rea-agents 6.3.0 → 6.5.0

package/dist/domain/native/nativeInspection.js

@@ -24,7 +24,12 @@ const architectureSchema = z.object({
     name: z.string(),
     cpu_type: z.string().nullable(),
     cpu_subtype: z.string().nullable(),
-    file_offset: z.number().int().min(0).nullable(),
+    file_offset: z
+        .number()
+        .int()
+        .min(0)
+        .nullable()
+        .describe("Offset from the start of the input Mach-O container."),
     size: z.number().int().min(0).nullable(),
     alignment: z.number().int().min(0).nullable(),
 });
@@ -39,7 +44,12 @@ const sectionSchema = z.object({
     name: z.string(),
     address: hexAddress.nullable(),
     size: z.number().int().min(0).nullable(),
-    file_offset: z.number().int().min(0).nullable(),
+    file_offset: z
+        .number()
+        .int()
+        .min(0)
+        .nullable()
+        .describe("Offset from the start of the selected Mach-O slice."),
     alignment: z.number().int().min(0).nullable(),
     flags: z.array(z.string()),
 });
@@ -47,7 +57,12 @@ const segmentSchema = z.object({
     name: z.string(),
     vm_address: hexAddress.nullable(),
     vm_size: z.number().int().min(0).nullable(),
-    file_offset: z.number().int().min(0).nullable(),
+    file_offset: z
+        .number()
+        .int()
+        .min(0)
+        .nullable()
+        .describe("Offset from the start of the selected Mach-O slice."),
     file_size: z.number().int().min(0).nullable(),
     maximum_permissions: permissionSchema,
     initial_permissions: permissionSchema,
@@ -79,12 +94,31 @@ const buildMetadataSchema = z.object({
 });
 export const inspectMachoSchema = z.object({
     format: z.literal("mach-o"),
+    /** Exact lipo slice selected for inspection and its offset in the input container. */
+    selected_architecture: z.object({
+        name: z
+            .string()
+            .nullable()
+            .describe("Exact architecture name selected from lipo output; null when selection is unknown."),
+        container_file_offset: z
+            .number()
+            .int()
+            .min(0)
+            .nullable()
+            .describe("Offset of the selected slice from the start of the input Mach-O container; null when unknown."),
+    }),
     endian: z.enum(["little", "big"]).nullable(),
     word_size: z.union([z.literal(32), z.literal(64)]).nullable(),
     file_type: z.string().nullable(),
     flags: z.array(z.string()),
     uuid: z.string().nullable(),
-    entrypoints: coverage(z.object({ file_offset: z.number().int().min(0) })),
+    entrypoints: coverage(z.object({
+        file_offset: z
+            .number()
+            .int()
+            .min(0)
+            .describe("LC_MAIN entry offset from the start of the selected Mach-O slice."),
+    })),
     architectures: coverage(architectureSchema),
     build_metadata: coverage(buildMetadataSchema),
     load_commands: coverage(loadCommandSchema),

