import { projectModelArtifactView, modelArtifactSummarySchema, modelArtifactViewRequestSchema, modelArtifactViewItemsSchema, modelArtifactViewContextSchema, } from "./modelArtifactView.js"; import { commandSummaryContext, gdbCommandSummarySchema, projectCommandObservationView, } from "./commandObservationView.js"; import { fridaSessionStatusSummarySchema, fridaSessionStatusViewContext, projectFridaSessionStatusView, } from "./fridaSessionStatusView.js"; import { commandObservationSchema } from "../commandObservation.js"; import { goBinarySummarySchema, goBinaryViewContextSchema, goBinaryViewPageSchema, goBinaryViewRequestSchema, projectGoBinaryView, } from "./goBinaryView.js"; import { projectNativeFunctionMatchingView, nativeFunctionMatchingViewRequestSchema, nativeFunctionMatchingViewItemsSchema, nativeFunctionMatchingViewContextSchema, } from "./nativeFunctionMatchingView.js"; import { protobufViewRequestSchema, protobufViewItemsSchema, protobufViewContextSchema, } from "./protobufCaptureView.js"; import { nativeInventoryViewRequestSchema, nativeInventoryViewRowSchema, nativeInventoryViewContext, nativeInventorySummarySchema, projectNativeInventoryView, } from "./nativeInventoryView.js"; import { NATIVE_INVENTORY_OPERATIONS, nativeInventoryOperationSchema, } from "../native/nativeInventory.js"; import { absoluteLocalPathStringSchema } from "../localPath.js"; import { z } from "zod"; import { desktopViewRequestSchema, desktopViewItemsSchema, desktopSummarySchema, projectDesktopApplicationView, } from "./desktopApplicationView.js"; import { desktopCoverageSchema } from "../desktopApplication.js"; import { javascriptModuleReferencesRequestSchema, javascriptModuleReferenceSchema, } from "./javascriptModuleReferences.js"; import { javascriptApplicationSourceCoverageSchema } from "./javascriptApplicationCoverage.js"; import { javascriptFactsViewRequestSchema, javascriptFactRowSchema, } from "./javascriptFactsView.js"; import { javaScriptSourceSelectionSchema } from "../javascript/javascriptSourceSelection.js"; import { AnalysisUnsupportedTargetError } from "../analysisErrorCore.js"; import { INSPECT_ANALYSIS_VIEW_OPERATION, analysisViewInputError, } from "./analysisViewErrors.js"; import { digestCanonicalValue } from "../canonicalDigest.js"; import { digestSchema, prefixedDigestSchema } from "../digests.js"; import { evidenceSchema, type Evidence } from "../evidence.js"; import { jsonObjectSchema, jsonValueSchema } from "../jsonValue.js"; import { err, ok, type Result } from "../result.js"; import type { AnalysisError } from "../analysisErrorBase.js"; import { safeParseOwnedBinaryLayout } from "../native/binaryLayout.js"; import { functionDossierSchema } from "../hopperValues.js"; import { artifactGraphManifestSchema, artifactInventoryCoverageSchema, } from "../artifactGraph.js"; import { artifactInspectionResultSchema } from "../artifactInspection.js"; import { parseOwnedJavaScriptApplicationAnalysisSteps, type JavaScriptApplicationAnalysisResult, } from "../javascript/javascriptApplicationAnalysis.js"; import { analysisInputErrorFromIssues } from "../inputIssueProjection.js"; import { projectBinaryLayoutView } from "./binaryLayoutView.js"; import { projectJavaScriptApplicationView } from "./javascriptApplicationView.js"; import { projectWebNetworkApiSurfaceView, apiSurfaceFields, apiSurfaceViewSchema, } from "./webNetworkApiSurfaceView.js"; import { projectNativeFunctionView } from "./nativeFunctionView.js"; import { projectEvmInterfaceView, evmViewRequestSchema, evmViewItemSchema, evmSummarySchema, } from "./evmInterfaceView.js"; import { projectArtifactInventoryView, artifactInventoryViewRequestSchema, artifactInventoryItemsSchema, artifactInventorySummarySchema, } from "./artifactInventoryView.js"; import { projectManagedArtifactView, managedViewRequestSchema, managedViewItemSchema, managedSummarySchema, managedViewContextSchema, } from "./managedArtifactView.js"; import { projectManagedMemberView, managedMembersViewRequestSchema, managedMembersViewPageSchema, managedMemberSummarySchema, managedMembersViewContextSchema, } from "./managedMemberView.js"; import { projectWasmArtifactView, wasmViewRequestSchema, wasmViewItemSchema, wasmSummarySchema, } from "./wasmArtifactView.js"; import { machoSummarySchema, machoViewContextSchema, machoViewItemSchema, machoViewRequestSchema, projectMachoView, } from "./machoView.js"; import { interfaceBuilderSummarySchema, interfaceBuilderViewContextSchema, interfaceBuilderViewItemsSchema, interfaceBuilderViewRequestSchema, projectInterfaceBuilderView, } from "./interfaceBuilderView.js"; import { projectWebNetworkCaptureView, captureViewRequestSchema, captureViewItemsSchema, captureSummarySchema, } from "./webNetworkCaptureView.js"; import type { WebNetworkApiSurfaceAccumulator } from "./WebNetworkApiSurfaceAccumulator.js"; import type { EnvironmentManifestAccumulator } from "./EnvironmentManifestAccumulator.js"; import type { EnvironmentStateAccumulator } from "./EnvironmentStateAccumulator.js"; import { projectEnvironmentManifestView, environmentManifestFields, environmentManifestViewRequestSchema, } from "./environmentManifestView.js"; import { environmentStateFields, environmentStateViewRequestSchema, projectEnvironmentStateView, } from "./environmentStateView.js"; import { pcapViewRequestSchema, pcapViewPageSchema, pcapSummarySchema, projectPcapCaptureView, } from "./pcapCaptureView.js"; import { qlogViewRequestSchema, qlogViewPageSchema, qlogViewContextSchema, } from "./qlogCaptureView.js"; import { projectAndroidPackageView, androidPackageSummarySchema, androidViewRequestSchema, androidManifestViewItemSchema, } from "./androidPackageView.js"; import { projectDartAotView, dartAotSummarySchema, dartAotViewRequestSchema, dartAotViewContextSchema, } from "./dartAotView.js"; import { projectIl2cppMetadataView, il2cppMetadataSummarySchema, il2cppMetadataViewRequestSchema, il2cppMetadataViewContextSchema, il2cppMetadataViewItemsSchema, } from "./il2cppMetadataView.js"; const summaryViewSchema = z.strictObject({ kind: z.literal("summary") }); const facetViewSchema = z.strictObject({ kind: z.literal("facet"), facet: z.enum(["mitigations", "linkage"]), }); const indexSelectorSchema = z.strictObject({ index: z.number().int().nonnegative(), }); const nameSelectorSchema = z.strictObject({ name: z.string() }); const pathSelectorSchema = z.strictObject({ path: z .string() .describe( "Exact observed module path or original source-map reference from a module page; an empty reference is valid.", ), }); const nodeIdSelectorSchema = z.strictObject({ node_id: prefixedDigestSchema("jag_node"), }); const moduleItemViewSchema = z.strictObject({ kind: z.literal("item"), collection: z.literal("modules"), selector: z.union([pathSelectorSchema, nodeIdSelectorSchema]), }); const sectionOrSymbolItemViewSchema = z.strictObject({ kind: z.literal("item"), collection: z.enum(["sections", "symbols"]), selector: z.union([indexSelectorSchema, nameSelectorSchema]), }); /** * The collection-specific selector alternatives are expressed in the owning * contract so the advertised JSON Schema preserves them: modules accept * path/node_id, sections and symbols accept index/name. Refinement-only * constraints do not survive JSON Schema conversion, so the advertised * schema previously accepted combinations that runtime input validation * rejects. */ const itemViewSchema = z.discriminatedUnion("collection", [ moduleItemViewSchema, sectionOrSymbolItemViewSchema, ]); const pageViewSchema = z.strictObject({ kind: z.literal("page"), collection: z.enum(["sections", "symbols", "modules"]), offset: z.number().int().nonnegative(), limit: z.number().int().positive(), }); /** Bounded native function facets of already authenticated analyze_function Evidence. */ const nativeViewSchema = z.strictObject({ kind: z.literal("native"), facet: z.enum([ "procedure", "pseudocode", "assembly", "basic_blocks", "comments", "callers", "callees", "incoming_references", "outgoing_references", "unresolved_calls", "referenced_strings", "referenced_names", "swift_string_literals", "swift_string_literal_omissions", "native_api", "value_flow_summary", "value_flow_operations", "value_flow_def_use", "value_flow_effects", "value_flow_parameters", "value_flow_parameter_uses", ]), offset: z.number().int().nonnegative().default(0), limit: z.number().int().positive().default(64), }); /** Caller-selected projection of already completed analysis Evidence. */ export const analysisViewRequestSchema = z.discriminatedUnion("kind", [ nativeFunctionMatchingViewRequestSchema, summaryViewSchema, goBinaryViewRequestSchema, desktopViewRequestSchema, facetViewSchema, itemViewSchema, pageViewSchema, javascriptModuleReferencesRequestSchema, javascriptFactsViewRequestSchema, nativeViewSchema, nativeInventoryViewRequestSchema, artifactInventoryViewRequestSchema, wasmViewRequestSchema, machoViewRequestSchema, interfaceBuilderViewRequestSchema, evmViewRequestSchema, managedViewRequestSchema, managedMembersViewRequestSchema, androidViewRequestSchema, apiSurfaceViewSchema, environmentManifestViewRequestSchema, environmentStateViewRequestSchema, captureViewRequestSchema, protobufViewRequestSchema, qlogViewRequestSchema, pcapViewRequestSchema, dartAotViewRequestSchema, il2cppMetadataViewRequestSchema, modelArtifactViewRequestSchema, ]); // The application owns admission and authenticated Evidence parsing. SDK and // CLI envelope parsing must borrow this unknown value rather than clone it // before admission. Advertise the owning Evidence contract in both dialects. const inlineEvidenceInputSchema = z.unknown().nonoptional(); inlineEvidenceInputSchema._zod.processJSONSchema = evidenceSchema._zod.processJSONSchema; /** Unauthenticated inline input, an exact same-session retained reference, or one local Evidence file. */ export const analysisViewSourceSchema = z.discriminatedUnion("kind", [ z.strictObject({ kind: z.literal("retained-evidence"), evidence_id: prefixedDigestSchema("ev"), }), z.strictObject({ kind: z.literal("inline"), evidence: inlineEvidenceInputSchema, }), z.strictObject({ kind: z.literal("evidence-file"), path: absoluteLocalPathStringSchema.describe( "Absolute local path of one completed Evidence JSON file. REA reads and authenticates it, then projects it like retained Evidence, so large captures are not charged as inline input.", ), }), ]); /** Public inspect_analysis_view input. */ export const inspectAnalysisViewInputSchema = z.strictObject({ source: analysisViewSourceSchema, view: analysisViewRequestSchema, }); const coverageSchema = z.strictObject({ status: z.enum(["complete-within-view", "page", "empty"]), examined: z.number().int().nonnegative(), total: z.number().int().nonnegative(), next_offset: z.number().int().nonnegative().nullable(), exhausted: z.boolean(), }); const artifactSchema = z.strictObject({ path: z .string() .describe("Exact recorded artifact path, including an empty string."), sha256: digestSchema.nullable(), }); const layoutSummarySchema = z.strictObject({ bytes: z.number().int().nonnegative(), format: z.literal("elf"), architecture: z.strictObject({ machine: z.literal("EM_X86_64"), bits: z.literal(64), byte_order: z.literal("little"), }), image_type: z.enum(["ET_EXEC", "ET_DYN", "ET_REL"]), entry: z.strictObject({ reported_value: z.string().min(1), meaning: z.enum(["linked-virtual-address", "not-applicable", "absent"]), execution_status: z.literal("unknown"), }), counts: z.strictObject({ sections: z.number().int().nonnegative(), segments: z.number().int().nonnegative(), symbols: z.number().int().nonnegative(), relocations: z.number().int().nonnegative(), }), limitation_count: z.number().int().nonnegative(), }); const javascriptSummarySchema = z.strictObject({ input_path: z.string().min(1), format: z.enum(["asar", "directory"]), root_artifact_sha256: digestSchema, source_selection: javaScriptSourceSelectionSchema.exactOptional(), statistics: jsonObjectSchema, electron: jsonObjectSchema, coverage: jsonObjectSchema, limitation_count: z.number().int().nonnegative(), }); const viewResultBase = { parent_evidence_id: prefixedDigestSchema("ev"), parent_operation: z.enum([ "inspect_binary_layout", "inspect_go_binary", "gdb_console", "frida_session_status", "inspect_with_objdump", "inspect_desktop_application", "analyze_javascript_application", "analyze_function", "inspect_artifact", "inventory_artifact", "inspect_wasm_artifact", "inspect_macho", "decode_interface_builder", "inspect_evm_interface", "inspect_managed_artifact", "inspect_managed_members", "inspect_web_network_capture", "inspect_android_package", "inspect_pcap_capture", "inspect_dart_aot", "inspect_il2cpp_metadata", "inspect_model_artifact", ...NATIVE_INVENTORY_OPERATIONS, "match_native_functions", ]), parent_digest: digestSchema, view_digest: digestSchema, artifact: artifactSchema, coverage: coverageSchema, limitations: z.array(z.string()), unknowns: z.array(z.string()), } as const; const summaryViewResultBase = { kind: z.literal("summary"), view: summaryViewSchema, ...viewResultBase, } as const; /** Opt-in command delivery keeps output once and retains the complete parent. */ export const gdbCommandSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, ...commandSummaryContext, parent_operation: z.literal("gdb_console"), artifact: artifactSchema.nullable(), summary: gdbCommandSummarySchema, }); export const objdumpSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, ...commandSummaryContext, parent_operation: z.literal("inspect_with_objdump"), artifact: artifactSchema.nullable(), summary: commandObservationSchema, }); export const fridaSessionStatusSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, ...fridaSessionStatusViewContext, parent_operation: z.literal("frida_session_status"), artifact: artifactSchema.nullable(), summary: fridaSessionStatusSummarySchema, }); /** Opt-in Go delivery retains original bytes and exposes build identity/counts. */ export const goBinarySummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, ...goBinaryViewContextSchema.shape, parent_operation: z.literal("inspect_go_binary"), summary: goBinarySummarySchema, }); /** Summary `inspect_binary_layout` detail returns; no other view kind. */ export const binaryLayoutSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, summary: layoutSummarySchema, parent_operation: z.literal("inspect_binary_layout"), }); /** Summary `analyze_javascript_application` detail returns; no other view kind. */ export const javascriptApplicationSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, summary: javascriptSummarySchema, parent_operation: z.literal("analyze_javascript_application"), }); /** Typed reference page; full item observations remain available separately. */ export const javascriptModuleReferencesViewResultSchema = z.strictObject({ ...viewResultBase, kind: z.literal("javascript"), view: javascriptModuleReferencesRequestSchema, parent_operation: z.literal("analyze_javascript_application"), rows: z.array(javascriptModuleReferenceSchema), source_coverage: javascriptApplicationSourceCoverageSchema, }); /** Paged retained observations with exact selected properties and provenance. */ const javascriptFactsViewResultSchema = z.strictObject({ ...viewResultBase, kind: z.literal("javascript-facts"), view: javascriptFactsViewRequestSchema, parent_operation: z.literal("analyze_javascript_application"), rows: z.array(javascriptFactRowSchema), source_coverage: javascriptApplicationSourceCoverageSchema, }); /** Exact summary carrier for artifact inspection's optional delivery contract. */ export const artifactInventorySummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.enum(["inspect_artifact", "inventory_artifact"]), summary: artifactInventorySummarySchema, }); export const desktopApplicationSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_desktop_application"), summary: desktopSummarySchema, }); /** Exact summary carrier for WASM inspection's optional delivery contract. */ export const wasmArtifactSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_wasm_artifact"), summary: wasmSummarySchema, }); /** Exact slice identity and collection counts for Mach-O's selected delivery. */ export const machoSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_macho"), summary: machoSummarySchema, }); /** Decoded documents and graph counts for Interface Builder's selected delivery. */ export const interfaceBuilderSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("decode_interface_builder"), summary: interfaceBuilderSummarySchema, }); /** Exact inferred-interface summary for EVM's caller-selected delivery. */ export const evmInterfaceSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_evm_interface"), summary: evmSummarySchema, }); /** Exact metadata overview for the managed artifact's selected delivery. */ export const managedArtifactSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_managed_artifact"), summary: managedSummarySchema, }); /** Exact member selection, coverage and counts for the selected delivery. */ export const managedMemberSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_managed_members"), summary: managedMemberSummarySchema, }); /** Exact historical capture