rea-agents 6.3.0 → 6.4.0

package/dist/domain/analysisSnapshot.js

@@ -3,12 +3,13 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { analysisProfileSchema, analysisProfilesEqual, committedProviderSchema, } from "./analysisProfile.js";
+import { BINARY_ARCHITECTURES, } from "./binaryTargetTypes.js";
 import { evidenceBundleForTarget, evidenceBundleSchema, parseEvidenceBundle, } from "./evidenceBundle.js";
 import { evidenceLocationSchema, } from "./evidence.js";
 import { jsonObjectSchema, jsonValueSchema, } from "./jsonValue.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
-const architectureSchema = z.enum(["x86", "x86_64", "arm", "arm64"]);
+const architectureSchema = z.enum(BINARY_ARCHITECTURES);
 const formatSchema = z.enum([
     "analysis-database",
     "mach-o",

package/dist/domain/analysisView/analysisView.js

@@ -6,10 +6,12 @@ import { evidenceSchema } from "../evidence.js";
 import { jsonObjectSchema, jsonValueSchema } from "../jsonValue.js";
 import { err, ok } from "../result.js";
 import { binaryLayoutSchema } from "../native/binaryLayout.js";
+import { functionDossierSchema } from "../hopperValues.js";
 import { parseOwnedJavaScriptApplicationAnalysisSteps, } from "../javascript/javascriptApplicationAnalysis.js";
 import { analysisInputErrorFromIssues } from "../inputIssueProjection.js";
 import { projectBinaryLayoutView } from "./binaryLayoutView.js";
 import { projectJavaScriptApplicationView } from "./javascriptApplicationView.js";
+import { projectNativeFunctionView } from "./nativeFunctionView.js";
 /** Public name of the selected-view workflow. */
 export const INSPECT_ANALYSIS_VIEW_OPERATION = "inspect_analysis_view";
 const summaryViewSchema = z.strictObject({ kind: z.literal("summary") });
@@ -57,12 +59,40 @@ const pageViewSchema = z.strictObject({
     offset: z.number().int().nonnegative(),
     limit: z.number().int().positive(),
 });
+/** Bounded native function facets of already authenticated analyze_function Evidence. */
+const nativeViewSchema = z.strictObject({
+    kind: z.literal("native"),
+    facet: z.enum([
+        "procedure",
+        "pseudocode",
+        "assembly",
+        "basic_blocks",
+        "comments",
+        "callers",
+        "callees",
+        "incoming_references",
+        "outgoing_references",
+        "unresolved_calls",
+        "referenced_strings",
+        "referenced_names",
+        "native_api",
+        "value_flow_summary",
+        "value_flow_operations",
+        "value_flow_def_use",
+        "value_flow_effects",
+        "value_flow_parameters",
+        "value_flow_parameter_uses",
+    ]),
+    offset: z.number().int().nonnegative().default(0),
+    limit: z.number().int().positive().default(64),
+});
 /** Caller-selected projection of already completed analysis Evidence. */
 export const analysisViewRequestSchema = z.discriminatedUnion("kind", [
     summaryViewSchema,
     facetViewSchema,
     itemViewSchema,
     pageViewSchema,
+    nativeViewSchema,
 ]);
 /** Inline Evidence or an exact same-session retained reference. */
 export const analysisViewSourceSchema = z.discriminatedUnion("kind", [
@@ -88,7 +118,9 @@ const coverageSchema = z.strictObject({
     exhausted: z.boolean(),
 });
 const artifactSchema = z.strictObject({
-    path: z.string().min(1),
+    path: z
+        .string()
+        .describe("Exact recorded artifact path, including an empty string."),
     sha256: digestSchema,
 });
 const layoutSummarySchema = z.strictObject({
@@ -127,6 +159,7 @@ const viewResultBase = {
     parent_operation: z.enum([
         "inspect_binary_layout",
         "analyze_javascript_application",
+        "analyze_function",
     ]),
     parent_digest: digestSchema,
     view_digest: digestSchema,
@@ -161,6 +194,13 @@ export const analysisViewResultSchema = z.discriminatedUnion("kind", [
         items: z.array(jsonValueSchema),
         ...viewResultBase,
     }),
+    z.strictObject({
+        kind: z.literal("native"),
+        view: nativeViewSchema,
+        procedure_address: z.string().nullable(),
+        item: jsonValueSchema,
+        ...viewResultBase,
+    }),
 ]);
 /** Construct a typed input failure for one selected-view constraint. */
 export const analysisViewInputError = (issues) => new AnalysisInputError(INSPECT_ANALYSIS_VIEW_OPERATION, undefined, issues);
@@ -189,7 +229,7 @@ const parseJavaScriptParent = (input) => {
         })), { source: { normalized_result: input } }, { cause }));
     }
 };
-const unsupportedParent = (parent) => new AnalysisUnsupportedTargetError(INSPECT_ANALYSIS_VIEW_OPERATION, parentArtifactPath(parent), `Parent Evidence operation ${JSON.stringify(parent.operation)} is not inspect_binary_layout or analyze_javascript_application.`);
+const unsupportedParent = (parent) => new AnalysisUnsupportedTargetError(INSPECT_ANALYSIS_VIEW_OPERATION, parentArtifactPath(parent), `Parent Evidence operation ${JSON.stringify(parent.operation)} is not inspect_binary_layout, analyze_javascript_application or analyze_function.`);
 const parentArtifactPath = (parent) => {
     if (typeof parent.normalizedResult === "object" &&
         parent.normalizedResult !== null &&
@@ -237,5 +277,15 @@ export const projectAnalysisView = (parent, view) => {
         const projected = projectJavaScriptApplicationView(parent, analysis.value, view);
         return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
     }
+    if (parent.operation === "analyze_function") {
+        const native = functionDossierSchema.safeParse(parent.normalizedResult);
+        if (!native.success)
+            return err(analysisInputErrorFromIssues(INSPECT_ANALYSIS_VIEW_OPERATION, native.error.issues.map((issue) => ({
+                ...issue,
+                path: ["source", "normalized_result", ...issue.path],
+            })), { source: { normalized_result: parent.normalizedResult } }, { cause: native.error }));
+        const projected = projectNativeFunctionView(parent, native.data, view);
+        return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
+    }
     return err(unsupportedParent(parent));
 };

