rea-agents 6.5.0 → 6.7.0

package/dist/apktool/ApktoolCommandCleanup.js

@@ -0,0 +1,134 @@
+import { AnalysisCleanupLease, AnalysisCleanupLeaseGroup, } from "../artifacts/AnalysisCleanupLease.js";
+import { ArtifactResourceRetryFailure, ArtifactResourceScope, } from "../artifacts/ArtifactResourceScope.js";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import { DarwinProcessOwnershipInspectionError } from "../process/DarwinProcessRunTokenReader.js";
+import { OwnedCommandFailure } from "../process/OwnedCommand.js";
+/** Retain exact command/helper capabilities across invocation and shutdown. */
+export class ApktoolCommandCleanup {
+    #scope = new ArtifactResourceScope();
+    #owners = new Set();
+    async run(operation, name) {
+        try {
+            return await this.#scope.run(() => {
+                this.#prune();
+                return operation();
+            });
+        }
+        catch (cause) {
+            throw this.#retryFailure(cause, name);
+        }
+    }
+    async close() {
+        try {
+            await this.#scope.close();
+        }
+        catch (cause) {
+            throw this.#retryFailure(cause, "close");
+        }
+        finally {
+            this.#prune();
+        }
+    }
+    pendingFor(root) {
+        this.#prune();
+        return [...this.#owners].some((owner) => owner.root === root);
+    }
+    retainFailure(cause, primary, operation, root) {
+        const retained = [];
+        const command = cause instanceof OwnedCommandFailure ? cause : undefined;
+        const preparation = command?.preparationFailure ??
+            (cause instanceof DarwinProcessOwnershipInspectionError
+                ? cause
+                : undefined);
+        if (preparation?.cleanupFailure !== undefined) {
+            const cleanup = preparation.cleanupFailure;
+            retained.push(this.#retain(cleanup, async () => {
+                if (!cleanup.cleanupIncomplete)
+                    return;
+                if (preparation.cleanupOwner === undefined)
+                    throw cleanup;
+                await preparation.cleanupOwner.close();
+                if (cleanup.cleanupIncomplete)
+                    throw cleanup;
+            }, root));
+        }
+        if (command !== undefined &&
+            (command.cleanupOwner !== undefined || command.cleanupFailure !== null)) {
+            const owner = command.cleanupOwner;
+            const cleanup = new ProviderCleanupError("apktool", command.resources, {
+                reason: command.cleanupFailure ?? "Command cleanup remains incomplete",
+            }, { operation, cause });
+            const retainedOwner = this.#retain(cleanup, async () => {
+                if (owner === undefined)
+                    throw cleanup;
+                const result = await owner.stop();
+                if (result.status === "incomplete")
+                    throw new Error(result.reason);
+            }, root);
+            retainedOwner.lease.bindCleanupError(cleanup);
+            retained.push(retainedOwner);
+        }
+        if (retained.length === 0)
+            return primary;
+        const cleanup = new ProviderCleanupError("apktool", retained.flatMap((owner) => owner.cleanup.cleanupResources), {}, { operation, cause });
+        this.#bind(cleanup, retained);
+        return analysisErrorWithCleanupFailure(primary, cleanup, operation).bindCleanupDependencies([primary, cleanup]);
+    }
+    #retain(cleanup, release, root) {
+        const lease = new AnalysisCleanupLease(async () => {
+            try {
+                await release();
+            }
+            catch (cause) {
+                throw new ArtifactReaderFailure("unavailable", cleanup.message, {
+                    cause,
+                    cleanup: {
+                        reason: cleanup.message,
+                        resources: cleanup.cleanupResources,
+                    },
+                });
+            }
+        }, cleanup.cleanupResources);
+        const owner = { lease, cleanup, root };
+        this.#owners.add(owner);
+        this.#scope.retain({
+            kind: "lease",
+            resource: cleanup.cleanupResources[0] ?? "apktool command",
+            lease,
+        });
+        return owner;
+    }
+    #bind(error, owners) {
+        new AnalysisCleanupLeaseGroup(error, owners.map((owner) => owner.lease));
+        // Helper cleanup can itself contain independently released peers. Its
+        // producer owns current labels; the leases own completion of this retry set.