package/dist/domain/native/nativeInstruction.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-/** Exact instruction location within the active analysis program. */
+/** Exact code or data location within the active analysis program. */
 export const nativeInstructionInputSchema = z.strictObject({
     address: z.string().min(1),
     document: z.string().optional(),
@@ -12,6 +12,27 @@ const reference = z.strictObject({
     indirect: z.boolean(),
     computed: z.boolean(),
     operand_index: z.number().int(),
+    source_address: z.string().min(1).nullable().optional(),
+    data: z.boolean().nullable().optional(),
+    read: z.boolean().nullable().optional(),
+    write: z.boolean().nullable().optional(),
+    primary: z
+        .boolean()
+        .nullable()
+        .optional()
+        .describe("Provider primary-reference status, not proof of literal addressing or a runtime access. Null or omission means unavailable."),
+    provenance: z
+        .string()
+        .min(1)
+        .nullable()
+        .optional()
+        .describe("Provider subsystem reporting this reference; null or omission means unavailable."),
+    source: z
+        .string()
+        .min(1)
+        .nullable()
+        .optional()
+        .describe("Provider reference origin, such as analysis, default, imported or user_defined; null or omission means unavailable."),
 });
 /** Provider-decoded facts for one instruction; operand tokens preserve their native ordering. */
 export const nativeInstructionSchema = z.strictObject({
@@ -25,7 +46,17 @@ export const nativeInstructionSchema = z.strictObject({
     ]),
     procedure: z.string().nullable(),
     architecture: z.string(),
-    mode: z.string(),
+    mode: z
+        .string()
+        .describe("Provider-reported mode label. Per-address decoder context, when available, is reported separately; a program-wide label does not establish runtime encoding mode."),
+    decoder_context: z
+        .array(z.strictObject({
+        register: z.string().min(1),
+        value: z.string().min(1).nullable(),
+        source: z.string().min(1),
+    }))
+        .optional()
+        .describe("Observed per-address decoder context. Null means no value was available; omission means the provider or older capture does not expose this facet. The separate mode field retains the program language variant."),
     bytes: z.string().nullable(),
     length: z.number().int().positive().nullable(),
     mnemonic: z.string().nullable(),
@@ -63,6 +94,11 @@ export const nativeInstructionSchema = z.strictObject({
             .describe("Observed provider facts used to classify flow; older captures or other providers may omit them."),
     }),
     references: z.array(reference),
+    incoming_references: z
+        .array(reference)
+        .nullable()
+        .optional()
+        .describe("Static references to this exact code or data address, excluding synthetic entry-point references. An empty array means the provider examined the address and found none; null or omission means unavailable. Analyzer references do not prove literal addressing or runtime access."),
     limitations: z.array(z.string()),
 });
 /** Static target resolution preserves provider references as evidence, never runtime certainty. */

package/dist/domain/native/nativeInvestigationGraph.js

@@ -169,7 +169,6 @@ export const traceNativeInvestigationGraph = (graph, input) => {
         const current = queue.shift();
         if (current === undefined)
             break;
-        reachedDepth = Math.max(reachedDepth, current.depth);
         const adjacent = adjacency.get(current.id) ?? [];
         for (const edge of adjacent) {
             if (selectedEdges.size + unresolved.size >= limits.max_edges) {
@@ -188,20 +187,25 @@ export const traceNativeInvestigationGraph = (graph, input) => {
                 reason ??= "max_depth_reached";
                 continue;
             }
-            selectedEdges.set(edge.id, edge);
-            if (alreadyVisited)
-                continue;
-            if (visited.size >= limits.max_nodes) {
+            // Check destination capacity before retaining its edge. Otherwise the node
+            // bound leaves a resolved edge pointing outside the returned trace.
+            if (!alreadyVisited && visited.size >= limits.max_nodes) {
                 truncated = true;
                 reason = "max_nodes_reached";
                 break;
             }
+            selectedEdges.set(edge.id, edge);
+            if (alreadyVisited)
+                continue;
             if (!nodeById.has(nextId)) {
                 truncated = true;
                 reason ??= "edge_target_missing_from_graph";
                 continue;
             }
             visited.add(nextId);
+            // A retained node has already been reached even if a later sibling
+            // exhausts a budget before this node is dequeued for expansion.
+            reachedDepth = Math.max(reachedDepth, current.depth + 1);
             queue.push({ id: nextId, depth: current.depth + 1 });
         }
         if (reason === "max_edges_reached" || reason === "max_nodes_reached")