package/dist/domain/analysisView/binaryLayoutView.js

@@ -96,6 +96,8 @@ const layoutSummary = (layout) => ({
 /** Project one layout view without re-running the decoder. */
 export const projectBinaryLayoutView = (parent, layout, view) => {
     const shared = parentFields(parent, layout);
+    if (view.kind === "native")
+        return err(layoutIncompatible("Native views require analyze_function Evidence."));
     if (view.kind === "summary")
         return ok({
             kind: "summary",

package/dist/domain/analysisView/javascriptApplicationView.js

@@ -176,6 +176,8 @@ const selectModule = (modules, selector) => {
 export const projectJavaScriptApplicationView = (parent, analysis, view) => {
     const shared = parentFields(parent, analysis);
     const modules = moduleEntries(analysis.graph.nodes);
+    if (view.kind === "native")
+        return err(jsIncompatible("Native views require analyze_function Evidence."));
     if (view.kind === "summary")
         return ok({
             kind: "summary",

package/dist/domain/analysisView/nativeFunctionView.js

@@ -0,0 +1,155 @@
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { jsonValueSchema } from "../jsonValue.js";
+import { err, ok } from "../result.js";
+import { analysisViewInputError, } from "./analysisView.js";
+import { completeWithinViewCoverage, pageViewCoverage, } from "./analysisViewCoverage.js";
+const viewError = (message) => analysisViewInputError([
+    { path: ["view"], reason: "invalid_value", message },
+]);
+const parentFields = (parent, dossier, artifact) => {
+    const flow = dossier.native_value_flow;
+    const api = dossier.native_api;
+    const unknowns = [];
+    if (flow === null)
+        unknowns.push("native_value_flow was not recorded");
+    else if (!flow.available)
+        unknowns.push("native_value_flow unavailable: " + flow.reason);
+    else if (flow.truncated)
+        unknowns.push("native_value_flow is truncated; omitted observations remain unknown");
+    if (api === null)
+        unknowns.push("native_api was not recorded");
+    else if (!api.available)
+        unknowns.push("native_api unavailable: " + api.reason, ...api.residual_unknowns);
+    return {
+        parent_evidence_id: parent.evidenceId,
+        parent_operation: "analyze_function",
+        parent_digest: parent.evidenceId.slice(3),
+        procedure_address: dossier.procedure.address,
+        artifact,
+        limitations: uniqueSorted([
+            ...parent.limitations,
+            ...dossier.limitations,
+            ...(flow?.limitations ?? []),
+            ...(api?.available ? api.limitations : []),
+        ]),
+        unknowns: uniqueSorted(unknowns),
+    };
+};
+const pseudocodePage = (body, offset, limit) => {
+    const start = Math.min(offset, body.length);
+    const high = (n) => n >= 0xd800 && n <= 0xdbff;
+    const low = (n) => n >= 0xdc00 && n <= 0xdfff;
+    if (start > 0 &&
+        start < body.length &&
+        high(body.charCodeAt(start - 1)) &&
+        low(body.charCodeAt(start)))
+        return err(viewError("Pseudocode offset splits a UTF-16 surrogate pair."));
+    let end = Math.min(start + limit, body.length);
+    if (end > start &&
+        end < body.length &&
+        high(body.charCodeAt(end - 1)) &&
+        low(body.charCodeAt(end)))
+        end--;
+    if (end === start && start < body.length)
+        return err(viewError("Increase pseudocode limit to include the next complete Unicode character."));
+    return ok({
+        item: { text: body.slice(start, end), unit: "utf16-code-units" },
+        coverage: pageViewCoverage(start, end - start, body.length),
+    });
+};
+const nativeRows = (dossier, facet) => {
+    const sourceFlow = dossier.native_value_flow;
+    const flow = sourceFlow?.available ? sourceFlow : undefined;
+    return {
+        assembly: dossier.assembly,
+        basic_blocks: dossier.basic_blocks,
+        comments: dossier.comments,
