Files
reverse-engineering-anything/src/domain/analysisView/analysisView.ts
T
gensokyo-devand555aaditya 03f17cf41d feat(android): apply caller-selected R8 mapping evidence (#7456)
Apply caller-selected R8/ProGuard mappings to shared Android inspections, preserving raw identities, exact verification, ambiguity and provenance. Add retained summaries and bounded/cached parsing, with measured real R8/Conscrypt workflows and review fixes.

Fixes #6329.

Co-authored-by: 555aaditya <107977627+555aaditya@users.noreply.github.com>
2026-10-27 15:47:08 +08:00

1770 lines
61 KiB
TypeScript

import { analysisViewCoverageSchema } from "./analysisViewCoverage.js";
import {
javaScriptRouteInventorySourceSchema,
javaScriptRouteInventorySchema,
} from "../javascript/javascriptRouteInventory.js";
import { nativeFunctionMatchingContextSchema } from "../native/functionMatching.js";
import {
nativeObservationViewRequestSchema,
nativeContextViewRequestSchema,
nativeObservationItemsSchemas,
nativeContextItemsSchemas,
nativeSourceContextReferenceSchema,
nativeObservationOperationSchema,
} from "./nativeObservationSchemas.js";
import {
NATIVE_OBSERVATION_OPERATIONS,
type NativeObservationOperation,
} from "../native/nativeObservation.js";
import { projectNativeObservationView } from "./nativeObservationView.js";
import {
devicetreeViewRequestSchema,
devicetreeViewItemsSchema,
devicetreeSummarySchema,
devicetreePageContextSchema,
projectDevicetreeView,
} from "./devicetreeView.js";
import {
apkSignatureViewRequestSchema,
apkSignatureViewItemsSchema,
} from "../apkSignature/apkSignatureQuery.js";
import {
projectApkSignatureView,
apkSignatureSummarySchema,
apkSignatureSourceCoverageSchema,
} from "./apkSignatureView.js";
import { byteEntropySchema } from "../native/byteEntropy.js";
import {
erlangBeamViewRequestSchema,
erlangBeamViewPageSchema,
erlangBeamSummarySchema,
projectErlangBeamView,
} from "./erlangBeamView.js";
import {
pythonPycViewRequestSchema,
pythonPycViewItemsSchema,
pythonPycSummarySchema,
projectPythonPycView,
} from "./pythonPycView.js";
import {
nativeExportsViewRequestSchema,
nativeExportsViewItemsSchema,
nativeExportsSummarySchema,
projectNativeExportsView,
} from "./nativeExportsView.js";
import {
byteEntropySummarySchema,
projectByteEntropyView,
} from "./byteEntropyView.js";
import {
parseAnalysisViewResult,
analysisViewResultInputError,
} from "./analysisViewParent.js";
import {
javaScriptRoutesViewRequestSchema,
javaScriptRoutesViewItemsSchema,
javaScriptRoutesViewSummarySchema,
projectJavaScriptRoutesView,
} from "./javascriptRoutesView.js";
import {
webBundleViewRequestSchema,
webBundleViewItemsSchema,
webBundleSummarySchema,
projectWebBundleView,
} from "./webBundleView.js";
import { webBundleAnalysisSchema } from "../webBundleAnalysis.js";
import { recordedBrowserOriginSchema } from "../browserObservation.js";
import {
sourceToBundleViewRequestSchema,
sourceToBundleViewItemsSchema,
sourceToBundleViewContextSchema,
projectSourceToBundleView,
} from "./sourceToBundleView.js";
import {
gpuCodeObjectsViewRequestSchema,
gpuCodeObjectsSummarySchema,
gpuCodeObjectsItemsSchema,
gpuCodeObjectsPtxPageSchema,
projectGpuCodeObjectsView,
} from "./gpuCodeObjectsView.js";
import { gpuCodeObjectsObjectSchema } from "../gpu/gpuCodeObjects.js";
import { modelArtifactViewRequestSchema } from "../model/modelArtifactQuery.js";
import {
projectModelArtifactView,
modelArtifactSummarySchema,
modelArtifactViewItemsSchema,
modelArtifactViewContextSchema,
} from "./modelArtifactView.js";
import {
commandSummaryContext,
gdbCommandSummarySchema,
projectCommandObservationView,
} from "./commandObservationView.js";
import {
fridaSessionStatusSummarySchema,
fridaSessionStatusViewContext,
projectFridaSessionStatusView,
} from "./fridaSessionStatusView.js";
import { commandObservationSchema } from "../commandObservation.js";
import {
rustBinaryViewPageSchema,
rustBinaryViewRequestSchema,
} from "../rust/rustBinaryQuery.js";
import {
goBinarySummarySchema,
goBinaryViewContextSchema,
goBinaryViewPageSchema,
goBinaryViewRequestSchema,
projectGoBinaryView,
} from "./goBinaryView.js";
import {
rustBinarySummarySchema,
rustBinaryViewContextSchema,
projectRustBinaryView,
} from "./rustBinaryView.js";
import {
projectNativeFunctionMatchingView,
nativeFunctionMatchingViewRequestSchema,
nativeFunctionMatchingViewItemsSchema,
} from "./nativeFunctionMatchingView.js";
import {
protobufViewRequestSchema,
protobufViewItemsSchema,
protobufViewContextSchema,
} from "./protobufCaptureView.js";
import {
nativeInventoryViewRequestSchema,
nativeInventoryViewRowSchema,
nativeInventorySummarySchema,
projectNativeInventoryView,
} from "./nativeInventoryView.js";
import { nativeViewSourceContext } from "./nativeViewContext.js";
import {
NATIVE_INVENTORY_OPERATIONS,
nativeInventoryOperationSchema,
} from "../native/nativeInventory.js";
import { absoluteLocalPathStringSchema } from "../localPath.js";
import { z } from "zod";
import {
browserScenarioSummarySchema,
browserScenarioViewContextSchema,
browserScenarioViewItemsSchema,
browserScenarioViewRequestSchema,
} from "./browserScenarioViewSchemas.js";
import { projectBrowserScenarioView } from "./browserScenarioView.js";
import {
nativeLoadImageViewRequestSchema,
nativeLoadImageViewItemsSchema,
nativeLoadImageSummarySchema,
projectNativeLoadImageView,
} from "./nativeLoadImageView.js";
import {
desktopViewRequestSchema,
desktopViewItemsSchema,
desktopSummarySchema,
projectDesktopApplicationView,
} from "./desktopApplicationView.js";
import { desktopCoverageSchema } from "../desktopApplication.js";
import {
javascriptModuleReferencesRequestSchema,
javascriptModuleReferenceSchema,
} from "./javascriptModuleReferences.js";
import { javascriptApplicationSourceCoverageSchema } from "./javascriptApplicationCoverage.js";
import {
javascriptFactsViewRequestSchema,
javascriptFactRowSchema,
} from "./javascriptFactsView.js";
import { javaScriptSourceSelectionSchema } from "../javascript/javascriptSourceSelection.js";
import { AnalysisUnsupportedTargetError } from "../analysisErrorCore.js";
import {
