rea-agents 5.0.0 → 6.0.0

package/dist/application/javascript/JavaScriptSemanticGraphObjectProjection.js

@@ -1,5 +1,5 @@
 import { createJavaScriptSemanticGraphUnknown } from "../../domain/javascript/javascriptSemanticGraph.js";
-import { addSemanticGraphNode, addSemanticGraphRelation, addSemanticGraphUnknown, constructSemanticGraphNode, } from "./JavaScriptSemanticGraphConstruction.js";
+import { retainSemanticGraphNode, addSemanticGraphRelation, addSemanticGraphUnknown, } from "./JavaScriptSemanticGraphConstruction.js";
 import { unknownSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
 import { semanticPropertySlot } from "./JavaScriptSemanticGraphValueProjection.js";
 /** Project static object reads, writes, spreads, and destructuring. */
@@ -45,7 +45,7 @@ export const projectSemanticObjects = (context) => {
             addObjectUnknown(context, operation, slot ?? occurrence);
     }
 };
-const addObjectOccurrence = (context, operation) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+const addObjectOccurrence = (context, operation) => retainSemanticGraphNode(context.state, context.file, {
     kind: "expression",
     roleKey: operation.objectOperationId,
     location: operation.location,
@@ -60,7 +60,7 @@ const addObjectOccurrence = (context, operation) => addSemanticGraphNode(context
         operation_kind: operation.kind,
         property_name: operation.propertyName,
     },
-}, context.state));
+});
 const addObjectUnknown = (context, operation, node) => {
     const relation = operation.kind === "read"
         ? "reads-property"

package/dist/application/javascript/JavaScriptSemanticGraphProjection.js

@@ -1,18 +1,124 @@
 import { compareCodePoints } from "../../domain/canonicalOrdering.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
-/** Find the innermost callable that contains one exact source range. */
-export const owningSemanticCallableNode = (location, ir, nodes) => {
-    if (location === null)
-        return undefined;
-    return ir.callables
-        .filter((callable) => contains(callable.location, location))
-        .sort((left, right) => compareCodePoints(positionKey(right.location), positionKey(left.location)))
-        .map(({ callableId }) => nodes.get(callableId))
-        .find((node) => node !== undefined);
+/** Index one immutable file IR; read retained callable membership at query time. */
+export const createSemanticCallableOwnerLookup = (ir, nodes) => {
+    const entries = ir.callables
+        .map((callable, order) => ({
+        callableId: callable.callableId,
+        range: callable.location,
+        order,
+        priority: positionKey(callable.location),
+    }))
+        .sort((left, right) => pointCompare(left.range.start, right.range.start) ||
+        left.order - right.order);
+    const tree = buildSourceIntervalTree(entries, 0, entries.length);
+    return (location) => {
+        if (location === null || tree === null || nodes.size === 0)
+            return undefined;
+        const pending = [tree];
+        let best;
+        let result;
+        while (pending.length > 0) {
+            const current = pending.pop();
+            if (current === undefined ||
+                pointCompare(current.minimumStart, location.start) > 0 ||
+                pointCompare(current.maximumEnd, location.end) < 0)
+                continue;
+            const candidate = current.entry;
+            if (contains(candidate.range, location)) {
+                const node = nodes.get(candidate.callableId);
+                const rank = best === undefined
+                    ? 1
+                    : compareCodePoints(candidate.priority, best.priority) ||
+                        best.order - candidate.order;
+                if (node !== undefined && rank > 0) {
+                    best = candidate;
+                    result = node;
+                }
+            }
+            if (current.left !== null)
+                pending.push(current.left);
+            if (current.right !== null)
+                pending.push(current.right);
+        }
+        return result;
+    };
 };
-/** Find retained semantic nodes whose exact ranges are within one expression. */
-export const semanticNodesWithinRange = (nodes, range) => nodes.filter((node) => node.identity.source_range !== null &&
-    contains(range, node.identity.source_range));
+const buildSourceIntervalTree = (entries, start, end) => {
+    if (start >= end)
+        return null;
+    const middle = Math.floor((start + end) / 2);
+    const entry = entries[middle];
+    if (entry === undefined)
+        return null;
+    // This recursion follows a balanced index, not the producer's nesting depth.
+    const left = buildSourceIntervalTree(entries, start, middle);
+    const right = buildSourceIntervalTree(entries, middle + 1, end);
+    let minimumEnd = entry.range.end;
+    let maximumEnd = entry.range.end;
+    for (const child of [left, right]) {
+        if (child !== null && pointCompare(child.minimumEnd, minimumEnd) < 0)
+            minimumEnd = child.minimumEnd;
+        if (child !== null && pointCompare(child.maximumEnd, maximumEnd) > 0)
+            maximumEnd = child.maximumEnd;
+    }
+    return {
+        entry,
+        minimumStart: left?.minimumStart ?? entry.range.start,
+        maximumStart: right?.maximumStart ?? entry.range.start,
+        minimumEnd,
+        maximumEnd,
+        left,
+        right,
+    };
+};
+/** Index an immutable node list; return contained ranges in producer order. */
+export const createSemanticNodeRangeLookup = (nodes) => {
+    const entries = nodes
+        .flatMap((node, order) => {
+        const range = node.identity.source_range;
+        return range === null ? [] : [{ node, range, order }];
+    })
+        .sort((left, right) => pointCompare(left.range.start, right.range.start) ||
+        left.order - right.order);
+    const tree = buildSourceIntervalTree(entries, 0, entries.length);
+    return (range) => {
+        if (tree === null)
+            return [];
+        const pending = [tree];
+        const matches = [];
+        while (pending.length > 0) {
+            const current = pending.pop();
+            if (current === undefined ||
+                pointCompare(current.maximumStart, range.start) < 0 ||
+                pointCompare(current.minimumEnd, range.end) > 0)
+                continue;
+            if (contains(range, current.entry.range))
+                matches.push(current.entry);
+            if (current.left !== null)
+                pending.push(current.left);
+            if (current.right !== null)
+                pending.push(current.right);
+        }
+        return matches
+            .sort((left, right) => left.order - right.order)
+            .map(({ node }) => node);
+    };
+};
+/** Index exact call ranges, preserving the first producer occurrence. */
+export const createSemanticCallSiteLookup = (ir, nodes) => {
+    const identifiers = new Map();
+    for (const call of ir.callSites) {
+        const key = rangeKey(call.location);
+        if (!identifiers.has(key))
+            identifiers.set(key, call.callSiteId);
+    }
+    return (range) => {
+        const identifier = identifiers.get(rangeKey(range));
+        return identifier === undefined ? undefined : nodes.get(identifier);
+    };
+};
+const rangeKey = (range) => `${range.start.line}:${range.start.column}-${range.end.line}:${range.end.column}`;
 /** Report extractor support without treating missing families as absence. */
 export const semanticFamilyStatus = (family, analysis) => {
     if (![

