mirror of
https://github.com/morluto/rea
synced 2026-10-25 22:08:11 -04:00
gensokyo-dev
1221 lines
42 KiB
TypeScript
1221 lines
42 KiB
TypeScript
import { byteEntropySchema } from "../native/byteEntropy.js";
|
|
import {
|
|
byteEntropySummarySchema,
|
|
projectByteEntropyView,
|
|
} from "./byteEntropyView.js";
|
|
import {
|
|
parseAnalysisViewResult,
|
|
analysisViewResultInputError,
|
|
} from "./analysisViewParent.js";
|
|
import {
|
|
javaScriptRoutesViewRequestSchema,
|
|
javaScriptRoutesViewItemsSchema,
|
|
javaScriptRoutesViewSummarySchema,
|
|
javaScriptRoutesSourceReferenceSchema,
|
|
projectJavaScriptRoutesView,
|
|
} from "./javascriptRoutesView.js";
|
|
import { javaScriptRouteInventorySchema } from "../javascript/javascriptRouteInventory.js";
|
|
import {
|
|
sourceToBundleViewRequestSchema,
|
|
sourceToBundleViewItemsSchema,
|
|
sourceToBundleViewContextSchema,
|
|
projectSourceToBundleView,
|
|
} from "./sourceToBundleView.js";
|
|
import {
|
|
gpuCodeObjectsViewRequestSchema,
|
|
gpuCodeObjectsSummarySchema,
|
|
gpuCodeObjectsItemsSchema,
|
|
gpuCodeObjectsPtxPageSchema,
|
|
projectGpuCodeObjectsView,
|
|
} from "./gpuCodeObjectsView.js";
|
|
import { gpuCodeObjectsObjectSchema } from "../gpu/gpuCodeObjects.js";
|
|
import { modelArtifactViewRequestSchema } from "../model/modelArtifactQuery.js";
|
|
import {
|
|
projectModelArtifactView,
|
|
modelArtifactSummarySchema,
|
|
modelArtifactViewItemsSchema,
|
|
modelArtifactViewContextSchema,
|
|
} from "./modelArtifactView.js";
|
|
import {
|
|
commandSummaryContext,
|
|
gdbCommandSummarySchema,
|
|
projectCommandObservationView,
|
|
} from "./commandObservationView.js";
|
|
import {
|
|
fridaSessionStatusSummarySchema,
|
|
fridaSessionStatusViewContext,
|
|
projectFridaSessionStatusView,
|
|
} from "./fridaSessionStatusView.js";
|
|
import { commandObservationSchema } from "../commandObservation.js";
|
|
import {
|
|
rustBinaryViewPageSchema,
|
|
rustBinaryViewRequestSchema,
|
|
} from "../rust/rustBinaryQuery.js";
|
|
import {
|
|
goBinarySummarySchema,
|
|
goBinaryViewContextSchema,
|
|
goBinaryViewPageSchema,
|
|
goBinaryViewRequestSchema,
|
|
projectGoBinaryView,
|
|
} from "./goBinaryView.js";
|
|
import {
|
|
rustBinarySummarySchema,
|
|
rustBinaryViewContextSchema,
|
|
projectRustBinaryView,
|
|
} from "./rustBinaryView.js";
|
|
import {
|
|
projectNativeFunctionMatchingView,
|
|
nativeFunctionMatchingViewRequestSchema,
|
|
nativeFunctionMatchingViewItemsSchema,
|
|
nativeFunctionMatchingViewContextSchema,
|
|
} from "./nativeFunctionMatchingView.js";
|
|
import {
|
|
protobufViewRequestSchema,
|
|
protobufViewItemsSchema,
|
|
protobufViewContextSchema,
|
|
} from "./protobufCaptureView.js";
|
|
import {
|
|
nativeInventoryViewRequestSchema,
|
|
nativeInventoryViewRowSchema,
|
|
nativeInventoryViewContext,
|
|
nativeInventorySummarySchema,
|
|
projectNativeInventoryView,
|
|
} from "./nativeInventoryView.js";
|
|
import {
|
|
NATIVE_INVENTORY_OPERATIONS,
|
|
nativeInventoryOperationSchema,
|
|
} from "../native/nativeInventory.js";
|
|
|
|
import { absoluteLocalPathStringSchema } from "../localPath.js";
|
|
import { z } from "zod";
|
|
import {
|
|
desktopViewRequestSchema,
|
|
desktopViewItemsSchema,
|
|
desktopSummarySchema,
|
|
projectDesktopApplicationView,
|
|
} from "./desktopApplicationView.js";
|
|
import { desktopCoverageSchema } from "../desktopApplication.js";
|
|
import {
|
|
javascriptModuleReferencesRequestSchema,
|
|
javascriptModuleReferenceSchema,
|
|
} from "./javascriptModuleReferences.js";
|
|
import { javascriptApplicationSourceCoverageSchema } from "./javascriptApplicationCoverage.js";
|
|
import {
|
|
javascriptFactsViewRequestSchema,
|
|
javascriptFactRowSchema,
|
|
} from "./javascriptFactsView.js";
|
|
import { javaScriptSourceSelectionSchema } from "../javascript/javascriptSourceSelection.js";
|
|
|
|
import { AnalysisUnsupportedTargetError } from "../analysisErrorCore.js";
|
|
import {
|
|
INSPECT_ANALYSIS_VIEW_OPERATION,
|
|
analysisViewInputError,
|
|
} from "./analysisViewErrors.js";
|
|
import { digestCanonicalValue } from "../canonicalDigest.js";
|
|
import { digestSchema, prefixedDigestSchema } from "../digests.js";
|
|
import { evidenceSchema, type Evidence } from "../evidence.js";
|
|
import { jsonObjectSchema, jsonValueSchema } from "../jsonValue.js";
|
|
import { err, ok, type Result } from "../result.js";
|
|
import type { AnalysisError } from "../analysisErrorBase.js";
|
|
import {
|
|
binaryLayoutSchema,
|
|
safeParseOwnedBinaryLayout,
|
|
} from "../native/binaryLayout.js";
|
|
import { bundleResourceRootSchema } from "../apple/bundleResourceRoot.js";
|
|
import { functionDossierSchema } from "../hopperValues.js";
|
|
import {
|
|
artifactGraphManifestSchema,
|
|
artifactInventoryCoverageSchema,
|
|
} from "../artifactGraph.js";
|
|
import { artifactInspectionResultSchema } from "../artifactInspection.js";
|
|
import {
|
|