INSPECT_ANALYSIS_VIEW_OPERATION,
analysisViewInputError,
} from "./analysisViewErrors.js";
import { digestCanonicalValue } from "../canonicalDigest.js";
import { digestSchema, prefixedDigestSchema } from "../digests.js";
import { evidenceSchema, type Evidence } from "../evidence.js";
import { jsonObjectSchema, jsonValueSchema } from "../jsonValue.js";
import { err, ok, type Result } from "../result.js";
import type { AnalysisError } from "../analysisErrorBase.js";
import {
binaryLayoutSchema,
safeParseOwnedBinaryLayout,
} from "../native/binaryLayout.js";
import { bundleResourceRootSchema } from "../apple/bundleResourceRoot.js";
import {
functionDossierSchema,
functionFacetAvailabilitySchema,
} from "../native/functionDossier.js";
import {
artifactGraphManifestSchema,
artifactInventoryCoverageSchema,
} from "../artifactGraph.js";
import { artifactInspectionResultSchema } from "../artifactInspection.js";
import {
parseOwnedJavaScriptApplicationAnalysisSteps,
type JavaScriptApplicationAnalysisResult,
} from "../javascript/javascriptApplicationAnalysis.js";
import { projectBinaryLayoutView } from "./binaryLayoutView.js";
import { projectJavaScriptApplicationView } from "./javascriptApplicationView.js";
import {
createApiSurfaceAccumulator,
projectWebNetworkApiSurfaceView,
apiSurfaceFields,
apiSurfaceViewSchema,
} from "./webNetworkApiSurfaceView.js";
import { projectNativeFunctionView } from "./nativeFunctionView.js";
import {
projectEvmInterfaceView,
evmViewRequestSchema,
evmViewItemSchema,
evmSummarySchema,
} from "./evmInterfaceView.js";
import {
projectArtifactInventoryView,
artifactInventoryViewRequestSchema,
artifactInventoryItemsSchema,
artifactInventorySummarySchema,
} from "./artifactInventoryView.js";
import {
projectManagedArtifactView,
managedViewRequestSchema,
managedViewItemSchema,
managedSummarySchema,
managedViewContextSchema,
} from "./managedArtifactView.js";
import {
projectManagedMemberView,
managedMembersViewRequestSchema,
managedMembersViewPageSchema,
managedMemberSummarySchema,
managedMembersViewContextSchema,
} from "./managedMemberView.js";
import {
projectWasmArtifactView,
wasmViewRequestSchema,
wasmViewItemSchema,
wasmSummarySchema,
} from "./wasmArtifactView.js";
import {
machoSummarySchema,
machoViewContextSchema,
machoViewRows,
machoViewRequestSchema,
projectMachoView,
} from "./machoView.js";
import {
interfaceBuilderSummarySchema,
interfaceBuilderViewContextSchema,
interfaceBuilderViewItemsSchema,
interfaceBuilderViewRequestSchema,
projectInterfaceBuilderView,
} from "./interfaceBuilderView.js";
import {
projectWebNetworkCaptureView,
captureViewRequestSchema,
captureViewItemsSchema,
captureSummarySchema,
} from "./webNetworkCaptureView.js";
import type { WebNetworkApiSurfaceAccumulator } from "./WebNetworkApiSurfaceAccumulator.js";
import type { EnvironmentManifestAccumulator } from "./EnvironmentManifestAccumulator.js";
import type { EnvironmentStateAccumulator } from "./EnvironmentStateAccumulator.js";
import { admitAnalysisViewData } from "./analysisViewDataAdmission.js";
import {
createEnvironmentManifestAccumulator,
projectEnvironmentManifestView,
environmentManifestFields,
environmentManifestViewRequestSchema,
} from "./environmentManifestView.js";
import {
createEnvironmentStateAccumulator,
environmentStateFields,
environmentStateViewRequestSchema,
projectEnvironmentStateView,
} from "./environmentStateView.js";
import {
environmentCoverageFields,
environmentCoverageViewRequestSchema,
projectEnvironmentCoverageView,
} from "./environmentCoverageView.js";
import {
pcapViewRequestSchema,
pcapViewPageSchema,
pcapSummarySchema,
projectPcapCaptureView,
} from "./pcapCaptureView.js";
import {
qlogViewRequestSchema,
qlogViewPageSchema,
qlogViewContextSchema,
} from "./qlogCaptureView.js";
import {
projectAndroidPackageView,
androidPackageSummarySchema,
androidViewRequestSchema,
androidManifestViewItemSchema,
androidManifestViewRequestSchema,
androidComponentsViewRequestSchema,
androidComponentSummaryViewRequestSchema,
androidComponentViewRowSchema,
androidComponentViewContextSchema,
androidComponentSummarySchema,
} from "./androidPackageView.js";
import {
projectAndroidSymbolSummary,
androidClassSummarySchema,
androidMethodSummarySchema,
} from "./androidSymbolView.js";
import {
projectDartAotView,
dartAotSummarySchema,
dartAotViewRequestSchema,
dartAotViewContextSchema,
} from "./dartAotView.js";
import {
projectIl2cppMetadataView,
il2cppMetadataSummarySchema,
il2cppMetadataViewRequestSchema,
il2cppMetadataViewContextSchema,
il2cppMetadataViewItemsSchema,
} from "./il2cppMetadataView.js";
const summaryViewSchema = z.strictObject({ kind: z.literal("summary") });
const facetViewSchema = z.strictObject({
kind: z.literal("facet"),
facet: z.enum(["mitigations", "linkage"]),
});
const indexSelectorSchema = z.strictObject({
index: z.int().nonnegative(),
});
const nameSelectorSchema = z.strictObject({
name: z
.string()
.describe(
"Exact UTF-8 section or symbol name, matched against retained source bytes. Use index for non-UTF-8 names or unresolved name bytes.",
),
});
const pathSelectorSchema = z.strictObject({
path: z
.string()
.describe(
"Exact observed module path or original source-map reference from a module page; an empty reference is valid.",
),
});
const nodeIdSelectorSchema = z.strictObject({
node_id: prefixedDigestSchema("jag_node"),
});
const moduleItemViewSchema = z.strictObject({
kind: z.literal("item"),
collection: z.literal("modules"),
selector: z.union([pathSelectorSchema, nodeIdSelectorSchema]),
});
const sectionOrSymbolItemViewSchema = z.strictObject({
kind: z.literal("item"),
collection: z.enum(["sections", "symbols"]),
selector: z.union([indexSelectorSchema, nameSelectorSchema]),
});
/**
* The collection-specific selector alternatives are expressed in the owning
* contract so the advertised JSON Schema preserves them: modules accept
* path/node_id, sections and symbols accept index/name. Refinement-only
* constraints do not survive JSON Schema conversion, so the advertised
* schema previously accepted combinations that runtime input validation
* rejects.