+        callers: dossier.callers,
+        callees: dossier.callees,
+        incoming_references: dossier.incoming_references,
+        outgoing_references: dossier.outgoing_references,
+        unresolved_calls: dossier.unresolved_calls,
+        referenced_strings: dossier.referenced_strings,
+        referenced_names: dossier.referenced_names,
+        value_flow_operations: flow?.operations,
+        value_flow_def_use: flow?.def_use,
+        value_flow_effects: flow?.effects,
+        value_flow_parameters: flow?.parameters,
+        value_flow_parameter_uses: flow?.parameter_uses,
+    }[facet];
+};
+/** Project bounded native function facets from complete retained Evidence without reanalysis. */
+export const projectNativeFunctionView = (parent, dossier, view) => {
+    if (view.kind !== "native")
+        return err(viewError("analyze_function Evidence requires a native view."));
+    const artifact = parent.artifact;
+    if (!artifact)
+        return err(analysisViewInputError([
+            {
+                path: ["source", "subject"],
+                reason: "invalid_value",
+                message: "Native function Evidence requires an artifact-bound subject.",
+            },
+        ]));
+    const common = parentFields(parent, dossier, artifact);
+    const singleton = (item) => ({
+        kind: "native",
+        view,
+        item: jsonValueSchema.parse(item),
+        coverage: completeWithinViewCoverage(1, 1),
+        ...common,
+    });
+    const flow = dossier.native_value_flow;
+    if (view.facet === "procedure" ||
+        view.facet === "native_api" ||
+        view.facet === "value_flow_summary") {
+        if (view.offset !== 0)
+            return err(viewError("Singleton native facets require offset 0."));
+        if (view.facet === "procedure")
+            return ok(singleton(dossier.procedure));
+        if (view.facet === "native_api")
+            return ok(singleton(dossier.native_api ?? { available: false, reason: "not recorded" }));
+        const status = flow === null
+            ? { available: false, reason: "not recorded" }
+            : !flow.available
+                ? { available: false, reason: flow.reason }
+                : {
+                    available: true,
+                    provenance: flow.provenance,
+                    truncated: flow.truncated,
+                    omitted_operations_lower_bound: flow.omitted_operations_lower_bound,
+                    known_omitted_inputs: flow.known_omitted_inputs,
+                    known_omitted_edges: flow.known_omitted_edges,
+                    operations: flow.operations.length,
+                    def_use: flow.def_use.length,
+                    effects: flow.effects.length,
+                    parameters: flow.parameters.length,
+                    parameter_uses: flow.parameter_uses.length,
+                };
+        return ok(singleton(status));
+    }
+    if (view.facet === "pseudocode") {
+        const page = pseudocodePage(dossier.pseudocode, view.offset, view.limit);
+        return page.ok
+            ? ok({ kind: "native", view, ...page.value, ...common })
+            : page;
+    }
+    const rows = nativeRows(dossier, view.facet);
+    if (rows === undefined)
+        return ok(singleton({
+            available: false,
+            // Only value-flow facets inherit the value-flow failure reason; an
+            // older dossier simply has no unresolved_calls record.
+            reason: view.facet.startsWith("value_flow_") && flow?.available === false
+                ? flow.reason
+                : "not recorded",
+        }));
+    const items = rows.slice(view.offset, view.offset + view.limit);
+    return ok({
+        kind: "native",
+        view,
+        item: jsonValueSchema.parse(items),
+        coverage: pageViewCoverage(view.offset, items.length, rows.length),
+        ...common,
+    });
+};

