reverseport 0.0.0-stage → 1.2.0

package/dist/domain/managed/managedReconstruction.js

@@ -0,0 +1,190 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { evidenceSchema } from "../evidence.js";
+import { cliMetadataGuidSchema, managedMemberInspectionSchema, } from "./managedArtifact.js";
+import { digestSchema, prefixedDigestSchema } from "../digests.js";
+import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
+const textSchema = z.string().min(1);
+const decompilerSchema = z.strictObject({
+    name: textSchema,
+    version: textSchema.nullable().default(null),
+    family: z.enum(["ilspy", "dnspy", "dnlib", "mono-cecil", "other"]),
+    executable_sha256: digestSchema.nullable().default(null),
+    options: z.array(z.string()).default([]),
+});
+const managedReconstructionMethodInputSchema = z.strictObject({
+    token: tokenSchema,
+    signature_sha256: digestSchema,
+    normalized_il_sha256: digestSchema.nullable(),
+    reconstruction: z.strictObject({
+        kind: z.enum(["decompiled-csharp", "decompiled-il", "semantic-pseudocode"]),
+        language: z.enum(["csharp", "il", "pseudocode"]),
+        text: textSchema,
+        text_sha256: digestSchema.optional(),
+        source_path: textSchema.nullable().optional(),
+        start_line: z.number().int().min(1).nullable().optional(),
+        end_line: z.number().int().min(1).nullable().optional(),
+    }),
+});
+export const managedReconstructionImportInputSchema = z.strictObject({
+    static_members: evidenceSchema,
+    decompiler: decompilerSchema,
+    methods: z.array(managedReconstructionMethodInputSchema).min(1),
+    notes: z.array(textSchema).default([]),
+});
+const importedMethodSchema = z.strictObject({
+    token: tokenSchema,
+    declaring_type: z.string().nullable(),
+    name: z.string(),
+    signature_sha256: digestSchema,
+    normalized_il_sha256: digestSchema.nullable(),
+    body_sha256: digestSchema.nullable(),
+    il_size: z.number().int().min(0),
+    reconstruction: z.strictObject({
+        kind: z.enum(["decompiled-csharp", "decompiled-il", "semantic-pseudocode"]),
+        language: z.enum(["csharp", "il", "pseudocode"]),
+        text: textSchema,
+        text_sha256: digestSchema,
+        text_length: z.number().int().min(1),
+        line_count: z.number().int().min(1),
+        source_path: textSchema.nullable(),
+        start_line: z.number().int().min(1).nullable(),
+        end_line: z.number().int().min(1).nullable(),
+    }),
+    validation: z.strictObject({
+        matched_static_member: z.literal(true),
+        exact_build_required: z.literal(true),
+        canonical_observation: z.literal(false),
+        confidence_floor: z.literal("inference"),
+    }),
+});
+export const managedReconstructionImportResultSchema = z.strictObject({
+    reconstruction_id: prefixedDigestSchema("mre"),
+    phase: z.literal("reconstruction-import"),
+    executed: z.literal(false),
+    static_observation: z.strictObject({
+        evidence_id: evidenceIdSchema,
+        artifact_sha256: digestSchema,
+        artifact_path: z.string().min(1),
+        byte_length: z.number().int().min(0),
+        module_name: z.string().nullable(),
+        mvid: cliMetadataGuidSchema.nullable(),
+        metadata_status: z.enum(["absent", "complete", "partial", "malformed"]),
+    }),
+    decompiler: decompilerSchema.extend({
+        options_sha256: digestSchema,
+    }),
+    summary: z.strictObject({
+        imported_methods: z.number().int().min(1),
+        decompiled_csharp_methods: z.number().int().min(0),
+        decompiled_il_methods: z.number().int().min(0),
+        pseudocode_methods: z.number().int().min(0),
+        total_text_bytes: z.number().int().min(1),
+    }),
+    methods: z.array(importedMethodSchema).min(1),
+    notes: z.array(textSchema),
+    evidence_links: z.array(evidenceIdSchema).length(1),
+    limitations: z.array(textSchema),
+});
+const sha256Text = (value) => createHash("sha256").update(value).digest("hex");
+const sha256Json = (value) => {
+    const serialized = canonicalize(value);
+    if (serialized === undefined)
+        throw new TypeError("Managed reconstruction canonicalization failed");
+    return createHash("sha256").update(serialized).digest("hex");
+};
+const countLines = (text) => text.length === 0 ? 0 : text.split(/\r\n|\r|\n/u).length;
+const findObservedMethod = (members, candidate) => members.methods.find((item) => item.token === candidate.token &&
+    item.signature.raw_sha256 === candidate.signature_sha256 &&
+    item.body.status === "present" &&
+    item.body.normalized_il_sha256 !== null &&