+        error.bindCleanupResourceOwner({
+            get cleanupResources() {
+                return [
+                    ...new Set(owners
+                        .filter((owner) => !owner.lease.released)
+                        .flatMap((owner) => owner.cleanup.cleanupResources)),
+                ];
+            },
+        });
+    }
+    #retryFailure(cause, operation) {
+        if (!(cause instanceof ArtifactResourceRetryFailure) ||
+            cause.cleanup === undefined ||
+            !cause.failedOwners.every((failed) => failed.kind === "lease" &&
+                [...this.#owners].some((owner) => owner.lease === failed.lease)))
+            return cause;
+        const owners = [...this.#owners].filter((owner) => !owner.lease.released);
+        const failure = new ProviderCleanupError("apktool", owners.flatMap((owner) => owner.cleanup.cleanupResources), { reason: cause.cleanup.reason }, { operation, cause });
+        this.#bind(failure, owners);
+        return failure;
+    }
+    #prune() {
+        for (const owner of this.#owners)
+            if (owner.lease.released)
+                this.#owners.delete(owner);
+    }
+}

package/dist/apktool/ApktoolCommandOutput.js

@@ -0,0 +1,22 @@
+import { OwnedCommandFailure } from "../process/OwnedCommand.js";
+import { DarwinProcessOwnershipInspectionError } from "../process/DarwinProcessRunTokenReader.js";
+/** Project the command owner's bounded output without losing examined byte counts. */
+const capturedApktoolCommandOutput = (output) => ({
+    stdout: output.stdout.text,
+    stderr: output.stderr.text,
+    truncated: output.diagnosticTruncated === true || output.outputIncomplete === true,
+    stdout_bytes: output.stdout.observedBytes,
+    stderr_bytes: output.stderr.observedBytes,
+    exit_code: output.exitCode ?? null,
+    signal: output.signal ?? null,
+});
+/** The command owner selects command output or preparation output, once. */
+export const capturedApktoolFailureOutput = (cause) => {
+    if (cause instanceof OwnedCommandFailure)
+        return cause.snapshot === null
+            ? cause.preparationFailure?.capturedOutput
+            : capturedApktoolCommandOutput(cause.snapshot);
+    return cause instanceof DarwinProcessOwnershipInspectionError
+        ? cause.capturedOutput
+        : undefined;
+};

package/dist/apktool/ApktoolConfiguration.js

@@ -1,11 +1,19 @@
+import { capturedApktoolFailureOutput } from "./ApktoolCommandOutput.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { ok, err } from "../domain/result.js";
+import { ApktoolCommandCleanup } from "./ApktoolCommandCleanup.js";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { DarwinProcessOwnershipInspectionError } from "../process/DarwinProcessRunTokenReader.js";
 import { AnalysisCancelledError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
 import { isAbsolute, win32 } from "node:path";
 import { stat } from "node:fs/promises";
 import { snapshotEnvironment } from "../process/snapshotEnvironment.js";
 import { ABORTED, waitForAbortable } from "../process/AbortablePromise.js";
 import { ProviderStartupDeadline } from "../process/ProviderDeadline.js";
-import { execFileOutput, execFileOutputFailure, } from "../process/ExecFileOutput.js";
-import { gte, valid } from "semver";
+import { randomUUID } from "node:crypto";
+import { OwnedCommandFailure, runOwnedCommand, prepareOwnedCommand, } from "../process/OwnedCommand.js";
+import { parse } from "semver";
 import { isWindowsBatchFile, windowsBatchCommand, WindowsBatchCommandError, } from "../process/WindowsBatchCommand.js";
 /** Environment key selecting the caller's apktool launcher. */
 export const APKTOOL_COMMAND_ENV = "REA_APKTOOL_COMMAND";
@@ -18,7 +26,9 @@ const VERSION_MAX_OUTPUT_BYTES = 64 * 1024;
  */
 export const resolveApktoolCommand = async (environment, platform = process.platform, signal) => {
     if (signal?.aborted === true)
-        throw new AnalysisCancelledError("inspect_apktool_client");
+        throw new AnalysisCancelledError("inspect_apktool_client", {
+            cause: signal.reason,
+        });
     const selectedEnvironment = snapshotEnvironment(environment, platform);
     const configured = selectedEnvironment[APKTOOL_COMMAND_ENV];
     if (configured !== undefined && configured.trim() !== "") {
@@ -48,7 +58,9 @@ export const resolveApktoolCommand = async (environment, platform = process.plat
     // A single deadline owns the whole PATH search, including filesystem waits.
