rea-agents 4.1.0 → 6.0.0

package/dist/domain/apple/appleBundleAnatomy.js

@@ -0,0 +1,236 @@
+import { z } from "zod";
+import { digestSchema, prefixedDigestSchema } from "../digests.js";
+const pathSchema = z.string().min(1);
+const BUNDLE_EXTENSION = /\.(?:app|appex|xpc|framework|systemextension|dext|bundle|plugin|qlgenerator|mdimporter)$/iu;
+const MACH_O_FORMATS = ["mach-o", "mach-o-universal"];
+/** One inventoried file or directory with its content identity. */
+export const appleComponentSchema = z.strictObject({
+    path: pathSchema,
+    artifact_id: prefixedDigestSchema("art"),
+    sha256: digestSchema,
+    format: z.string().min(1),
+});
+/** One application root or nested bundle classified by path convention. */
+export const appleBundleSchema = z.strictObject({
+    path: pathSchema,
+    parent_path: pathSchema.nullable(),
+    layout: z.enum(["shallow", "macos-deep", "versioned-framework"]),
+    role: z.enum([
+        "application",
+        "app-extension",
+        "xpc-service",
+        "framework",
+        "login-item",
+        "system-extension",
+        "driver-extension",
+        "plug-in",
+        "resource-bundle",
+        "bundle",
+        "helper-application",
+        "nested-application",
+    ]),
+    role_basis: z.literal("path-convention"),
+    info_plist_path: pathSchema.nullable(),
+    executable_candidates: z.array(pathSchema),
+    signing_paths: z.array(pathSchema),
+});
+/** Report whether an inventory format is a thin or universal Mach-O. */
+export const isMachOFormat = (format) => MACH_O_FORMATS.includes(format);
+/** AppleDouble metadata written beside archived files (`._name`, `__MACOSX/`). */
+export const isSidecar = (path) => {
+    const segments = path.split("/");
+    return (segments.includes("__MACOSX") || (segments.at(-1) ?? "").startsWith("._"));
+};
+export const isWithin = (path, root) => root === "." || path === root || path.startsWith(`${root}/`);
+/**
+ * Outermost iOS (`Payload/X.app`) and macOS (`X.app/Contents/…`) applications.
+ * An inventoried `.app` directory is its own root, `.`.
+ */
+export const applicationRoots = (entries, subject) => {
+    // A selected `.app` directory is the application, even when its inventory
+    // is partial or lacks Contents/; coverage and limitations describe that.
+    if (subject.format === "directory" && /\.app$/iu.test(subject.name))
+        return ["."];
+    const found = new Set();
+    for (const { path } of entries) {
+        if (isSidecar(path))
+            continue;
+        const ios = /^(Payload\/[^/]+\.app)(?:\/|$)/u.exec(path);
+        if (ios?.[1] !== undefined) {
+            found.add(ios[1]);
+            continue;
+        }
+        const segments = path.split("/");
+        const index = segments.findIndex((segment, position) => /\.app$/iu.test(segment) && segments[position + 1] === "Contents");
+        if (index >= 0)
+            found.add(segments.slice(0, index + 1).join("/"));
+    }
+    const roots = [...found];
+    return roots
+        .filter((root) => !roots.some((other) => other !== root && isWithin(root, other)))
+        .sort(compare);
+};
+export const detectBundles = (entries, roots) => {
+    const paths = new Set(roots);
+    for (const { path, kind } of entries) {
+        if (isSidecar(path))
+            continue;
+        const root = roots.find((candidate) => isWithin(path, candidate));
+        if (root === undefined)
+            continue;
+        const segments = path.split("/");
+        const start = root === "." ? 0 : root.split("/").length;
+        for (let index = start; index < segments.length; index++) {
+            const segment = segments[index] ?? "";
+            const leaf = index === segments.length - 1;
+            // A symlink or file named like a bundle has no observed contents.