+    candidate.normalized_il_sha256 !== null &&
+    item.body.normalized_il_sha256 === candidate.normalized_il_sha256);
+const verifyTextSha256 = (candidate, textSha256) => {
+    if (candidate.reconstruction.text_sha256 !== undefined &&
+        candidate.reconstruction.text_sha256 !== textSha256)
+        throw new TypeError(`Reconstruction text hash mismatch for ${candidate.token}`);
+};
+const buildImportedMethod = (observed, candidate, textSha256) => ({
+    token: observed.token,
+    declaring_type: observed.declaring_type,
+    name: observed.name,
+    signature_sha256: observed.signature.raw_sha256,
+    normalized_il_sha256: observed.body.normalized_il_sha256,
+    body_sha256: observed.body.il_sha256,
+    il_size: observed.body.il_size,
+    reconstruction: {
+        kind: candidate.reconstruction.kind,
+        language: candidate.reconstruction.language,
+        text: candidate.reconstruction.text,
+        text_sha256: textSha256,
+        text_length: candidate.reconstruction.text.length,
+        line_count: countLines(candidate.reconstruction.text),
+        source_path: candidate.reconstruction.source_path ?? null,
+        start_line: candidate.reconstruction.start_line ?? null,
+        end_line: candidate.reconstruction.end_line ?? null,
+    },
+    validation: {
+        matched_static_member: true,
+        exact_build_required: true,
+        canonical_observation: false,
+        confidence_floor: "inference",
+    },
+});
+const buildReconstructionSummary = (methods) => ({
+    imported_methods: methods.length,
+    decompiled_csharp_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "decompiled-csharp").length,
+    decompiled_il_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "decompiled-il").length,
+    pseudocode_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "semantic-pseudocode").length,
+    total_text_bytes: methods.reduce((total, { reconstruction }) => total + reconstruction.text_length, 0),
+});
+const buildStaticObservation = (staticEvidence, members) => ({
+    evidence_id: staticEvidence.evidence_id,
+    artifact_sha256: members.artifact.sha256,
+    artifact_path: members.artifact.path,
+    byte_length: members.artifact.byte_length,
+    module_name: members.module?.name ?? null,
+    mvid: members.module?.mvid ?? null,
+    metadata_status: members.metadata.status,
+});
+const buildDecompilerRecord = (decompiler) => ({
+    ...decompiler,
+    options_sha256: sha256Json(decompiler.options),
+});
+const RECONSTRUCTION_LIMITATIONS = [
+    "Decompiler output is imported as reconstruction evidence and analyst inference; metadata and IL observations remain canonical.",
+    "This operation did not execute, load, reflect over, debug, instrument, patch, or decompile the target artifact.",
+    "The imported reconstruction is valid only for the exact artifact SHA-256, MVID, method signature, and normalized IL shape recorded here.",
+    "Obfuscated names, decompiler variables, and control-flow restructuring are not treated as proof without separate validation.",
+];
+const buildReconstructionWithoutId = (input, staticEvidence, members, methods) => ({
+    phase: "reconstruction-import",
+    executed: false,
+    static_observation: buildStaticObservation(staticEvidence, members),
+    decompiler: buildDecompilerRecord(input.decompiler),
+    summary: buildReconstructionSummary(methods),
+    methods: [...methods],
+    notes: input.notes,
+    evidence_links: [staticEvidence.evidence_id],
+    limitations: RECONSTRUCTION_LIMITATIONS,
+});
+/** Authenticate decompiler reconstruction against static IL Evidence. */
+export const importManagedReconstruction = (input) => {
+    const { evidence: staticEvidence, result: members } = parseManagedInspectionEvidence(input.static_members, "inspect_managed_members", managedMemberInspectionSchema);
+    const methods = input.methods.map((candidate) => {
+        const observed = findObservedMethod(members, candidate);
+        if (observed === undefined)
+            throw new TypeError(`Reconstruction method lock ${candidate.token} does not match a static managed member observation`);
+        const textSha256 = sha256Text(candidate.reconstruction.text);
+        verifyTextSha256(candidate, textSha256);
+        return buildImportedMethod(observed, candidate, textSha256);
+    });
+    const withoutId = buildReconstructionWithoutId(input, staticEvidence, members, methods);
+    return managedReconstructionImportResultSchema.parse({
+        ...withoutId,
+        reconstruction_id: `mre_${sha256Json(withoutId)}`,
+    });
+};

package/dist/domain/mobileApplicationGraphProjection.js