package/dist/domain/native/nativeLoadImage.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { nativeMetadataRecoverySummarySchema } from "./nativeMetadataRecovery.js";
 import { jsonValueSchema } from "../jsonValue.js";
+import { binaryArchitectureSchema } from "../rawBinary.js";
 const integer = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
 const digest = z.string().regex(/^[a-f0-9]{64}$/u);
 const hexBytes = z.string().regex(/^(?:[a-f0-9]{2})*$/u);
@@ -68,7 +69,7 @@ export const nativeLoadImageCheckSchema = z.strictObject({
     address: address.nullable(),
 });
 /** Read-only native image verification; verified applies only to declared coverage. */
-export const nativeLoadImageSchema = z.discriminatedUnion("status", [
+export const nativeLoadImageSchema = z.union([
     z.strictObject({
         status: z.literal("unsupported"),
         reason: z.string().min(1),
@@ -92,4 +93,21 @@ export const nativeLoadImageSchema = z.discriminatedUnion("status", [
         checks: z.array(nativeLoadImageCheckSchema),
         limitations: z.array(z.string().min(1)),
     }),
+    z.strictObject({
+        status: z.enum(["verified", "mismatch"]),
+        format: z.literal("raw-binary"),
+        target_sha256: digest,
+        architecture: binaryArchitectureSchema,
+        language_id: z.string().min(1),
+        compiler_spec_id: z.string().min(1),
+        base_address: address,
+        file_bytes: integer.min(1),
+        entry: z.strictObject({
+            address: address,
+            file_offset: z.literal(0),
+        }),
+        observations: nativeLoadImageObservationSchema,
+        checks: z.array(nativeLoadImageCheckSchema),
+        limitations: z.array(z.string().min(1)),
+    }),
 ]);

package/dist/domain/native/nativeMetadataRecovery.js

@@ -4,6 +4,8 @@ const relatedType = z.strictObject({ address, type: z.string().nullable() });
 /** Runtime-format metadata recovered in an analysis image, with explicit inference boundaries. */
 export const nativeMetadataRecoverySchema = z.strictObject({
     format: z.literal("dotnet-nativeaot"),
+    /** Identifies parser-only facts without claiming Ghidra defined a DataType. */
+    source: z.enum(["analysis-database", "read-only-derived-overlay"]).optional(),
     status: z.enum(["complete", "partial"]),
     header_address: address,
     format_major: z.number().int().nonnegative(),
@@ -21,18 +23,25 @@ export const nativeMetadataRecoverySchema = z.strictObject({
         procedure_name: z.string().nullable(),
         basis: z.literal("method-table-pointer"),
     })),
-    derived_memory: z.strictObject({
+    derived_memory: z
+        .strictObject({
         address,
         size_bytes: z.number().int().nonnegative(),
         sha256: z.string().regex(/^[a-f0-9]{64}$/u),
         file_offset: z.null(),
-    }),
+    })
+        .nullable(),
+    truncated: z.boolean().optional(),
+    virtual_slots_omitted: z.number().int().nonnegative().optional(),
+    interfaces_omitted: z.number().int().nonnegative().optional(),
+    output_budget_bytes: z.number().int().nonnegative().optional(),
     diagnostics: z.array(z.string()),
     limitations: z.array(z.string()),
 });
 /** Discover a recovered runtime format and reusable type identities from the loaded image. */
 export const nativeMetadataRecoverySummarySchema = z.strictObject({
     format: z.literal("dotnet-nativeaot"),
+    analysis_mode: z.literal("read-only-derived-overlay").optional(),
     status: z.enum(["complete", "partial", "not_applicable"]),
     reason: z.string().nullable(),
     analysis_artifact_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
@@ -42,12 +51,76 @@ export const nativeMetadataRecoverySummarySchema = z.strictObject({
     format_minor: z.number().int().nonnegative().nullable(),
     method_tables: z.number().int().nonnegative(),
     types: z.array(relatedType),
-    derived_memory: nativeMetadataRecoverySchema.shape.derived_memory.nullable(),
+    frozen_strings: z
+        .array(z.strictObject({ address, value: z.string() }))
+        .optional(),
+    truncated: z.boolean().optional(),
+    types_omitted: z.number().int().nonnegative().optional(),
+    frozen_strings_omitted: z.number().int().nonnegative().optional(),
+    output_budget_bytes: z.number().int().nonnegative().optional(),
+    derived_overlay: z
+        .strictObject({
+        address,
+        size_bytes: z.number().int().nonnegative(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    })
+        .nullable()
+        .optional(),
+    derived_memory: nativeMetadataRecoverySchema.shape.derived_memory,
     coverage: z
         .strictObject({
-        frozen_object_candidates: z.number().int().nonnegative(),
-        frozen_objects_annotated: z.number().int().nonnegative(),
-        basis: z.literal("rehydrated-pointer-candidates-and-committed-instance-types"),
+        frozen_object_candidates: z.number().int().nonnegative().optional(),
+        frozen_objects_annotated: z.number().int().nonnegative().optional(),
+        pointer_candidates_examined: z.number().int().nonnegative().optional(),
+        pointer_slots_examined: z.number().int().nonnegative().optional(),
+        scan_bytes_examined: z.number().int().nonnegative().optional(),
+        scan_bytes_omitted: z.number().int().nonnegative().optional(),
+        rtr_signature_scan_bytes_examined: z
+            .number()
+            .int()
+            .nonnegative()
+            .optional(),
+        rtr_signature_scan_bytes_omitted: z
+            .number()
+            .int()
+            .nonnegative()
+            .optional(),
+        method_table_validation_items_examined: z
+            .number()
+            .int()
+            .nonnegative()
+            .optional(),
+        work_units_examined: z.number().int().nonnegative().optional(),
+        method_tables_recovered: z.number().int().nonnegative().optional(),
+        frozen_string_candidates: z.number().int().nonnegative().optional(),
+        frozen_scan_bytes_examined: z.number().int().nonnegative().optional(),
+        frozen_scan_bytes_omitted: z.number().int().nonnegative().optional(),
+        frozen_string_data_bytes_examined: z
+            .number()
+            .int()
+            .nonnegative()
+            .optional(),
+        source_bytes_examined: z.number().int().nonnegative().optional(),
+        source_bytes_omitted: z.number().int().nonnegative().optional(),
+        source_byte_budget_bytes: z.number().int().nonnegative().optional(),
+        work_budget_units: z.number().int().nonnegative().optional(),
+        working_memory_budget_bytes: z.number().int().nonnegative().optional(),
+        working_memory_bytes_peak: z.number().int().nonnegative().optional(),
+        truncation_reason: z
+            .enum([
+            "source-byte-budget",
+            "work-unit-budget",
+            "working-memory-budget",
+            "response-budget",
+        ])
+            .optional(),
+        basis: z.enum([
+            "rehydrated-pointer-candidates-and-committed-instance-types",
+            "raw-image-pointer-scan",
+            "raw-image-and-rehydrated-pointer-scan",
+            "unsupported-layout",
+            "no-rtr-header",
+        ]),
     })
         .nullable(),
     diagnostics: z.array(z.string()),