     const deadline = new ProviderStartupDeadline(VERSION_TIMEOUT_MS, signal);
     const lookupInterruption = () => deadline.interruption === "cancelled"
-        ? new AnalysisCancelledError("inspect_apktool_client")
+        ? new AnalysisCancelledError("inspect_apktool_client", {
+            cause: signal?.reason,
+        })
         : new AnalysisTimeoutError("inspect_apktool_client", VERSION_TIMEOUT_MS, {
             diagnostics: { phase: "windows_path_lookup" },
         });
@@ -125,24 +137,44 @@ export const apktoolInvocation = (selection, arguments_, environment, platform =
         windowsVerbatimArguments: false,
     };
 /** Read the version from Apktool's single-line `--version` response. */
-export const parseApktoolVersionOutput = (stdout) => {
+export const parseApktoolVersionOutput = (stdout, platform = process.platform) => {
     const line = stdout
         .split(/\r?\n/u)
         .map((entry) => entry.trim())
         .find((entry) => entry !== "");
-    if (line === undefined || valid(line) === null)
+    const parsed = line === undefined ? null : parse(line);
+    if (line === undefined || parsed === null)
         return { version: null, reportedVersion: line ?? null };
-    return { version: line };
-};
-const supportsDocumentedApktoolVersion = (version) => {
-    // Debian's verified 2.7.0-dirty build is a downstream build marker, not a
-    // prerelease. Treat only that known marker as build metadata for the floor.
-    const comparisonVersion = version.replace(/-dirty$/u, "+dirty");
-    const parsedVersion = valid(comparisonVersion);
-    return parsedVersion !== null && gte(parsedVersion, "2.7.0");
+    // Debian's exact -dirty marker denotes a downstream release build. Preserve
+    // the reported spelling; other prereleases remain earlier than their release.
+    const downstreamRelease = parsed.prerelease.length === 1 &&
+        parsed.prerelease[0] === "dirty" &&
+        parsed.build.length === 0;
+    const atLeast = (release) => (downstreamRelease
+        ? parsed.compareMain(release)
+        : parsed.compare(release)) >= 0;
+    const limitations = [];
+    const discloseAdvisory = (fix, advisory, slug) => `Reported apktool version ${JSON.stringify(line)} predates the upstream ${fix} fix for ${advisory} (decoded resource paths could escape the output directory). Verify the selected decoder's patches before decoding untrusted APKs; launcher version alone does not establish engine contents or downstream backports. https://github.com/iBotPeaches/Apktool/security/advisories/${slug}`;
+    if (!atLeast("2.9.2"))
+        limitations.push(discloseAdvisory("2.9.2", "CVE-2024-21633", "GHSA-2hqv-2xv4-5h5w"));
+    if (platform === "win32" && !atLeast("2.9.3"))
+        limitations.push(discloseAdvisory("2.9.3", "GHSA-vgwr-4w3p-xmjv on Windows", "GHSA-vgwr-4w3p-xmjv"));
+    // Upstream 65dd848 validates ResTypeSpec names in 3.0.2. The tagged 3.0.0
+    // producer also lacks that check, although the advisory names only 3.0.1.
+    if (parsed.major === 3 && parsed.minor === 0 && !atLeast("3.0.2"))
+        limitations.push(discloseAdvisory("3.0.2", "CVE-2026-39973", "GHSA-m8mh-x359-vm8m") +
+            (parsed.patch === 0
+                ? " Inclusion of the 3.0.0 release line is source-derived; the advisory lists 3.0.1."
+                : ""));
+    return {
+        version: line,
+        supportsDocumentedVersion: atLeast("2.7.0"),
+        limitations,
+    };
 };
-/** Probe the selected apktool launcher without decoding anything. */
-export const inspectApktoolClient = async (selection, signal, environment = process.env, platform = process.platform) => {
+/** Probe within the caller-admitted command scope; decodes nothing. */
+export const inspectApktoolClient = async (selection, cleanup, options = {}) => {
+    const { signal, environment = process.env, platform = process.platform, } = options;
     const hostEnvironment = snapshotEnvironment(environment, platform);
     let invocation;
     try {
@@ -157,39 +189,64 @@ export const inspectApktoolClient = async (selection, signal, environment = proc
             remediation: `Set ${APKTOOL_COMMAND_ENV} to a launcher path without cmd.exe metacharacters (" % ^ ! & | < >), or to a native apktool executable`,
         }, { cause });
     }
-    let stdout;
-    let stderr;
+    let interpreted;
     try {
-        ({ stdout, stderr } = await execFileOutput(invocation.command, invocation.arguments, {
+        // The owned process group stops a shell launcher's children with it; a
+        // child holding inherited output pipes cannot outlive the deadline.