@@ -0,0 +1,61 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { evidenceSchema } from "./evidence.js";
+import { digestSchema } from "./digests.js";
+import { prefixedDigestSchema } from "./digests.js";
+import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "./bridgeCandidateProjection.js";
+/** Evidence-scoped identifier schemas shared by application graph projections. */
+export const projectionEvidenceIdSchema = prefixedDigestSchema("ev");
+export const projectionPathSchema = z.string().min(1);
+/** Inventory pages accepted by every application graph projection. */
+export const applicationInventoryProjectionInputSchema = z.strictObject({
+    inventory_evidence: z.array(evidenceSchema).min(1),
+});
+/** One authenticated inventory entry retained by application graph projections. */
+export const projectedComponentSchema = z.strictObject({
+    path: projectionPathSchema,
+    artifact_id: prefixedDigestSchema("art"),
+    sha256: digestSchema,
+    format: z.string().min(1),
+});
+/** Path-pair hypotheses connecting managed content to a native library. */
+export const projectedBridgeCandidateSchema = (basis) => z.strictObject({
+    managed_path: projectionPathSchema,
+    native_path: projectionPathSchema,
+    basis: z.enum(basis),
+});
+/** Coverage status combining inventory completeness with a projection budget. */
+export const projectionCoverage = (inventory, budgetComplete) => ({
+    status: inventory.complete && budgetComplete
+        ? "complete-within-inventory"
+        : "partial",
+    inventory_complete: inventory.complete,
+});
+/** Flatten every inventoried occurrence into authenticated path components. */
+export const projectedComponents = (inventory) => {
+    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
+    return inventory.occurrences
+        .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
+        .map((occurrence) => {
+        const node = nodes.get(occurrence.artifact_id ?? "");
+        if (node === undefined)
+            throw new TypeError("Application projection occurrence has no artifact node");
+        return {
+            path: occurrence.logical_path,
+            artifact_id: node.artifact_id,
+            sha256: node.sha256,
+            format: occurrence.artifact_format,
+        };
+    });
+};
+export { bridgeCandidateCoverageSchema, projectCartesianCandidates };
+/** Unicode code point ordering so projection arrays sort deterministically. */
+export const compareProjectionStrings = (left, right) => (left < right ? -1 : left > right ? 1 : 0);
+/** Digest a canonical JSON projection payload for its stable identifier. */
+export const projectionDigest = (value, label) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError(`${label} is not canonical JSON`);
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/domain/native/binaryLayout.js

@@ -0,0 +1,354 @@
+import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
+import { CANONICAL_BASE64_PATTERN } from "../stringPatterns.js";
+const unsignedHex = z.string().regex(/^0x(?:0|[1-9a-f][0-9a-f]{0,15})$/);
+const index = z.number().int().nonnegative();
+const scalar = z.union([z.string(), z.number().int()]);
+const range = z.strictObject({ offset: unsignedHex, bytes: unsignedHex });
+const canonicalBase64 = z.string().regex(CANONICAL_BASE64_PATTERN);
+const name = z.strictObject({
+    display: z.string(),
+    bytes_base64: canonicalBase64.nullable(),
+    location: range.nullable(),
+    unknown_reason: z.string().nullable(),
+});
+/** Explicit local object selection, independent of an active disassembler target. */
+export const inspectBinaryLayoutInputSchema = z.strictObject({
+    path: localPathStringSchema.describe("Absolute filesystem path to the selected binary"),
+});
+/** File and linked-image evidence; numeric ELF values never pass through unsafe JSON numbers. */
+const binaryLayoutObjectSchema = z.strictObject({
+    artifact: z.strictObject({
+        path: z.string().min(1),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        bytes: index,
+    }),
+    format: z.literal("elf"),
+    architecture: z.strictObject({
+        machine: z.literal("EM_X86_64"),
+        bits: z.literal(64),
+        byte_order: z.literal("little"),
+    }),
+    image_type: z.enum(["ET_EXEC", "ET_DYN", "ET_REL"]),
+    entry_point: z.strictObject({
+        reported_value: unsignedHex,
+        meaning: z.enum(["linked-virtual-address", "not-applicable", "absent"]),
+        execution_status: z.literal("unknown"),
+    }),
+    runtime_load_base: z.null(),
+    sections: z.array(z.strictObject({
+        index,
+        name,