package/dist/domain/android/androidApplication.js

@@ -6,6 +6,7 @@ import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
 import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "../bridgeCandidateProjection.js";
+import { nativeRuntimeConvention } from "../nativeConvention.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const componentSchema = z.strictObject({
@@ -65,7 +66,7 @@ export const projectAndroidApplication = (input) => {
     const parsed = androidApplicationProjectionInputSchema.parse(input);
     const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
     if (inventory.manifest.root_format !== "apk")
-        throw new TypeError("Android application projection requires APK Evidence");
+        throw new TypeError(`Android application projection requires APK inventory Evidence; the inventory root format is ${inventory.manifest.root_format}. APK is chosen for a ZIP archive whose name ends in .apk.`);
     const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
     const all = inventory.occurrences
         .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
@@ -90,6 +91,13 @@ export const projectAndroidApplication = (input) => {
         "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
         "Runtime families are inferred from inventory formats and paths; filename suffixes do not establish valid DEX or JVM class bytes.",
         "Bridge candidates are path-based hypotheses, not decoded JNI declarations or observed runtime calls.",
+        "A bridge basis is inferred from the native path and is repeated for every managed component.",
+        "ZIP inventory cannot see the APK Signing Block, so an empty signing array does not mean the APK is unsigned.",
+        ...(all.some(({ path }) => path === "AndroidManifest.xml")
+            ? []
+            : [
+                "No root AndroidManifest.xml occurrence was observed. The APK family comes from the .apk suffix of a ZIP archive, so these bytes may not be an APK.",
+            ]),
         ...(bridgeProjection.coverage.status === "partial"
             ? [
                 `Bridge candidate pairs exceeded the projection safety budget; ${bridgeProjection.coverage.omitted_candidates} hypotheses are omitted. Component arrays still include every component from the supplied inventory pages.`,
@@ -120,32 +128,29 @@ export const projectAndroidApplication = (input) => {
     });
 };
 const classify = (all) => ({
-    manifests: all.filter(({ path, format }) => format === "android-manifest" ||
-        /(?:^|\/)AndroidManifest\.xml$/u.test(path)),
-    resources: all.filter(({ path, format }) => format === "android-resources" || /(?:^|\/)resources\.arsc$/u.test(path)),
-    dex: all.filter(({ path, format }) => format === "dex" || /(?:^|\/)[^/]+\.dex$/iu.test(path)),
-    jvm_classes: all.filter(({ path, format }) => format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path)),
+    manifests: all.filter(({ path }) => /(?:^|\/)AndroidManifest\.xml$/u.test(path)),
+    resources: all.filter(({ path }) => /(?:^|\/)resources\.arsc$/u.test(path)),
+    dex: all.filter(({ path }) => /(?:^|\/)[^/]+\.dex$/iu.test(path)),
+    jvm_classes: all.filter(({ path }) => /(?:^|\/)[^/]+\.class$/iu.test(path)),
     native_libraries: all.filter(({ path, format }) => format === "elf" || /(?:^|\/)lib\/[^/]+\/[^/]+\.so$/iu.test(path)),
     javascript: all.filter(({ format }) => format === "javascript-bundle"),
     signing: all.filter(({ path }) => /^META-INF\/[^/]+\.(?:MF|RSA|DSA|EC|SF)$/iu.test(path)),
 });
 const runtimeFamilies = (all) => {
-    const paths = all.map(({ path }) => path.toLowerCase());
     const families = new Set();
-    if (all.some(({ path, format }) => format === "dex" || path.toLowerCase().endsWith(".dex")))
+    if (all.some(({ path }) => path.toLowerCase().endsWith(".dex")))
         families.add("dalvik-art");
-    if (all.some(({ path, format }) => format === "jvm-class" || path.toLowerCase().endsWith(".class")))
+    if (all.some(({ path }) => path.toLowerCase().endsWith(".class")))
         families.add("java-kotlin");
     if (all.some(({ format }) => format === "elf"))
         families.add("native");
     if (all.some(({ format }) => format === "javascript-bundle"))
         families.add("javascript");
-    if (paths.some((path) => path.includes("reactnative") || path.includes("hermes")))
-        families.add("react-native");
-    if (paths.some((path) => path.includes("libflutter.so")))
-        families.add("flutter");
-    if (paths.some((path) => path.includes("libunity.so")))
-        families.add("unity");
+    for (const { path } of all) {
+        const convention = nativeRuntimeConvention(path);
+        if (convention !== null)
+            families.add(convention);
+    }
     return [...families].sort(compare);
 };
 const bridgeCandidates = (managed, native) => {
@@ -159,14 +164,14 @@ const bridgeCandidates = (managed, native) => {
     });
 };
 const bridgeBasis = (path) => {
-    const lower = path.toLowerCase();
-    if (lower.includes("react") || lower.includes("hermes"))
+    const convention = nativeRuntimeConvention(path);
+    if (convention === "react-native")
         return "react-native-convention";
-    if (lower.includes("flutter"))
+    if (convention === "flutter")
         return "flutter-convention";
-    if (lower.includes("unity"))
+    if (convention === "unity")
         return "unity-convention";
-    if (/lib\/[^/]+\/lib[^/]+\.so$/u.test(lower))
+    if (/(?:^|\/)lib\/[^/]+\/lib[^/]+\.so$/iu.test(path))
         return "jni-library-convention";
     return "managed-and-native-content";
 };