+        await prepareOwnedCommand(signal);
+        await runOwnedCommand({
+            command: invocation.command,
+            arguments: invocation.arguments,
             windowsVerbatimArguments: invocation.windowsVerbatimArguments,
-            timeout: VERSION_TIMEOUT_MS,
-            stopSignal: "SIGTERM",
-            maxBuffer: VERSION_MAX_OUTPUT_BYTES,
-            env: hostEnvironment,
-            ...(signal === undefined ? {} : { signal }),
-        }));
+            // Apktool launchers are commonly interpreter scripts, so ownership is
+            // proved by the run token rather than the launcher's argv prefix.
+            expectedCommand: null,
+            runId: randomUUID(),
+            hostEnvironment,
+        }, {
+            timeoutMs: VERSION_TIMEOUT_MS,
+            diagnosticBytes: VERSION_MAX_OUTPUT_BYTES,
+            observeCompleted: (snapshot) => {
+                try {
+                    interpreted = ok(interpretApktoolVersion(snapshot.stdout.text, snapshot.stderr.text, selection, platform));
+                }
+                catch (cause) {
+                    if (!(cause instanceof ApktoolConfigurationFailure))
+                        throw cause;
+                    interpreted = err(cause);
+                }
+            },
+        }, signal === undefined ? {} : { signal });
     }
     catch (cause) {
-        const failure = execFileOutputFailure(cause);
-        if (signal?.aborted || failure?.code === "ABORT_ERR")
-            throw new AnalysisCancelledError("inspect_apktool_client", { cause });
-        if (failure?.code === "ENOENT")
-            throw new ApktoolConfigurationFailure("command_missing", `The selected apktool launcher was not found: ${selection.command}`, {
-                selected_command: selection.command,
-                command_source: selection.commandSource,
-                remediation: `Set ${APKTOOL_COMMAND_ENV} to an absolute apktool launcher (the upstream wrapper or a java -jar script)`,
+        const recordedFailure = interpreted?.ok === false ? interpreted.error : undefined;
+        const cancellation = cause instanceof OwnedCommandFailure ? cause.cancellation : undefined;
+        const failure = recordedFailure === undefined
+            ? versionProbeFailure(cause, selection, interpreted?.ok === true ? interpreted.value : undefined)
+            : new ApktoolConfigurationFailure(recordedFailure.code, recordedFailure.message, {
+                ...recordedFailure.diagnostics,
+                ...(cancellation === undefined
+                    ? {}
+                    : { cancellation_observed: true }),
             }, { cause });
-        throw new ApktoolConfigurationFailure("version_unresolved", "The selected apktool launcher did not report a usable version", {
-            selected_command: selection.command,
-            ...(failure === undefined
-                ? {}
-                : {
-                    exit_code: failure.code,
-                    stderr_excerpt: failure.stderr.slice(0, 512),
-                }),
-        }, { cause });
+        const primary = failure instanceof AnalysisError
+            ? failure
+            : new ProviderAdapterError("apktool", "inspect_apktool_client", {
+                cause: failure,
+                userMessage: failure.message,
+                diagnostics: failure.diagnostics,
+            });
+        const retained = cleanup.retainFailure(cause, primary, "inspect_apktool_client");
+        throw retained === primary ? failure : retained;
     }
-    const identity = parseApktoolVersionOutput(stdout);
+    if (interpreted === undefined)
+        throw new ApktoolConfigurationFailure("version_unresolved", "The owned version command completed without an output observation", { selected_command: selection.command });
+    if (!interpreted.ok)
+        throw interpreted.error;
+    return interpreted.value;
+};
+const interpretApktoolVersion = (stdout, stderr, selection, platform) => {
+    const identity = parseApktoolVersionOutput(stdout, platform);
     if (identity.version === null)
         throw new ApktoolConfigurationFailure("version_unresolved", "The selected apktool launcher exited successfully but did not report a recognizable version", {
             selected_command: selection.command,
@@ -199,7 +256,7 @@ export const inspectApktoolClient = async (selection, signal, environment = proc
             stdout,
             stderr,
         });
-    if (!supportsDocumentedApktoolVersion(identity.version))
+    if (!identity.supportsDocumentedVersion)
         throw new ApktoolConfigurationFailure("unsupported_version", `The selected Apktool version ${identity.version} is older than the supported minimum 2.7.0`, {
             selected_command: selection.command,
             command_source: selection.commandSource,
@@ -225,3 +282,64 @@ export const apktoolConfigurationAvailability = (cause) => ({