*/
const itemViewSchema = z.discriminatedUnion("collection", [
moduleItemViewSchema,
sectionOrSymbolItemViewSchema,
]);
const pageViewSchema = z.strictObject({
kind: z.literal("page"),
collection: z.enum(["sections", "symbols", "modules"]),
offset: z.int().nonnegative(),
limit: z.int().positive(),
});
/** Bounded native function facets of already authenticated analyze_function Evidence. */
const nativeViewSchema = z.strictObject({
kind: z.literal("native"),
facet: z.enum([
"procedure",
"pseudocode",
"assembly",
"basic_blocks",
"comments",
"callers",
"callees",
"incoming_references",
"outgoing_references",
"unresolved_calls",
"referenced_strings",
"referenced_names",
"swift_string_literals",
"swift_string_literal_omissions",
"native_api",
"value_flow_summary",
"value_flow_operations",
"value_flow_def_use",
"value_flow_effects",
"value_flow_parameters",
"value_flow_parameter_uses",
]),
offset: z.int().nonnegative().default(0),
limit: z.int().positive().default(64),
});
/** Caller-selected projection of already completed analysis Evidence. */
export const analysisViewRequestSchema = z.discriminatedUnion("kind", [
nativeObservationViewRequestSchema,
nativeContextViewRequestSchema,
devicetreeViewRequestSchema,
erlangBeamViewRequestSchema,
pythonPycViewRequestSchema,
nativeExportsViewRequestSchema,
javaScriptRoutesViewRequestSchema,
webBundleViewRequestSchema,
nativeFunctionMatchingViewRequestSchema,
sourceToBundleViewRequestSchema,
summaryViewSchema,
goBinaryViewRequestSchema,
rustBinaryViewRequestSchema,
desktopViewRequestSchema,
facetViewSchema,
itemViewSchema,
pageViewSchema,
javascriptModuleReferencesRequestSchema,
javascriptFactsViewRequestSchema,
nativeViewSchema,
nativeInventoryViewRequestSchema,
nativeLoadImageViewRequestSchema,
artifactInventoryViewRequestSchema,
wasmViewRequestSchema,
machoViewRequestSchema,
interfaceBuilderViewRequestSchema,
evmViewRequestSchema,
managedViewRequestSchema,
managedMembersViewRequestSchema,
androidViewRequestSchema,
apiSurfaceViewSchema,
environmentManifestViewRequestSchema,
environmentStateViewRequestSchema,
environmentCoverageViewRequestSchema,
captureViewRequestSchema,
browserScenarioViewRequestSchema,
protobufViewRequestSchema,
qlogViewRequestSchema,
pcapViewRequestSchema,
dartAotViewRequestSchema,
il2cppMetadataViewRequestSchema,
apkSignatureViewRequestSchema,
modelArtifactViewRequestSchema,
gpuCodeObjectsViewRequestSchema,
]);
// The application owns admission and authenticated Evidence parsing. SDK and
// CLI envelope parsing must borrow this unknown value rather than clone it
// before admission. Advertise the owning Evidence contract in both dialects.
const inlineEvidenceInputSchema = z.unknown().nonoptional();
inlineEvidenceInputSchema._zod.processJSONSchema =
evidenceSchema._zod.processJSONSchema;
/** Unauthenticated inline input, an exact same-session retained reference, or one local Evidence file. */
export const analysisViewSourceSchema = z.discriminatedUnion("kind", [
z.strictObject({
kind: z.literal("retained-evidence"),
evidence_id: prefixedDigestSchema("ev"),
}),
z.strictObject({
kind: z.literal("inline"),
evidence: inlineEvidenceInputSchema,
}),
z.strictObject({
kind: z.literal("evidence-file"),
path: absoluteLocalPathStringSchema.describe(
"Absolute local path of one completed Evidence JSON file, or of an Evidence bundle written by --evidence_output or export_evidence_bundle. REA reads and authenticates it, then projects it like retained Evidence, so large captures are not charged as inline input.",
),
evidence_id: prefixedDigestSchema("ev")
.exactOptional()
.describe(
"The record to project when the file is an Evidence bundle, such as a summary's normalized_result.parent_evidence_id. A bundle holding exactly one record needs no selection.",
),
}),
]);
/** Public inspect_analysis_view input. */
export const inspectAnalysisViewInputSchema = z.strictObject({
source: analysisViewSourceSchema,
view: analysisViewRequestSchema,
});
const artifactSchema = z.strictObject({
path: z
.string()
.describe(
"Selected artifact path, or the canonical resource root when resource-only Evidence has no executable subject.",
),
sha256: digestSchema.nullable(),
});
const layoutSummarySchema = z.strictObject({
bytes: binaryLayoutSchema.shape.artifact.shape.bytes,
format: binaryLayoutSchema.shape.format,
architecture: binaryLayoutSchema.shape.architecture,
image_type: binaryLayoutSchema.shape.image_type,
entry: z.strictObject({
reported_value: z.string().min(1),
meaning: z.enum(["linked-virtual-address", "not-applicable", "absent"]),
execution_status: z.literal("unknown"),
}),
counts: z.strictObject({
sections: z.int().nonnegative(),
segments: z.int().nonnegative(),
symbols: z.int().nonnegative(),
relocations: z.int().nonnegative(),
}),
limitation_count: z.int().nonnegative(),
});
const javascriptSummarySchema = z.strictObject({
input_path: z.string().min(1),
format: z.enum(["asar", "directory"]),
root_artifact_sha256: digestSchema,
source_selection: javaScriptSourceSelectionSchema.exactOptional(),
statistics: jsonObjectSchema,
electron: jsonObjectSchema,
coverage: jsonObjectSchema,
limitation_count: z.int().nonnegative(),
});
const viewResultBase = {
parent_evidence_id: prefixedDigestSchema("ev"),
parent_operation: z.enum([
"inspect_python_pyc",
"inspect_erlang_beam",
"inspect_devicetree",
"inspect_byte_entropy",
"inspect_native_exports",
"inspect_binary_layout",
"inspect_go_binary",
"gdb_console",
"frida_session_status",
"inspect_with_objdump",
"inspect_desktop_application",
"analyze_javascript_application",
"analyze_web_bundle",
"analyze_function",
"inspect_artifact",
"inventory_artifact",
"inspect_wasm_artifact",
"inspect_macho",
"decode_interface_builder",
"inspect_evm_interface",
"inspect_managed_artifact",
"inspect_managed_members",
"inspect_web_network_capture",
"inspect_android_package",
"inspect_android_class",
"inspect_android_method",
"inspect_pcap_capture",
"inspect_dart_aot",
"inspect_il2cpp_metadata",
"inspect_model_artifact",
"inspect_gpu_code_objects",
...NATIVE_INVENTORY_OPERATIONS,
...NATIVE_OBSERVATION_OPERATIONS,
"match_native_functions",
]),
parent_digest: digestSchema,
view_digest: digestSchema,
artifact: artifactSchema,
coverage: analysisViewCoverageSchema,
limitations: z.array(z.string()),
unknowns: z.array(z.string()),
} as const;
const summaryViewResultBase = {
kind: z.literal("summary"),
view: summaryViewSchema,
...viewResultBase,
} as const;
const nativeObservationSummaryFor = <
Operation extends NativeObservationOperation,
>(
operation: Operation,
) =>
z.strictObject({
...summaryViewResultBase,
...nativeViewSourceContext,
artifact: artifactSchema.nullable(),
parent_operation: z.literal(operation),
source_context: nativeSourceContextReferenceSchema,
summary: z.strictObject({ observations: z.int().nonnegative() }),
items: nativeObservationItemsSchemas[operation],
});
export const nativeObservationSummaryViewResultSchemas = {
procedure_address: nativeObservationSummaryFor("procedure_address"),
procedure_callees: nativeObservationSummaryFor("procedure_callees"),
procedure_callers: nativeObservationSummaryFor("procedure_callers"),
resolve_containing_procedure: nativeObservationSummaryFor(
"resolve_containing_procedure",
),
get_call_graph: nativeObservationSummaryFor("get_call_graph"),
};
const nativeObservationSummaryViewResultSchema = z.discriminatedUnion(
"parent_operation",
[
nativeObservationSummaryViewResultSchemas.procedure_address,
nativeObservationSummaryViewResultSchemas.procedure_callees,
nativeObservationSummaryViewResultSchemas.procedure_callers,
nativeObservationSummaryViewResultSchemas.resolve_containing_procedure,
nativeObservationSummaryViewResultSchemas.get_call_graph,
],
);
const nativeObservationPageFor = <Operation extends NativeObservationOperation>(
operation: Operation,
) =>
nativeObservationSummaryFor(operation)
.omit({ kind: true, view: true })
.extend({
kind: z.literal("native-observation"),
view: nativeObservationViewRequestSchema,
});
const nativeObservationPageViewResultSchema = z.discriminatedUnion(
"parent_operation",
[
nativeObservationPageFor("procedure_address"),
nativeObservationPageFor("procedure_callees"),
nativeObservationPageFor("procedure_callers"),
nativeObservationPageFor("resolve_containing_procedure"),
nativeObservationPageFor("get_call_graph"),
],
);
const nativeContextFor = <Facet extends keyof typeof nativeContextItemsSchemas>(
facet: Facet,
) =>
z.strictObject({
...viewResultBase,
...nativeViewSourceContext,
kind: z.literal("native-context"),
artifact: artifactSchema.nullable(),
parent_operation: nativeObservationOperationSchema,
source_context: nativeSourceContextReferenceSchema,
facet: z.literal(facet),
view: nativeContextViewRequestSchema.extend({ facet: z.literal(facet) }),
items: nativeContextItemsSchemas[facet],
