rea-agents 5.0.0 → 6.1.0

package/dist/domain/analysisSnapshot.js

@@ -77,11 +77,26 @@ const entrySchema = z.object({
         subject: subjectSchema.nullable(),
     }),
 });
+const workflowEntrySchema = z.object({
+    query_id: prefixedDigestSchema("query"),
+    operation: z.string().min(1),
+    parameters: jsonObjectSchema,
+    execution: z.object({
+        result: jsonValueSchema,
+        raw_result: jsonValueSchema.nullable(),
+        provider: committedProviderSchema,
+        analysis_profile: analysisProfileSchema,
+        limitations: z.array(z.string()),
+        locations: z.array(evidenceLocationSchema),
+        subject: subjectSchema.nullable(),
+    }),
+});
 /** Provider- and profile-exact cache of successful immutable analysis calls. */
 export const analysisSnapshotSchema = z.object({
     target: targetSchema,
     binding: bindingSchema,
     entries: z.array(entrySchema),
+    workflow_entries: z.array(workflowEntrySchema).optional(),
     evidence_bundle: evidenceBundleSchema,
 });
 const canonicalJson = (value) => {
@@ -122,6 +137,11 @@ export const snapshotEvidenceForQuery = (snapshot, query) => {
     if (!snapshotMatchesBinding(snapshot, target, bindingProfile))
         return undefined;
     const encodedParameters = canonicalJson(parameters);
+    const queryId = analysisQueryId(snapshot.target, snapshot.binding, operation, parameters);
+    const entry = snapshot.entries.find((candidate) => candidate.query_id === queryId);
+    const workflowEntry = snapshot.workflow_entries?.find((candidate) => candidate.query_id === queryId);
+    if (entry === undefined && workflowEntry === undefined)
+        return undefined;
     return snapshot.evidence_bundle.records.find((record) => record.subject?.digest.sha256 === target.sha256 &&
         record.operation === operation &&
         record.provider.id === provider.id &&
@@ -129,8 +149,54 @@ export const snapshotEvidenceForQuery = (snapshot, query) => {
         record.provider.version === provider.version &&
         "analysis_profile" in record &&
         analysisProfilesEqual(record.analysis_profile, evidenceProfile) &&
-        canonicalJson(record.parameters) === encodedParameters);
+        canonicalJson(record.parameters) === encodedParameters &&
+        ((entry !== undefined && evidenceMatchesEntry(record, entry, snapshot)) ||
+            (workflowEntry !== undefined &&
+                evidenceMatchesWorkflowEntry(record, workflowEntry, snapshot))));
+};
+/** Create one exact replay record for a derived application workflow result. */
+export const createAnalysisSnapshotWorkflowEntry = (input) => {
+    const { target, binding, operation, parameters, execution } = input;
+    if (execution.provider.id !== execution.analysisProfile.provider.id ||
+        execution.provider.name !== execution.analysisProfile.provider.name ||
+        execution.provider.version !== execution.analysisProfile.provider.version)
+        throw new TypeError("Workflow snapshot execution provider does not match its profile");
+    return {
+        query_id: analysisQueryId(target, binding, operation, parameters),
+        operation,
+        parameters: jsonObjectSchema.parse(parameters),
+        execution: {
+            result: execution.result,
+            raw_result: execution.rawResult,
+            provider: execution.analysisProfile.provider,
+            analysis_profile: execution.analysisProfile,
+            limitations: [...execution.limitations],
+            locations: [...execution.locations],
+            subject: execution.subject === null
+                ? null
+                : {
+                    ...execution.subject,
+                    architecture: execution.subject.architecture ?? null,
+                },
+        },
+    };
 };
+const evidenceMatchesEntry = (evidence, entry, snapshot) => isCorrespondingEvidence(evidence, snapshot) &&
+    canonicalJson({
+        query: evidenceQueryKey(evidence),
+        normalized_result: evidence.normalized_result,
+        raw_result: evidence.raw_result,
+        limitations: evidence.limitations,
+        locations: evidence.locations,
+        subject: evidence.subject === null
+            ? null
+            : {
+                local_path: evidence.subject.local_path,
+                sha256: evidence.subject.digest.sha256,
+                format: evidence.subject.format,
+                architecture: evidence.subject.architecture,
+            },
+    }) === entryEvidenceKey(entry, snapshot.binding);
 /** Compute the stable lookup key for one provider/profile-specific query. */
 export const analysisQueryId = (target, binding, operation, parameters) => `query_${createHash("sha256")
     .update(canonicalJson({ target, binding, operation, parameters }))
@@ -171,7 +237,9 @@ export const parseAnalysisSnapshot = (input) => {
         throw new TypeError("Analysis snapshot evidence contains records for another target");
     const ids = new Set();
     const boundEntries = [];
+    const boundWorkflowEntries = [];
     const index = createEvidenceIndex(parsed);
+    const workflowIndex = createWorkflowEvidenceIndex(parsed);
     for (const entry of parsed.entries) {
         if (entry.execution.provider.id !== parsed.binding.provider.id ||
             entry.execution.provider.name !== parsed.binding.provider.name ||
@@ -192,10 +260,41 @@ export const parseAnalysisSnapshot = (input) => {
         }
         boundEntries.push(entry);
     }
+    for (const entry of parsed.workflow_entries ?? []) {
+        if (entry.execution.provider.id !==