     reason: cause.message,
     diagnostics: { ...cause.diagnostics },
 });
+/** Interpret the command owner's outcome, without inferring a new failure from a late signal. */
+const versionProbeFailure = (cause, selection, observed) => {
+    if (cause instanceof AnalysisError)
+        return cause;
+    const preparation = cause instanceof OwnedCommandFailure
+        ? cause.preparationFailure
+        : cause instanceof DarwinProcessOwnershipInspectionError
+            ? cause
+            : undefined;
+    const output = capturedApktoolFailureOutput(cause);
+    if (cause instanceof OwnedCommandFailure && cause.reason === "cancelled")
+        return new AnalysisCancelledError("inspect_apktool_client", {
+            cause: cause.cancellation?.reason,
+            ...(output === undefined ? {} : { capturedOutput: output }),
+            ...(observed === undefined
+                ? {}
+                : { diagnostics: { client: { version: observed.version } } }),
+        });
+    if (preparation !== undefined)
+        return new ProviderAdapterError("apktool", "inspect_apktool_client", {
+            cause,
+            diagnostics: {
+                stage: "ownership_preparation",
+                ...(preparation.compilerOutcome === undefined
+                    ? {}
+                    : {
+                        compiler_outcome: jsonValueSchema.parse(preparation.compilerOutcome),
+                    }),
+            },
+            ...(preparation.capturedOutput === undefined
+                ? {}
+                : { capturedOutput: preparation.capturedOutput }),
+        });
+    if (cause instanceof OwnedCommandFailure && cause.reason === "timeout")
+        return new AnalysisTimeoutError("inspect_apktool_client", VERSION_TIMEOUT_MS, { cause, ...(output === undefined ? {} : { capturedOutput: output }) });
+    if (cause instanceof Error &&
+        "code" in cause &&
+        (cause.code === "ENOENT" || cause.code === "EACCES"))
+        return new ApktoolConfigurationFailure("command_missing", `The selected apktool launcher was not found: ${selection.command}`, {
+            selected_command: selection.command,
+            command_source: selection.commandSource,
+            remediation: `Set ${APKTOOL_COMMAND_ENV} to an absolute apktool launcher (the upstream wrapper or a java -jar script)`,
+        }, { cause });
+    const snapshot = cause instanceof OwnedCommandFailure ? cause.snapshot : null;
+    return new ApktoolConfigurationFailure("version_unresolved", "The selected apktool launcher did not report a usable version", {
+        selected_command: selection.command,
+        ...(observed === undefined
+            ? {}
+            : { client: { version: observed.version } }),
+        ...(snapshot === null
+            ? {}
+            : {
+                exit_code: snapshot.exitCode ?? null,
+                stderr_excerpt: snapshot.stderr.text.slice(0, 512),
+            }),
+        ...(cause instanceof OwnedCommandFailure &&
+            cause.reason === "output-limit"
+            ? { max_output_bytes: VERSION_MAX_OUTPUT_BYTES }
+            : {}),
+    }, { cause });
+};

package/dist/apktool/ApktoolDecodeOutput.js

@@ -1,4 +1,5 @@
-import { DOMParser, } from "@xmldom/xmldom";
+import { parseXmlDocument } from "../domain/xmlDocument.js";
+import { ok, err } from "../domain/result.js";
 import { isMap, isScalar, parseDocument, } from "yaml";
 const metaInfoTag = {
     tag: "tag:yaml.org,2002:brut.androlib.meta.MetaInfo",
@@ -30,12 +31,26 @@ export const parseApktoolYml = (yml) => {
 };
 /** Read the package attribute from the decoded Android manifest root. */
 export const parseManifestPackage = (manifest) => {
-    const document = parseXml(manifest, "AndroidManifest.xml");
-    const root = document.documentElement;
+    const parsed = parseXmlDocument(manifest, {
+        doctype: "allow",
+        lineEndings: "preserve",
+    });
+    if (!parsed.ok)
+        throw new TypeError(`AndroidManifest.xml is not well-formed XML: ${parsed.error.message}`, { cause: parsed.error });
+    const root = parsed.value.documentElement;
     if (root === null || root.nodeName !== "manifest")
         throw new TypeError("AndroidManifest.xml root must be <manifest>");
     return root.getAttribute("package") || null;
 };
+/** A whole-document failure does not establish an omitted-entry count. */
+export class ApktoolStringsDocumentError extends Error {
+    reason;
+    _tag = "ApktoolStringsDocumentError";
+    constructor(reason, message, options) {
+        super(message, options);
+        this.reason = reason;
+    }
+}
 /**
  * Project direct `<string>` children from decoded resources XML. DOM parsing
  * identifies elements and attributes; text values are sliced from the input
@@ -43,16 +58,17 @@ export const parseManifestPackage = (manifest) => {
  * Markup-bearing string values are omitted and counted as partial evidence.
