rea-agents 6.0.0 → 6.2.0

package/dist/artifacts/apple/NibArchive.js

@@ -1,8 +1,9 @@
 import { TextDecoder } from "node:util";
+import { InterfaceBuilderDecodeBudget, InterfaceBuilderDecodeBudgetExceeded, } from "./InterfaceBuilderDecodeBudget.js";
 const MAGIC = Buffer.from("NIBArchive", "ascii");
-const MAX_RECORDS = 1_000_000;
+const DEFAULT_DECODE_BUDGET_BYTES = 128 * 1024 * 1024;
 /** Decode Apple's length-prefixed NIBArchive representation without loading UI classes. */
-export const decodeNibArchive = (bytes) => {
+export const decodeNibArchive = (bytes, budget = new InterfaceBuilderDecodeBudget(DEFAULT_DECODE_BUDGET_BYTES)) => {
     if (bytes.length < 50 || !bytes.subarray(0, MAGIC.length).equals(MAGIC))
         throw new TypeError("NIBArchive magic or header is invalid");
     const formatVersion = readU32(bytes, 10);
@@ -23,11 +24,13 @@ export const decodeNibArchive = (bytes) => {
         valuesOffset,
         classesOffset,
     ]);
+    const projectedFieldCount = preflightProjectedFieldCount(bytes, objectsOffset, keysOffset, objectCount, valueCount, classCount, budget.remainingBytes);
+    budget.reserve(objectCount * 96 + projectedFieldCount * 96, "NIBArchive object and projected field counts exceed the aggregate Interface Builder decode budget");
     const objectRecords = parseObjects(bytes, objectsOffset, keysOffset, objectCount, valueCount, classCount);
-    const keys = parseStrings(bytes, keysOffset, valuesOffset, keyCount, "key");
-    const classes = parseClasses(bytes, classesOffset, bytes.length, classCount);
+    const keys = parseStrings(bytes, keysOffset, valuesOffset, keyCount, "key", budget);
+    const classes = parseClasses(bytes, classesOffset, bytes.length, classCount, budget);
     const neededValues = valueIndexes(objectRecords, valueCount);
-    const values = parseValues(bytes, valuesOffset, classesOffset, valueCount, keyCount, neededValues);
+    const values = parseValues(bytes, valuesOffset, classesOffset, valueCount, keyCount, neededValues, budget);
     for (const { value } of values.values()) {
         if (typeof value === "object" &&
             value !== null &&
@@ -89,19 +92,40 @@ const parseObjects = (bytes, start, end, count, valueCount, classCount) => {
         throw new TypeError("NIBArchive object table overlaps the next table");
     return output;
 };
-const parseStrings = (bytes, start, end, count, label) => {
+const preflightProjectedFieldCount = (bytes, start, end, objectCount, valueCount, classCount, maxBytes) => {
+    if (objectCount * 96 > maxBytes)
+        throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "NIBArchive object count exceeds the aggregate Interface Builder decode budget");
+    const cursor = { offset: start };
+    let projectedFields = 0;
+    for (let index = 0; index < objectCount; index += 1) {
+        const classIndex = readVarint(bytes, cursor, end);
+        const valueStart = readVarint(bytes, cursor, end);
+        const fieldCount = readVarint(bytes, cursor, end);
+        if (classIndex >= classCount ||
+            valueStart > valueCount ||
+            fieldCount > valueCount - valueStart)
+            throw new TypeError(`NIBArchive object ${index} references an invalid table range`);
+        projectedFields += fieldCount;
+        if (!Number.isSafeInteger(projectedFields) ||
+            projectedFields * 96 > maxBytes - objectCount * 96)
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "NIBArchive projected field ranges exceed the aggregate Interface Builder decode budget");
+    }
+    return projectedFields;
+};
+const parseStrings = (bytes, start, end, count, label, budget) => {
     const cursor = { offset: start };
     const output = [];
     for (let index = 0; index < count; index += 1) {
         const length = readVarint(bytes, cursor, end);
         const next = checkedEnd(cursor.offset, length, end, `${label} ${index}`);
+        budget.reserve(32 + length * 2, `NIBArchive ${label} strings exceed the aggregate Interface Builder decode budget`);
         const value = decodeUtf8(bytes, cursor.offset, next, `${label} ${index}`);