+            entry.execution.analysis_profile.provider.id ||
+            entry.execution.provider.name !==
+                entry.execution.analysis_profile.provider.name ||
+            entry.execution.provider.version !==
+                entry.execution.analysis_profile.provider.version)
+            throw new TypeError("Analysis snapshot workflow entry provider does not match its profile");
+        const expected = analysisQueryId(parsed.target, parsed.binding, entry.operation, entry.parameters);
+        if (entry.query_id !== expected)
+            throw new TypeError("Analysis snapshot workflow query identifier does not match");
+        if (ids.has(entry.query_id))
+            throw new TypeError("Analysis snapshot contains duplicate queries");
+        ids.add(entry.query_id);
+        if (!workflowEntryHasMatchingEvidence(entry, workflowIndex)) {
+            if (workflowEntryHasCorrespondingEvidence(entry, workflowIndex))
+                throw new TypeError(`Analysis snapshot workflow entry ${entry.operation} differs from its Evidence record`);
+            continue;
+        }
+        boundWorkflowEntries.push(entry);
+    }
     const sorted = [...parsed.entries].sort((left, right) => left.query_id.localeCompare(right.query_id));
     if (JSON.stringify(parsed.entries) !== JSON.stringify(sorted))
         throw new TypeError("Analysis snapshot entries are not canonical");
-    return { ...parsed, entries: boundEntries };
+    const sortedWorkflows = [...(parsed.workflow_entries ?? [])].sort((left, right) => left.query_id.localeCompare(right.query_id));
+    if (parsed.workflow_entries !== undefined &&
+        JSON.stringify(parsed.workflow_entries) !== JSON.stringify(sortedWorkflows))
+        throw new TypeError("Analysis snapshot workflow entries are not canonical");
+    return {
+        ...parsed,
+        entries: boundEntries,
+        ...(parsed.workflow_entries === undefined
+            ? {}
+            : { workflow_entries: boundWorkflowEntries }),
+    };
 };
 const createEvidenceIndex = (snapshot) => {
     const matching = new Set();
@@ -259,5 +358,70 @@ const entryEvidenceKey = (entry, binding) => canonicalJson({
             architecture: entry.execution.subject.architecture,
         },
 });
+const workflowEntryQueryKey = (entry) => canonicalJson({
+    operation: entry.operation,
+    parameters: entry.parameters,
+    provider: entry.execution.provider,
+    analysis_profile: entry.execution.analysis_profile,
+});
+const workflowEntryEvidenceKey = (entry) => canonicalJson({
+    query: workflowEntryQueryKey(entry),
+    normalized_result: entry.execution.result,
+    raw_result: entry.execution.raw_result,
+    limitations: entry.execution.limitations,
+    locations: entry.execution.locations,
+    subject: entry.execution.subject === null
+        ? null
+        : {
+            local_path: entry.execution.subject.path,
+            sha256: entry.execution.subject.sha256,
+            format: entry.execution.subject.format,
+            architecture: entry.execution.subject.architecture,
+        },
+});
+const isWorkflowEvidence = (evidence, snapshot, entry) => evidence.predicate_type === "rea.analysis" &&
+    evidence.confidence === "derived" &&
+    evidence.authority === "shipped-artifact" &&
+    evidence.subject?.digest.sha256 === snapshot.target.sha256 &&
+    "analysis_profile" in evidence &&
+    analysisProfilesEqual(evidence.analysis_profile, entry.execution.analysis_profile) &&
+    evidence.provider.id === entry.execution.provider.id &&
+    evidence.provider.name === entry.execution.provider.name &&
+    evidence.provider.version === entry.execution.provider.version;
+const createWorkflowEvidenceIndex = (snapshot) => {
+    const matching = new Set();
+    const corresponding = new Set();
+    for (const evidence of snapshot.evidence_bundle.records) {
+        if (evidence.predicate_type !== "rea.analysis" ||
+            evidence.confidence !== "derived" ||
+            evidence.authority !== "shipped-artifact" ||
+            evidence.subject?.digest.sha256 !== snapshot.target.sha256 ||
+            !("analysis_profile" in evidence))
+            continue;
+        corresponding.add(evidenceQueryKey(evidence));
+        matching.add(canonicalJson(evidenceContentProjection(evidence)));
+    }
+    return { matching, corresponding };
+};
+const workflowEntryHasMatchingEvidence = (entry, index) => index.matching.has(workflowEntryEvidenceKey(entry));
+const workflowEntryHasCorrespondingEvidence = (entry, index) => index.corresponding.has(workflowEntryQueryKey(entry));
+const evidenceMatchesWorkflowEntry = (evidence, entry, snapshot) => isWorkflowEvidence(evidence, snapshot, entry) &&
+    canonicalJson(evidenceContentProjection(evidence)) ===
+        workflowEntryEvidenceKey(entry);
+const evidenceContentProjection = (evidence) => ({
+    query: evidenceQueryKey(evidence),
+    normalized_result: evidence.normalized_result,
+    raw_result: evidence.raw_result,
+    limitations: evidence.limitations,
+    locations: evidence.locations,
+    subject: evidence.subject === null
+        ? null
+        : {
+            local_path: evidence.subject.local_path,
+            sha256: evidence.subject.digest.sha256,
+            format: evidence.subject.format,
+            architecture: evidence.subject.architecture,
+        },
+});
 /** Serialize a validated snapshot with byte-stable canonical entry ordering. */
 export const serializeAnalysisSnapshot = (snapshot) => `${canonicalJson(parseAnalysisSnapshot(snapshot))}\n`;