+        name_offset: unsignedHex,
+        type: scalar,
+        header_location: range,
+        address: unsignedHex,
+        offset: unsignedHex,
+        size: unsignedHex,
+        alignment: unsignedHex,
+        flags: unsignedHex,
+        link: index,
+        info: index,
+        entry_size: unsignedHex,
+        file_backing: z.enum(["file", "none"]),
+    })),
+    segments: z.array(z.strictObject({
+        index,
+        type: scalar,
+        header_location: range,
+        offset: unsignedHex,
+        file_size: unsignedHex,
+        memory_size: unsignedHex,
+        virtual_address: unsignedHex,
+        physical_address: unsignedHex,
+        alignment: unsignedHex,
+        flags: unsignedHex,
+        file_backing: z.enum(["file", "none"]),
+        permissions: z
+            .strictObject({
+            read: z.boolean(),
+            write: z.boolean(),
+            execute: z.boolean(),
+        })
+            .nullable(),
+    })),
+    symbols: z.array(z.strictObject({
+        table_index: index,
+        entry_index: index,
+        name,
+        name_offset: unsignedHex,
+        location: range,
+        value: unsignedHex,
+        value_meaning: z.enum([
+            "undefined",
+            "alignment",
+            "absolute-value",
+            "no-address",
+            "unknown-section-index",
+            "section-offset",
+            "tls-offset",
+            "linked-virtual-address",
+        ]),
+        size: unsignedHex,
+        binding: scalar,
+        type: scalar,
+        visibility: scalar,
+        section_index: scalar,
+    })),
+    relocations: z.array(z.strictObject({
+        section_index: index,
+        entry_index: index,
+        reported_offset: unsignedHex,
+        target: z.discriminatedUnion("kind", [
+            z.strictObject({
+                kind: z.literal("section-offset"),
+                section_index: index,
+                offset: unsignedHex,
+            }),
+            z.strictObject({
+                kind: z.literal("linked-virtual-address"),
+                address: unsignedHex,
+            }),
+            z.strictObject({
+                kind: z.literal("unknown-section"),
+                reported_section_index: index,
+                offset: unsignedHex,
+                unknown_reason: z.enum([
+                    "undefined-section-reference",
+                    "inactive-section-header",
+                ]),
+            }),
+        ]),
+        location: range,
+        type: index,
+        symbol_table_index: index,
+        symbol_index: index,
+        symbol_reference_meaning: z.enum([
+            "zero-symbol-value",
+            "symbol-table-entry",
+        ]),
+        addend: z
+            .string()
+            .regex(/^-?(?:0|[1-9][0-9]{0,18})$/)
+            .nullable(),
+    })),
+    packed_relative_relocations: z.array(z.strictObject({
+        section_index: index,
+        location: range,
+        encoded_bytes_base64: canonicalBase64,
+        entries: z.array(z.strictObject({ decoded_index: index, reported_offset: unsignedHex })),
+        offset_meaning: z.enum(["linked-virtual-address", "unknown"]),
+        evidence_kind: z.literal("derived"),
+        entry_source_locations: z.null(),
+        addends: z.null(),
+    })),
+    relocation_inventory_completeness: z.literal("unknown"),
+    linkage: z.strictObject({
+        needed_libraries: z.array(name),
+        interpreters: z.array(name),
+        got: z.array(z.strictObject({ display_name: z.string(), address: unsignedHex })),
+        plt: z.array(z.strictObject({ display_name: z.string(), address: unsignedHex })),
+        convenience_maps_completeness: z.literal("unknown"),
+        runtime_library_paths: z.null(),
+    }),
+    mitigations: z.strictObject({
+        evidence_kind: z.literal("inferred"),
+        position_independent: z.boolean(),
+        nx_indicator: z.boolean().nullable(),
+        executable_stack_indicator: z.boolean(),
+        stack_canary_indicator: z.boolean(),
+        relro: z.enum(["Partial", "Full"]).nullable(),
+    }),
+    diagnostics: z.strictObject({
+        stdout: z.string(),
+        stderr: z.string(),
+        truncated: z.boolean(),
+    }),
+    limitations: z.array(z.string()),
+});
+/** Decoder payload excludes the artifact identity observed by the owning process boundary. */
+export const binaryLayoutPayloadSchema = binaryLayoutObjectSchema.omit({
+    artifact: true,
+    diagnostics: true,
+});
+/** Check source ranges again at the public boundary, independently of upstream parsing. */