parseOwnedJavaScriptApplicationAnalysisSteps,
|
|
type JavaScriptApplicationAnalysisResult,
|
|
} from "../javascript/javascriptApplicationAnalysis.js";
|
|
import { projectBinaryLayoutView } from "./binaryLayoutView.js";
|
|
import { projectJavaScriptApplicationView } from "./javascriptApplicationView.js";
|
|
import {
|
|
projectWebNetworkApiSurfaceView,
|
|
apiSurfaceFields,
|
|
apiSurfaceViewSchema,
|
|
} from "./webNetworkApiSurfaceView.js";
|
|
import { projectNativeFunctionView } from "./nativeFunctionView.js";
|
|
import {
|
|
projectEvmInterfaceView,
|
|
evmViewRequestSchema,
|
|
evmViewItemSchema,
|
|
evmSummarySchema,
|
|
} from "./evmInterfaceView.js";
|
|
import {
|
|
projectArtifactInventoryView,
|
|
artifactInventoryViewRequestSchema,
|
|
artifactInventoryItemsSchema,
|
|
artifactInventorySummarySchema,
|
|
} from "./artifactInventoryView.js";
|
|
import {
|
|
projectManagedArtifactView,
|
|
managedViewRequestSchema,
|
|
managedViewItemSchema,
|
|
managedSummarySchema,
|
|
managedViewContextSchema,
|
|
} from "./managedArtifactView.js";
|
|
import {
|
|
projectManagedMemberView,
|
|
managedMembersViewRequestSchema,
|
|
managedMembersViewPageSchema,
|
|
managedMemberSummarySchema,
|
|
managedMembersViewContextSchema,
|
|
} from "./managedMemberView.js";
|
|
import {
|
|
projectWasmArtifactView,
|
|
wasmViewRequestSchema,
|
|
wasmViewItemSchema,
|
|
wasmSummarySchema,
|
|
} from "./wasmArtifactView.js";
|
|
import {
|
|
machoSummarySchema,
|
|
machoViewContextSchema,
|
|
machoViewItemSchema,
|
|
machoViewRequestSchema,
|
|
projectMachoView,
|
|
} from "./machoView.js";
|
|
import {
|
|
interfaceBuilderSummarySchema,
|
|
interfaceBuilderViewContextSchema,
|
|
interfaceBuilderViewItemsSchema,
|
|
interfaceBuilderViewRequestSchema,
|
|
projectInterfaceBuilderView,
|
|
} from "./interfaceBuilderView.js";
|
|
import {
|
|
projectWebNetworkCaptureView,
|
|
captureViewRequestSchema,
|
|
captureViewItemsSchema,
|
|
captureSummarySchema,
|
|
} from "./webNetworkCaptureView.js";
|
|
import type { WebNetworkApiSurfaceAccumulator } from "./WebNetworkApiSurfaceAccumulator.js";
|
|
import type { EnvironmentManifestAccumulator } from "./EnvironmentManifestAccumulator.js";
|
|
import type { EnvironmentStateAccumulator } from "./EnvironmentStateAccumulator.js";
|
|
import {
|
|
projectEnvironmentManifestView,
|
|
environmentManifestFields,
|
|
environmentManifestViewRequestSchema,
|
|
} from "./environmentManifestView.js";
|
|
import {
|
|
environmentStateFields,
|
|
environmentStateViewRequestSchema,
|
|
projectEnvironmentStateView,
|
|
} from "./environmentStateView.js";
|
|
import {
|
|
pcapViewRequestSchema,
|
|
pcapViewPageSchema,
|
|
pcapSummarySchema,
|
|
projectPcapCaptureView,
|
|
} from "./pcapCaptureView.js";
|
|
import {
|
|
qlogViewRequestSchema,
|
|
qlogViewPageSchema,
|
|
qlogViewContextSchema,
|
|
} from "./qlogCaptureView.js";
|
|
import {
|
|
projectAndroidPackageView,
|
|
androidPackageSummarySchema,
|
|
androidViewRequestSchema,
|
|
androidManifestViewItemSchema,
|
|
} from "./androidPackageView.js";
|
|
import {
|
|
projectDartAotView,
|
|
dartAotSummarySchema,
|
|
dartAotViewRequestSchema,
|
|
dartAotViewContextSchema,
|
|
} from "./dartAotView.js";
|
|
import {
|
|
projectIl2cppMetadataView,
|
|
il2cppMetadataSummarySchema,
|
|
il2cppMetadataViewRequestSchema,
|
|
il2cppMetadataViewContextSchema,
|
|
il2cppMetadataViewItemsSchema,
|
|
} from "./il2cppMetadataView.js";
|
|
|
|
const summaryViewSchema = z.strictObject({ kind: z.literal("summary") });
|
|
const facetViewSchema = z.strictObject({
|
|
kind: z.literal("facet"),
|
|
facet: z.enum(["mitigations", "linkage"]),
|
|
});
|
|
const indexSelectorSchema = z.strictObject({
|
|
index: z.int().nonnegative(),
|
|
});
|
|
const nameSelectorSchema = z.strictObject({ name: z.string() });
|
|
const pathSelectorSchema = z.strictObject({
|
|
path: z
|
|
.string()
|
|
.describe(
|
|
"Exact observed module path or original source-map reference from a module page; an empty reference is valid.",
|
|
),
|
|
});
|
|
const nodeIdSelectorSchema = z.strictObject({
|
|
node_id: prefixedDigestSchema("jag_node"),
|
|
});
|
|
const moduleItemViewSchema = z.strictObject({
|
|
kind: z.literal("item"),
|
|
collection: z.literal("modules"),
|
|
selector: z.union([pathSelectorSchema, nodeIdSelectorSchema]),
|
|
});
|
|
const sectionOrSymbolItemViewSchema = z.strictObject({
|
|
kind: z.literal("item"),
|
|
collection: z.enum(["sections", "symbols"]),
|
|
selector: z.union([indexSelectorSchema, nameSelectorSchema]),
|
|
});
|
|
/**
|
|
* The collection-specific selector alternatives are expressed in the owning
|
|
* contract so the advertised JSON Schema preserves them: modules accept
|
|
* path/node_id, sections and symbols accept index/name. Refinement-only
|
|
* constraints do not survive JSON Schema conversion, so the advertised
|
|
* schema previously accepted combinations that runtime input validation
|
|
* rejects.