package/dist/application/javascript/JavaScriptSemanticGraphResourceProjection.js

@@ -1,5 +1,5 @@
 import { createJavaScriptSemanticGraphUnknown } from "../../domain/javascript/javascriptSemanticGraph.js";
-import { addSemanticGraphNode, addSemanticGraphRelation, addSemanticGraphUnknown, constructSemanticGraphNode, } from "./JavaScriptSemanticGraphConstruction.js";
+import { retainSemanticGraphNode, addSemanticGraphRelation, addSemanticGraphUnknown, } from "./JavaScriptSemanticGraphConstruction.js";
 import { unknownSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
 import { semanticCallSiteAt, } from "./JavaScriptSemanticGraphFlowProjection.js";
 /** Project built-in resource acquisition and exact local release handles. */
@@ -21,7 +21,7 @@ export const projectSemanticResources = (context) => {
         else
             projectRelease(context, operation, resourceNodes);
 };
-const addResourceNode = (context, operation) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+const addResourceNode = (context, operation) => retainSemanticGraphNode(context.state, context.file, {
     kind: "resource",
     roleKey: operation.resourceId,
     location: operation.location,
@@ -31,7 +31,7 @@ const addResourceNode = (context, operation) => addSemanticGraphNode(context.sta
         : (context.callableNodes.get(operation.ownerCallableId)?.node_id ??
             null),
     properties: { method: operation.method },
-}, context.state));
+});
 const projectRelease = (context, operation, resourceNodes) => {
     const callSite = semanticCallSiteAt(context, operation.location);
     const resources = operation.linkedResourceIds.flatMap((identifier) => {