package/dist/domain/android/androidAnalysis.js

@@ -1,9 +1,7 @@
 import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
 const target = {
-    path: z
-        .string()
-        .min(1)
-        .describe("Local APK path; the target is never executed"),
+    path: localPathStringSchema.describe("Local APK path; the target is never executed"),
 };
 const classTarget = {
     ...target,

package/dist/domain/android/androidApplication.js

@@ -5,6 +5,7 @@ import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js"
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "../bridgeCandidateProjection.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const componentSchema = z.strictObject({
@@ -52,6 +53,7 @@ export const androidApplicationProjectionResultSchema = z.strictObject({
             "unity-convention",
         ]),
     })),
+    bridge_candidate_coverage: bridgeCandidateCoverageSchema,
     coverage: z.strictObject({
         status: z.enum(["complete-within-inventory", "partial"]),
         inventory_complete: z.boolean(),
@@ -88,6 +90,11 @@ export const projectAndroidApplication = (input) => {
         "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
         "Runtime families are inferred from inventory formats and paths; filename suffixes do not establish valid DEX or JVM class bytes.",
         "Bridge candidates are path-based hypotheses, not decoded JNI declarations or observed runtime calls.",
+        ...(bridgeProjection.coverage.status === "partial"
+            ? [
+                `Bridge candidate pairs exceeded the projection safety budget; ${bridgeProjection.coverage.omitted_candidates} hypotheses are omitted. Component arrays still include every component from the supplied inventory pages.`,
+            ]
+            : []),
     ];
     const withoutId = {
         root_sha256: inventory.manifest.root_sha256,
@@ -98,8 +105,9 @@ export const projectAndroidApplication = (input) => {
         components,
         runtime_families: runtimeFamilies(all),
         bridge_candidates: bridgeProjection.candidates,
+        bridge_candidate_coverage: bridgeProjection.coverage,
         coverage: {
-            status: inventory.complete
+            status: inventory.complete && bridgeProjection.coverage.status === "complete"
                 ? "complete-within-inventory"
                 : "partial",
             inventory_complete: inventory.complete,
@@ -141,14 +149,14 @@ const runtimeFamilies = (all) => {
     return [...families].sort(compare);
 };
 const bridgeCandidates = (managed, native) => {
-    const candidates = managed.flatMap((source) => native.map((target) => ({
-        managed_path: source.path,
-        native_path: target.path,
-        basis: bridgeBasis(target.path),
-    })));
-    return {
-        candidates,
-    };
+    return projectCartesianCandidates({
+        groups: [{ left: managed, right: native }],
+        createCandidate: (managed_path, target) => ({
+            managed_path,
+            native_path: target.path,
+            basis: bridgeBasis(target.path),
+        }),
+    });
 };
 const bridgeBasis = (path) => {
     const lower = path.toLowerCase();