|
|
*/
|
|
const itemViewSchema = z.discriminatedUnion("collection", [
|
|
moduleItemViewSchema,
|
|
sectionOrSymbolItemViewSchema,
|
|
]);
|
|
const pageViewSchema = z.strictObject({
|
|
kind: z.literal("page"),
|
|
collection: z.enum(["sections", "symbols", "modules"]),
|
|
offset: z.int().nonnegative(),
|
|
limit: z.int().positive(),
|
|
});
|
|
|
|
/** Bounded native function facets of already authenticated analyze_function Evidence. */
|
|
const nativeViewSchema = z.strictObject({
|
|
kind: z.literal("native"),
|
|
facet: z.enum([
|
|
"procedure",
|
|
"pseudocode",
|
|
"assembly",
|
|
"basic_blocks",
|
|
"comments",
|
|
"callers",
|
|
"callees",
|
|
"incoming_references",
|
|
"outgoing_references",
|
|
"unresolved_calls",
|
|
"referenced_strings",
|
|
"referenced_names",
|
|
"swift_string_literals",
|
|
"swift_string_literal_omissions",
|
|
"native_api",
|
|
"value_flow_summary",
|
|
"value_flow_operations",
|
|
"value_flow_def_use",
|
|
"value_flow_effects",
|
|
"value_flow_parameters",
|
|
"value_flow_parameter_uses",
|
|
]),
|
|
offset: z.int().nonnegative().default(0),
|
|
limit: z.int().positive().default(64),
|
|
});
|
|
|
|
/** Caller-selected projection of already completed analysis Evidence. */
|
|
export const analysisViewRequestSchema = z.discriminatedUnion("kind", [
|
|
javaScriptRoutesViewRequestSchema,
|
|
nativeFunctionMatchingViewRequestSchema,
|
|
sourceToBundleViewRequestSchema,
|
|
summaryViewSchema,
|
|
goBinaryViewRequestSchema,
|
|
rustBinaryViewRequestSchema,
|
|
desktopViewRequestSchema,
|
|
facetViewSchema,
|
|
itemViewSchema,
|
|
pageViewSchema,
|
|
javascriptModuleReferencesRequestSchema,
|
|
javascriptFactsViewRequestSchema,
|
|
nativeViewSchema,
|
|
nativeInventoryViewRequestSchema,
|
|
artifactInventoryViewRequestSchema,
|
|
wasmViewRequestSchema,
|
|
machoViewRequestSchema,
|
|
interfaceBuilderViewRequestSchema,
|
|
evmViewRequestSchema,
|
|
managedViewRequestSchema,
|
|
managedMembersViewRequestSchema,
|
|
androidViewRequestSchema,
|
|
apiSurfaceViewSchema,
|
|
environmentManifestViewRequestSchema,
|
|
environmentStateViewRequestSchema,
|
|
captureViewRequestSchema,
|
|
protobufViewRequestSchema,
|
|
qlogViewRequestSchema,
|
|
pcapViewRequestSchema,
|
|
dartAotViewRequestSchema,
|
|
il2cppMetadataViewRequestSchema,
|
|
modelArtifactViewRequestSchema,
|
|
gpuCodeObjectsViewRequestSchema,
|
|
]);
|
|
|
|
// The application owns admission and authenticated Evidence parsing. SDK and
|
|
// CLI envelope parsing must borrow this unknown value rather than clone it
|
|
// before admission. Advertise the owning Evidence contract in both dialects.
|
|
const inlineEvidenceInputSchema = z.unknown().nonoptional();
|
|
inlineEvidenceInputSchema._zod.processJSONSchema =
|
|
evidenceSchema._zod.processJSONSchema;
|
|
|
|
/** Unauthenticated inline input, an exact same-session retained reference, or one local Evidence file. */
|
|
export const analysisViewSourceSchema = z.discriminatedUnion("kind", [
|
|
z.strictObject({
|
|
kind: z.literal("retained-evidence"),
|
|
evidence_id: prefixedDigestSchema("ev"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("inline"),
|
|
evidence: inlineEvidenceInputSchema,
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("evidence-file"),
|
|
path: absoluteLocalPathStringSchema.describe(
|
|
"Absolute local path of one completed Evidence JSON file. REA reads and authenticates it, then projects it like retained Evidence, so large captures are not charged as inline input.",
|
|
),
|
|
}),
|
|
]);
|
|
|
|
/** Public inspect_analysis_view input. */
|
|
export const inspectAnalysisViewInputSchema = z.strictObject({
|
|
source: analysisViewSourceSchema,
|
|
view: analysisViewRequestSchema,
|
|
});
|
|
|
|
const coverageSchema = z.strictObject({
|
|
status: z.enum(["complete-within-view", "page", "empty"]),
|
|
examined: z.int().nonnegative(),
|
|
total: z.int().nonnegative(),
|
|
next_offset: z.int().nonnegative().nullable(),
|
|
exhausted: z.boolean(),
|
|
});
|
|
|
|
const artifactSchema = z.strictObject({
|
|
path: z
|
|
.string()
|
|
.describe(
|
|
"Selected artifact path, or the canonical resource root when resource-only Evidence has no executable subject.",
|
|
),
|
|
sha256: digestSchema.nullable(),
|
|
});
|
|
|
|
const layoutSummarySchema = z.strictObject({
|
|
bytes: binaryLayoutSchema.shape.artifact.shape.bytes,
|
|
format: binaryLayoutSchema.shape.format,
|
|
architecture: binaryLayoutSchema.shape.architecture,
|
|
image_type: binaryLayoutSchema.shape.image_type,
|
|
entry: z.strictObject({
|
|
reported_value: z.string().min(1),
|
|
meaning: z.enum(["linked-virtual-address", "not-applicable", "absent"]),
|
|
execution_status: z.literal("unknown"),
|
|
}),
|
|
counts: z.strictObject({
|
|
sections: z.int().nonnegative(),
|
|
segments: z.int().nonnegative(),
|
|
symbols: z.int().nonnegative(),
|
|
relocations: z.int().nonnegative(),
|
|
}),
|
|
limitation_count: z.int().nonnegative(),
|
|
});
|
|
|
|
const javascriptSummarySchema = z.strictObject({
|
|
input_path: z.string().min(1),
|
|
format: z.enum(["asar", "directory"]),
|
|
root_artifact_sha256: digestSchema,
|
|
source_selection: javaScriptSourceSelectionSchema.exactOptional(),
|
|
statistics: jsonObjectSchema,
|
|
electron: jsonObjectSchema,
|
|
coverage: jsonObjectSchema,
|
|
limitation_count: z.int().nonnegative(),
|
|
});
|
|
|
|
const viewResultBase = {
|
|
parent_evidence_id: prefixedDigestSchema("ev"),
|
|
parent_operation: z.enum([
|
|
"inspect_byte_entropy",
|
|
"inspect_binary_layout",
|
|
"inspect_go_binary",
|
|
"gdb_console",
|
|
"frida_session_status",
|
|
"inspect_with_objdump",
|
|
"inspect_desktop_application",
|
|
"analyze_javascript_application",