});
const nativeContextViewResultSchema = z.discriminatedUnion("facet", [
nativeContextFor("overview"),
nativeContextFor("analysis-profile"),
nativeContextFor("limitations"),
nativeContextFor("result-limitations"),
]);
export const byteEntropySummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
summary: byteEntropySummarySchema,
parent_operation: z.literal("inspect_byte_entropy"),
});
export const nativeExportsSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_native_exports"),
summary: nativeExportsSummarySchema,
});
export const devicetreeSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_devicetree"),
summary: devicetreeSummarySchema,
});
export const erlangBeamSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_erlang_beam"),
summary: erlangBeamSummarySchema,
});
export const erlangBeamTableViewResultSchema = z.strictObject({
...viewResultBase,
kind: z.literal("beam"),
parent_operation: z.literal("inspect_erlang_beam"),
view: erlangBeamViewRequestSchema,
beam: erlangBeamSummarySchema,
page: erlangBeamViewPageSchema,
});
export const pythonPycSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_python_pyc"),
summary: pythonPycSummarySchema,
});
export const pythonPycCodeObjectsViewResultSchema = z.strictObject({
...viewResultBase,
kind: z.literal("python-pyc"),
parent_operation: z.literal("inspect_python_pyc"),
view: pythonPycViewRequestSchema,
pyc: pythonPycSummarySchema,
items: pythonPycViewItemsSchema,
});
/** Opt-in command delivery keeps output once and retains the complete parent. */
export const gdbCommandSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
...commandSummaryContext,
parent_operation: z.literal("gdb_console"),
artifact: artifactSchema.nullable(),
summary: gdbCommandSummarySchema,
});
export const objdumpSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
...commandSummaryContext,
parent_operation: z.literal("inspect_with_objdump"),
artifact: artifactSchema.nullable(),
summary: commandObservationSchema,
});
export const fridaSessionStatusSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
...fridaSessionStatusViewContext,
parent_operation: z.literal("frida_session_status"),
artifact: artifactSchema.nullable(),
summary: fridaSessionStatusSummarySchema,
});
/** Opt-in Go delivery retains original bytes and exposes build identity/counts. */
export const goBinarySummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
...goBinaryViewContextSchema.shape,
parent_operation: z.literal("inspect_go_binary"),
summary: goBinarySummarySchema,
});
/** Compact source identity and counts, retaining the complete embedded graph. */
export const rustBinarySummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
...rustBinaryViewContextSchema.shape,
parent_operation: z.literal("inspect_rust_binary"),
summary: rustBinarySummarySchema,
});
export const rustBinaryPageViewResultSchema = z.strictObject({
...viewResultBase,
...rustBinaryViewContextSchema.shape,
kind: z.literal("rust"),
parent_operation: z.literal("inspect_rust_binary"),
view: rustBinaryViewRequestSchema,
rust: rustBinarySummarySchema,
page: rustBinaryViewPageSchema,
});
/** Summary `inspect_binary_layout` detail returns; no other view kind. */
export const binaryLayoutSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
summary: layoutSummarySchema,
parent_operation: z.literal("inspect_binary_layout"),
});
/** Summary `analyze_javascript_application` detail returns; no other view kind. */
export const javascriptApplicationSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
summary: javascriptSummarySchema,
parent_operation: z.literal("analyze_javascript_application"),
});
/** Typed reference page; full item observations remain available separately. */
export const javascriptModuleReferencesViewResultSchema = z.strictObject({
...viewResultBase,
kind: z.literal("javascript"),
view: javascriptModuleReferencesRequestSchema,
parent_operation: z.literal("analyze_javascript_application"),
rows: z.array(javascriptModuleReferenceSchema),
source_coverage: javascriptApplicationSourceCoverageSchema,
});
/** Paged retained observations with exact selected properties and provenance. */
const javascriptFactsViewResultSchema = z.strictObject({
...viewResultBase,
kind: z.literal("javascript-facts"),
view: javascriptFactsViewRequestSchema,
parent_operation: z.literal("analyze_javascript_application"),
rows: z.array(javascriptFactRowSchema),
source_coverage: javascriptApplicationSourceCoverageSchema,
});
/** Exact summary carrier for artifact inspection's optional delivery contract. */
export const artifactInventorySummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.enum(["inspect_artifact", "inventory_artifact"]),
summary: artifactInventorySummarySchema,
});
export const desktopApplicationSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_desktop_application"),
summary: desktopSummarySchema,
});
/** Exact summary carrier for WASM inspection's optional delivery contract. */
export const wasmArtifactSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_wasm_artifact"),
summary: wasmSummarySchema,
});
/** Exact slice identity and collection counts for Mach-O's selected delivery. */
export const machoSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_macho"),
summary: machoSummarySchema,
});
/** Decoded documents and graph counts for Interface Builder's selected delivery. */
export const interfaceBuilderSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("decode_interface_builder"),
resource_root: bundleResourceRootSchema.optional(),
summary: interfaceBuilderSummarySchema,
});
/** Exact inferred-interface summary for EVM's caller-selected delivery. */
export const evmInterfaceSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_evm_interface"),
summary: evmSummarySchema,
});
/** Exact metadata overview for the managed artifact's selected delivery. */
export const managedArtifactSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_managed_artifact"),
summary: managedSummarySchema,
});
/** Exact member selection, coverage and counts for the selected delivery. */
export const managedMemberSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_managed_members"),
summary: managedMemberSummarySchema,
});
/** Exact historical capture summary, with no body or member-inventory payload. */
export const webNetworkCaptureSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_web_network_capture"),
summary: captureSummarySchema,
});
/** Compact outcomes and the focus screen from a retained browser scenario. */
export const browserScenarioSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
artifact: z.null(),
parent_operation: z.literal("capture_browser_scenario"),
summary: browserScenarioSummarySchema,
});
/** Exact package declarations with retained decoded manifest text. */
export const androidPackageSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_android_package"),
summary: androidPackageSummarySchema,
});
/** Exact class facts with complete raw protocol Evidence retained separately. */
export const androidClassSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_android_class"),
summary: androidClassSummarySchema,
});
/** Exact selected method body, source coverage and optional mapping facts. */
export const androidMethodSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_android_method"),
summary: androidMethodSummarySchema,
});
/** Legacy manifest views keep their original shape; new facets are explicit. */
export const androidManifestViewResultSchema = z.strictObject({
...viewResultBase,
kind: z.literal("android"),
facet: z.literal("manifest").optional(),
view: androidManifestViewRequestSchema,
item: androidManifestViewItemSchema,
parent_operation: z.literal("inspect_android_package"),
});
export const androidComponentsViewResultSchema = z.strictObject({
...viewResultBase,
...androidComponentViewContextSchema.shape,
kind: z.literal("android"),
facet: z.literal("components"),
view: androidComponentsViewRequestSchema,
items: z.array(androidComponentViewRowSchema),
byte_limited: z.boolean(),
parent_operation: z.literal("inspect_android_package"),
});
export const androidComponentSummaryViewResultSchema = z.strictObject({
...viewResultBase,
...androidComponentViewContextSchema.shape,
kind: z.literal("android"),
facet: z.literal("component-summary"),
view: androidComponentSummaryViewRequestSchema,
summary: androidComponentSummarySchema,
parent_operation: z.literal("inspect_android_package"),
});
const androidPackageViewResultSchema = z.discriminatedUnion("facet", [
androidManifestViewResultSchema,
androidComponentsViewResultSchema,
androidComponentSummaryViewResultSchema,
]);
export const pcapCaptureSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_pcap_capture"),
summary: pcapSummarySchema,
