rea-agents - v1.1.0
Preparing search index...
application/BinarySession
BinarySessionPort
Interface BinarySessionPort
Target lifecycle used by CLI and MCP without exposing a concrete provider.
interface
BinarySessionPort
{
activeTarget
()
:
BinaryTarget
|
undefined
;
close
()
:
Promise
<
Result
<
null
,
AnalysisError
>
>
;
evidenceById
(
evidenceId
:
string
,
)
:
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
undefined
;
execute
(
operation
:
AnalysisOperation
,
parameters
:
Readonly
<
Record
<
string
,
JsonValue
>
>
,
options
?:
ExecutionOptions
,
)
:
Promise
<
Result
<
AnalysisExecution
,
AnalysisError
>
>
;
exportEvidenceBundle
()
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
hasEvidence
(
evidenceId
:
string
)
:
boolean
;
importEvidenceBundle
(
bundle
:
unknown
,
)
:
Result
<
number
,
EvidenceIntegrityError
|
EvidenceLimitError
>
;
listUnknowns
(
filters
?:
{
domain
?:
string
;
severity
?:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
?:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
}
,
)
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
open
(
path
:
string
,
options
?:
{
signal
?:
AbortSignal
;
targetKind
?:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
}
,
)
:
Promise
<
Result
<
BinaryTarget
,
AnalysisError
>
>
;
providerIdentity
(
operation
?:
AnalysisOperation
)
:
ProviderIdentity
;
recordEvidence
(
evidence
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
)
:
Result
<
"added"
|
"duplicate"
,
EvidenceIntegrityError
|
EvidenceLimitError
,
>
;
recordEvidenceWithUnknown
(
evidence
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
|
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
|
null
,
AnalysisError
,
>
;
recordUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
;
status
()
:
JSONType
;
updateUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
expected_revision
:
number
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
;
verifyUnknownResolution
(
unknownId
:
string
,
)
:
Result
<
{
truthVerified
:
boolean
;
unknown
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
;
valid
:
boolean
;
}
,
UnknownRegistryError
,
>
;
}
Hierarchy (
View Summary
)
AnalysisOperationPort
BinarySessionPort
Implemented by
BinarySession
Index
Methods
active
Target
close
evidence
By
Id
execute
export
Evidence
Bundle
has
Evidence
import
Evidence
Bundle
list
Unknowns
open
provider
Identity
record
Evidence
record
Evidence
With
Unknown
record
Unknown
status
update
Unknown
verify
Unknown
Resolution
Methods
active
Target
activeTarget
()
:
BinaryTarget
|
undefined
Returns
BinaryTarget
|
undefined
close
close
()
:
Promise
<
Result
<
null
,
AnalysisError
>
>
Returns
Promise
<
Result
<
null
,
AnalysisError
>
>
evidence
By
Id
evidenceById
(
evidenceId
:
string
,
)
:
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
undefined
Parameters
evidenceId
:
string
Returns
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
undefined
execute
execute
(
operation
:
AnalysisOperation
,
parameters
:
Readonly
<
Record
<
string
,
JsonValue
>
>
,
options
?:
ExecutionOptions
,
)
:
Promise
<
Result
<
AnalysisExecution
,
AnalysisError
>
>
Parameters
operation
:
AnalysisOperation
parameters
:
Readonly
<
Record
<
string
,
JsonValue
>
>
Optional
options
:
ExecutionOptions
Returns
Promise
<
Result
<
AnalysisExecution
,
AnalysisError
>
>
export
Evidence
Bundle
exportEvidenceBundle
()
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
Returns
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
has
Evidence
hasEvidence
(
evidenceId
:
string
)
:
boolean
Parameters
evidenceId
:
string
Returns
boolean
import
Evidence
Bundle
importEvidenceBundle
(
bundle
:
unknown
,
)
:
Result
<
number
,
EvidenceIntegrityError
|
EvidenceLimitError
>
Parameters
bundle
:
unknown
Returns
Result
<
number
,
EvidenceIntegrityError
|
EvidenceLimitError
>
list
Unknowns
listUnknowns
(
filters
?:
{
domain
?:
string
;
severity
?:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
?:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
}
,
)
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
Parameters
Optional
filters
:
{
domain
?:
string
;
severity
?:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
?:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
}
Returns
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
open
open
(
path
:
string
,
options
?:
{
signal
?:
AbortSignal
;
targetKind
?:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
}
,
)
:
Promise
<
Result
<
BinaryTarget
,
AnalysisError
>
>
Parameters
path
:
string
Optional
options
:
{
signal
?:
AbortSignal
;
targetKind
?:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
}
Returns
Promise
<
Result
<
BinaryTarget
,
AnalysisError
>
>
provider
Identity
providerIdentity
(
operation
?:
AnalysisOperation
)
:
ProviderIdentity
Parameters
Optional
operation
:
AnalysisOperation
Returns
ProviderIdentity
record
Evidence
recordEvidence
(
evidence
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
)
:
Result
<
"added"
|
"duplicate"
,
EvidenceIntegrityError
|
EvidenceLimitError
,
>
Parameters
evidence
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
Returns
Result
<
"added"
|
"duplicate"
,
EvidenceIntegrityError
|
EvidenceLimitError
>
record
Evidence
With
Unknown
recordEvidenceWithUnknown
(
evidence
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
|
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
|
null
,
AnalysisError
,
>
Parameters
evidence
:
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"hopper"
|
"mach-o"
|
"elf"
|
"pe"
|
"zip"
|
"ipa"
|
"apk"
|
"asar"
|
"dmg"
|
"pkg"
|
"plist"
|
"javascript"
|
"source-map"
|
"unknown"
|
"file"
|
"directory"
|
"mach-o-universal"
|
"javascript-bundle"
|
"entitlements"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
Returns
Result
<
|
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
|
null
,
AnalysisError
,
>
record
Unknown
recordUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
Parameters
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
Returns
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
status
status
()
:
JSONType
Returns
JSONType
update
Unknown
updateUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
expected_revision
:
number
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
Parameters
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
expected_revision
:
number
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
Returns
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
verify
Unknown
Resolution
verifyUnknownResolution
(
unknownId
:
string
,
)
:
Result
<
{
truthVerified
:
boolean
;
unknown
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
;
valid
:
boolean
;
}
,
UnknownRegistryError
,
>
Parameters
unknownId
:
string
Returns
Result
<
{
truthVerified
:
boolean
;
unknown
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
;
valid
:
boolean
;
}
,
UnknownRegistryError
,
>
Settings
Member Visibility
Protected
Inherited
Theme
OS
Light
Dark
On This Page
Methods
active
Target
close
evidence
By
Id
execute
export
Evidence
Bundle
has
Evidence
import
Evidence
Bundle
list
Unknowns
open
provider
Identity
record
Evidence
record
Evidence
With
Unknown
record
Unknown
status
update
Unknown
verify
Unknown
Resolution
rea-agents - v1.1.0
Loading...
Target lifecycle used by CLI and MCP without exposing a concrete provider.