|
|
"analyze_web_bundle",
|
|
"analyze_function",
|
|
"inspect_artifact",
|
|
"inventory_artifact",
|
|
"inspect_wasm_artifact",
|
|
"inspect_macho",
|
|
"decode_interface_builder",
|
|
"inspect_evm_interface",
|
|
"inspect_managed_artifact",
|
|
"inspect_managed_members",
|
|
"inspect_web_network_capture",
|
|
"inspect_android_package",
|
|
"inspect_pcap_capture",
|
|
"inspect_dart_aot",
|
|
"inspect_il2cpp_metadata",
|
|
"inspect_model_artifact",
|
|
"inspect_gpu_code_objects",
|
|
...NATIVE_INVENTORY_OPERATIONS,
|
|
"match_native_functions",
|
|
]),
|
|
parent_digest: digestSchema,
|
|
view_digest: digestSchema,
|
|
artifact: artifactSchema,
|
|
coverage: coverageSchema,
|
|
limitations: z.array(z.string()),
|
|
unknowns: z.array(z.string()),
|
|
} as const;
|
|
|
|
const summaryViewResultBase = {
|
|
kind: z.literal("summary"),
|
|
view: summaryViewSchema,
|
|
...viewResultBase,
|
|
} as const;
|
|
|
|
export const byteEntropySummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
summary: byteEntropySummarySchema,
|
|
parent_operation: z.literal("inspect_byte_entropy"),
|
|
});
|
|
|
|
/** Opt-in command delivery keeps output once and retains the complete parent. */
|
|
export const gdbCommandSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
...commandSummaryContext,
|
|
parent_operation: z.literal("gdb_console"),
|
|
artifact: artifactSchema.nullable(),
|
|
summary: gdbCommandSummarySchema,
|
|
});
|
|
|
|
export const objdumpSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
...commandSummaryContext,
|
|
parent_operation: z.literal("inspect_with_objdump"),
|
|
artifact: artifactSchema.nullable(),
|
|
summary: commandObservationSchema,
|
|
});
|
|
|
|
export const fridaSessionStatusSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
...fridaSessionStatusViewContext,
|
|
parent_operation: z.literal("frida_session_status"),
|
|
artifact: artifactSchema.nullable(),
|
|
summary: fridaSessionStatusSummarySchema,
|
|
});
|
|
|
|
/** Opt-in Go delivery retains original bytes and exposes build identity/counts. */
|
|
export const goBinarySummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
...goBinaryViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_go_binary"),
|
|
summary: goBinarySummarySchema,
|
|
});
|
|
|
|
/** Compact source identity and counts, retaining the complete embedded graph. */
|
|
export const rustBinarySummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
...rustBinaryViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_rust_binary"),
|
|
summary: rustBinarySummarySchema,
|
|
});
|
|
|
|
export const rustBinaryPageViewResultSchema = z.strictObject({
|
|
...viewResultBase,
|
|
...rustBinaryViewContextSchema.shape,
|
|
kind: z.literal("rust"),
|
|
parent_operation: z.literal("inspect_rust_binary"),
|
|
view: rustBinaryViewRequestSchema,
|
|
rust: rustBinarySummarySchema,
|
|
page: rustBinaryViewPageSchema,
|
|
});
|
|
|
|
/** Summary `inspect_binary_layout` detail returns; no other view kind. */
|
|
export const binaryLayoutSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
summary: layoutSummarySchema,
|
|
parent_operation: z.literal("inspect_binary_layout"),
|
|
});
|
|
|
|
/** Summary `analyze_javascript_application` detail returns; no other view kind. */
|
|
export const javascriptApplicationSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
summary: javascriptSummarySchema,
|
|
parent_operation: z.literal("analyze_javascript_application"),
|
|
});
|
|
|
|
/** Typed reference page; full item observations remain available separately. */
|
|
export const javascriptModuleReferencesViewResultSchema = z.strictObject({
|
|
...viewResultBase,
|
|
kind: z.literal("javascript"),
|
|
view: javascriptModuleReferencesRequestSchema,
|
|
parent_operation: z.literal("analyze_javascript_application"),
|
|
rows: z.array(javascriptModuleReferenceSchema),
|
|
source_coverage: javascriptApplicationSourceCoverageSchema,
|
|
});
|
|
|
|
/** Paged retained observations with exact selected properties and provenance. */
|
|
const javascriptFactsViewResultSchema = z.strictObject({
|
|
...viewResultBase,
|
|
kind: z.literal("javascript-facts"),
|
|
view: javascriptFactsViewRequestSchema,
|
|
parent_operation: z.literal("analyze_javascript_application"),
|
|
rows: z.array(javascriptFactRowSchema),
|
|
source_coverage: javascriptApplicationSourceCoverageSchema,
|
|
});
|
|
|
|
/** Exact summary carrier for artifact inspection's optional delivery contract. */
|
|
export const artifactInventorySummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.enum(["inspect_artifact", "inventory_artifact"]),
|
|
summary: artifactInventorySummarySchema,
|
|
});
|
|
|
|
export const desktopApplicationSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_desktop_application"),
|
|
summary: desktopSummarySchema,
|
|
});
|
|
|
|
/** Exact summary carrier for WASM inspection's optional delivery contract. */
|
|
export const wasmArtifactSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_wasm_artifact"),
|
|
summary: wasmSummarySchema,
|
|
});
|
|
|
|
/** Exact slice identity and collection counts for Mach-O's selected delivery. */
|
|
export const machoSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_macho"),
|
|
summary: machoSummarySchema,
|
|
});
|
|
|
|
/** Decoded documents and graph counts for Interface Builder's selected delivery. */
|
|
export const interfaceBuilderSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("decode_interface_builder"),
|
|
resource_root: bundleResourceRootSchema.optional(),
|
|
summary: interfaceBuilderSummarySchema,
|
|
});
|
|
|
|
/** Exact inferred-interface summary for EVM's caller-selected delivery. */