});
/** Exact snapshot and pool-coverage carrier for selected AOT delivery. */
export const dartAotSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_dart_aot"),
summary: dartAotSummarySchema,
});
export const javaScriptRoutesViewResultSchema = z.strictObject({
...viewResultBase,
artifact: artifactSchema.nullable(),
kind: z.literal("javascript-routes"),
parent_operation: z.enum([
"analyze_javascript_application",
"analyze_web_bundle",
]),
view: javaScriptRoutesViewRequestSchema,
inventory_id: javaScriptRouteInventorySchema.shape.inventory_id,
source_manifest_sha256: digestSchema,
source_coverage: javaScriptRouteInventorySchema.shape.coverage,
inventory_capacity: javaScriptRouteInventorySchema.shape.capacity,
capture_url: z.string().nullable(),
items: javaScriptRoutesViewItemsSchema,
sources: z.array(javaScriptRouteInventorySourceSchema),
summary: javaScriptRoutesViewSummarySchema.nullable(),
byte_limited: z.boolean(),
});
/** Compact web bundle findings retain endpoint observations and inference candidates. */
export const webBundleSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
artifact: artifactSchema.nullable(),
parent_operation: z.literal("analyze_web_bundle"),
target_url: z.string(),
target_origin: recordedBrowserOriginSchema.nullable().optional(),
source_unknowns: webBundleAnalysisSchema.shape.unknowns,
summary: webBundleSummarySchema,
});
export const webBundlePageViewResultSchema = z.strictObject({
...viewResultBase,
artifact: artifactSchema.nullable(),
kind: z.literal("web-bundle"),
parent_operation: z.literal("analyze_web_bundle"),
target_url: z.string(),
target_origin: recordedBrowserOriginSchema.nullable().optional(),
source_unknowns: webBundleAnalysisSchema.shape.unknowns,
view: webBundleViewRequestSchema,
completeness: webBundleAnalysisSchema.shape.completeness,
items: webBundleViewItemsSchema,
summary: webBundleSummarySchema.nullable(),
byte_limited: z.boolean(),
});
export const gpuCodeObjectsSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_gpu_code_objects"),
summary: gpuCodeObjectsSummarySchema,
});
export const gpuCodeObjectsPageViewResultSchema = z.strictObject({
kind: z.literal("gpu-code-objects"),
view: gpuCodeObjectsViewRequestSchema,
items: gpuCodeObjectsItemsSchema,
ptx: gpuCodeObjectsPtxPageSchema.nullable(),
source_coverage: gpuCodeObjectsObjectSchema.shape.coverage,
...viewResultBase,
parent_operation: z.literal("inspect_gpu_code_objects"),
});
export const apkSignatureSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_apk_signature"),
summary: apkSignatureSummarySchema,
});
export const apkSignaturePageViewResultSchema = z.strictObject({
...viewResultBase,
kind: z.literal("apk-signature"),
parent_operation: z.literal("inspect_apk_signature"),
view: apkSignatureViewRequestSchema,
items: apkSignatureViewItemsSchema,
source_coverage: apkSignatureSourceCoverageSchema,
});
export const modelArtifactSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_model_artifact"),
summary: modelArtifactSummarySchema,
});
export const modelArtifactPageViewResultSchema = z.strictObject({
kind: z.literal("model-artifact"),
view: modelArtifactViewRequestSchema,
items: modelArtifactViewItemsSchema,
...viewResultBase,
...modelArtifactViewContextSchema.shape,
parent_operation: z.literal("inspect_model_artifact"),
});
/** Metadata identity and row counts for selected IL2CPP delivery. */
export const il2cppMetadataSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("inspect_il2cpp_metadata"),
summary: il2cppMetadataSummarySchema,
});
/** Exact inventory summary with the original observation's provider and query. */
export const nativeInventorySummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
...nativeViewSourceContext,
parent_operation: nativeInventoryOperationSchema,
artifact: artifactSchema.nullable(),
summary: nativeInventorySummarySchema,
});
/** Compact provider load observations retain the independent verification state. */
export const nativeLoadImageSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
...nativeViewSourceContext,
artifact: artifactSchema.nullable(),
parent_operation: z.literal("inspect_native_load_image"),
summary: nativeLoadImageSummarySchema,
});
/** Compact native matching discovery retains the complete matching report. */
export const nativeFunctionMatchingSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
artifact: z.null(),
parent_operation: z.literal("match_native_functions"),
summary: nativeFunctionMatchingContextSchema,
});
/** Rows observed for one facet, or null when the provider declared that facet unavailable. */
const declaredFacetCountSchema = z
.number()
.int()
.nonnegative()
.nullable()
.describe(
"Observed rows; null when facet_availability declares the facet unavailable, so no rows is not evidence of none.",
);
/** Rows of an optional dossier record, or null when the dossier omitted it. */
const recordedFacetCountSchema = z
.number()
.int()
.nonnegative()
.nullable()
.describe(
"Observed rows; null when the dossier did not record the facet (the native facet view reports it not recorded), so no rows is not evidence of none.",
);
/** Rows of one value-flow facet, or null when value flow is unavailable. */
const valueFlowFacetCountSchema = z
.number()
.int()
.nonnegative()
.nullable()
.describe(
"Observed rows; null when value_flow.available is false because native_value_flow was not recorded or the provider declared it unavailable (unknowns names which), so no rows is not evidence of none.",
);
/** Compact analyze_function dossier; the complete dossier stays retained for facet paging. */
export const nativeFunctionSummarySchema = z.strictObject({
procedure: z.strictObject({
name: z.string(),
address: z.string(),
}),
pseudocode: z.strictObject({
available: z
.boolean()
.describe(
"Provider facet_availability for pseudocode when declared; otherwise whether decompiled text is present. The flag is authoritative over raw length.",
),
code_units: z
.number()
.int()
.nonnegative()
.describe(
"Pseudocode length in UTF-16 code units, the unit inspect_analysis_view pages pseudocode by.",
),
}),
value_flow: z.strictObject({
available: z.boolean(),
truncated: z
.boolean()
.describe(
"True only when value-flow is available and the provider truncated it; false when value-flow is unavailable (see available).",
),
}),
facet_availability: functionFacetAvailabilitySchema
.nullable()
.describe(
"The provider's declared availability per facet, or null when it declared none. Unavailable facets name their reason here and in unknowns.",
),
counts: z.strictObject({
assembly: declaredFacetCountSchema,
basic_blocks: declaredFacetCountSchema,
comments: declaredFacetCountSchema,
callers: declaredFacetCountSchema,
callees: declaredFacetCountSchema,
incoming_references: declaredFacetCountSchema,
outgoing_references: declaredFacetCountSchema,
unresolved_calls: recordedFacetCountSchema,
referenced_strings: declaredFacetCountSchema,
referenced_names: declaredFacetCountSchema,
swift_string_literals: recordedFacetCountSchema,
swift_string_literal_omissions: recordedFacetCountSchema,
value_flow_operations: valueFlowFacetCountSchema,
value_flow_def_use: valueFlowFacetCountSchema,
value_flow_effects: valueFlowFacetCountSchema,
value_flow_parameters: valueFlowFacetCountSchema,
value_flow_parameter_uses: valueFlowFacetCountSchema,
}),
limitation_count: z.number().int().nonnegative(),
});
/** Compact analyze_function summary that retains the complete native dossier Evidence. */
export const nativeFunctionSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
parent_operation: z.literal("analyze_function"),
procedure_address: z.string().nullable(),
summary: nativeFunctionSummarySchema,
});
export const sourceToBundleSummaryViewResultSchema = z.strictObject({
...summaryViewResultBase,
artifact: z.null(),
parent_operation: z.literal("compare_source_to_bundle"),
summary: sourceToBundleViewContextSchema,
});
export const sourceToBundlePageViewResultSchema = z.strictObject({
...viewResultBase,
...sourceToBundleViewContextSchema.shape,
kind: z.literal("source-to-bundle"),
artifact: z.null(),
parent_operation: z.literal("compare_source_to_bundle"),
view: sourceToBundleViewRequestSchema,
items: sourceToBundleViewItemsSchema,
});
/** Bind the existing nested facet selection to its producer-owned rows. */
const machoPage = <Facet extends keyof typeof machoViewRows>(facet: Facet) =>
z.strictObject({
...viewResultBase,
...machoViewContextSchema.shape,
kind: z.literal("macho"),
parent_operation: z.literal("inspect_macho"),
view: machoViewRequestSchema.extend({ facet: z.literal(facet) }),
item: machoViewRows[facet],
});
// The input tag preserves kind dispatch; the output projection advertises the
// correlated pages without adding a discriminator to their public wire shape.