package/dist/domain/apktool/apktoolResourceAnalysis.js

@@ -0,0 +1,77 @@
+import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
+import { digestSchema } from "../digests.js";
+/** Upper bound for one decoded resource projection in one response. */
+const MAX_MANIFEST_BYTES = 512 * 1024;
+const MAX_STRINGS = 2_000;
+/**
+ * Caller intent for Apktool-backed resource decoding. Apktool is
+ * bring-your-own: REA never installs it, and decoding happens in a
+ * provider-owned workspace that is removed after the facts are projected.
+ */
+export const apktoolInputSchemas = {
+    inspect_apktool_client: z.strictObject({}),
+    decode_android_resources: z.strictObject({
+        path: localPathStringSchema.describe("Local APK file to decode"),
+        include_strings: z
+            .boolean()
+            .default(true)
+            .describe(`Project res/values/strings.xml entries (bounded to ${String(MAX_STRINGS)} entries)`),
+        locale: z
+            .string()
+            .min(2)
+            .max(16)
+            .regex(/^(?:[a-z]{2,3}(?:-(?:r?[A-Z]{2}|r?[0-9]{3}))?|b\+[a-z]{2,3}(?:\+[A-Za-z0-9]{2,8})*)$/u, "Locale must look like de, pt-BR, pt-rBR, or b+zh+Hans+CN")
+            .optional()
+            .describe("Project strings from res/values-<locale>/strings.xml instead of the default table"),
+    }),
+};
+/** Validate operation and input together so their types remain correlated. */
+export const apktoolRequestSchema = z.discriminatedUnion("operation", [
+    z.strictObject({
+        operation: z.literal("inspect_apktool_client"),
+        input: apktoolInputSchemas.inspect_apktool_client,
+    }),
+    z.strictObject({
+        operation: z.literal("decode_android_resources"),
+        input: apktoolInputSchemas.decode_android_resources,
+    }),
+]);
+const client = z.strictObject({
+    command: z.string().min(1),
+    command_source: z.enum(["environment", "path"]),
+    apktool_version: z.string().min(1).nullable(),
+});
+/** Portable Apktool observations with explicit coverage limitations. */
+export const apktoolResultSchemas = {
+    inspect_apktool_client: z.strictObject({
+        client,
+    }),
+    decode_android_resources: z.strictObject({
+        client,
+        target: z.strictObject({
+            path: localPathStringSchema,
+            bytes: z.number().int().nonnegative(),
+            sha256: digestSchema,
+        }),
+        metadata: z.strictObject({
+            version_name: z.string().nullable(),
+            version_code: z
+                .string()
+                .nullable()
+                .describe("Version code exactly as apktool.yml prints it, e.g. '45' or '45.1'"),
+            min_sdk_version: z.string().nullable(),
+            target_sdk_version: z.string().nullable(),
+            package_name: z.string().nullable(),
+        }),
+        manifest: z.string().nullable(),
+        strings: z.array(z.strictObject({
+            name: z.string().min(1),
+            value: z.string(),
+        })),
+        locale: z.string().nullable(),
+        locales: z.array(z.string().min(1)),
+        decoded_file_count: z.number().int().nonnegative(),
+        coverage: z.enum(["complete", "partial"]),
+    }),
+};