|
|
export const evmInterfaceSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_evm_interface"),
|
|
summary: evmSummarySchema,
|
|
});
|
|
|
|
/** Exact metadata overview for the managed artifact's selected delivery. */
|
|
export const managedArtifactSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_managed_artifact"),
|
|
summary: managedSummarySchema,
|
|
});
|
|
|
|
/** Exact member selection, coverage and counts for the selected delivery. */
|
|
export const managedMemberSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_managed_members"),
|
|
summary: managedMemberSummarySchema,
|
|
});
|
|
|
|
/** Exact historical capture summary, with no body or member-inventory payload. */
|
|
export const webNetworkCaptureSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_web_network_capture"),
|
|
summary: captureSummarySchema,
|
|
});
|
|
|
|
/** Exact package declarations with retained decoded manifest text. */
|
|
export const androidPackageSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_android_package"),
|
|
summary: androidPackageSummarySchema,
|
|
});
|
|
|
|
export const pcapCaptureSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_pcap_capture"),
|
|
summary: pcapSummarySchema,
|
|
});
|
|
|
|
/** Exact snapshot and pool-coverage carrier for selected AOT delivery. */
|
|
export const dartAotSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_dart_aot"),
|
|
summary: dartAotSummarySchema,
|
|
});
|
|
|
|
export const javaScriptRoutesViewResultSchema = z.strictObject({
|
|
...viewResultBase,
|
|
artifact: artifactSchema.nullable(),
|
|
kind: z.literal("javascript-routes"),
|
|
parent_operation: z.enum([
|
|
"analyze_javascript_application",
|
|
"analyze_web_bundle",
|
|
]),
|
|
view: javaScriptRoutesViewRequestSchema,
|
|
inventory_id: javaScriptRouteInventorySchema.shape.inventory_id,
|
|
source_manifest_sha256: digestSchema,
|
|
source_coverage: javaScriptRouteInventorySchema.shape.coverage,
|
|
inventory_capacity: javaScriptRouteInventorySchema.shape.capacity,
|
|
capture_url: z.string().nullable(),
|
|
items: javaScriptRoutesViewItemsSchema,
|
|
sources: z.array(javaScriptRoutesSourceReferenceSchema),
|
|
summary: javaScriptRoutesViewSummarySchema.nullable(),
|
|
byte_limited: z.boolean(),
|
|
});
|
|
|
|
export const gpuCodeObjectsSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_gpu_code_objects"),
|
|
summary: gpuCodeObjectsSummarySchema,
|
|
});
|
|
export const gpuCodeObjectsPageViewResultSchema = z.strictObject({
|
|
kind: z.literal("gpu-code-objects"),
|
|
view: gpuCodeObjectsViewRequestSchema,
|
|
items: gpuCodeObjectsItemsSchema,
|
|
ptx: gpuCodeObjectsPtxPageSchema.nullable(),
|
|
source_coverage: gpuCodeObjectsObjectSchema.shape.coverage,
|
|
...viewResultBase,
|
|
parent_operation: z.literal("inspect_gpu_code_objects"),
|
|
});
|
|
|
|
export const modelArtifactSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_model_artifact"),
|
|
summary: modelArtifactSummarySchema,
|
|
});
|
|
|
|
export const modelArtifactPageViewResultSchema = z.strictObject({
|
|
kind: z.literal("model-artifact"),
|
|
view: modelArtifactViewRequestSchema,
|
|
items: modelArtifactViewItemsSchema,
|
|
...viewResultBase,
|
|
...modelArtifactViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_model_artifact"),
|
|
});
|
|
|
|
/** Metadata identity and row counts for selected IL2CPP delivery. */
|
|
export const il2cppMetadataSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
parent_operation: z.literal("inspect_il2cpp_metadata"),
|
|
summary: il2cppMetadataSummarySchema,
|
|
});
|
|
|
|
/** Exact inventory summary with the original observation's provider and query. */
|
|
export const nativeInventorySummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
...nativeInventoryViewContext,
|
|
parent_operation: nativeInventoryOperationSchema,
|
|
artifact: artifactSchema.nullable(),
|
|
summary: nativeInventorySummarySchema,
|
|
});
|
|
|
|
/** Compact native matching discovery retains the complete matching report. */
|
|
export const nativeFunctionMatchingSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
artifact: z.null(),
|
|
parent_operation: z.literal("match_native_functions"),
|
|
summary: nativeFunctionMatchingViewContextSchema,
|
|
});
|
|
|
|
export const sourceToBundleSummaryViewResultSchema = z.strictObject({
|
|
...summaryViewResultBase,
|
|
artifact: z.null(),
|
|
parent_operation: z.literal("compare_source_to_bundle"),
|
|
summary: sourceToBundleViewContextSchema,
|
|
});
|
|
export const sourceToBundlePageViewResultSchema = z.strictObject({
|
|
...viewResultBase,
|
|
...sourceToBundleViewContextSchema.shape,
|
|
kind: z.literal("source-to-bundle"),
|
|
artifact: z.null(),
|
|
parent_operation: z.literal("compare_source_to_bundle"),
|
|
view: sourceToBundleViewRequestSchema,
|
|
items: sourceToBundleViewItemsSchema,
|
|
});
|
|
|
|
/** Projected facts for one selected view of retained analysis Evidence. */
|
|
export const analysisViewResultSchema = z.discriminatedUnion("kind", [
|
|
javaScriptRoutesViewResultSchema,
|
|
sourceToBundlePageViewResultSchema,
|
|
z.strictObject({
|
|
...viewResultBase,
|
|
...nativeFunctionMatchingViewContextSchema.shape,
|
|
kind: z.literal("function-matches"),
|
|
artifact: z.null(),
|
|
view: nativeFunctionMatchingViewRequestSchema,
|
|
items: nativeFunctionMatchingViewItemsSchema,
|
|
parent_operation: z.literal("match_native_functions"),
|
|
}),
|
|
z.strictObject({
|
|
...viewResultBase,
|
|
...apiSurfaceFields,
|
|
kind: z.literal("api-surface"),
|
|
parent_operation: z.literal("inspect_web_network_capture"),
|
|
view: apiSurfaceViewSchema,
|
|
artifact: z.strictObject({