         cursor.offset = next;
         output.push(value);
     }
     return output;
 };
-const parseClasses = (bytes, start, end, count) => {
+const parseClasses = (bytes, start, end, count, budget) => {
     const cursor = { offset: start };
     const output = [];
     for (let index = 0; index < count; index += 1) {
@@ -112,13 +136,14 @@ const parseClasses = (bytes, start, end, count) => {
         ensureRange(cursor.offset, extraCount * 4, end, `class ${index} extensions`);
         cursor.offset += extraCount * 4;
         const next = checkedEnd(cursor.offset, length, end, `class ${index}`);
+        budget.reserve(32 + length * 2, "NIBArchive class names exceed the aggregate Interface Builder decode budget");
         const name = decodeUtf8(bytes, cursor.offset, next, `class ${index}`).replace(/\0+$/u, "");
         cursor.offset = next;
         output.push(name);
     }
     return output;
 };
-const parseValues = (bytes, start, end, count, keyCount, needed) => {
+const parseValues = (bytes, start, end, count, keyCount, needed, budget) => {
     const cursor = { offset: start };
     const output = new Map();
     for (let index = 0; index < count; index += 1) {
@@ -127,15 +152,19 @@ const parseValues = (bytes, start, end, count, keyCount, needed) => {
             throw new TypeError(`NIBArchive value ${index} references an invalid key`);
         ensureRange(cursor.offset, 1, end, `value ${index} type`);
         const type = bytes[cursor.offset++] ?? -1;
-        const value = readValue(bytes, cursor, end, type, index);
-        if (needed.has(index))
-            output.set(index, { key_index: keyIndex, value });
+        if (!needed.has(index)) {
+            skipValue(bytes, cursor, end, type, index);
+            continue;
+        }
+        budget.reserve(64, "NIBArchive decoded values exceed the aggregate Interface Builder decode budget");
+        const value = readValue(bytes, cursor, end, type, index, budget);
+        output.set(index, { key_index: keyIndex, value });
     }
     if (cursor.offset > end)
         throw new TypeError("NIBArchive value table overlaps the next table");
     return output;
 };
-const readValue = (bytes, cursor, end, type, index) => {
+const readValue = (bytes, cursor, end, type, index, budget) => {
     switch (type) {
         case 0:
             ensureRange(cursor.offset, 1, end, `value ${index}`);
@@ -185,6 +214,7 @@ const readValue = (bytes, cursor, end, type, index) => {
         case 8: {
             const length = readVarint(bytes, cursor, end);
             const next = checkedEnd(cursor.offset, length, end, `value ${index} data`);
+            budget.reserve(32 + 4 * Math.ceil(length / 3), `NIBArchive data value ${index} exceeds the aggregate Interface Builder decode budget`);
             const encoded = bytes.subarray(cursor.offset, next).toString("base64");
             cursor.offset = next;
             return { $nib_data_base64: encoded };
@@ -202,6 +232,43 @@ const readValue = (bytes, cursor, end, type, index) => {
             throw new TypeError(`NIBArchive value ${index} has unsupported type ${type}`);
     }
 };
+const skipValue = (bytes, cursor, end, type, index) => {
+    switch (type) {
+        case 0:
+            ensureRange(cursor.offset, 1, end, `value ${index}`);
+            cursor.offset += 1;
+            return;
+        case 1:
+            ensureRange(cursor.offset, 2, end, `value ${index}`);
+            cursor.offset += 2;
+            return;
+        case 2:
+        case 10:
+            ensureRange(cursor.offset, 4, end, `value ${index}`);
+            cursor.offset += 4;
+            return;
+        case 3:
+        case 7:
+            ensureRange(cursor.offset, 8, end, `value ${index}`);
+            cursor.offset += 8;
+            return;
+        case 6:
+            ensureRange(cursor.offset, 4, end, `value ${index}`);
+            cursor.offset += 4;
+            return;
+        case 4:
+        case 5:
+        case 9:
+            return;
+        case 8: {
+            const length = readVarint(bytes, cursor, end);