package/dist/domain/apple/appleApplication.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { appleBundleSchema, appleComponentSchema, applicationRoots, detectBundles, isMachOFormat, isSidecar, isWithin, platformsOf, } from "./appleBundleAnatomy.js";
+import { anatomyNameIs, anatomyTailMatches, appleBundleSchema, appleComponentSchema, applicationRoots, detectBundles, isMachOFormat, isSidecar, isWithin, platformsOf, } from "./appleBundleAnatomy.js";
+import { isSwiftRuntimeLibrary, nativeRuntimeConvention, } from "../nativeConvention.js";
 import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js";
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
@@ -166,48 +167,61 @@ const appleRootFormat = (format) => {
 };
 const classifyComponents = (entries, all, roots) => {
     const withinApp = (path) => roots.some((root) => isWithin(path, root));
-    const anatomy = (pattern) => entries.flatMap(({ path, kind, component }) => kind === "file" &&
+    const matching = (predicate) => entries.flatMap(({ path, kind, component }) => kind === "file" &&
         component !== undefined &&
         !isSidecar(path) &&
         withinApp(path) &&
-        pattern.test(path)
+        predicate(path)
         ? [component]
         : []);
+    const lastSegment = (path) => path.split("/").at(-1) ?? "";
     return {
-        bundle_metadata: all.filter(({ path }) => /(?:^|\/)Info\.plist$/u.test(path)),
+        bundle_metadata: all.filter(({ path }) => anatomyNameIs(lastSegment(path), "Info.plist")),
         executables: all.filter(({ path, format }) => withinApp(path) && isMachOFormat(format)),
         frameworks: all.filter(({ path }) => /\.framework\//u.test(path)),
         native_libraries: all.filter(({ path }) => /\.(?:dylib|so)$/iu.test(path)),
         javascript: all.filter(({ format }) => format === "javascript-bundle"),
-        signing: all.filter(({ path }) => /(?:^|\/)(?:embedded\.(?:mobileprovision|provisionprofile)|_CodeSignature\/CodeResources)$/u.test(path)),
-        privileged_helpers: anatomy(/(?:^|\/)Contents\/Library\/LaunchServices\/[^/]+$/u),
-        launchd_plists: anatomy(/(?:^|\/)Contents\/Library\/Launch(?:Agents|Daemons)\/[^/]+\.plist$/u).map((component) => ({
+        signing: all.filter(({ path }) => anatomyTailMatches(path, ["_CodeSignature", "CodeResources"]) ||
+            anatomyNameIs(lastSegment(path), "embedded.mobileprovision") ||
+            anatomyNameIs(lastSegment(path), "embedded.provisionprofile")),
+        privileged_helpers: matching((path) => anatomyTailMatches(path, ["Contents", "Library", "LaunchServices", "*"])),
+        launchd_plists: matching((path) => path.endsWith(".plist") &&
+            (anatomyTailMatches(path, [
+                "Contents",
+                "Library",
+                "LaunchAgents",
+                "*",
+            ]) ||
+                anatomyTailMatches(path, [
+                    "Contents",
+                    "Library",
+                    "LaunchDaemons",
+                    "*",
+                ]))).map((component) => ({
             ...component,
-            domain: component.path.includes("/LaunchDaemons/")
+            domain: component.path
+                .split("/")