|
|
path: z.string(),
|
|
sha256: digestSchema.nullable(),
|
|
}),
|
|
}),
|
|
z.strictObject({
|
|
...viewResultBase,
|
|
...environmentManifestFields,
|
|
kind: z.literal("environment-manifest"),
|
|
parent_operation: z.enum([
|
|
"inspect_web_network_capture",
|
|
"capture_browser_scenario",
|
|
]),
|
|
view: environmentManifestViewRequestSchema,
|
|
}),
|
|
z.strictObject({
|
|
...viewResultBase,
|
|
...environmentStateFields,
|
|
kind: z.literal("environment-state"),
|
|
parent_operation: z.enum([
|
|
"inspect_web_network_capture",
|
|
"capture_browser_scenario",
|
|
]),
|
|
view: environmentStateViewRequestSchema,
|
|
}),
|
|
z.discriminatedUnion("parent_operation", [
|
|
byteEntropySummaryViewResultSchema,
|
|
gdbCommandSummaryViewResultSchema,
|
|
objdumpSummaryViewResultSchema,
|
|
fridaSessionStatusSummaryViewResultSchema,
|
|
goBinarySummaryViewResultSchema,
|
|
rustBinarySummaryViewResultSchema,
|
|
binaryLayoutSummaryViewResultSchema,
|
|
desktopApplicationSummaryViewResultSchema,
|
|
javascriptApplicationSummaryViewResultSchema,
|
|
artifactInventorySummaryViewResultSchema,
|
|
wasmArtifactSummaryViewResultSchema,
|
|
machoSummaryViewResultSchema,
|
|
interfaceBuilderSummaryViewResultSchema,
|
|
evmInterfaceSummaryViewResultSchema,
|
|
managedArtifactSummaryViewResultSchema,
|
|
managedMemberSummaryViewResultSchema,
|
|
webNetworkCaptureSummaryViewResultSchema,
|
|
androidPackageSummaryViewResultSchema,
|
|
pcapCaptureSummaryViewResultSchema,
|
|
dartAotSummaryViewResultSchema,
|
|
il2cppMetadataSummaryViewResultSchema,
|
|
modelArtifactSummaryViewResultSchema,
|
|
gpuCodeObjectsSummaryViewResultSchema,
|
|
nativeInventorySummaryViewResultSchema,
|
|
nativeFunctionMatchingSummaryViewResultSchema,
|
|
sourceToBundleSummaryViewResultSchema,
|
|
]),
|
|
z.strictObject({
|
|
...viewResultBase,
|
|
...nativeInventoryViewContext,
|
|
kind: z.literal("native-inventory"),
|
|
parent_operation: nativeInventoryOperationSchema,
|
|
artifact: artifactSchema.nullable(),
|
|
view: nativeInventoryViewRequestSchema,
|
|
rows: z.array(nativeInventoryViewRowSchema),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("protobuf"),
|
|
view: protobufViewRequestSchema,
|
|
items: protobufViewItemsSchema,
|
|
...viewResultBase,
|
|
...protobufViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_web_network_capture"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("capture"),
|
|
view: captureViewRequestSchema,
|
|
items: captureViewItemsSchema,
|
|
...viewResultBase,
|
|
parent_operation: z.literal("inspect_web_network_capture"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("qlog"),
|
|
view: qlogViewRequestSchema,
|
|
page: qlogViewPageSchema,
|
|
context: qlogViewContextSchema,
|
|
...viewResultBase,
|
|
parent_operation: z.literal("inspect_web_network_capture"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("pcap"),
|
|
view: pcapViewRequestSchema,
|
|
page: pcapViewPageSchema,
|
|
source_coverage: z.enum(["complete", "partial"]),
|
|
...viewResultBase,
|
|
parent_operation: z.literal("inspect_pcap_capture"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("facet"),
|
|
view: facetViewSchema,
|
|
facet: jsonValueSchema,
|
|
...viewResultBase,
|
|
}),
|
|
z.strictObject({
|
|
...viewResultBase,
|
|
...goBinaryViewContextSchema.shape,
|
|
kind: z.literal("go"),
|
|
parent_operation: z.literal("inspect_go_binary"),
|
|
view: goBinaryViewRequestSchema,
|
|
page: goBinaryViewPageSchema,
|
|
}),
|
|
rustBinaryPageViewResultSchema,
|
|
z.strictObject({
|
|
kind: z.literal("item"),
|
|
view: itemViewSchema,
|
|
item: jsonValueSchema,
|
|
...viewResultBase,
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("page"),
|
|
view: pageViewSchema,
|
|
items: z.array(jsonValueSchema),
|
|
...viewResultBase,
|
|
}),
|
|
javascriptModuleReferencesViewResultSchema,
|
|
javascriptFactsViewResultSchema,
|
|
z.strictObject({
|
|
kind: z.literal("native"),
|
|
view: nativeViewSchema,
|
|
procedure_address: z.string().nullable(),
|
|
item: jsonValueSchema,
|
|
...viewResultBase,
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("wasm"),
|
|
view: wasmViewRequestSchema,
|
|
item: wasmViewItemSchema,
|
|
...viewResultBase,
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("desktop-application"),
|
|
view: desktopViewRequestSchema,
|
|
items: desktopViewItemsSchema,
|
|
...viewResultBase,
|
|
source_coverage: desktopCoverageSchema,
|
|
parent_operation: z.literal("inspect_desktop_application"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("macho"),
|
|
view: machoViewRequestSchema,
|
|
item: machoViewItemSchema,
|
|
...viewResultBase,
|
|
...machoViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_macho"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("interface-builder"),
|
|
view: interfaceBuilderViewRequestSchema,
|
|
items: interfaceBuilderViewItemsSchema,
|
|
...viewResultBase,
|
|
resource_root: bundleResourceRootSchema.optional(),
|
|
...interfaceBuilderViewContextSchema.shape,
|
|
parent_operation: z.literal("decode_interface_builder"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("evm"),
|
|
view: evmViewRequestSchema,
|
|
item: evmViewItemSchema,
|
|
...viewResultBase,
|
|
parent_operation: z.literal("inspect_evm_interface"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("managed"),
|
|
view: managedViewRequestSchema,
|
|
item: managedViewItemSchema,
|
|
...viewResultBase,
|
|
...managedViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_managed_artifact"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("managed-members"),
|
|
view: managedMembersViewRequestSchema,
|
|
page: managedMembersViewPageSchema,
|
|
...viewResultBase,
