Add immutable session bundle snapshots, bounded resource discovery, paginated unknowns, mutable current analysis snapshots, and provider-neutral navigation/address context tools.
BREAKING CHANGE: export_evidence_bundle now requires a filesystem path and no longer returns an inline bundle.
Add static providers for Android APK/AAB/DEX and Apple IPA artifacts,
including manifests, resources, signing, and native libraries (#366).
- mobileApplicationInvestigation.ts: domain schemas for Android
(APK, AAB, DEX) and iOS (IPA) artifact formats with manifests,
signing info, resources, and native libraries.
- detectMobileFormat and detectPlatform: classify from extensions
- classifyMobileResource: resource type from path
- Utility functions for native library filtering, internet
permission checking, and architecture enumeration
Closes#366
Replace 50 ms procfs sampling with event-backed capture of root/child/
grandchild spawn, exit, re-exec, and reparent events (#332).
- eventProcessTree.ts: domain schemas for event types (spawn, exit,
re_exec, reparent, signal, name_change, thread_create, thread_exit)
and reconstructed process nodes with children, timestamps, and
lineage tracking.
- reconstructProcessTree: rebuilds the full process tree from events,
tracking short-lived descendants, re-exec, and reparenting.
- Utility functions: getDescendants, containsProcess, maxTreeDepth.
- Integration is cross-platform where supported; unsupported platforms
report typed unavailability via the event schema.
Closes#332
Add deeper Objective-C and Swift metadata extraction, plus database
path/save/licensing behavior where licensing permits (#353).
- objcSwiftMetadata.ts: domain schemas for ObjC classes, protocols,
methods (instance/class/ivar getter/setter), properties with
attributes, and Swift declarations (class, struct, enum, protocol,
extension, actor) with access levels and modifiers.
- Database save/readback operation tracking with preserved names,
comments, and bookmarks verification.
- Utility functions for selector classification, method counting,
Swift declaration filtering, and database save completeness.
- Read-only and mutating operations are distinguished.
Closes#353
Add static analysis for MSIX, MSI, AppX packages, their resources,
and digital signatures (#363).
- packageAnalysis.ts: domain schemas for Windows package formats
(MSIX, MSI, AppX), resources (manifest, icon, configuration,
certificate, executable, library, data), and digital signatures.
- detectPackageFormat: classifies from file extension
- classifyResource: identifies resource type from path
- Digital signature validation with timestamp detection
- Package and resource contents are inventoried without execution
Closes#363
morluto