package/dist/domain/apple/appleApplication.js

@@ -6,6 +6,7 @@ import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js"
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "../bridgeCandidateProjection.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const APPLE_ROOT_FORMATS = ["ipa", "directory", "zip", "dmg"];
@@ -52,6 +53,7 @@ export const appleApplicationProjectionResultSchema = z.strictObject({
             "unity-convention",
         ]),
     })),
+    bridge_candidate_coverage: bridgeCandidateCoverageSchema,
     coverage: z.strictObject({
         status: z.enum(["complete-within-inventory", "partial"]),
         inventory_complete: z.boolean(),
@@ -110,6 +112,7 @@ export const projectAppleApplication = (input) => {
         sidecars: entries.some(({ path }) => isSidecar(path)),
         symlinks: entries.some(({ kind }) => kind === "symlink"),
         unattributed,
+        bridgeCandidateCoverage: bridgeProjection.coverage,
     });
     const withoutId = {
         root_sha256: inventory.manifest.root_sha256,
@@ -127,8 +130,9 @@ export const projectAppleApplication = (input) => {
             .sort(compare),
         runtime_families: runtimeFamilies,
         bridge_candidates: bridgeProjection.candidates,
+        bridge_candidate_coverage: bridgeProjection.coverage,
         coverage: {
-            status: complete
+            status: complete && bridgeProjection.coverage.status === "complete"
                 ? "complete-within-inventory"
                 : "partial",
             inventory_complete: inventory.complete,
@@ -137,9 +141,11 @@ export const projectAppleApplication = (input) => {
     };
     return appleApplicationProjectionResultSchema.parse({
         ...withoutId,
-        projection_id: `aap_${digest(withoutId)}`,
+        projection_id: appleProjectionId(withoutId),
     });
 };
+/** Identify the complete projection, including source Evidence provenance. */
+export const appleProjectionId = (projection) => `aap_${digest(projection)}`;
 /**
  * IPA projection keeps every archive component, as before. Directory, ZIP,
  * and DMG inventories can hold installers and other siblings, so only
@@ -204,21 +210,37 @@ const identifyRuntimeFamilies = (all) => {
         families.add("unity");
     return [...families].sort(compare);
 };
-/** Pair scripts and native code only within the same application root. */
+/** Pair scripts and native code within matching application-root groups. */
 const identifyBridgeCandidates = (scripts, native, roots) => {
     const owner = (path) => roots.find((root) => isWithin(path, root)) ?? null;
-    return {
-        candidates: scripts.flatMap((script) => {
-            const root = owner(script.path);
-            return native
-                .filter(({ path }) => owner(path) === root)
-                .map((item) => ({
-                source_path: script.path,
-                native_path: item.path,
-                basis: bridgeBasis(item.path),
-            }));
+    const scriptGroups = [];
+    for (const script of scripts) {
+        const root = owner(script.path);
+        const last = scriptGroups.at(-1);
+        if (last?.root === root)
+            last.left.push(script);
+        else
+            scriptGroups.push({ root, left: [script] });
+    }
+    const nativeByRoot = new Map();
+    for (const item of native) {
+        const root = owner(item.path);
+        const scoped = nativeByRoot.get(root) ?? [];
+        scoped.push(item);
+        nativeByRoot.set(root, scoped);
+    }
+    const groups = scriptGroups.map(({ root, left }) => ({
+        left,
+        right: nativeByRoot.get(root) ?? [],
+    }));
+    return projectCartesianCandidates({
+        groups,
+        createCandidate: (source_path, item) => ({
+            source_path,
+            native_path: item.path,
+            basis: bridgeBasis(item.path),
         }),
-    };
+    });
 };
 const bridgeBasis = (path) => {
     const lower = path.toLowerCase();
@@ -264,6 +286,11 @@ const projectionLimitations = (facts) => [
             "AppleDouble sidecar entries (._* files and __MACOSX/) describe neighbouring files and are excluded from bundle roles.",
         ]
         : []),
+    ...(facts.bridgeCandidateCoverage.status === "partial"
+        ? [
+            `Bridge candidate pairs exceeded the projection safety budget; ${facts.bridgeCandidateCoverage.omitted_candidates} hypotheses are omitted. Component arrays still include every component from the supplied inventory pages.`,
+        ]
+        : []),
     "Bundle roles follow path conventions. Read each info_plist_path with inspect_plist for CFBundleExecutable, identifiers, and declared services.",
     "Bundle identifiers and signing claims require dedicated plist and CMS parsing; this projection reports only exact paths and hashes.",
     "Bridge candidates are path-based hypotheses, not observed runtime calls.",