+            if (BUNDLE_EXTENSION.test(segment) && (!leaf || kind === "directory"))
+                paths.add(segments.slice(0, index + 1).join("/"));
+        }
+    }
+    const tree = indexTree(entries);
+    return [...paths].sort(compare).map((path) => {
+        const layout = bundleLayout(path, tree);
+        return {
+            path,
+            parent_path: enclosingBundle(path, paths),
+            layout,
+            role: roots.includes(path) ? "application" : bundleRole(path),
+            role_basis: "path-convention",
+            info_plist_path: infoPlistPath(path, layout, tree),
+            executable_candidates: executableCandidates(path, layout, tree),
+            signing_paths: signingPaths(path, layout, tree),
+        };
+    });
+};
+const indexTree = (entries) => {
+    const children = new Map();
+    const files = new Map();
+    const directories = new Set();
+    for (const { path, kind, component } of entries) {
+        if (isSidecar(path))
+            continue;
+        if (kind === "file" && component !== undefined)
+            files.set(path, component);
+        if (kind === "directory")
+            directories.add(path);
+        const segments = path.split("/");
+        let parent = "";
+        for (const segment of segments) {
+            const names = children.get(parent) ?? new Set();
+            names.add(segment);
+            children.set(parent, names);
+            parent = joinPath(parent, segment);
+            if (parent !== path)
+                directories.add(parent);
+        }
+    }
+    return { children, files, directories };
+};
+const joinPath = (directory, name) => directory === "" ? name : `${directory}/${name}`;
+const directoryOf = (bundle) => (bundle === "." ? "" : bundle);
+const enclosingBundle = (path, bundles) => {
+    if (path === ".")
+        return null;
+    const segments = path.split("/");
+    for (let length = segments.length - 1; length > 0; length--) {
+        const candidate = segments.slice(0, length).join("/");
+        if (bundles.has(candidate))
+            return candidate;
+    }
+    return bundles.has(".") ? "." : null;
+};
+const bundleLayout = (bundle, tree) => {
+    const names = tree.children.get(directoryOf(bundle));
+    if (names?.has("Contents") === true)
+        return "macos-deep";
+    if (names?.has("Versions") === true)
+        return "versioned-framework";
+    return "shallow";
+};
+const bundleRole = (bundle) => {
+    const segments = bundle.split("/");
+    const name = (segments.at(-1) ?? "").toLowerCase();
+    const container = segments.at(-2);
+    if (name.endsWith(".appex"))
+        return "app-extension";
+    if (name.endsWith(".xpc"))
+        return "xpc-service";
+    if (name.endsWith(".framework"))
+        return "framework";
+    if (name.endsWith(".systemextension"))
+        return "system-extension";
+    if (name.endsWith(".dext"))
+        return "driver-extension";
+    if (name.endsWith(".bundle")) {
+        if (container === "PlugIns")
+            return "plug-in";
+        return container === "Resources" ? "resource-bundle" : "bundle";
+    }
+    if (!name.endsWith(".app"))
+        return "plug-in";
+    if (container === "LoginItems" && segments.at(-3) === "Library")
+        return "login-item";
+    if (container === "Helpers")
+        return "helper-application";
+    return "nested-application";
+};
+/** Files directly inside one directory; nested bundles are deeper paths. */
+const directFiles = (directory, tree) => [...(tree.children.get(directory) ?? [])]
+    .map((name) => joinPath(directory, name))
+    .filter((path) => tree.files.has(path))
+    .sort(compare);
+/** Content directories; `Versions/Current` is a symlink outside the inventory. */
+const contentDirectories = (bundle, layout, tree) => {
+    const directory = directoryOf(bundle);
+    if (layout === "macos-deep")
+        return [joinPath(directory, "Contents")];
+    if (layout === "shallow")
+        return [directory];
+    const versions = joinPath(directory, "Versions");
+    // Only real version directories count: Current is a symlink, and files
+    // such as .DS_Store are not versions.