+            cursor.offset = checkedEnd(cursor.offset, length, end, `value ${index} data`);
+            return;
+        }
+        default:
+            throw new TypeError(`NIBArchive value ${index} has unsupported type ${type}`);
+    }
+};
 const valueIndexes = (objects, total) => {
     const indexes = new Set();
     for (const object of objects)
@@ -213,8 +280,8 @@ const valueIndexes = (objects, total) => {
 };
 const readCount = (bytes, offset, label) => {
     const count = readU32(bytes, offset);
-    if (count > MAX_RECORDS)
-        throw new TypeError(`NIBArchive ${label} count exceeds the decoder bound`);
+    if (count > bytes.length)
+        throw new TypeError(`NIBArchive ${label} count exceeds the archive length`);
     return count;
 };
 const readOffset = (bytes, offset, fileLength, label) => {

package/dist/artifacts/apple/NibViewHierarchy.js

@@ -1,5 +1,5 @@
 /** Project encoded view parents; archive owners are not inferred view parents. */
-export const projectNibViewHierarchy = (objects, retainedIds) => {
+export const projectNibViewHierarchy = (objects, retainedIds, reserveNode = () => true, maxNodes = 20_000) => {
     const { parents, involved, invalid } = collectNibParents(objects, retainedIds);
     if (parents.size === 0)
         return { hierarchy: null, omitted: invalid };
@@ -21,7 +21,10 @@ export const projectNibViewHierarchy = (objects, retainedIds) => {
         const item = pending.pop();
         if (item === undefined)
             break;
-        if (visited.has(item.id) || item.depth > 128 || visited.size >= 20_000)
+        if (visited.has(item.id) ||
+            item.depth > 128 ||
+            visited.size >= maxNodes ||
+            !reserveNode())
             continue;
         visited.add(item.id);
         const node = { objectID: String(item.id), children: [] };
@@ -35,7 +38,7 @@ export const projectNibViewHierarchy = (objects, retainedIds) => {
     };
 };
 /** Add encoded parent links once; conflicting legacy parents remain unknown. */
-export const mergeNibHierarchies = (legacy, recovered) => {
+export const mergeNibHierarchies = (legacy, recovered, reserveNode = () => true, maxNodes = 20_000) => {
     const existing = new Map();
     const owners = new Map();
     const parents = new Map();
@@ -70,6 +73,10 @@ export const mergeNibHierarchies = (legacy, recovered) => {
             break;
         let target = existing.get(entry.node.objectID);
         if (target === undefined) {
+            if (existing.size >= maxNodes || !reserveNode()) {
+                omitted += 1;
+                continue;
+            }
             target = { objectID: entry.node.objectID, children: [] };
             existing.set(target.objectID, target);
             entry.output.push(target);

package/dist/artifacts/apple/PlistNumberLiterals.js

@@ -0,0 +1,164 @@
+import { decodeXmlText } from "../../domain/propertyListKeys.js";
+const collector = () => {
+    const integers = new Map();
+    const reals = new Set();
+    let unsafeIntegerLiterals = 0;
+    let incompleteMetadata = false;
+    return {
+        integer: (literal) => {
+            if (!/^[+-]?\d+$/u.test(literal)) {
+                incompleteMetadata = true;
+                return;
+            }
+            const exact = BigInt(literal);
+            if (exact >= BigInt(Number.MIN_SAFE_INTEGER) &&
+                exact <= BigInt(Number.MAX_SAFE_INTEGER))
+                return;
+            unsafeIntegerLiterals += 1;
+            const rounded = Number(exact);
+            integers.set(rounded, (integers.get(rounded) ?? new Set()).add(exact.toString()));
+        },
+        real: (value) => {
+            reals.add(value);
+        },
+        markIncomplete: () => {
+            incompleteMetadata = true;
+        },
+        result: (incomplete = false) => ({
+            incomplete: incomplete || incompleteMetadata,
+            integers,
+            reals,
+            unsafeIntegerLiterals,
+        }),
+    };
+};
+// Consume quoted tag attributes and opaque comment/CDATA tokens whole.