const machoPageViewResultSchema = z
.object({ kind: z.literal("macho") })
.passthrough()
.pipe(
z.union([
machoPage("entrypoints"),
machoPage("architectures"),
machoPage("build_metadata"),
machoPage("load_commands"),
machoPage("dependencies"),
machoPage("imports"),
machoPage("exports"),
machoPage("segments"),
machoPage("provenance"),
]),
);
/** Projected facts for one selected view of retained analysis Evidence. */
export const analysisViewResultSchema = z.discriminatedUnion("kind", [
nativeObservationPageViewResultSchema,
nativeContextViewResultSchema,
javaScriptRoutesViewResultSchema,
webBundlePageViewResultSchema,
sourceToBundlePageViewResultSchema,
z.strictObject({
...viewResultBase,
...nativeFunctionMatchingContextSchema.shape,
kind: z.literal("function-matches"),
artifact: z.null(),
view: nativeFunctionMatchingViewRequestSchema,
items: nativeFunctionMatchingViewItemsSchema,
parent_operation: z.literal("match_native_functions"),
}),
z.strictObject({
...viewResultBase,
...apiSurfaceFields,
kind: z.literal("api-surface"),
parent_operation: z.literal("inspect_web_network_capture"),
view: apiSurfaceViewSchema,
artifact: z.strictObject({
path: z.string(),
sha256: digestSchema.nullable(),
}),
}),
z.strictObject({
...viewResultBase,
...environmentManifestFields,
kind: z.literal("environment-manifest"),
parent_operation: z.enum([
"inspect_web_network_capture",
"capture_browser_scenario",
]),
view: environmentManifestViewRequestSchema,
}),
z.strictObject({
...viewResultBase,
...environmentStateFields,
kind: z.literal("environment-state"),
parent_operation: z.enum([
"inspect_web_network_capture",
"capture_browser_scenario",
]),
view: environmentStateViewRequestSchema,
}),
z.strictObject({
...viewResultBase,
...environmentCoverageFields,
kind: z.literal("environment-coverage"),
parent_operation: z.enum([
"inspect_web_network_capture",
"capture_browser_scenario",
]),
view: environmentCoverageViewRequestSchema,
}),
z.discriminatedUnion("parent_operation", [
nativeObservationSummaryViewResultSchema,
erlangBeamSummaryViewResultSchema,
devicetreeSummaryViewResultSchema,
pythonPycSummaryViewResultSchema,
nativeExportsSummaryViewResultSchema,
byteEntropySummaryViewResultSchema,
gdbCommandSummaryViewResultSchema,
objdumpSummaryViewResultSchema,
fridaSessionStatusSummaryViewResultSchema,
goBinarySummaryViewResultSchema,
rustBinarySummaryViewResultSchema,
binaryLayoutSummaryViewResultSchema,
desktopApplicationSummaryViewResultSchema,
javascriptApplicationSummaryViewResultSchema,
artifactInventorySummaryViewResultSchema,
wasmArtifactSummaryViewResultSchema,
machoSummaryViewResultSchema,
interfaceBuilderSummaryViewResultSchema,
evmInterfaceSummaryViewResultSchema,
managedArtifactSummaryViewResultSchema,
managedMemberSummaryViewResultSchema,
webNetworkCaptureSummaryViewResultSchema,
browserScenarioSummaryViewResultSchema,
androidPackageSummaryViewResultSchema,
androidClassSummaryViewResultSchema,
androidMethodSummaryViewResultSchema,
pcapCaptureSummaryViewResultSchema,
dartAotSummaryViewResultSchema,
il2cppMetadataSummaryViewResultSchema,
apkSignatureSummaryViewResultSchema,
modelArtifactSummaryViewResultSchema,
gpuCodeObjectsSummaryViewResultSchema,
nativeInventorySummaryViewResultSchema,
nativeLoadImageSummaryViewResultSchema,
nativeFunctionMatchingSummaryViewResultSchema,
nativeFunctionSummaryViewResultSchema,
sourceToBundleSummaryViewResultSchema,
webBundleSummaryViewResultSchema,
]),
z.strictObject({
...viewResultBase,
kind: z.literal("devicetree"),
parent_operation: z.literal("inspect_devicetree"),
view: devicetreeViewRequestSchema,
devicetree: devicetreePageContextSchema,
items: devicetreeViewItemsSchema,
}),
erlangBeamTableViewResultSchema,
pythonPycCodeObjectsViewResultSchema,
z.strictObject({
...viewResultBase,
kind: z.literal("native-exports"),
parent_operation: z.literal("inspect_native_exports"),
view: nativeExportsViewRequestSchema,
exports: nativeExportsSummarySchema,
items: nativeExportsViewItemsSchema,
}),
z.strictObject({
...viewResultBase,
...nativeViewSourceContext,
kind: z.literal("native-inventory"),
parent_operation: nativeInventoryOperationSchema,
artifact: artifactSchema.nullable(),
view: nativeInventoryViewRequestSchema,
rows: z.array(nativeInventoryViewRowSchema),
}),
z.strictObject({
...viewResultBase,
kind: z.literal("native-load-image"),
...nativeViewSourceContext,
verification_status: z.enum(["unsupported", "verified", "mismatch"]),
parent_operation: z.literal("inspect_native_load_image"),
artifact: artifactSchema.nullable(),
view: nativeLoadImageViewRequestSchema,
items: nativeLoadImageViewItemsSchema,
}),
z.strictObject({
kind: z.literal("protobuf"),
view: protobufViewRequestSchema,
items: protobufViewItemsSchema,
...viewResultBase,
...protobufViewContextSchema.shape,
parent_operation: z.literal("inspect_web_network_capture"),
}),
z.strictObject({
kind: z.literal("capture"),
view: captureViewRequestSchema,
items: captureViewItemsSchema,
...viewResultBase,
parent_operation: z.literal("inspect_web_network_capture"),
}),
z.strictObject({
kind: z.literal("browser-scenario"),
view: browserScenarioViewRequestSchema,
items: browserScenarioViewItemsSchema,
...viewResultBase,
...browserScenarioViewContextSchema.shape,
artifact: z.null(),
parent_operation: z.literal("capture_browser_scenario"),
}),
z.strictObject({
kind: z.literal("qlog"),
view: qlogViewRequestSchema,
page: qlogViewPageSchema,
context: qlogViewContextSchema,