+                .some((segment) => anatomyNameIs(segment, "LaunchDaemons"))
                 ? "daemon"
                 : "agent",
         })),
-        helpers: anatomy(/(?:^|\/)Contents\/Helpers\/[^/]+$/u),
+        helpers: matching((path) => anatomyTailMatches(path, ["Contents", "Helpers", "*"])),
     };
 };
 const deduplicateComponents = (values) => [...new Map(values.map((value) => [value.path, value])).values()].sort((left, right) => compare(left.path, right.path));
 const identifyRuntimeFamilies = (all) => {
-    const paths = all.map(({ path }) => path.toLowerCase());
     const families = new Set();
     if (all.some(({ format }) => ["mach-o", "mach-o-universal"].includes(format)))
         families.add("native");
-    if (paths.some((path) => /\.(?:dylib|framework\/[^/]+)$/u.test(path)))
+    if (all.some(({ path }) => isSwiftRuntimeLibrary(path)))
         families.add("swift-objective-c");
     if (all.some(({ format }) => format === "javascript-bundle"))
         families.add("javascript");
-    if (paths.some((path) => path.includes("reactnative") ||
-        path.includes("react.framework") ||
-        path.includes("hermes")))
-        families.add("react-native");
-    if (paths.some((path) => path.includes("flutter.framework") || path.includes("app.framework")))
-        families.add("flutter");
-    if (paths.some((path) => path.includes("unityframework.framework")))
-        families.add("unity");
+    for (const { path } of all) {
+        const convention = nativeRuntimeConvention(path);
+        if (convention !== null)
+            families.add(convention);
+    }
     return [...families].sort(compare);
 };
 /** Pair scripts and native code within matching application-root groups. */
@@ -243,12 +257,12 @@ const identifyBridgeCandidates = (scripts, native, roots) => {
     });
 };
 const bridgeBasis = (path) => {
-    const lower = path.toLowerCase();
-    if (lower.includes("react"))
+    const convention = nativeRuntimeConvention(path);
+    if (convention === "react-native")
         return "react-native-convention";
-    if (lower.includes("flutter") || lower.includes("app.framework"))
+    if (convention === "flutter")
         return "flutter-convention";
-    if (lower.includes("unity"))
+    if (convention === "unity")
         return "unity-convention";
     return "javascript-and-native-content";
 };
@@ -293,7 +307,10 @@ const projectionLimitations = (facts) => [
         : []),
     "Bundle roles follow path conventions. Read each info_plist_path with inspect_plist for CFBundleExecutable, identifiers, and declared services.",
     "Bundle identifiers and signing claims require dedicated plist and CMS parsing; this projection reports only exact paths and hashes.",
+    "Runtime families are inferred from inventory formats and bounded framework path conventions, not observed runtime loading.",
+    "Generic framework and dylib paths do not establish Swift or Objective-C; this inventory projection does not decode language metadata.",
     "Bridge candidates are path-based hypotheses, not observed runtime calls.",
+    "A bridge basis is inferred from the native path and is repeated for every managed component.",
 ];
 const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const digest = (value) => {