package/dist/application/javascript/JavaScriptSemanticGraphValueProjection.js

@@ -1,4 +1,4 @@
-import { addSemanticGraphNode, addSemanticGraphRelation, constructSemanticGraphNode, } from "./JavaScriptSemanticGraphConstruction.js";
+import { retainSemanticGraphNode, addSemanticGraphRelation, } from "./JavaScriptSemanticGraphConstruction.js";
 /** Project bounded literal values and object slots for exact query seeds. */
 export const projectSemanticValues = (context) => {
     for (const binding of context.ir.bindings) {
@@ -55,16 +55,16 @@ const projectValue = (input) => {
             });
         }
 };
-const addLiteralNode = (context, binding, value, role) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+const addLiteralNode = (context, binding, value, role) => retainSemanticGraphNode(context.state, context.file, {
     kind: "literal",
     roleKey: `literal:${binding.bindingId}:${role}:${JSON.stringify(value)}`,
     location: binding.definitions[0]?.location ?? null,
     label: JSON.stringify(value),
     functionNodeId: context.bindingNodes.get(binding.bindingId)?.function_node_id ?? null,
     properties: { value },
-}, context.state));
+});
 /** Create one canonical property slot for a binding/property identity. */
-export const semanticPropertySlot = (context, objectBindingId, name) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+export const semanticPropertySlot = (context, objectBindingId, name) => retainSemanticGraphNode(context.state, context.file, {
     kind: "property-slot",
     roleKey: `property:${objectBindingId}:${name}`,
     location: null,
@@ -74,4 +74,4 @@ export const semanticPropertySlot = (context, objectBindingId, name) => addSeman
         name,
         object_binding_id: objectBindingId,
     },
-}, context.state));
+});

package/dist/application/{ProcessCli.js → process/ProcessCli.js}

@@ -1,14 +1,14 @@
 import { readFile } from "node:fs/promises";
-import { AnalysisError } from "../domain/analysisErrorBase.js";
-import { AnalysisInputError } from "../domain/analysisErrorCore.js";
-import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
-import { createEvidence, parseEvidence } from "../domain/evidence.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
-import { projectInputIssues } from "../domain/inputIssueProjection.js";
-import { processTraceSpecificationSchema } from "../domain/processTraceComparison.js";
-import { processScenarioSchema } from "../domain/processScenario.js";
-import { compareProcessCaptures, parseProcessCapture, } from "../domain/processCapture.js";
-import { captureProcessScenario } from "./ProcessHarness.js";
+import { AnalysisError } from "../../domain/analysisErrorBase.js";
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
+import { createEvidence, parseEvidence } from "../../domain/evidence.js";
+import { jsonValueSchema } from "../../domain/jsonValue.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { processTraceSpecificationSchema } from "../../domain/process/processTraceComparison.js";
+import { processScenarioSchema } from "../../domain/process/processScenario.js";
+import { compareProcessCaptures, parseProcessCapture, } from "../../domain/process/processCapture.js";
+import { captureProcessScenario } from "../../process/capture/ProcessHarness.js";
 import { PROCESS_PROVIDER, createProcessCaptureEvidence, } from "./ProcessEvidence.js";
 /** Identify the process workflow's typed diagnostic result for CLI exit status. */
 export const isProcessCliFailure = (value) => typeof value === "object" &&

package/dist/application/{ProcessEvidence.js → process/ProcessEvidence.js}

@@ -1,7 +1,7 @@
-import { createEvidence } from "../domain/evidence.js";
-import { PROCESS_PROVIDER } from "../domain/processEvidenceProvider.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
-export { PROCESS_PROVIDER } from "../domain/processEvidenceProvider.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { PROCESS_PROVIDER } from "../../domain/process/processEvidenceProvider.js";
+import { jsonValueSchema } from "../../domain/jsonValue.js";
+export { PROCESS_PROVIDER } from "../../domain/process/processEvidenceProvider.js";
 /** Project one process scenario into secret-free Evidence parameters. */
 const processEvidenceParameters = (scenario) => ({
     executable_name: scenario.executable.split("/").at(-1) ?? scenario.executable,