summary, with no body or member-inventory payload. */ export const webNetworkCaptureSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_web_network_capture"), summary: captureSummarySchema, }); /** Exact package declarations with retained decoded manifest text. */ export const androidPackageSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_android_package"), summary: androidPackageSummarySchema, }); export const pcapCaptureSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_pcap_capture"), summary: pcapSummarySchema, }); /** Exact snapshot and pool-coverage carrier for selected AOT delivery. */ export const dartAotSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_dart_aot"), summary: dartAotSummarySchema, }); export const modelArtifactSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_model_artifact"), summary: modelArtifactSummarySchema, }); export const modelArtifactPageViewResultSchema = z.strictObject({ kind: z.literal("model-artifact"), view: modelArtifactViewRequestSchema, items: modelArtifactViewItemsSchema, ...viewResultBase, ...modelArtifactViewContextSchema.shape, parent_operation: z.literal("inspect_model_artifact"), }); /** Metadata identity and row counts for selected IL2CPP delivery. */ export const il2cppMetadataSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, parent_operation: z.literal("inspect_il2cpp_metadata"), summary: il2cppMetadataSummarySchema, }); /** Exact inventory summary with the original observation's provider and query. */ export const nativeInventorySummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, ...nativeInventoryViewContext, parent_operation: nativeInventoryOperationSchema, artifact: artifactSchema.nullable(), summary: nativeInventorySummarySchema, }); /** Compact native matching discovery retains the complete matching report. */ export const nativeFunctionMatchingSummaryViewResultSchema = z.strictObject({ ...summaryViewResultBase, artifact: z.null(), parent_operation: z.literal("match_native_functions"), summary: nativeFunctionMatchingViewContextSchema, }); /** Projected facts for one selected view of retained analysis Evidence. */ export const analysisViewResultSchema = z.discriminatedUnion("kind", [ z.strictObject({ ...viewResultBase, ...nativeFunctionMatchingViewContextSchema.shape, kind: z.literal("function-matches"), artifact: z.null(), view: nativeFunctionMatchingViewRequestSchema, items: nativeFunctionMatchingViewItemsSchema, parent_operation: z.literal("match_native_functions"), }), z.strictObject({ ...viewResultBase, ...apiSurfaceFields, kind: z.literal("api-surface"), parent_operation: z.literal("inspect_web_network_capture"), view: apiSurfaceViewSchema, artifact: z.strictObject({ path: z.string(), sha256: digestSchema.nullable(), }), }), z.strictObject({ ...viewResultBase, ...environmentManifestFields, kind: z.literal("environment-manifest"), parent_operation: z.enum([ "inspect_web_network_capture", "capture_browser_scenario", ]), view: environmentManifestViewRequestSchema, }), z.strictObject({ ...viewResultBase, ...environmentStateFields, kind: z.literal("environment-state"), parent_operation: z.enum([ "inspect_web_network_capture", "capture_browser_scenario", ]), view: environmentStateViewRequestSchema, }), z.discriminatedUnion("parent_operation", [ gdbCommandSummaryViewResultSchema, objdumpSummaryViewResultSchema, fridaSessionStatusSummaryViewResultSchema, goBinarySummaryViewResultSchema, binaryLayoutSummaryViewResultSchema, desktopApplicationSummaryViewResultSchema, javascriptApplicationSummaryViewResultSchema, artifactInventorySummaryViewResultSchema, wasmArtifactSummaryViewResultSchema, machoSummaryViewResultSchema, interfaceBuilderSummaryViewResultSchema, evmInterfaceSummaryViewResultSchema, managedArtifactSummaryViewResultSchema, managedMemberSummaryViewResultSchema, webNetworkCaptureSummaryViewResultSchema, androidPackageSummaryViewResultSchema, pcapCaptureSummaryViewResultSchema, dartAotSummaryViewResultSchema, il2cppMetadataSummaryViewResultSchema, modelArtifactSummaryViewResultSchema, nativeInventorySummaryViewResultSchema, nativeFunctionMatchingSummaryViewResultSchema, ]), z.strictObject({ ...viewResultBase, ...nativeInventoryViewContext, kind: z.literal("native-inventory"), parent_operation: nativeInventoryOperationSchema, artifact: artifactSchema.nullable(), view: nativeInventoryViewRequestSchema, rows: z.array(nativeInventoryViewRowSchema), }), z.strictObject({ kind: z.literal("protobuf"), view: protobufViewRequestSchema, items: protobufViewItemsSchema, ...viewResultBase, ...protobufViewContextSchema.shape, parent_operation: z.literal("inspect_web_network_capture"), }), z.strictObject({ kind: z.literal("capture"), view: captureViewRequestSchema, items: captureViewItemsSchema, ...viewResultBase, parent_operation: z.literal("inspect_web_network_capture"), }), z.strictObject({ kind: z.literal("qlog"), view: qlogViewRequestSchema, page: qlogViewPageSchema, context: qlogViewContextSchema, ...viewResultBase, parent_operation: z.literal("inspect_web_network_capture"), }), z.strictObject({ kind: z.literal("pcap"), view: pcapViewRequestSchema, page: pcapViewPageSchema, source_coverage: z.enum(["complete", "partial"]), ...viewResultBase, parent_operation: z.literal("inspect_pcap_capture"), }), z.strictObject({ kind: z.literal("facet"), view: facetViewSchema, facet: jsonValueSchema, ...viewResultBase, }), z.strictObject({ ...viewResultBase, ...goBinaryViewContextSchema.shape, kind: z.literal("go"), parent_operation: z.literal("inspect_go_binary"), view: goBinaryViewRequestSchema, page: goBinaryViewPageSchema, }), z.strictObject({ kind: z.literal("item"), view: itemViewSchema, item: jsonValueSchema, ...viewResultBase, }), z.strictObject({ kind: z.literal("page"), view: pageViewSchema, items: z.array(jsonValueSchema), ...viewResultBase, }), javascriptModuleReferencesViewResultSchema, javascriptFactsViewResultSchema, z.strictObject({ kind: z.literal("native"), view: nativeViewSchema, procedure_address: z.string().nullable(), item: jsonValueSchema, ...viewResultBase, }), z.strictObject({ kind: z.literal("wasm"), view: wasmViewRequestSchema, item: wasmViewItemSchema, ...viewResultBase, }), z.strictObject({ kind: z.literal("desktop-application"), view: desktopViewRequestSchema, items: desktopViewItemsSchema, ...viewResultBase, source_coverage: desktopCoverageSchema, parent_operation: z.literal("inspect_desktop_application"), }), z.strictObject({ kind: z.literal("macho"), view: machoViewRequestSchema, item: machoViewItemSchema, ...viewResultBase, ...machoViewContextSchema.shape, parent_operation: z.literal("inspect_macho"), }), z.strictObject({ kind: z.literal("interface-builder"), view: interfaceBuilderViewRequestSchema, items: interfaceBuilderViewItemsSchema, ...viewResultBase, ...interfaceBuilderViewContextSchema.shape, parent_operation: z.literal("decode_interface_builder"), }), z.strictObject({ kind: z.literal("evm"), view: evmViewRequestSchema, item: evmViewItemSchema, ...viewResultBase, parent_operation: z.literal("inspect_evm_interface"), }), z.strictObject({ kind: z.literal("managed"), view: managedViewRequestSchema, item: managedViewItemSchema, ...viewResultBase, ...managedViewContextSchema.shape, parent_operation: z.literal("inspect_managed_artifact"), }), z.strictObject({ kind: z.literal("managed-members"), view: managedMembersViewRequestSchema, page: managedMembersViewPageSchema, ...viewResultBase, ...managedMembersViewContextSchema.shape, parent_operation: z.literal("inspect_managed_members"), }), z.strictObject({ kind: z.literal("android"), view: androidViewRequestSchema, item: androidManifestViewItemSchema, ...viewResultBase, parent_operation: z.literal("inspect_android_package"), }), z.strictObject({ kind: z.literal("dart-aot"), view: dartAotViewRequestSchema, items: z.array(z.string()), ...viewResultBase, ...dartAotViewContextSchema.shape, parent_operation: z.literal("inspect_dart_aot"), }), modelArtifactPageViewResultSchema, z.strictObject({ kind: z.literal("il2cpp-metadata"), view: il2cppMetadataViewRequestSchema, items: il2cppMetadataViewItemsSchema, ...viewResultBase, ...il2cppMetadataViewContextSchema.shape, parent_operation: z.literal("inspect_il2cpp_metadata"), }), z.strictObject({ kind: z.literal("inventory"), view: artifactInventoryViewRequestSchema, source_coverage: artifactInventoryCoverageSchema.exactOptional(), manifest: artifactGraphManifestSchema, inventory_evidence_ids: z.array(prefixedDigestSchema("ev")).min(1), source_complete: z.boolean(), items: artifactInventoryItemsSchema, ...viewResultBase, }), ]); export type AnalysisViewRequest = z.output; export type InspectAnalysisViewInput = z.output< typeof inspectAnalysisViewInputSchema >; export type AnalysisViewResult = z.output; export type AnalysisViewCoverage = z.output; /** Parent record already resolved from inline Evidence or a session reference. */ export interface AnalysisViewParent { readonly evidenceId: string; readonly operation: string; readonly normalizedResult: unknown; readonly provider?: Evidence["provider"]; readonly analysisProfileDigest?: string | null; /** The owner proved normalizedResult belongs to a sealed, deep-frozen Evidence snapshot. */ readonly sealedResult?: boolean; /** Preserve the authenticated source identity, including explicit absence. */ readonly subject?: Evidence["subject"]; readonly limitations: readonly string[]; readonly artifact?: { readonly path: string; readonly sha256: string } | null; /** Parent Evidence parameters, when the parent operation records them. */ readonly parameters?: unknown; } /** View payload before the content digest is attached. */ type WithoutViewDigest = T extends { readonly view_digest: string } ? Omit : never; export type UnsignedAnalysisView = WithoutViewDigest; /** Attach the content digest that must change when projected bytes change. */ export const sealAnalysisView = ( projection: UnsignedAnalysisView, ): AnalysisViewResult => analysisViewResultSchema.parse({ ...projection, view_digest: digestCanonicalValue(projection, "Analysis view"), }); const parentDigest = (evidenceId: string): string => evidenceId.slice(3); const parseJavaScriptParent = ( input: unknown, ): Result => { try { // The format owner authenticates imported results completely before reuse; // mutable or merely frozen inputs still receive canonical validation. const steps = parseOwnedJavaScriptApplicationAnalysisSteps(input); let step = steps.next(); while (!step.done) step = steps.next(); return ok(step.value); } catch (cause: unknown) { if (!(cause instanceof z.ZodError)) throw cause; return err( analysisInputErrorFromIssues( INSPECT_ANALYSIS_VIEW_OPERATION, cause.issues.map((issue) => ({ ...issue, path: ["source", "normalized_result", ...issue.path], })), { source: { normalized_result: input } }, { cause }, ), ); } }; const unsupportedParent = ( parent: AnalysisViewParent, ): AnalysisUnsupportedTargetError => new AnalysisUnsupportedTargetError( INSPECT_ANALYSIS_VIEW_OPERATION, parentArtifactPath(parent), parent.operation === "capture_browser_scenario" ? `Parent Evidence operation "capture_browser_scenario" supports only the environment-manifest and environment-state views.` : `Parent Evidence operation ${JSON.stringify(parent.operation)} does not support analysis views. Use completed binary layout, JavaScript application, native function/inventory, artifact inventory/inspection, WASM, Mach-O, Interface Builder, EVM, managed artifact or member, Android package, Dart AOT, IL2CPP metadata, or web network capture Evidence.`, ); const parentArtifactPath = (parent: AnalysisViewParent): string => { if ( typeof parent.normalizedResult === "object" && parent.normalizedResult !== null && "artifact" in parent.normalizedResult && typeof parent.normalizedResult.artifact === "object" && parent.normalizedResult.artifact !== null && "path" in parent.normalizedResult.artifact && typeof parent.normalizedResult.artifact.path === "string" ) return parent.normalizedResult.artifact.path; if ( typeof parent.normalizedResult === "object" && parent.normalizedResult !== null && "input_path" in parent.normalizedResult && typeof parent.normalizedResult.input_path === "string" ) return parent.normalizedResult.input_path; return parent.evidenceId; }; /** Named source owners for views that need no extra decoder or accumulator. */ const retainedViewProjectors = new Map([ ["frida_session_status", projectFridaSessionStatusView], ["gdb_console", projectCommandObservationView], ["inspect_with_objdump", projectCommandObservationView], ["inspect_go_binary", projectGoBinaryView], ...NATIVE_INVENTORY_OPERATIONS.map( (operation) => [operation, projectNativeInventoryView] as