|
|
...managedMembersViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_managed_members"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("android"),
|
|
view: androidViewRequestSchema,
|
|
item: androidManifestViewItemSchema,
|
|
...viewResultBase,
|
|
parent_operation: z.literal("inspect_android_package"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("dart-aot"),
|
|
view: dartAotViewRequestSchema,
|
|
items: z.array(z.string()),
|
|
...viewResultBase,
|
|
...dartAotViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_dart_aot"),
|
|
}),
|
|
modelArtifactPageViewResultSchema,
|
|
gpuCodeObjectsPageViewResultSchema,
|
|
z.strictObject({
|
|
kind: z.literal("il2cpp-metadata"),
|
|
view: il2cppMetadataViewRequestSchema,
|
|
items: il2cppMetadataViewItemsSchema,
|
|
...viewResultBase,
|
|
...il2cppMetadataViewContextSchema.shape,
|
|
parent_operation: z.literal("inspect_il2cpp_metadata"),
|
|
}),
|
|
z.strictObject({
|
|
kind: z.literal("inventory"),
|
|
view: artifactInventoryViewRequestSchema,
|
|
source_coverage: artifactInventoryCoverageSchema.exactOptional(),
|
|
manifest: artifactGraphManifestSchema,
|
|
inventory_evidence_ids: z.array(prefixedDigestSchema("ev")).min(1),
|
|
source_complete: z.boolean(),
|
|
items: artifactInventoryItemsSchema,
|
|
...viewResultBase,
|
|
}),
|
|
]);
|
|
|
|
export type AnalysisViewRequest = z.output<typeof analysisViewRequestSchema>;
|
|
export type InspectAnalysisViewInput = z.output<
|
|
typeof inspectAnalysisViewInputSchema
|
|
>;
|
|
export type AnalysisViewResult = z.output<typeof analysisViewResultSchema>;
|
|
export type AnalysisViewCoverage = z.output<typeof coverageSchema>;
|
|
|
|
/** Parent record already resolved from inline Evidence or a session reference. */
|
|
export interface AnalysisViewParent {
|
|
readonly evidenceId: string;
|
|
readonly operation: string;
|
|
readonly normalizedResult: unknown;
|
|
readonly provider?: Evidence["provider"];
|
|
readonly analysisProfileDigest?: string | null;
|
|
/** The owner proved normalizedResult belongs to a sealed, deep-frozen Evidence snapshot. */
|
|
readonly sealedResult?: boolean;
|
|
/** Preserve the authenticated source identity, including explicit absence. */
|
|
readonly subject?: Evidence["subject"];
|
|
readonly limitations: readonly string[];
|
|
readonly artifact?: { readonly path: string; readonly sha256: string } | null;
|
|
/** Parent Evidence parameters, when the parent operation records them. */
|
|
readonly parameters?: unknown;
|
|
}
|
|
|
|
/** View payload before the content digest is attached. */
|
|
type WithoutViewDigest<T> = T extends { readonly view_digest: string }
|
|
? Omit<T, "view_digest">
|
|
: never;
|
|
export type UnsignedAnalysisView = WithoutViewDigest<AnalysisViewResult>;
|
|
|
|
/** Attach the content digest that must change when projected bytes change. */
|
|
export const sealAnalysisView = (
|
|
projection: UnsignedAnalysisView,
|
|
): AnalysisViewResult =>
|
|
analysisViewResultSchema.parse({
|
|
...projection,
|
|
view_digest: digestCanonicalValue(projection, "Analysis view"),
|
|
});
|
|
|
|
const parentDigest = (evidenceId: string): string => evidenceId.slice(3);
|
|
|
|
const parseJavaScriptParent = (
|
|
input: unknown,
|
|
): Result<JavaScriptApplicationAnalysisResult, AnalysisError> => {
|
|
try {
|
|
// The format owner authenticates imported results completely before reuse;
|
|
// mutable or merely frozen inputs still receive canonical validation.
|
|
const steps = parseOwnedJavaScriptApplicationAnalysisSteps(input);
|
|
let step = steps.next();
|
|
while (!step.done) step = steps.next();
|
|
return ok(step.value);
|
|
} catch (cause: unknown) {
|
|
if (!(cause instanceof z.ZodError)) throw cause;
|
|
return err(analysisViewResultInputError(input, cause));
|
|
}
|
|
};
|
|
|
|
const unsupportedParent = (
|
|
parent: AnalysisViewParent,
|
|
): AnalysisUnsupportedTargetError =>
|
|
new AnalysisUnsupportedTargetError(
|
|
INSPECT_ANALYSIS_VIEW_OPERATION,
|
|
parentArtifactPath(parent),
|
|
parent.operation === "capture_browser_scenario"
|
|
? `Parent Evidence operation "capture_browser_scenario" supports only the environment-manifest and environment-state views.`
|
|
: `Parent Evidence operation ${JSON.stringify(parent.operation)} does not support analysis views. Use completed binary layout, JavaScript application, native function/inventory, artifact inventory/inspection, WASM, Mach-O, Interface Builder, EVM, managed artifact or member, Android package, Dart AOT, IL2CPP metadata, or web network capture Evidence.`,
|
|
);
|
|
|
|
const parentArtifactPath = (parent: AnalysisViewParent): string => {
|
|
if (
|
|
typeof parent.normalizedResult === "object" &&
|
|
parent.normalizedResult !== null &&
|
|
"artifact" in parent.normalizedResult &&
|
|
typeof parent.normalizedResult.artifact === "object" &&
|
|
parent.normalizedResult.artifact !== null &&
|
|
"path" in parent.normalizedResult.artifact &&
|
|
typeof parent.normalizedResult.artifact.path === "string"
|
|
)
|
|
return parent.normalizedResult.artifact.path;
|
|
if (
|
|
typeof parent.normalizedResult === "object" &&
|
|
parent.normalizedResult !== null &&
|
|
"input_path" in parent.normalizedResult &&
|
|
typeof parent.normalizedResult.input_path === "string"
|
|
)
|
|
return parent.normalizedResult.input_path;
|
|
return parent.evidenceId;
|
|
};
|
|
|
|
/** Named source owners for views that need no extra decoder or accumulator. */
|
|
const retainedViewProjectors = new Map<string, typeof projectWasmArtifactView>([
|
|
["frida_session_status", projectFridaSessionStatusView],
|
|
["gdb_console", projectCommandObservationView],
|
|