+    return [...(tree.children.get(versions) ?? [])]
+        .filter((version) => version !== "Current")
+        .map((version) => joinPath(versions, version))
+        .filter((version) => tree.directories.has(version))
+        .sort(compare);
+};
+const infoPlistPath = (bundle, layout, tree) => {
+    const directories = contentDirectories(bundle, layout, tree);
+    // With several real versions, Versions/Current (a symlink outside the
+    // inventory) decides which plist applies, so the plist stays unknown.
+    if (directories.length !== 1)
+        return null;
+    const candidates = directories
+        .map((directory) => joinPath(directory, layout === "versioned-framework"
+        ? "Resources/Info.plist"
+        : "Info.plist"))
+        .filter((path) => tree.files.has(path));
+    return candidates.length === 1 ? (candidates[0] ?? null) : null;
+};
+const executableCandidates = (bundle, layout, tree) => contentDirectories(bundle, layout, tree)
+    .flatMap((directory) => directFiles(layout === "macos-deep" ? joinPath(directory, "MacOS") : directory, tree))
+    .filter((path) => MACH_O_FORMATS.includes(tree.files.get(path)?.format ?? ""));
+const signingPaths = (bundle, layout, tree) => contentDirectories(bundle, layout, tree)
+    .flatMap((directory) => [
+    joinPath(directory, "_CodeSignature/CodeResources"),
+    joinPath(directory, "embedded.provisionprofile"),
+    joinPath(directory, "embedded.mobileprovision"),
+])
+    .filter((path) => tree.files.has(path))
+    .sort(compare);
+/** Platforms of application roots whose layout was observed, not assumed. */
+export const platformsOf = (bundles) => [
+    ...new Set(bundles.flatMap(({ role, layout, info_plist_path: plist }) => {
+        if (role !== "application")
+            return [];
+        if (layout === "macos-deep")
+            return ["macos"];
+        // An empty or partial root has no Contents/ either; require Info.plist.
+        if (layout === "shallow" && plist !== null)
+            return ["ios"];
+        return [];
+    })),
+].sort(compare);
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/domain/apple/dyldPaths.js

@@ -0,0 +1,81 @@
+const MAX_SYMLINK_HOPS = 32;
+/**
+ * Resolve a root-relative path one segment at a time, as `open` would:
+ * symlinks are followed inside the root, `..` applies to the real parent,
+ * and any escape above the root or through an absolute link stops.
+ */
+export const resolveTreePath = async (view, input) => {
+    const pending = segmentsOf(input);
+    const resolved = [];
+    let last;
+    let hops = 0;
+    while (pending.length > 0) {
+        const segment = pending.shift() ?? "";
+        if (segment === "..") {
+            if (resolved.length === 0)
+                return { kind: "escapes" };
+            resolved.pop();
+            last = { kind: "directory" };
+            continue;
+        }
+        const path = [...resolved, segment].join("/");
+        const entry = await view.entry(path);
+        if (entry === undefined)
+            return { kind: "absent" };
+        if (entry.kind === "symlink") {
+            hops += 1;
+            if (hops > MAX_SYMLINK_HOPS)
+                return { kind: "absent" };
+            if (entry.target.startsWith("/"))
+                return { kind: "escapes" };
+            pending.unshift(...segmentsOf(entry.target));
+            continue;
+        }
+        if (entry.kind === "file" && pending.length > 0)
+            return { kind: "absent" };
+        resolved.push(segment);
+        last = entry;
+    }
+    return last?.kind === "file"
+        ? { kind: "file", path: resolved.join("/") }
+        : { kind: "not-file" };
+};
+const segmentsOf = (path) => path.split("/").filter((segment) => segment !== "" && segment !== ".");
+export const directoryOf = (path) => {
+    const index = path.lastIndexOf("/");
+    return index < 0 ? "" : path.slice(0, index);
+};
+export const joinPath = (directory, rest) => directory === "" ? rest : rest === "" ? directory : `${directory}/${rest}`;
+/** Expand one dyld path prefix relative to its owning image. */
+export const expandPrefix = (raw, context) => {
+    const variable = /^@(executable_path|loader_path)(?:\/(.*))?$/u.exec(raw);
+    if (variable !== null) {
+        const rest = variable[2] ?? "";
+        if (variable[1] === "loader_path")
+            return { scope: "target", path: joinPath(context.ownerDirectory, rest) };
+        return context.executable === null
+            ? { scope: "undetermined", path: raw }
+            : {
+                scope: "target",
+                path: joinPath(directoryOf(context.executable), rest),
+            };
+    }
+    if (raw.startsWith("/"))
+        return { scope: "outside", path: raw };
+    return { scope: "undetermined", path: raw };
+};
+/**
+ * Slices a process may load, best first, following dyld's graded
+ * architectures: an x86_64h process also accepts generic x86_64.