const, ), ["inspect_desktop_application", projectDesktopApplicationView], ["inspect_wasm_artifact", projectWasmArtifactView], ["inspect_macho", projectMachoView], ["decode_interface_builder", projectInterfaceBuilderView], ["inspect_evm_interface", projectEvmInterfaceView], ["inspect_managed_artifact", projectManagedArtifactView], ["inspect_managed_members", projectManagedMemberView], ["inspect_android_package", projectAndroidPackageView], ["inspect_dart_aot", projectDartAotView], ["inspect_il2cpp_metadata", projectIl2cppMetadataView], ["inspect_model_artifact", projectModelArtifactView], ["match_native_functions", projectNativeFunctionMatchingView], ["inspect_artifact", projectArtifactInventoryView], ["inventory_artifact", projectArtifactInventoryView], ]); /** Budgets a caller created before admitting the source; each grouping view uses its own. */ export interface AnalysisViewAccumulators { readonly apiSurface?: WebNetworkApiSurfaceAccumulator | undefined; readonly manifest?: EnvironmentManifestAccumulator | undefined; readonly state?: EnvironmentStateAccumulator | undefined; } type GroupingViewRequest = Extract< AnalysisViewRequest, { kind: "api-surface" | "environment-manifest" | "environment-state" } >; const isGroupingView = ( view: AnalysisViewRequest, ): view is GroupingViewRequest => view.kind === "api-surface" || view.kind === "environment-manifest" || view.kind === "environment-state"; /** Views that group a capture's records, each under the budget its caller created. */ const projectGroupingView = ( parent: AnalysisViewParent, view: GroupingViewRequest, accumulators: AnalysisViewAccumulators, ): Result => { if (view.kind === "api-surface") return projectWebNetworkApiSurfaceView( parent, view, accumulators.apiSurface, ); if (view.kind === "environment-manifest") return projectEnvironmentManifestView(parent, view, accumulators.manifest); return projectEnvironmentStateView(parent, view, accumulators.state); }; /** Project one selected view from authenticated parent analysis Evidence. */ export const projectAnalysisView = ( parent: AnalysisViewParent, view: AnalysisViewRequest, accumulators: AnalysisViewAccumulators = {}, ): Result => { const digest = parentDigest(parent.evidenceId); if (!digestSchema.safeParse(digest).success) return err( analysisViewInputError([ { path: ["source"], reason: "invalid_format", message: "Parent Evidence ID is not a digest-backed identifier.", }, ]), ); if (isGroupingView(view)) { const grouped = projectGroupingView(parent, view, accumulators); return grouped.ok ? ok(sealAnalysisView(grouped.value)) : grouped; } if (parent.operation === "inspect_web_network_capture") { const projected = projectWebNetworkCaptureView(parent, view); return projected.ok ? ok(sealAnalysisView(projected.value)) : projected; } if (parent.operation === "inspect_pcap_capture") { const projected = projectPcapCaptureView(parent, view); return projected.ok ? ok(sealAnalysisView(projected.value)) : projected; } if (parent.operation === "inspect_binary_layout") { const layout = safeParseOwnedBinaryLayout(parent.normalizedResult); if (!layout.success) return err( analysisViewInputError([ { path: ["source"], reason: "invalid_value", message: "Parent Evidence result does not match inspect_binary_layout.", }, ]), ); const projected = projectBinaryLayoutView(parent, layout.data, view); return projected.ok ? ok(sealAnalysisView(projected.value)) : projected; } if (parent.operation === "analyze_javascript_application") { const analysis = parseJavaScriptParent(parent.normalizedResult); if (!analysis.ok) return analysis; const projected = projectJavaScriptApplicationView( parent, analysis.value, view, ); return projected.ok ? ok(sealAnalysisView(projected.value)) : projected; } if (parent.operation === "analyze_function") { const native = functionDossierSchema.safeParse(parent.normalizedResult); if (!native.success) return err( analysisInputErrorFromIssues( INSPECT_ANALYSIS_VIEW_OPERATION, native.error.issues.map((issue) => ({ ...issue, path: ["source", "normalized_result", ...issue.path], })), { source: { normalized_result: parent.normalizedResult } }, { cause: native.error }, ), ); const projected = projectNativeFunctionView(parent, native.data, view); return projected.ok ? ok(sealAnalysisView(projected.value)) : projected; } const project = retainedViewProjectors.get(parent.operation); if (project !== undefined) { const projected = project(parent, view); return projected.ok ? ok(sealAnalysisView(projected.value)) : projected; } return err(unsupportedParent(parent)); };