  */
 export const parseDecodedStrings = (stringsXml) => {
-    let document;
-    try {
-        document = parseXml(stringsXml, "strings.xml");
-    }
-    catch {
-        return { entries: [], unparsedCount: 1 };
-    }
-    const root = document.documentElement;
+    const parsed = parseXmlDocument(stringsXml, {
+        doctype: "allow",
+        lineEndings: "preserve",
+    });
+    if (!parsed.ok)
+        return err(new ApktoolStringsDocumentError("malformed", parsed.error.message, {
+            cause: parsed.error,
+        }));
+    const root = parsed.value.documentElement;
     if (root === null || root.nodeName !== "resources")
-        return { entries: [], unparsedCount: 1 };
+        return err(new ApktoolStringsDocumentError("wrong_root", "String resource document root must be <resources>"));
     const entries = [];
     let unparsedCount = 0;
     const offsets = sourceLineOffsets(stringsXml);
@@ -95,7 +111,7 @@ export const parseDecodedStrings = (stringsXml) => {
         }
         entries.push({ name, value: value.join("") });
     }
-    return { entries, unparsedCount };
+    return ok({ entries, unparsedCount });
 };
 const yamlScalar = (document, path, source) => {
     const node = document.getIn(path, true);
@@ -108,16 +124,6 @@ const yamlScalar = (document, path, source) => {
         ? String(node.value)
         : source.slice(range[0], range[1]);
 };
-const parseXml = (xml, label) => {
-    const errors = [];
-    const document = new DOMParser({
-        normalizeLineEndings: (source) => source,
-        onError: (_level, message) => errors.push(message),
-    }).parseFromString(xml, "application/xml");
-    if (errors.length > 0 || document.documentElement === null)
-        throw new TypeError(`${label} is not well-formed XML${errors[0] === undefined ? "" : `: ${errors[0]}`}`);
-    return document;
-};
 const childNodes = (node) => {
     const children = [];
     for (let child = node.firstChild; child !== null; child = child.nextSibling)

package/dist/apktool/ApktoolDecodedInventory.js

@@ -0,0 +1,52 @@
+import { ok, err } from "../domain/result.js";
+import { DirectoryArtifactTraversalLimit } from "../artifacts/DirectoryArtifactReader.js";
+import { assertArtifactReadActive } from "../artifacts/ArtifactFileOperation.js";
+import { classifyAndroidStringsTable } from "../domain/apktool/apktoolResourceAnalysis.js";
+/** Count files over bounded examined coverage, including omitted special entries. */
+export const countDecodedFiles = async (workspace, root, signal, maximumEntries) => {
+    let count = 0;
+    let capped = false;
+    const locales = [];
+    const otherStringsTables = [];
+    const unreadableStringsTables = [];
+    const observeTable = (path, kind) => {
+        const match = /^res\/(values(?:-([^/]*))?)\/strings\.xml$/u.exec(path);
+        if (match === null)
+            return;
+        if (kind !== "file") {
+            unreadableStringsTables.push({ path, kind });
+            return;
+        }
+        const suffix = match[2];
+        if (suffix === undefined)
+            return;
+        const table = classifyAndroidStringsTable(suffix);
+        if (table.kind === "locale")
+            locales.push(table.locale);
+        else
+            otherStringsTables.push(match[1]);
+    };
+    const observation = () => {
+        return {
+            count,
+            capped,
+            locales: locales.sort(),
+            otherStringsTables: otherStringsTables.sort(),
+            unreadableStringsTables: unreadableStringsTables.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0),
+        };
+    };
+    try {
+        for await (const entry of workspace.entries(root, signal, maximumEntries, (omission) => observeTable(omission.path, omission.kind))) {
+            assertArtifactReadActive(signal);
+            observeTable(entry.path, entry.kind);
+            if (entry.kind === "file")
+                count += 1;
+        }
+    }
+    catch (cause) {
+        if (!(cause instanceof DirectoryArtifactTraversalLimit))
+            return err({ cause, partial: observation() });
+        capped = true;
+    }
+    return ok(observation());
+};