+ */
+const COMPATIBLE_ARCHITECTURES = {
+    x86_64h: ["x86_64h", "x86_64"],
+};
+export const compatibleSlice = (slices, process) => {
+    for (const architecture of COMPATIBLE_ARCHITECTURES[process] ?? [process]) {
+        const slice = slices.find((item) => item.architecture === architecture);
+        if (slice !== undefined)
+            return slice;
+    }
+    return undefined;
+};

package/dist/domain/apple/dylibResolution.js

@@ -0,0 +1,367 @@
+import { z } from "zod";
+import { compatibleSlice, directoryOf, expandPrefix, joinPath, resolveTreePath, } from "./dyldPaths.js";
+import { digestSchema } from "../digests.js";
+import { DYLIB_RESOLUTION_LIMITATIONS, deriveFindings, } from "./dylibResolutionFindings.js";
+/** Normalized path below the analyzed root: no `.`/`..` or empty segments. */
+const ROOT_RELATIVE_PATH = /^(?!\/)(?!(?:.*\/)?\.{1,2}(?:\/|$))(?!.*\/\/)(?!.*\/$)[^\\\0]+$/u;
+const rootRelativePathSchema = z.string().min(1).regex(ROOT_RELATIVE_PATH);
+/** Caller selection of process roots and one CPU slice. */
+export const dylibResolutionInputSchema = z.strictObject({
+    roots: z.array(rootRelativePathSchema).min(1).optional(),
+    architecture: z.enum(["arm64", "arm64e", "x86_64"]).optional(),
+});
+const dependencyCommandSchema = z.enum([
+    "LC_LOAD_DYLIB",
+    "LC_LOAD_WEAK_DYLIB",
+    "LC_REEXPORT_DYLIB",
+    "LC_LAZY_LOAD_DYLIB",
+    "LC_LOAD_UPWARD_DYLIB",
+]);
+const dependencySchema = z.strictObject({
+    command: dependencyCommandSchema,
+    encoding: z.enum(["dylib_command", "dylib_use_command"]),
+    install_name: z.string(),
+    weak: z.boolean(),
+    upward: z.boolean(),
+    reexport: z.boolean(),
+    delayed_init: z.boolean(),
+    current_version: z.string(),
+    compatibility_version: z.string(),
+});
+/** Observed dylib-loading facts of one Mach-O slice. */
+export const machoSliceSchema = z.strictObject({
+    architecture: z.string().min(1),
+    file_type: z.enum(["execute", "dylib", "bundle", "other"]),
+    install_name: z.string().nullable(),
+    dependencies: z.array(dependencySchema),
+    rpaths: z.array(z.string()),
+    dyld_environment: z.array(z.string()),
+    code_signature_present: z.boolean(),
+});
+const candidateSchema = z.strictObject({
+    path: z.string(),
+    source: z.enum([
+        "literal",
+        "executable_path",
+        "loader_path",
+        "rpath",
+        "already-loaded",
+    ]),
+    rpath: z.string().nullable(),
+    rpath_owner: z.string().nullable(),
+    outcome: z.enum([
+        "resolved",
+        "absent",
+        "not-mach-o",
+        "malformed",
+        "unsupported",
+        "architecture-missing",
+        "outside-target",
+        "escapes-target",
+        "undetermined",
+    ]),
+    resolved_path: z.string().nullable(),
+});
+const edgeSchema = z.strictObject({
+    root: z.string(),
+    architecture: z.string(),
+    loader: z.string(),
+    via: z.array(z.string()),
+    ...dependencySchema.shape,
+    candidates: z.array(candidateSchema),
+    resolution: z.strictObject({
+        status: z.enum(["resolved", "conditional", "unresolved", "undetermined"]),
+        image: z.string().nullable(),
+    }),
+    install_name_matches: z.boolean().nullable(),
+    /**
+     * The loader was reached through a conditional edge, so it might not load;
+     * this edge describes what happens only if it does.