package/dist/domain/apple/dyldEnvironment.js

@@ -0,0 +1,73 @@
+/** Retain recognized image-selection settings separately from diagnostic observations. */
+export const embeddedDyldOverrides = (environment, platforms) => {
+    const overrides = [];
+    for (const setting of environment) {
+        const delimiter = setting.indexOf("=");
+        if (delimiter <= 0)
+            continue;
+        const variable = setting.slice(0, delimiter);
+        const value = setting.slice(delimiter + 1);
+        const effect = overrideEffect(variable, value);
+        if (effect === undefined)
+            continue;
+        // ROOT_PATH is accepted only for simulator processes. Missing or unknown
+        // platform metadata cannot establish that dyld ignores it.
+        if (variable === "DYLD_ROOT_PATH" &&
+            platforms.length > 0 &&
+            platforms.every((platform) => platform >= 1 && platform <= 12) &&
+            !platforms.some((platform) => [7, 8, 9, 12].includes(platform)))
+            continue;
+        overrides.push({ variable, value, ...effect });
+    }
+    return overrides;
+};
+const overrideEffect = (variable, value) => {
+    switch (variable) {
+        // Empty directory components still produce /leaf candidates in dyld.
+        // In particular, an empty fallback value is not a no-op.
+        case "DYLD_LIBRARY_PATH":
+            return { phase: "override", scope: "library" };
+        case "DYLD_FRAMEWORK_PATH":
+            return { phase: "override", scope: "framework" };
+        case "DYLD_FALLBACK_LIBRARY_PATH":
+            return { phase: "fallback", scope: "library" };
+        case "DYLD_FALLBACK_FRAMEWORK_PATH":
+            return { phase: "fallback", scope: "framework" };
+        // Versioned paths map discovered images to their reported install names,
+        // so the directory's kind does not establish the replaced image's kind.
+        case "DYLD_VERSIONED_LIBRARY_PATH":
+        case "DYLD_VERSIONED_FRAMEWORK_PATH":
+        case "DYLD_IMAGE_SUFFIX":
+            // Versioned paths scan directories; suffixes create path variants.
+            // Empty directories cannot be scanned and empty suffixes repeat a path.
+            return /[^:]/u.test(value)
+                ? { phase: "override", scope: "all" }
+                : undefined;
+        case "DYLD_INSERT_LIBRARIES":
+            return value === "" ? undefined : { phase: "override", scope: "all" };
+        case "DYLD_ROOT_PATH":
+        case "DYLD_OVERLAY_PATH":
+            return value === "" ? undefined : { phase: "override", scope: "prefix" };
+        default:
+            return undefined;
+    }
+};
+const isFrameworkInstallName = (name, overrides) => {
+    const separator = name.lastIndexOf(".framework/");
+    if (separator < 0)
+        return false;
+    const framework = name.slice(0, separator).split("/").at(-1);
+    const leaf = name.slice(name.lastIndexOf("/") + 1);
+    return (leaf === framework ||
+        overrides.some(({ variable, value }) => variable === "DYLD_IMAGE_SUFFIX" && leaf === `${framework}${value}`));
+};
+/** Select only settings that can affect this dependency at its reached search phase. */
+export const hasApplicableDyldOverrides = (overrides, installName, ordinarySearchFoundImage) => {
+    const kind = isFrameworkInstallName(installName, overrides)
+        ? "framework"
+        : "library";
+    return overrides.some(({ phase, scope }) => (phase === "override" || !ordinarySearchFoundImage) &&
+        (scope === "all" ||
+            scope === kind ||
+            (scope === "prefix" && !installName.startsWith("@"))));
+};