["inspect_with_objdump", projectCommandObservationView],
|
|
["inspect_go_binary", projectGoBinaryView],
|
|
["inspect_rust_binary", projectRustBinaryView],
|
|
...NATIVE_INVENTORY_OPERATIONS.map(
|
|
(operation) => [operation, projectNativeInventoryView] as const,
|
|
),
|
|
["inspect_desktop_application", projectDesktopApplicationView],
|
|
["inspect_wasm_artifact", projectWasmArtifactView],
|
|
["inspect_macho", projectMachoView],
|
|
["decode_interface_builder", projectInterfaceBuilderView],
|
|
["inspect_evm_interface", projectEvmInterfaceView],
|
|
["inspect_managed_artifact", projectManagedArtifactView],
|
|
["inspect_managed_members", projectManagedMemberView],
|
|
["inspect_android_package", projectAndroidPackageView],
|
|
["inspect_dart_aot", projectDartAotView],
|
|
["inspect_il2cpp_metadata", projectIl2cppMetadataView],
|
|
["inspect_model_artifact", projectModelArtifactView],
|
|
["inspect_gpu_code_objects", projectGpuCodeObjectsView],
|
|
["match_native_functions", projectNativeFunctionMatchingView],
|
|
["compare_source_to_bundle", projectSourceToBundleView],
|
|
["inspect_artifact", projectArtifactInventoryView],
|
|
["inventory_artifact", projectArtifactInventoryView],
|
|
]);
|
|
|
|
/** Budgets a caller created before admitting the source; each grouping view uses its own. */
|
|
export interface AnalysisViewAccumulators {
|
|
readonly apiSurface?: WebNetworkApiSurfaceAccumulator | undefined;
|
|
readonly manifest?: EnvironmentManifestAccumulator | undefined;
|
|
readonly state?: EnvironmentStateAccumulator | undefined;
|
|
}
|
|
|
|
type GroupingViewRequest = Extract<
|
|
AnalysisViewRequest,
|
|
{ kind: "api-surface" | "environment-manifest" | "environment-state" }
|
|
>;
|
|
|
|
const isGroupingView = (
|
|
view: AnalysisViewRequest,
|
|
): view is GroupingViewRequest =>
|
|
view.kind === "api-surface" ||
|
|
view.kind === "environment-manifest" ||
|
|
view.kind === "environment-state";
|
|
|
|
/** Views that group a capture's records, each under the budget its caller created. */
|
|
const projectGroupingView = (
|
|
parent: AnalysisViewParent,
|
|
view: GroupingViewRequest,
|
|
accumulators: AnalysisViewAccumulators,
|
|
): Result<UnsignedAnalysisView, AnalysisError> => {
|
|
if (view.kind === "api-surface")
|
|
return projectWebNetworkApiSurfaceView(
|
|
parent,
|
|
view,
|
|
accumulators.apiSurface,
|
|
);
|
|
if (view.kind === "environment-manifest")
|
|
return projectEnvironmentManifestView(parent, view, accumulators.manifest);
|
|
return projectEnvironmentStateView(parent, view, accumulators.state);
|
|
};
|
|
|
|
/** Project one selected view from authenticated parent analysis Evidence. */
|
|
export const projectAnalysisView = (
|
|
parent: AnalysisViewParent,
|
|
view: AnalysisViewRequest,
|
|
accumulators: AnalysisViewAccumulators = {},
|
|
): Result<AnalysisViewResult, AnalysisError> => {
|
|
const digest = parentDigest(parent.evidenceId);
|
|
if (!digestSchema.safeParse(digest).success)
|
|
return err(
|
|
analysisViewInputError([
|
|
{
|
|
path: ["source"],
|
|
reason: "invalid_format",
|
|
message: "Parent Evidence ID is not a digest-backed identifier.",
|
|
},
|
|
]),
|
|
);
|
|
if (view.kind === "javascript-routes") {
|
|
const projected = projectJavaScriptRoutesView(parent, view);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
if (isGroupingView(view)) {
|
|
const grouped = projectGroupingView(parent, view, accumulators);
|
|
return grouped.ok ? ok(sealAnalysisView(grouped.value)) : grouped;
|
|
}
|
|
if (parent.operation === "inspect_web_network_capture") {
|
|
const projected = projectWebNetworkCaptureView(parent, view);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
if (parent.operation === "inspect_pcap_capture") {
|
|
const projected = projectPcapCaptureView(parent, view);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
if (parent.operation === "inspect_byte_entropy") {
|
|
const report = byteEntropySchema.safeParse(parent.normalizedResult);
|
|
if (!report.success)
|
|
return err(
|
|
analysisViewInputError([
|
|
{
|
|
path: ["source"],
|
|
reason: "invalid_value",
|
|
message:
|
|
"Parent Evidence result does not match inspect_byte_entropy.",
|
|
},
|
|
]),
|
|
);
|
|
const projected = projectByteEntropyView(parent, report.data, view);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
if (parent.operation === "inspect_binary_layout") {
|
|
const layout = safeParseOwnedBinaryLayout(parent.normalizedResult);
|
|
if (!layout.success)
|
|
return err(
|
|
analysisViewInputError([
|
|
{
|
|
path: ["source"],
|
|
reason: "invalid_value",
|
|
message:
|
|
"Parent Evidence result does not match inspect_binary_layout.",
|
|
},
|
|
]),
|
|
);
|
|
const projected = projectBinaryLayoutView(parent, layout.data, view);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
if (parent.operation === "analyze_javascript_application") {
|
|
const analysis = parseJavaScriptParent(parent.normalizedResult);
|
|
if (!analysis.ok) return analysis;
|
|
const projected = projectJavaScriptApplicationView(
|
|
parent,
|
|
analysis.value,
|
|
view,
|
|
);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
if (parent.operation === "analyze_function") {
|
|
const native = parseAnalysisViewResult(functionDossierSchema, parent);
|
|
if (!native.ok) return native;
|
|
const projected = projectNativeFunctionView(parent, native.value, view);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
const project = retainedViewProjectors.get(parent.operation);
|
|
if (project !== undefined) {
|
|
const projected = project(parent, view);
|
|
return projected.ok ? ok(sealAnalysisView(projected.value)) : projected;
|
|
}
|
|
return err(unsupportedParent(parent));
|
|
};
|