+     */
+    loader_conditional: z.boolean(),
+});
+const findingSchema = z.strictObject({
+    kind: z.enum([
+        "required-load-unresolved",
+        "weak-load-unresolved",
+        "lazy-load-unresolved",
+        "earlier-rpath-candidate-absent",
+        "dyld-environment-present",
+    ]),
+    edge_index: z.number().int().nonnegative().nullable(),
+    image: z.string().nullable(),
+    basis: z.literal("derived"),
+    explanation: z.string().min(1),
+});
+const imageSchema = z.strictObject({
+    path: z.string(),
+    sha256: digestSchema,
+    parse_status: z.enum(["parsed", "malformed", "unsupported"]),
+    reason: z.string().nullable(),
+    slices: z.array(machoSliceSchema.omit({ dependencies: true })),
+});
+/** Static dyld load-path resolution for every selected process root. */
+export const dylibResolutionResultSchema = z.strictObject({
+    root_path: z.string(),
+    target_sha256: digestSchema,
+    roots: z.array(z.strictObject({ image: z.string(), architecture: z.string() })),
+    images: z.array(imageSchema),
+    edges: z.array(edgeSchema),
+    findings: z.array(findingSchema),
+    coverage: z.strictObject({
+        status: z.enum(["complete", "partial"]),
+        unparsed_images: z.array(z.string()),
+        roots_without_architecture: z.array(z.string()),
+    }),
+    limitations: z.array(z.string().min(1)),
+});
+const candidateTemplates = (dependency, loader, context) => {
+    const name = dependency.install_name;
+    if (!name.startsWith("@rpath/")) {
+        const source = name.startsWith("@executable_path")
+            ? "executable_path"
+            : name.startsWith("@loader_path")
+                ? "loader_path"
+                : "literal";
+        return [
+            {
+                expansion: expandPrefix(name, {
+                    ownerDirectory: directoryOf(loader),
+                    executable: context.executable,
+                }),
+                source,
+                rpath: null,
+                rpathOwner: null,
+            },
+        ];
+    }
+    const rest = name.slice("@rpath/".length);
+    const owners = [...(context.loaded.get(loader)?.chain ?? [loader])].reverse();
+    return owners.flatMap((owner) => (context.loaded.get(owner)?.slice.rpaths ?? []).map((rpath) => {
+        const base = expandPrefix(rpath, {
+            ownerDirectory: directoryOf(owner),
+            executable: context.executable,
+        });
+        const expansion = {
+            scope: base.scope,
+            path: base.scope === "outside"
+                ? `${base.path.replace(/\/+$/u, "")}/${rest}`
+                : joinPath(base.path, rest),
+        };
+        return { expansion, source: "rpath", rpath, rpathOwner: owner };
+    }));
+};
+const evaluateCandidate = async (template, context) => {
+    const base = {
+        path: template.expansion.path,
+        source: template.source,
+        rpath: template.rpath,
+        rpath_owner: template.rpathOwner,
+    };
+    if (template.expansion.scope === "outside")
+        return { ...base, outcome: "outside-target", resolved_path: null };
+    if (template.expansion.scope === "undetermined")
+        return { ...base, outcome: "undetermined", resolved_path: null };
+    const lookup = await resolveTreePath(context.view, template.expansion.path);
+    if (lookup.kind === "escapes")
+        return { ...base, outcome: "escapes-target", resolved_path: null };
+    if (lookup.kind !== "file")