package/dist/domain/native/nativeUiObservation.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { decodeCanonicalBase64 } from "../webScreenshot.js";
+import { readPngHeaderDimensions } from "../pngHeader.js";
 const scope = {
     pid: z.number().int().positive(),
     window_id: z.number().int().positive(),
@@ -84,23 +85,21 @@ const nativeUiScreenshotSchema = z
             code: "custom",
             message: "PNG screenshot digest mismatch",
         });
-    if (bytes.byteLength < 24 ||
-        !bytes.subarray(0, 8).equals(PNG_SIGNATURE) ||
-        bytes.subarray(12, 16).toString("ascii") !== "IHDR") {
+    const dimensions = readPngHeaderDimensions(bytes);
+    if (dimensions === undefined) {
         context.addIssue({
             code: "custom",
             message: "Screenshot bytes are not a PNG image",
         });
         return;
     }
-    if (bytes.readUInt32BE(16) !== screenshot.width ||
-        bytes.readUInt32BE(20) !== screenshot.height)
+    if (dimensions.width !== screenshot.width ||
+        dimensions.height !== screenshot.height)
         context.addIssue({
             code: "custom",
             message: "PNG screenshot dimensions mismatch",
         });
 });
-const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
 export const nativeUiSnapshotSchema = z.strictObject({
     window: z.strictObject({
         pid: z.number().int().positive(),