...viewResultBase,
parent_operation: z.literal("inspect_web_network_capture"),
}),
z.strictObject({
kind: z.literal("pcap"),
view: pcapViewRequestSchema,
page: pcapViewPageSchema,
source_coverage: z.enum(["complete", "partial"]),
...viewResultBase,
parent_operation: z.literal("inspect_pcap_capture"),
}),
z.strictObject({
kind: z.literal("facet"),
view: facetViewSchema,
facet: jsonValueSchema,
...viewResultBase,
}),
z.strictObject({
...viewResultBase,
...goBinaryViewContextSchema.shape,
kind: z.literal("go"),
parent_operation: z.literal("inspect_go_binary"),
view: goBinaryViewRequestSchema,
page: goBinaryViewPageSchema,
}),
rustBinaryPageViewResultSchema,
z.strictObject({
kind: z.literal("item"),
view: itemViewSchema,
item: jsonValueSchema,
...viewResultBase,
}),
z.strictObject({
kind: z.literal("page"),
view: pageViewSchema,
items: z.array(jsonValueSchema),
...viewResultBase,
}),
javascriptModuleReferencesViewResultSchema,
javascriptFactsViewResultSchema,
z.strictObject({
kind: z.literal("native"),
view: nativeViewSchema,
procedure_address: z.string().nullable(),
item: jsonValueSchema,
...viewResultBase,
}),
z.strictObject({
kind: z.literal("wasm"),
view: wasmViewRequestSchema,
item: wasmViewItemSchema,
...viewResultBase,
}),
z.strictObject({
kind: z.literal("desktop-application"),
view: desktopViewRequestSchema,
items: desktopViewItemsSchema,
...viewResultBase,
source_coverage: desktopCoverageSchema,
parent_operation: z.literal("inspect_desktop_application"),
}),
machoPageViewResultSchema,
z.strictObject({
kind: z.literal("interface-builder"),
view: interfaceBuilderViewRequestSchema,
items: interfaceBuilderViewItemsSchema,
...viewResultBase,
resource_root: bundleResourceRootSchema.optional(),
...interfaceBuilderViewContextSchema.shape,
parent_operation: z.literal("decode_interface_builder"),
}),
z.strictObject({
kind: z.literal("evm"),
view: evmViewRequestSchema,
item: evmViewItemSchema,
...viewResultBase,
parent_operation: z.literal("inspect_evm_interface"),
}),
z.strictObject({
kind: z.literal("managed"),
view: managedViewRequestSchema,
item: managedViewItemSchema,
...viewResultBase,
...managedViewContextSchema.shape,
parent_operation: z.literal("inspect_managed_artifact"),
}),
z.strictObject({
kind: z.literal("managed-members"),
view: managedMembersViewRequestSchema,
page: managedMembersViewPageSchema,
...viewResultBase,
...managedMembersViewContextSchema.shape,
parent_operation: z.literal("inspect_managed_members"),
}),
androidPackageViewResultSchema,
z.strictObject({
kind: z.literal("dart-aot"),
view: dartAotViewRequestSchema,
items: z.array(z.string()),
...viewResultBase,
...dartAotViewContextSchema.shape,
parent_operation: z.literal("inspect_dart_aot"),
}),
apkSignaturePageViewResultSchema,
modelArtifactPageViewResultSchema,
gpuCodeObjectsPageViewResultSchema,
z.strictObject({
kind: z.literal("il2cpp-metadata"),
view: il2cppMetadataViewRequestSchema,
items: il2cppMetadataViewItemsSchema,
...viewResultBase,
...il2cppMetadataViewContextSchema.shape,
parent_operation: z.literal("inspect_il2cpp_metadata"),
}),
z.strictObject({
kind: z.literal("inventory"),
view: artifactInventoryViewRequestSchema,
source_coverage: artifactInventoryCoverageSchema.exactOptional(),
manifest: artifactGraphManifestSchema,
inventory_evidence_ids: z.array(prefixedDigestSchema("ev")).min(1),
source_complete: z.boolean(),
items: artifactInventoryItemsSchema,
...viewResultBase,
}),
]);
export type AnalysisViewRequest = z.output<typeof analysisViewRequestSchema>;
export type InspectAnalysisViewInput = z.output<
typeof inspectAnalysisViewInputSchema
>;
export type AnalysisViewResult = z.output<typeof analysisViewResultSchema>;
/** Parent record already resolved from inline Evidence or a session reference. */
export interface AnalysisViewParent {
readonly evidenceId: string;
readonly operation: string;
readonly normalizedResult: unknown;
readonly provider?: Evidence["provider"];
readonly analysisProfile?: Evidence["analysis_profile"];
readonly authority?: Evidence["authority"];
readonly environment?: Evidence["environment"];
/** The owner proved normalizedResult belongs to a sealed, deep-frozen Evidence snapshot. */
readonly sealedResult?: boolean;
/** Subject presentation for this delivery, including explicit absence. */
readonly subject?: Evidence["subject"];
readonly limitations: readonly string[];
readonly artifact?: { readonly path: string; readonly sha256: string } | null;
/** Parent Evidence parameters, when the parent operation records them. */
readonly parameters?: unknown;
}
/** View payload before the content digest is attached. */
type WithoutViewDigest<T> = T extends { readonly view_digest: string }
? Omit<T, "view_digest">
: never;
export type UnsignedAnalysisView = WithoutViewDigest<AnalysisViewResult>;
/** Attach the content digest that must change when projected bytes change. */
export const sealAnalysisView = (
projection: UnsignedAnalysisView,
): AnalysisViewResult =>
analysisViewResultSchema.parse({
...projection,
view_digest: digestCanonicalValue(projection, "Analysis view"),
});
const parentDigest = (evidenceId: string): string => evidenceId.slice(3);
const parseJavaScriptParent = (
input: unknown,
): Result<JavaScriptApplicationAnalysisResult, AnalysisError> => {
try {
// The format owner authenticates imported results completely before reuse;
// mutable or merely frozen inputs still receive canonical validation.