+        return { ...base, outcome: "absent", resolved_path: null };
+    const facts = await imageFacts(context, lookup.path);
+    const outcome = facts.status !== "parsed"
+        ? facts.status
+        : compatibleSlice(facts.slices, context.architecture) === undefined
+            ? "architecture-missing"
+            : "resolved";
+    return { ...base, outcome, resolved_path: lookup.path };
+};
+const imageFacts = async (context, path) => {
+    const known = context.images.get(path);
+    if (known !== undefined)
+        return known;
+    const facts = await context.view.image(path);
+    context.images.set(path, facts);
+    return facts;
+};
+const resolution = (candidates) => {
+    let external = false;
+    for (const candidate of candidates) {
+        if (candidate.outcome === "resolved")
+            return {
+                status: external ? "conditional" : "resolved",
+                image: candidate.resolved_path,
+            };
+        // dyld might load these; REA cannot decide them from the analyzed root.
+        if (candidate.outcome === "outside-target" ||
+            candidate.outcome === "escapes-target" ||
+            candidate.outcome === "unsupported" ||
+            candidate.outcome === "undetermined")
+            external = true;
+    }
+    return { status: external ? "undetermined" : "unresolved", image: null };
+};
+const resolveDependency = async (dependency, loader, context) => {
+    const current = context.loaded.get(loader);
+    const chain = current?.chain ?? [loader];
+    const loaded = context.byInstallName.get(dependency.install_name);
+    const candidates = [];
+    if (loaded !== undefined)
+        candidates.push({
+            path: dependency.install_name,
+            source: "already-loaded",
+            rpath: null,
+            rpath_owner: null,
+            outcome: "resolved",
+            resolved_path: loaded,
+        });
+    else
+        for (const template of candidateTemplates(dependency, loader, context)) {
+            const candidate = await evaluateCandidate(template, context);
+            candidates.push(candidate);
+            // dyld stops at the first loadable candidate.
+            if (candidate.outcome === "resolved")
+                break;
+        }
+    const searched = resolution(candidates);
+    // Reusing an image that itself loads only conditionally is conditional too.
+    const resolved = loaded !== undefined &&
+        context.loaded.get(loaded)?.conditional === true &&
+        searched.status === "resolved"
+        ? { ...searched, status: "conditional" }
+        : searched;
+    const image = resolved.image === null ? undefined : context.images.get(resolved.image);
+    const slice = image?.status === "parsed"
+        ? compatibleSlice(image.slices, context.architecture)
+        : undefined;
+    return {
+        root: context.root,
+        architecture: context.architecture,
+        loader,
+        via: [...chain],
+        ...dependency,
+        candidates,
+        resolution: resolved,
+        install_name_matches: slice === undefined || slice.install_name === null
+            ? null
+            : slice.install_name === dependency.install_name,
+        loader_conditional: current?.conditional ?? false,
+    };
+};
+/**
+ * Follow dyld4's dependents-first order: resolve every dependency of one
+ * image, then recurse into the images it newly loaded, in load-command order.