+export const binaryLayoutSchema = binaryLayoutObjectSchema.superRefine((value, context) => {
+    const size = BigInt(value.artifact.bytes);
+    const check = (offset, length, path) => {
+        const start = BigInt(offset);
+        const bytes = BigInt(length);
+        if (start > size || bytes > size - start)
+            context.addIssue({
+                code: "custom",
+                path,
+                message: "Reported file-backed range lies outside the selected artifact.",
+            });
+    };
+    const checkLocation = (where, path) => check(where.offset, where.bytes, path);
+    const checkName = (reported, path) => {
+        if (reported.location !== null)
+            checkLocation(reported.location, [...path, "location"]);
+    };
+    const expectedEntryMeaning = value.image_type === "ET_REL"
+        ? "not-applicable"
+        : value.entry_point.reported_value === "0x0"
+            ? "absent"
+            : "linked-virtual-address";
+    if (value.entry_point.meaning !== expectedEntryMeaning)
+        context.addIssue({
+            code: "custom",
+            path: ["entry_point", "meaning"],
+            message: "Entry meaning must distinguish zero/unused fields from an actual linked address.",
+        });
+    for (const [index, section] of value.sections.entries()) {
+        if ((section.type === "SHT_SYMTAB" || section.type === "SHT_DYNSYM") &&
+            value.sections[section.link]?.type !== "SHT_STRTAB")
+            context.addIssue({
+                code: "custom",
+                path: ["sections", index, "link"],
+                message: "Symbol tables must link to an existing string-table section.",
+            });
+        if (section.index !== index)
+            context.addIssue({
+                code: "custom",
+                path: ["sections", index, "index"],
+                message: "Complete section order must preserve original producer indices.",
+            });
+        checkLocation(section.header_location, [
+            "sections",
+            index,
+            "header_location",
+        ]);
+        checkName(section.name, ["sections", index, "name"]);
+        if (section.file_backing === "file")
+            check(section.offset, section.size, ["sections", index]);
+    }
+    for (const [index, segment] of value.segments.entries()) {
+        if (segment.index !== index)
+            context.addIssue({
+                code: "custom",
+                path: ["segments", index, "index"],
+                message: "Complete segment order must preserve original producer indices.",
+            });
+        checkLocation(segment.header_location, [
+            "segments",
+            index,
+            "header_location",
+        ]);
+        const hasFileBytes = segment.type !== "PT_NULL" && BigInt(segment.file_size) !== 0n;
+        if (segment.file_backing !== (hasFileBytes ? "file" : "none"))
+            context.addIssue({
+                code: "custom",
+                path: ["segments", index, "file_backing"],
+                message: "File backing must follow the reported segment type and file size.",
+            });
+        if ((segment.type === "PT_NULL") !== (segment.permissions === null))
+            context.addIssue({
+                code: "custom",
+                path: ["segments", index, "permissions"],
+                message: "Unused PT_NULL flags have no permission meaning; other segment flags retain their interpretation.",
+            });
+        if (hasFileBytes)
+            check(segment.offset, segment.file_size, ["segments", index]);
+    }
+    for (const [index, symbol] of value.symbols.entries()) {
+        checkLocation(symbol.location, ["symbols", index, "location"]);
+        checkName(symbol.name, ["symbols", index, "name"]);
+    }
+    for (const [index, relocation] of value.relocations.entries())
+        checkLocation(relocation.location, ["relocations", index, "location"]);
+    validateRelocationReferences(value, context);
+    validatePackedRelativeTables(value, context, checkLocation);
+    for (const facet of ["needed_libraries", "interpreters"])
+        for (const [index, reported] of value.linkage[facet].entries())
+            checkName(reported, ["linkage", facet, index]);
+});
+const validateRelocationReferences = (value, context) => {
+    const symbols = new Set(value.symbols.map((symbol) => `${symbol.table_index}:${symbol.entry_index}`));
+    for (const [index, relocation] of value.relocations.entries()) {
+        const owner = value.sections[relocation.section_index];
+        const target = relocation.target;
+        const targetMatches = value.image_type === "ET_REL"