const steps = parseOwnedJavaScriptApplicationAnalysisSteps(input);
let step = steps.next();
while (!step.done) step = steps.next();
return ok(step.value);
} catch (cause: unknown) {
if (!(cause instanceof z.ZodError)) throw cause;
return err(analysisViewResultInputError(input, cause));
}
};
const unsupportedParent = (
parent: AnalysisViewParent,
): AnalysisUnsupportedTargetError =>
new AnalysisUnsupportedTargetError(
INSPECT_ANALYSIS_VIEW_OPERATION,
parentArtifactPath(parent),
`Parent Evidence operation ${JSON.stringify(parent.operation)} does not support analysis views. Use completed Evidence from a supported parent operation with a compatible view. For a summary receipt, use its normalized_result.parent_evidence_id rather than the receipt's own evidence_id.`,
);
const parentArtifactPath = (parent: AnalysisViewParent): string => {
if (
typeof parent.normalizedResult === "object" &&
parent.normalizedResult !== null &&
"artifact" in parent.normalizedResult &&
typeof parent.normalizedResult.artifact === "object" &&
parent.normalizedResult.artifact !== null &&
"path" in parent.normalizedResult.artifact &&
typeof parent.normalizedResult.artifact.path === "string"
)
return parent.normalizedResult.artifact.path;
if (
typeof parent.normalizedResult === "object" &&
parent.normalizedResult !== null &&
"input_path" in parent.normalizedResult &&
typeof parent.normalizedResult.input_path === "string"
)
return parent.normalizedResult.input_path;
return parent.evidenceId;
};
/** Named source owners for views that need no extra decoder or accumulator. */
const retainedViewProjectors = new Map<string, typeof projectWasmArtifactView>([
...NATIVE_OBSERVATION_OPERATIONS.map(
(operation) => [operation, projectNativeObservationView] as const,
),
["inspect_erlang_beam", projectErlangBeamView],
["inspect_devicetree", projectDevicetreeView],
["inspect_native_exports", projectNativeExportsView],
["inspect_native_load_image", projectNativeLoadImageView],
["inspect_python_pyc", projectPythonPycView],
["frida_session_status", projectFridaSessionStatusView],
["gdb_console", projectCommandObservationView],
["inspect_with_objdump", projectCommandObservationView],
["inspect_go_binary", projectGoBinaryView],
["inspect_rust_binary", projectRustBinaryView],
...NATIVE_INVENTORY_OPERATIONS.map(
(operation) => [operation, projectNativeInventoryView] as const,
),
["inspect_desktop_application", projectDesktopApplicationView],
["inspect_wasm_artifact", projectWasmArtifactView],
["inspect_macho", projectMachoView],
["decode_interface_builder", projectInterfaceBuilderView],
["inspect_evm_interface", projectEvmInterfaceView],
["inspect_managed_artifact", projectManagedArtifactView],
["inspect_managed_members", projectManagedMemberView],
["inspect_android_package", projectAndroidPackageView],
["inspect_android_class", projectAndroidSymbolSummary],
["inspect_android_method", projectAndroidSymbolSummary],
["capture_browser_scenario", projectBrowserScenarioView],
["inspect_dart_aot", projectDartAotView],
["inspect_il2cpp_metadata", projectIl2cppMetadataView],
["inspect_apk_signature", projectApkSignatureView],
["inspect_model_artifact", projectModelArtifactView],
["inspect_gpu_code_objects", projectGpuCodeObjectsView],
["match_native_functions", projectNativeFunctionMatchingView],
["compare_source_to_bundle", projectSourceToBundleView],
["inspect_artifact", projectArtifactInventoryView],
["inventory_artifact", projectArtifactInventoryView],
["analyze_web_bundle", projectWebBundleView],
]);
/** Budgets retained across source admission and the selected grouping projection. */
export interface AnalysisViewAccumulators {
readonly apiSurface?: WebNetworkApiSurfaceAccumulator | undefined;
readonly manifest?: EnvironmentManifestAccumulator | undefined;
readonly state?: EnvironmentStateAccumulator | undefined;
}
/** Prepare one view's source admission and projection under the same owned budget. */
export const prepareAnalysisViewProjection = (
view: AnalysisViewRequest,
): {
admitInlineEvidence(value: unknown): Result<void, AnalysisError>;
project(
parent: AnalysisViewParent,
): Result<AnalysisViewResult, AnalysisError>;
} => {
const accumulators: AnalysisViewAccumulators = {
apiSurface:
view.kind === "api-surface"
? createApiSurfaceAccumulator(view)
: undefined,
manifest:
view.kind === "environment-manifest"
? createEnvironmentManifestAccumulator(view)
: undefined,
state:
view.kind === "environment-state" || view.kind === "environment-coverage"
? createEnvironmentStateAccumulator(view)
: undefined,
};
const accumulator =
accumulators.apiSurface ?? accumulators.manifest ?? accumulators.state;
return {
admitInlineEvidence: (value) =>
accumulator === undefined
? admitAnalysisViewData(value, true)
: accumulator.admitInlineEvidence(value),
project: (parent) => projectAnalysisView(parent, view, accumulators),
};
};
/** Views that group a capture's records into tools. */
export type GroupingViewKind =
| "api-surface"
| "environment-manifest"
| "environment-state"
| "environment-coverage";
type GroupingViewRequest = Extract<
AnalysisViewRequest,
{ kind: GroupingViewKind }
>;
const isGroupingView = (
view: AnalysisViewRequest,
): view is GroupingViewRequest =>
view.kind === "api-surface" ||
view.kind === "environment-manifest" ||
view.kind === "environment-state" ||
view.kind === "environment-coverage";
/** Views that group a capture's records, each under the budget its caller created. */
const projectGroupingView = (
parent: AnalysisViewParent,
view: GroupingViewRequest,
accumulators: AnalysisViewAccumulators,
): Result<UnsignedAnalysisView, AnalysisError> => {
if (view.kind === "api-surface")
return projectWebNetworkApiSurfaceView(
parent,
view,
accumulators.apiSurface,
);
if (view.kind === "environment-manifest")
return projectEnvironmentManifestView(parent, view, accumulators.manifest);
if (view.kind === "environment-coverage")
return projectEnvironmentCoverageView(parent, view, accumulators.state);
return projectEnvironmentStateView(parent, view, accumulators.state);
};
/** Project one selected view from authenticated parent analysis Evidence. */
export const projectAnalysisView = (
parent: AnalysisViewParent,
view: AnalysisViewRequest,
accumulators: AnalysisViewAccumulators = {},
): Result<AnalysisViewResult, AnalysisError> => {
const digest = parentDigest(parent.evidenceId);
if (!digestSchema.safeParse(digest).success)
return err(
analysisViewInputError([
{
path: ["source"],
reason: "invalid_format",
message: "Parent Evidence ID is not a digest-backed identifier.",
},
]),
);
if (view.kind === "javascript-routes") {
const projected = projectJavaScriptRoutesView(parent, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
if (view.kind === "web-bundle") {
const projected = projectWebBundleView(parent, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
if (isGroupingView(view)) {
const grouped = projectGroupingView(parent, view, accumulators);
return grouped.ok ? ok(sealAnalysisView(grouped.value)) : grouped;
}
if (parent.operation === "inspect_web_network_capture") {
const projected = projectWebNetworkCaptureView(parent, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
if (parent.operation === "inspect_pcap_capture") {
const projected = projectPcapCaptureView(parent, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
if (parent.operation === "inspect_byte_entropy") {
const report = parseAnalysisViewResult(byteEntropySchema, parent);
if (!report.ok) return report;
const projected = projectByteEntropyView(parent, report.value, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
if (parent.operation === "inspect_binary_layout") {
const layout = parseAnalysisViewResult(
{ safeParse: safeParseOwnedBinaryLayout },
parent,
);
if (!layout.ok) return layout;
const projected = projectBinaryLayoutView(parent, layout.value, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
if (parent.operation === "analyze_javascript_application") {
const analysis = parseJavaScriptParent(parent.normalizedResult);
if (!analysis.ok) return analysis;
const projected = projectJavaScriptApplicationView(
parent,
analysis.value,
view,
);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
if (parent.operation === "analyze_function") {
const native = parseAnalysisViewResult(functionDossierSchema, parent);
if (!native.ok) return native;
const projected = projectNativeFunctionView(parent, native.value, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
const project = retainedViewProjectors.get(parent.operation);
if (project !== undefined) {
const projected = project(parent, view);
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
}
return err(unsupportedParent(parent));
};