package/dist/domain/apple/dyldPaths.js

@@ -0,0 +1,81 @@
+const MAX_SYMLINK_HOPS = 32;
+/**
+ * Resolve a root-relative path one segment at a time, as `open` would:
+ * symlinks are followed inside the root, `..` applies to the real parent,
+ * and any escape above the root or through an absolute link stops.
+ */
+export const resolveTreePath = async (view, input) => {
+    const pending = segmentsOf(input);
+    const resolved = [];
+    let last;
+    let hops = 0;
+    while (pending.length > 0) {
+        const segment = pending.shift() ?? "";
+        if (segment === "..") {
+            if (resolved.length === 0)
+                return { kind: "escapes" };
+            resolved.pop();
+            last = { kind: "directory" };
+            continue;
+        }
+        const path = [...resolved, segment].join("/");
+        const entry = await view.entry(path);
+        if (entry === undefined)
+            return { kind: "absent" };
+        if (entry.kind === "symlink") {
+            hops += 1;
+            if (hops > MAX_SYMLINK_HOPS)
+                return { kind: "absent" };
+            if (entry.target.startsWith("/"))
+                return { kind: "escapes" };
+            pending.unshift(...segmentsOf(entry.target));
+            continue;
+        }
+        if (entry.kind === "file" && pending.length > 0)
+            return { kind: "absent" };
+        resolved.push(segment);
+        last = entry;
+    }
+    return last?.kind === "file"
+        ? { kind: "file", path: resolved.join("/") }
+        : { kind: "not-file" };
+};
+const segmentsOf = (path) => path.split("/").filter((segment) => segment !== "" && segment !== ".");
+export const directoryOf = (path) => {
+    const index = path.lastIndexOf("/");
+    return index < 0 ? "" : path.slice(0, index);
+};
+export const joinPath = (directory, rest) => directory === "" ? rest : rest === "" ? directory : `${directory}/${rest}`;
+/** Expand one dyld path prefix relative to its owning image. */
+export const expandPrefix = (raw, context) => {
+    const variable = /^@(executable_path|loader_path)(?:\/(.*))?$/u.exec(raw);
+    if (variable !== null) {
+        const rest = variable[2] ?? "";
+        if (variable[1] === "loader_path")
+            return { scope: "target", path: joinPath(context.ownerDirectory, rest) };
+        return context.executable === null
+            ? { scope: "undetermined", path: raw }
+            : {
+                scope: "target",
+                path: joinPath(directoryOf(context.executable), rest),
+            };
+    }
+    if (raw.startsWith("/"))
+        return { scope: "outside", path: raw };
+    return { scope: "undetermined", path: raw };
+};
+/**
+ * Slices a process may load, best first, following dyld's graded
+ * architectures: an x86_64h process also accepts generic x86_64.
+ */
+const COMPATIBLE_ARCHITECTURES = {
+    x86_64h: ["x86_64h", "x86_64"],
+};
+export const compatibleSlice = (slices, process) => {
+    for (const architecture of COMPATIBLE_ARCHITECTURES[process] ?? [process]) {
+        const slice = slices.find((item) => item.architecture === architecture);
+        if (slice !== undefined)
+            return slice;
+    }
+    return undefined;
+};