package/dist/artifacts/ArtifactProvider.js

@@ -1,8 +1,9 @@
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { inspectBundleKeyedArchive } from "./apple/KeyedArchiveReader.js";
+import { traceDylibResolution } from "./apple/DylibResolutionReader.js";
 import { basename, dirname } from "node:path";
-import { inventoryArtifact } from "../application/ArtifactInventory.js";
-import { extractArtifact } from "../application/ArtifactExtraction.js";
+import { inventoryArtifact } from "./inventory/ArtifactInventory.js";
+import { extractArtifact } from "./extraction/ArtifactExtraction.js";
 import { analyzeInterfaceBuilderBundle } from "./apple/InterfaceBuilderAnalysis.js";
 import { analyzeAppleAssetCatalogs } from "./apple/AppleAssetCatalogAnalysis.js";
 import { ARTIFACT_ANALYSIS_OPERATIONS, artifactInventoryInputSchema, artifactExtractionExecutionSchema, } from "../contracts/artifactToolContracts.js";
@@ -15,7 +16,7 @@ import { ArtifactReaderFailure } from "./ArtifactReader.js";
 import { ARTIFACT_PROVIDER_IDENTITY as IDENTITY, artifactCapabilities, } from "./ArtifactProviderMetadata.js";
 import { createEvidence } from "../domain/evidence.js";
 import { createArtifactInspection } from "../domain/artifactInspection.js";
-import { resolveArtifactIntegrityPolicy } from "../application/ArtifactInventory/policy.js";
+import { resolveArtifactIntegrityPolicy } from "./inventory/policy.js";
 /** Read-only inventory and exclusively owned extraction provider. */
 export class ArtifactProvider {
     #capabilities;
@@ -98,6 +99,8 @@ class ArtifactClient {
             if (operation === "inspect_asset_catalog") {
                 return await this.inspectAssetCatalog(parameters, options);
             }
+            if (operation === "trace_dylib_resolution")
+                return await this.traceDylibResolution(parameters, options);
             if (operation === "extract_artifact") {
                 const parsed = artifactExtractionExecutionSchema.parse(parameters);
                 const result = await extractArtifact({
@@ -154,6 +157,30 @@ class ArtifactClient {
             })),
         }));
     }
+    async traceDylibResolution(parameters, options) {
+        if (this.target.kind !== "executable" || this.target.format !== "mach-o")
+            throw new ArtifactReaderFailure("unavailable", "trace_dylib_resolution requires an active Mach-O or .app bundle target");
+        // Only a target opened from an app bundle directory carries its Info.plist;
+        // a regular file whose name ends in .app is a standalone image.
+        const bundle = this.target.bundleInfoPlist === undefined
+            ? undefined
+            : this.target.sourcePath;
+        const result = await traceDylibResolution({
+            rootPath: bundle ?? dirname(this.target.path),
+            targetPath: this.target.path,
+            targetSha256: this.target.sha256,
+            enumerateRoots: bundle !== undefined,
+            parameters,
+            ...(options?.signal === undefined ? {} : { signal: options.signal }),
+        });
+        return ok(createAnalysisExecution(result, IDENTITY, {
+            limitations: result.limitations,
+            locations: result.images.map(({ path }) => ({
+                kind: "artifact-path",
+                path,
+            })),
+        }));
+    }
     async inspectArtifact(parameters, options) {
         const parsed = artifactInventoryInputSchema.parse(parameters);
         const inventoryParameters = {

package/dist/artifacts/ArtifactProviderMetadata.js

@@ -11,7 +11,8 @@ export const artifactCapabilities = (platform = process.platform) => Object.free
         effects: Object.freeze({
             mutatesArtifact: false,
             launchesProcess: operation !== "decode_interface_builder" &&
-                operation !== "inspect_keyed_archive",
+                operation !== "inspect_keyed_archive" &&
+                operation !== "trace_dylib_resolution",
             mayShowUi: false,
             mayAccessNetwork: false,
             mayWriteFilesystem: operation === "extract_artifact" ||

package/dist/artifacts/ZipArtifactReader.js

@@ -39,6 +39,9 @@ export class ZipArtifactReader {
         this.#reader = new ZipReader(this.#source, {
             checkSignature: true,
             checkOverlappingEntry: true,
+            // REA applies its own provider-neutral path validation in scanReader and
+            // must preserve that typed failure instead of zip.js rejecting first.
+            filenameValidation: "tolerant",
         });
     }
     async *entries(signal) {