package/dist/domain/native/objcSwiftMetadata.js

@@ -1,4 +1,6 @@
 import { z } from "zod";
+import { providerSchema } from "../evidence.js";
+import { isSwiftMangledSymbolName } from "../swiftSymbolClassification.js";
 import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrder.js";
 /** Objective-C method type. */
 export const objcMethodTypeSchema = z.enum([
@@ -95,6 +97,7 @@ export const nativeMetadataEvidenceSchema = z.strictObject({
         "decompiler",
     ]),
     description: z.string().min(1),
+    provider: providerSchema.optional(),
     location: nativeMetadataLocationSchema,
     artifact_path: z.string().min(1).nullable().default(null),
     artifact_sha256: z
@@ -316,7 +319,7 @@ export const inspectNativeDispatchMetadata = (names, maxRecords = 5_000) => {
             });
             classNames.add(methodMatch[2]);
         }
-        if (/^(?:_?\$s|_Tt)/u.test(entry.name))
+        if (isSwiftMangledSymbolName(entry.name) || entry.name.startsWith("_Tt"))
             swiftSymbols.push({
                 mangled_name: entry.name,
                 address: entry.address,

package/dist/domain/native/peResources.js

@@ -0,0 +1,100 @@
+import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
+const uint = z.number().int().min(0).max(0xffffffff);
+const range = z.strictObject({ offset: uint, bytes: uint });
+const identity = z.discriminatedUnion("kind", [
+    z.strictObject({ kind: z.literal("id"), id: uint }),
+    z.strictObject({
+        kind: z.literal("name"),
+        name: z.string(),
+        utf16le_hex: z.string().regex(/^(?:[0-9a-f]{4})*$/),
+        location: range,
+    }),
+]);
+/** Complete bounded inspection of a caller-selected PE image, without execution. */
+export const inspectPeResourcesInputSchema = z.strictObject({
+    path: localPathStringSchema.describe("Absolute filesystem path to a PE image"),
+    max_file_bytes: z
+        .number()
+        .int()
+        .min(64)
+        .max(536870912)
+        .default(67108864)
+        .describe("Maximum stable artifact bytes to read (default 64 MiB)"),
+    // Windows resource images carry thousands of entries: Windows 11 25H2
+    // SystemResources measures imageres.dll.mun at 6476 examined entries,
+    // shell32.dll.mun at 5903 and wmploc.DLL.mun at 5440. The default admits
+    // those stock images with headroom; the independent 8 MiB metadata budget
+    // still bounds allocation.
+    max_entries: z
+        .number()
+        .int()
+        .min(1)
+        .max(65536)
+        .default(16384)
+        .describe("Maximum resource directory entries to examine; exceeding the budget fails without partial success"),
+});
+/** Original file/RVA locations and resource identities; icon edges are static relationships. */
+export const peResourcesSchema = z.strictObject({
+    artifact: z.strictObject({
+        path: z.string().min(1),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        bytes: uint,
+    }),
+    format: z.enum(["pe32", "pe32-plus"]),
+    machine: uint,
+    directory: z
+        .strictObject({
+        rva: uint,
+        location: range,
+        data_directory_location: range,
+    })
+        .nullable(),
+    directories: z.array(z.strictObject({
+        location: range,
+        characteristics: uint,
+        timestamp: uint,
+        major_version: uint,
+        minor_version: uint,
+        named_entries: uint,
+        id_entries: uint,
+    })),
+    resources: z.array(z.strictObject({
+        index: uint,
+        type: identity,
+        name: identity,
+        language: identity,
+        entry_locations: z.array(range).length(3),
+        data_entry_location: range,
+        code_page: uint,
+        reserved: uint,
+        payload: z.strictObject({
+            rva: uint,
+            location: range,
+            sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        }),
+    })),
+    icon_groups: z.array(z.strictObject({
+        resource_index: uint,
+        images: z.array(z.strictObject({
+            location: range,
+            width: uint,
+            height: uint,
+            color_count: uint,
+            reserved: uint,
+            planes: uint,
+            bit_count: uint,
+            declared_bytes: uint,
+            resource_id: uint,
+            candidate_resource_indices: z.array(uint),
+            same_language_resource_index: uint.nullable(),
+            size_matches: z.boolean().nullable(),
+        })),
+    })),
+    coverage: z.strictObject({
+        status: z.literal("complete"),
+        examined_entries: uint,
+        resources: uint,
+    }),
+    limitations: z.array(z.string()),
+});