+ */
+const traceProcess = async (context, rootSlice, signal) => {
+    const edges = [];
+    context.loaded.set(context.root, {
+        slice: rootSlice,
+        chain: [context.root],
+        conditional: false,
+    });
+    if (rootSlice.install_name !== null)
+        context.byInstallName.set(rootSlice.install_name, context.root);
+    const pending = [context.root];
+    while (pending.length > 0) {
+        signal?.throwIfAborted();
+        const loader = pending.pop() ?? "";
+        const current = context.loaded.get(loader);
+        if (current === undefined)
+            continue;
+        const created = [];
+        for (const dependency of current.slice.dependencies) {
+            const edge = await resolveDependency(dependency, loader, context);
+            edges.push(edge);
+            // dyld loads LC_LAZY_LOAD_DYLIB images on first use, not at launch.
+            if (dependency.command === "LC_LAZY_LOAD_DYLIB")
+                continue;
+            const image = edge.resolution.image;
+            if (image === null || context.loaded.has(image))
+                continue;
+            const facts = context.images.get(image);
+            const slice = facts?.status === "parsed"
+                ? compatibleSlice(facts.slices, context.architecture)
+                : undefined;
+            if (slice === undefined)
+                continue;
+            context.loaded.set(image, {
+                slice,
+                chain: [...current.chain, image],
+                // dyld may load an unknown earlier candidate instead of this fallback.
+                conditional: current.conditional || edge.resolution.status === "conditional",
+            });
+            if (slice.install_name !== null &&
+                !context.byInstallName.has(slice.install_name))
+                context.byInstallName.set(slice.install_name, image);
+            created.push(image);
+        }
+        pending.push(...created.reverse());
+    }
+    return edges;
+};
+/** Trace dyld load paths from each process root through the analyzed root. */
+export const traceDylibLoading = async (view, request) => {
+    const images = new Map();
+    for (const path of request.unclassified ?? [])
+        images.set(path, await view.image(path));
+    const roots = [];
+    const edges = [];
+    const withoutArchitecture = [];
+    for (const root of request.roots) {
+        const facts = await view.image(root);
+        images.set(root, facts);
+        if (facts.status !== "parsed")
+            continue;
+        const slices = facts.slices.filter(({ architecture }) => request.architecture === undefined ||
+            architecture === request.architecture);
+        if (slices.length === 0)
+            withoutArchitecture.push(root);
+        for (const slice of slices) {
+            roots.push({ image: root, architecture: slice.architecture });
+            edges.push(...(await traceProcess({
+                view,
+                root,
+                architecture: slice.architecture,
+                executable: slice.file_type === "execute" ? root : null,
+                loaded: new Map(),
+                byInstallName: new Map(),
+                images,
+            }, slice, request.signal)));
+        }
+    }
+    const reported = [...images.entries()]
+        .filter(([, facts]) => facts.status !== "not-mach-o")
+        .sort(([left], [right]) => compare(left, right));
+    const unparsed = reported
+        .filter(([, facts]) => facts.status !== "parsed")
+        .map(([path]) => path);
+    return {
+        roots,
+        images: reported.map(([path, facts]) => ({
+            path,
+            parse_status: facts.status === "not-mach-o" ? "unsupported" : facts.status,
+            reason: facts.status === "parsed" || facts.status === "not-mach-o"
+                ? null
+                : facts.reason,
+            slices: facts.status === "parsed" ? facts.slices.map(withoutDependencies) : [],
+        })),
+        edges,
+        findings: deriveFindings(edges, roots, images),
+        coverage: {
+            status: unparsed.length === 0 && withoutArchitecture.length === 0
+                ? "complete"
+                : "partial",
+            unparsed_images: unparsed,
+            roots_without_architecture: withoutArchitecture,
+        },
+        limitations: DYLIB_RESOLUTION_LIMITATIONS,
+    };
+};
+const withoutDependencies = (slice) => ({
+    architecture: slice.architecture,
+    file_type: slice.file_type,
+    install_name: slice.install_name,
+    rpaths: slice.rpaths,
+    dyld_environment: slice.dyld_environment,
+    code_signature_present: slice.code_signature_present,
+});
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;