package/dist/artifacts/apple/DylibResolutionReader.js

@@ -0,0 +1,259 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readlink, realpath } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { resolveTreePath } from "../../domain/apple/dyldPaths.js";
+import { dylibResolutionInputSchema, dylibResolutionResultSchema, traceDylibLoading, } from "../../domain/apple/dylibResolution.js";
+import { ArtifactReaderFailure } from "../ArtifactReader.js";
+import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
+import { hasMachoMagic, readMachoImage } from "./MachoLoadCommandReader.js";
+const HASH_CHUNK_BYTES = 1024 * 1024;
+/** Lazily probed, symlink-preserving view of one analyzed directory. */
+class FilesystemTreeView {
+    root;
+    signal;
+    #entries = new Map();
+    #images = new Map();
+    #identities = new Map();
+    constructor(root, signal) {
+        this.root = root;
+        this.signal = signal;
+    }
+    entry(path) {
+        const cached = this.#entries.get(path);
+        if (cached !== undefined)
+            return cached;
+        const pending = this.#readEntry(path);
+        this.#entries.set(path, pending);
+        return pending;
+    }
+    image(path) {
+        const cached = this.#images.get(path);
+        if (cached !== undefined)
+            return cached;
+        const pending = readImage(join(this.root, path), this.signal).then(({ facts, identity }) => {
+            this.#identities.set(path, identity);
+            return facts;
+        });
+        this.#images.set(path, pending);
+        return pending;
+    }
+    /** Identity of the file whose header bytes `image()` parsed. */
+    identity(path) {
+        return this.#identities.get(path);
+    }
+    async #readEntry(path) {
+        cancelled(this.signal);
+        const absolute = join(this.root, path);
+        try {
+            const metadata = await lstat(absolute);
+            if (metadata.isSymbolicLink())
+                return { kind: "symlink", target: await readlink(absolute) };
+            if (metadata.isDirectory())
+                return { kind: "directory" };
+            return metadata.isFile() ? { kind: "file" } : undefined;
+        }
+        catch (cause) {
+            if (missing(cause))
+                return undefined;
+            throw cause;
+        }
+    }
+}
+/** Resolve dyld load paths for the active Mach-O or every executable in its bundle. */
+export const traceDylibResolution = async (options) => {
+    const parsed = dylibResolutionInputSchema.safeParse(options.parameters);
+    if (!parsed.success)
+        throw new ArtifactReaderFailure("path", "roots must be normalized paths relative to the analyzed root");
+    // Canonicalization is inside the translated region: a revoked permission
+    // keeps its reason and path.
+    let root = options.rootPath;
+    try {
+        root = await realpath(options.rootPath);
+        const target = relative(root, await realpath(options.targetPath))
+            .split(sep)
+            .join("/");
+        const view = new FilesystemTreeView(root, options.signal);
+        const { roots: requested, unclassified } = parsed.data.roots !== undefined
+            ? { roots: parsed.data.roots, unclassified: [] }
+            : options.enumerateRoots
+                ? await executableRoots(root, view, options.signal)
+                : { roots: [target], unclassified: [] };
+        const roots = await requireMachoRoots(view, requested);
+        const trace = await traceDylibLoading(view, {
+            roots,
+            unclassified,
+            ...(parsed.data.architecture === undefined
+                ? {}
+                : { architecture: parsed.data.architecture }),
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+        // Each digest must describe the same file whose headers were parsed.
+        const digests = new Map();
+        for (const { path } of trace.images)
+            digests.set(path, await fileSha256(join(root, path), {
+                path,
+                expected: view.identity(path),
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
+            }));
+        const targetDigest = digests.get(target) ??
+            (await fileSha256(join(root, target), {
+                path: target,
+                expected: undefined,
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
+            }));
+        if (targetDigest !== options.targetSha256)
+            throw new ArtifactReaderFailure("integrity", `Active target digest changed: expected ${options.targetSha256}, observed ${targetDigest}`);
+        return dylibResolutionResultSchema.parse({
+            ...trace,
+            root_path: options.rootPath,
+            target_sha256: options.targetSha256,
+            images: trace.images.map((image) => ({
+                ...image,
+                sha256: digests.get(image.path),
+            })),
+        });
+    }
+    catch (cause) {
+        if (options.signal?.aborted === true)
+            throw new ArtifactReaderFailure("cancelled", "Dylib resolution was cancelled", { cause });
+        const denied = permissionDenied(cause);
+        if (denied !== undefined)
+            throw new ArtifactReaderFailure("unavailable", `Permission denied (${denied.code}) reading ${deniedPath(root, denied.path)}`, { cause });