package/dist/domain/native/recordedCrash.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
 import { CANONICAL_BASE64_PATTERN } from "../stringPatterns.js";
 import { recordedNoteCoverageIssues } from "./recordedCrashNoteCoverage.js";
 const hex = z.string().regex(/^0x(?:0|[1-9a-f][0-9a-f]{0,15})$/);
@@ -14,7 +15,7 @@ const diagnostics = z.strictObject({
 // Exact b"CORE\0"; a lossy display label cannot establish the Linux note ABI.
 const LINUX_CORE_OWNER_BASE64 = "Q09SRQA=";
 /** Complete register identities in the supported Linux amd64 PRSTATUS ABI order. */
-export const RECORDED_LINUX_AMD64_REGISTERS = [
+const RECORDED_LINUX_AMD64_REGISTERS = [
     "r15",
     "r14",
     "r13",
@@ -43,13 +44,79 @@ export const RECORDED_LINUX_AMD64_REGISTERS = [
     "fs",
     "gs",
 ];
-const supportedRegisters = new Set(RECORDED_LINUX_AMD64_REGISTERS);
+const RECORDED_LINUX_AARCH64_REGISTERS = [
+    "x0",
+    "x1",
+    "x2",
+    "x3",
+    "x4",
+    "x5",
+    "x6",
+    "x7",
+    "x8",
+    "x9",
+    "x10",
+    "x11",
+    "x12",
+    "x13",
+    "x14",
+    "x15",
+    "x16",
+    "x17",
+    "x18",
+    "x19",
+    "x20",
+    "x21",
+    "x22",
+    "x23",
+    "x24",
+    "x25",
+    "x26",
+    "x27",
+    "x28",
+    "x29",
+    "x30",
+    "sp",
+    "pc",
+    "pstate",
+];
+/** Recorded-core architectures whose Linux note ABI is interpreted. */
+export const RECORDED_LINUX_CORE_ARCHITECTURES = [
+    "x86_64-little-endian",
+    "aarch64-little-endian",
+];
+/**
+ * ABI facts for one recorded-core architecture, measured from unchanged pwntools
+ * 4.15.0 `elf_prstatus_*` and `user_regs_struct_*` structures and mirrored by
+ * `bridge/pwntools/recorded_crash_impl.py`. Both profiles place `pr_cursig` at
+ * 12, `pr_pid` at 32 and the register window at 112; the ELF machine, the window
+ * contents and the Evidence CPU family differ per profile.
+ */
+export const RECORDED_LINUX_CORE_PROFILES = {
+    "x86_64-little-endian": {
+        machine: 62,
+        evidenceArchitecture: "x86_64",
+        registers: RECORDED_LINUX_AMD64_REGISTERS,
+        registerBytes: 8,
+        registerOffset: 112,
+        prstatusBytes: 336,
+    },
+    "aarch64-little-endian": {
+        machine: 183,
+        evidenceArchitecture: "arm64",
+        registers: RECORDED_LINUX_AARCH64_REGISTERS,
+        registerBytes: 8,
+        registerOffset: 112,
+        prstatusBytes: 392,
+    },
+};
+const recordedCoreRegisterSets = {
+    "x86_64-little-endian": new Set(RECORDED_LINUX_AMD64_REGISTERS),
+    "aarch64-little-endian": new Set(RECORDED_LINUX_AARCH64_REGISTERS),
+};
 /** Select an explicit recording and optionally request debugger-derived mapping context. */
 export const inspectRecordedCrashInputSchema = z.strictObject({
-    path: z
-        .string()
-        .min(1)
-        .describe("Absolute filesystem path to a supplied Linux ELF core"),
+    path: localPathStringSchema.describe("Absolute filesystem path to a supplied Linux ELF core"),
     include_debugger_context: z
         .boolean()
         .default(false)
@@ -98,7 +165,7 @@ const recordedCrashObjectSchema = z.strictObject({
         bytes: index,
     }),
     format: z.literal("elf-core"),
-    architecture: z.literal("x86_64-little-endian"),
+    architecture: z.enum(RECORDED_LINUX_CORE_ARCHITECTURES),
     target_execution: z.literal("not-performed"),
     live_process_identity: z.literal("unknown"),
     segments: z.array(z.strictObject({
@@ -218,6 +285,8 @@ export const recordedCrashSchema = recordedCrashObjectSchema.superRefine((value,
             new Set(rows.map(({ note_index }) => note_index)).size !== rows.length)
             fail("Each supported raw note requires exactly one corresponding interpretation.");
     }
+    const profile = RECORDED_LINUX_CORE_PROFILES[value.architecture];
+    const profileRegisters = recordedCoreRegisterSets[value.architecture];
     for (const thread of value.threads) {
         const note = value.notes[thread.note_index];
         if (note?.type !== "NT_PRSTATUS" ||
@@ -226,13 +295,13 @@ export const recordedCrashSchema = recordedCrashObjectSchema.superRefine((value,
             fail("Thread references a different note kind.");
             continue;
         }
-        if (thread.registers.length !== RECORDED_LINUX_AMD64_REGISTERS.length ||
-            !thread.registers.every(({ name }) => supportedRegisters.has(name)) ||
+        if (thread.registers.length !== profile.registers.length ||
+            !thread.registers.every(({ name }) => profileRegisters.has(name)) ||
             new Set(thread.registers.map(({ name }) => name)).size !==
                 thread.registers.length)
             fail("Each recorded thread requires every supported register exactly once.");
         for (const register of thread.registers)
-            if (BigInt(register.location.bytes) !== 8n ||
+            if (BigInt(register.location.bytes) !== BigInt(profile.registerBytes) ||
                 !within(register.location, BigInt(note.descriptor_location.offset), BigInt(note.descriptor_location.offset) +
                     BigInt(note.descriptor_location.bytes)))
                 fail("Register source exceeds its descriptor.");

