: jsonSafeRecord(Object.fromEntries(Object.entries(attributes).filter(([key]) => !carried.has(key)))),
         }));
     }
     for (const [sourceId, rawConnections] of Object.entries(connectionsRaw)) {

package/dist/domain/artifactComparison.js

@@ -1,10 +1,11 @@
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { z } from "zod";
 import {} from "./artifactGraph.js";
 import { evidenceSchema } from "./evidence.js";
 import { parseArtifactInventoryEvidence, } from "./artifactInventoryEvidence.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 import { canonicalJson } from "./comparisonSemantics.js";
+import { ZIP_NON_ENTRY_TAIL_LIMITATION } from "./zipPackageFormat.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const comparisonStatusSchema = z.enum([
     "unchanged",
@@ -95,6 +96,12 @@ export const compareArtifacts = (leftEvidence, rightEvidence) => {
         ...left.evidence.map(({ evidence_id: id }) => id),
         ...right.evidence.map(({ evidence_id: id }) => id),
     ], leftCovered && rightCovered);
+    const rootChange = rootHashChange(left.inventory, right.inventory, changes, [
+        ...left.evidence.map(({ evidence_id: id }) => id),
+        ...right.evidence.map(({ evidence_id: id }) => id),
+    ]);
+    if (rootChange !== null)
+        changes.push(rootChange);
     const summary = summarize(left.inventory, right.inventory, changes, leftCovered && rightCovered);
     return artifactComparisonResultSchema.parse({
         status: !leftComplete || !rightComplete
@@ -112,7 +119,7 @@ export const compareArtifacts = (leftEvidence, rightEvidence) => {
         right_manifest_id: right.inventory.manifest.manifest_id,
         summary,
         changes,
-        limitations: [...new Set(limitations)].sort(compareCodePoints),
+        limitations: [...new Set(limitations)].sort(compareUnicodeCodePoints),
     });
 };
 const compareOccurrences = (left, right, evidenceLinks, complete) => {
@@ -124,7 +131,7 @@ const compareOccurrences = (left, right, evidenceLinks, complete) => {
     const rightRelations = relationsByPath(right);
     const paths = [
         ...new Set([...leftByPath.keys(), ...rightByPath.keys()]),
-    ].sort(compareCodePoints);
+    ].sort(compareUnicodeCodePoints);
     const output = [];
     for (const path of paths) {
         const leftOccurrence = leftByPath.get(path);
@@ -251,18 +258,20 @@ const relationsByPath = (inventory) => {
     const output = new Map();
     const occurrences = new Map(inventory.occurrences.map((item) => [item.occurrence_id, item]));
     for (const edge of inventory.edges) {
-        const path = edge.logical_path ?? ".";
-        const values = output.get(path);
         const occurrence = occurrences.get(edge.occurrence_id);
+        // An incomplete inventory can omit the occurrence that names the child.
+        if (occurrence?.artifact_id === null || occurrence === undefined)
+            continue;
+        const path = occurrence.logical_path;
+        const values = output.get(path);
         const projection = {
-            parent_logical_path: occurrence?.parent_occurrence_id === null ||
-                occurrence?.parent_occurrence_id === undefined
+            parent_logical_path: occurrence.parent_occurrence_id === null
                 ? null
                 : (occurrences.get(occurrence.parent_occurrence_id)?.logical_path ??
                     null),
-            child_artifact_id: edge.child_artifact_id,
+            child_artifact_id: occurrence.artifact_id,
             relation: edge.relation,
-            logical_path: edge.logical_path,
+            logical_path: occurrence.logical_path,
             producer: edge.producer,
         };
         if (values === undefined)
@@ -271,7 +280,7 @@ const relationsByPath = (inventory) => {
             values.push(projection);
     }
     for (const values of output.values())
-        values.sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right)));
+        values.sort((left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right)));
     return output;
 };
 const summarize = (left, right, changes, covered) => {
@@ -302,4 +311,23 @@ const summarize = (left, right, changes, covered) => {
                 counts.contradiction),
     };
 };
-const hasCoverageLimitation = (limitations) => limitations.some((limitation) => !/integrity contradiction\(s\) were recorded/u.test(limitation));
+const hasCoverageLimitation = (limitations) => limitations.some((limitation) => limitation !== ZIP_NON_ENTRY_TAIL_LIMITATION &&
+    !/integrity contradiction\(s\) were recorded/u.test(limitation));
+const rootHashChange = (left, right, changes, evidenceLinks) => {
+    if (left.manifest.root_sha256 === right.manifest.root_sha256)
+        return null;
+    if (changes.some((change) => change.logical_path === "." && change.dimensions.includes("content")))
+        return null;
+    const leftRoot = left.occurrences.find((occurrence) => occurrence.logical_path === ".");
+    const rightRoot = right.occurrences.find((occurrence) => occurrence.logical_path === ".");
+    return {
+        classification: "changed",
+        logical_path: ".",
+        dimensions: ["content"],
+        left_occurrence_id: leftRoot?.occurrence_id ?? null,
+        right_occurrence_id: rightRoot?.occurrence_id ?? null,
+        left_artifact_id: leftRoot?.artifact_id ?? null,
+        right_artifact_id: rightRoot?.artifact_id ?? null,
+        evidence_links: [...evidenceLinks],
+    };
+};

package/dist/domain/artifactGraph.js

@@ -121,7 +121,7 @@ const artifactOccurrenceSchema = z.object({
     limitations: z.array(z.string()),
 });
 /** Observed bytes that contradict a container's declared integrity identity. */
-const integrityContradictionSchema = z.object({
+export const integrityContradictionSchema = z.object({
     contradiction_id: contradictionIdSchema,
     occurrence_id: occurrenceIdSchema,
     parent_artifact_id: artifactIdSchema,
@@ -134,12 +134,14 @@ const integrityContradictionSchema = z.object({
     provenance: z.literal("container-integrity-metadata-versus-observed-bytes"),
     limitations: z.array(z.string()).min(1),
 });
-/** Parent-child derivation relation between two content-addressed artifacts. */
+/**
+ * Parent-child derivation relation between two content-addressed artifacts.
+ * The child artifact and its logical path are those of the edge's occurrence.
+ */
 const artifactEdgeSchema = z.object({
     edge_id: edgeIdSchema,
     ordinal: z.number().int().min(0),
     parent_artifact_id: artifactIdSchema,
-    child_artifact_id: artifactIdSchema,
     relation: z.enum([
         "contains",
         "extracts",
@@ -150,7 +152,6 @@ const artifactEdgeSchema = z.object({
         "derived-from",
     ]),
     occurrence_id: occurrenceIdSchema,
-    logical_path: boundedRelativePathSchema.nullable(),
     producer: artifactCommandSchema.nullable(),
 });
 /** Stable cryptographic commitment and counts for a complete artifact graph. */
@@ -203,5 +204,6 @@ export const artifactExtractionResultSchema = z.object({
         residual_paths: z.array(boundedRelativePathSchema),
     }),
     provenance: z.array(artifactCommandSchema),
+    integrity_contradictions: z.array(integrityContradictionSchema),
     limitations: z.array(z.string()),
 });