+        throw cause;
+    }
+};
+/**
+ * Every Mach-O in the bundle with an executable slice is its own process root.
+ * Mach-O files that do not parse are returned separately: whether they are
+ * executables is unknown, so they make coverage partial instead of vanishing.
+ */
+const executableRoots = async (root, view, signal) => {
+    const roots = [];
+    const unclassified = [];
+    for await (const entry of new DirectoryArtifactReader(root).entries(signal)) {
+        if (entry.kind !== "file" ||
+            !(await startsWithMachoMagic(entry.adapterKey)))
+            continue;
+        const facts = await view.image(entry.path);
+        if (facts.status === "malformed" || facts.status === "unsupported")
+            unclassified.push(entry.path);
+        else if (facts.status === "parsed" &&
+            facts.slices.some(({ file_type: type }) => type === "execute"))
+            roots.push(entry.path);
+    }
+    return {
+        roots: roots.sort(compare),
+        unclassified: unclassified.sort(compare),
+    };
+};
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+/**
+ * Resolve each root segment by segment, as dependency candidates are, so a
+ * symlink in an intermediate directory cannot lead outside the analyzed root.
+ */
+const requireMachoRoots = async (view, roots) => {
+    const resolved = [];
+    for (const path of roots) {
+        const lookup = await resolveTreePath(view, path);
+        if (lookup.kind === "escapes")
+            throw new ArtifactReaderFailure("path", `Root ${path} resolves outside the analyzed root`);
+        if (lookup.kind !== "file")
+            throw new ArtifactReaderFailure("path", `Root ${path} is not a regular file in the analyzed root`);
+        if ((await view.image(lookup.path)).status === "not-mach-o")
+            throw new ArtifactReaderFailure("format", `Root ${path} is not a Mach-O image`);
+        if (!resolved.includes(lookup.path))
+            resolved.push(lookup.path);
+    }
+    return resolved;
+};
+const startsWithMachoMagic = async (path) => {
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const buffer = new Uint8Array(4);
+        const { bytesRead } = await handle.read(buffer, 0, 4, 0);
+        return hasMachoMagic(buffer.subarray(0, bytesRead));
+    }
+    finally {
+        await handle.close();
+    }
+};
+const identityOf = (metadata) => [
+    metadata.dev,
+    metadata.ino,
+    metadata.size,
+    metadata.mtimeNs,
+    metadata.ctimeNs,
+].join(":");
+const readImage = async (path, signal) => {
+    cancelled(signal);
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const metadata = await handle.stat({ bigint: true });
+        const size = Number(metadata.size);
+        const facts = await readMachoImage(async (offset, length) => {
+            cancelled(signal);
+            const buffer = new Uint8Array(Math.max(0, Math.min(length, size - offset)));
+            const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
+            return buffer.subarray(0, bytesRead);
+        }, size);
+        return { facts, identity: identityOf(metadata) };
+    }
+    finally {
+        await handle.close();
+    }
+};
+/** Hash a file, failing if it is not the file (or the version) that was parsed. */
+const fileSha256 = async (absolute, options) => {
+    const { signal } = options;
+    const handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const unchanged = async () => {
+        if (options.expected !== undefined &&
+            identityOf(await handle.stat({ bigint: true })) !== options.expected)
+            throw new ArtifactReaderFailure("integrity", `${options.path} changed while its dyld load commands were traced`);
+    };
+    try {
+        await unchanged();
+        const hash = createHash("sha256");
+        const buffer = new Uint8Array(HASH_CHUNK_BYTES);
+        for (;;) {
+            cancelled(signal);
+            const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+            if (bytesRead === 0)
+                break;
+            hash.update(buffer.subarray(0, bytesRead));
+        }
+        await unchanged();
+        return hash.digest("hex");
+    }
+    finally {
+        await handle.close();
+    }
+};
+const cancelled = (signal) => {
+    if (signal?.aborted === true)
+        throw new ArtifactReaderFailure("cancelled", "Dylib resolution was cancelled");
+};
+/** A denied path relative to the analyzed root, or absolute when outside it. */
+const deniedPath = (root, path) => {
+    if (path === undefined)
+        return "a file in the analyzed root";
+    const inside = relative(root, path);
+    return inside === "" || inside.startsWith("..") ? path : inside;
+};
+/** Host permission denials, kept distinct from malformed or missing files. */
+const permissionDenied = (cause) => {
+    if (!(cause instanceof Error) || !("code" in cause))
+        return undefined;
+    if (cause.code !== "EACCES" && cause.code !== "EPERM")
+        return undefined;
+    return {
+        code: cause.code,
+        path: "path" in cause && typeof cause.path === "string"
+            ? cause.path
+            : undefined,
+    };
+};
+const missing = (cause) => cause instanceof Error &&
+    "code" in cause &&
+    (cause.code === "ENOENT" || cause.code === "ENOTDIR");