+            ? target.kind === "section-offset"
+                ? target.section_index !== 0 &&
+                    target.section_index === owner?.info &&
+                    value.sections[target.section_index] !== undefined &&
+                    value.sections[target.section_index]?.type !== "SHT_NULL" &&
+                    target.offset === relocation.reported_offset
+                : target.kind === "unknown-section" &&
+                    target.reported_section_index === owner?.info &&
+                    target.offset === relocation.reported_offset &&
+                    (target.reported_section_index === 0
+                        ? target.unknown_reason === "undefined-section-reference"
+                        : value.sections[target.reported_section_index]?.type ===
+                            "SHT_NULL" &&
+                            target.unknown_reason === "inactive-section-header")
+            : target.kind === "linked-virtual-address" &&
+                target.address === relocation.reported_offset;
+        if (!targetMatches)
+            context.addIssue({
+                code: "custom",
+                path: ["relocations", index, "target"],
+                message: "Relocation target must preserve its reported offset and owner reference; SHN_UNDEF and inactive headers remain unknown rather than resolved sections.",
+            });
+        const table = value.sections[relocation.symbol_table_index];
+        const tableExists = relocation.symbol_table_index !== 0 &&
+            (table?.type === "SHT_SYMTAB" || table?.type === "SHT_DYNSYM");
+        const positiveReferenceExists = tableExists &&
+            BigInt(table.entry_size) >= 24n &&
+            BigInt(relocation.symbol_index) <
+                BigInt(table.size) / BigInt(table.entry_size) &&
+            symbols.has(`${relocation.symbol_table_index}:${relocation.symbol_index}`);
+        if ((owner?.type !== "SHT_REL" && owner?.type !== "SHT_RELA") ||
+            owner.link !== relocation.symbol_table_index ||
+            (relocation.symbol_table_index !== 0 && !tableExists) ||
+            (relocation.symbol_index !== 0 && !positiveReferenceExists) ||
+            relocation.symbol_reference_meaning !==
+                (relocation.symbol_index === 0
+                    ? "zero-symbol-value"
+                    : "symbol-table-entry"))
+            context.addIssue({
+                code: "custom",
+                path: ["relocations", index],
+                message: "Relocation must preserve its REL/RELA owner and resolve positive symbol indices through the linked symbol table; index zero uses a zero symbol value.",
+            });
+    }
+};
+const validatePackedRelativeTables = (value, context, checkLocation) => {
+    for (const [tableIndex, table,] of value.packed_relative_relocations.entries()) {
+        checkLocation(table.location, [
+            "packed_relative_relocations",
+            tableIndex,
+            "location",
+        ]);
+        const encodedBytes = (table.encoded_bytes_base64.length * 3) / 4 -
+            (table.encoded_bytes_base64.endsWith("==")
+                ? 2
+                : table.encoded_bytes_base64.endsWith("=")
+                    ? 1
+                    : 0);
+        if (!Number.isInteger(encodedBytes) ||
+            BigInt(encodedBytes) !== BigInt(table.location.bytes))
+            context.addIssue({
+                code: "custom",
+                path: ["packed_relative_relocations", tableIndex],
+                message: "Complete packed table bytes must match its original file range.",
+            });
+        const section = value.sections[table.section_index];
+        if (section?.type !== "SHT_RELR" ||
+            section.offset !== table.location.offset ||
+            section.size !== table.location.bytes)
+            context.addIssue({
+                code: "custom",
+                path: ["packed_relative_relocations", tableIndex, "section_index"],
+                message: "Packed relative evidence must retain its original RELR section identity and range.",
+            });
+        for (const [decoded, entry] of table.entries.entries())
+            if (entry.decoded_index !== decoded)
+                context.addIssue({
+                    code: "custom",
+                    path: ["packed_relative_relocations", tableIndex, "entries", decoded],
+                    message: "Decoded offsets must preserve upstream iterator order.",
+                });
+    }
+};

package/dist/domain/native/fileOffsetPartialObservation.js

@@ -0,0 +1 @@
+export {};