package/dist/domain/nativeConvention.js

@@ -0,0 +1,33 @@
+/** Path-segment conventions. These are inferences, not observations of runtime behavior. */
+const foldSegment = (segment) => segment.toLocaleLowerCase("en-US");
+const REACT_NATIVE_SEGMENTS = new Set([
+    "react.framework",
+    "reactnative.framework",
+    "libreactnative.so",
+    "libreactnativejni.so",
+    "libhermes_executor.so",
+    "libhermes.so",
+    "hermes.framework",
+]);
+const FLUTTER_SEGMENTS = new Set(["libflutter.so", "flutter.framework"]);
+const UNITY_SEGMENTS = new Set(["libunity.so", "unityframework.framework"]);
+/**
+ * A runtime family named by one filename or directory segment.
+ * Only recognized complete library and framework names establish a convention.
+ */
+export const nativeRuntimeConvention = (path) => {
+    for (const segment of path.split("/")) {
+        const folded = foldSegment(segment);
+        if (REACT_NATIVE_SEGMENTS.has(folded))
+            return "react-native";
+        if (FLUTTER_SEGMENTS.has(folded))
+            return "flutter";
+        if (UNITY_SEGMENTS.has(folded))
+            return "unity";
+    }
+    return null;
+};
+/** Swift runtime libraries are `libswift*.dylib` segments, not every dynamic library. */
+export const isSwiftRuntimeLibrary = (path) => path
+    .split("/")
+    .some((segment) => /^libswift.+\.dylib$/u.test(foldSegment(segment)));