+const XML_TOKEN = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<(?:[^>"']|"[^"]*"|'[^']*')*>/gu;
+const OPAQUE_ELEMENTS = new Set(["string", "key", "data", "date"]);
+/** Observe plist number element types without interpreting strings or class code. */
+export const xmlPlistNumberLiterals = (xml) => {
+    const output = collector();
+    const elements = [];
+    let number;
+    let cursor = 0;
+    for (const match of xml.matchAll(XML_TOKEN)) {
+        const index = match.index;
+        if (number !== undefined)
+            number.text += xml.slice(cursor, index);
+        const token = match[0];
+        cursor = index + token.length;
+        if (token.startsWith("<!--") || token.startsWith("<![CDATA[")) {
+            if (number !== undefined) {
+                number.plainText = false;
+                output.markIncomplete();
+            }
+            continue;
+        }
+        const tag = /^<\s*(\/?)\s*([\w:-]+)/u.exec(token);
+        if (tag === null) {
+            if (number !== undefined) {
+                number.plainText = false;
+                output.markIncomplete();
+            }
+            continue;
+        }
+        const closing = tag[1] === "/";
+        const name = tag[2];
+        if (name === undefined)
+            continue;
+        if (closing) {
+            if (number !== undefined &&
+                number.kind === name &&
+                number.depth === elements.length) {
+                if (number.plainText) {
+                    const text = decodeXmlText(number.text).trim();
+                    if (number.kind === "integer")
+                        output.integer(text);
+                    else
+                        output.real(Number.parseFloat(text));
+                }
+                number = undefined;
+            }
+            elements.pop();
+            continue;
+        }
+        // The pinned decoder reads only the first child for integers and only text
+        // nodes for reals. Mixed content cannot establish an exact association.
+        if (number !== undefined) {
+            number.plainText = false;
+            output.markIncomplete();
+        }
+        if (/\/\s*>$/u.test(token))
+            continue;
+        if (number === undefined &&
+            (name === "integer" || name === "real") &&
+            !elements.some((parent) => OPAQUE_ELEMENTS.has(parent)))
+            number = {
+                kind: name,
+                text: "",
+                depth: elements.length + 1,
+                plainText: true,
+            };
+        elements.push(name);
+    }
+    return output.result();
+};
+/** Observe bounded binary number markers without changing primary decode acceptance. */
+export const binaryPlistNumberLiterals = (bytes) => {
+    const output = collector();
+    if (bytes.length < 40 ||
+        bytes.subarray(0, 8).toString("ascii") !== "bplist00")
+        return output.result(true);
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const trailer = bytes.length - 32;
+    const offsetWidth = bytes[trailer + 6] ?? 0;
+    if (![1, 2, 4, 8].includes(offsetWidth))
+        return output.result(true);
+    const countRaw = view.getBigUint64(trailer + 8);
+    const tableRaw = view.getBigUint64(trailer + 24);
+    const safeMaximum = BigInt(Number.MAX_SAFE_INTEGER);
+    if (countRaw === 0n || countRaw > safeMaximum || tableRaw > safeMaximum)
+        return output.result(true);
+    if (tableRaw < 8n || tableRaw >= BigInt(trailer))
+        return output.result(true);
+    const offsetTable = Number(tableRaw);
+    const capacity = Math.floor((trailer - offsetTable) / offsetWidth);
+    if (countRaw > BigInt(capacity))
+        return output.result(true);
+    const count = Number(countRaw);
+    const unsigned = (offset) => {
+        if (offset < offsetTable || offset + offsetWidth > trailer)
+            return undefined;
+        if (offsetWidth === 1)
+            return view.getUint8(offset);
+        if (offsetWidth === 2)
+            return view.getUint16(offset);
+        if (offsetWidth === 4)
+            return view.getUint32(offset);
+        const value = view.getBigUint64(offset);
+        return value > safeMaximum ? undefined : Number(value);
+    };
+    for (let index = 0; index < count; index += 1) {
+        const offset = unsigned(offsetTable + index * offsetWidth);
+        if (offset === undefined || offset < 8 || offset >= offsetTable)
+            return output.result(true);
+        const marker = bytes[offset] ?? 0;
+        const type = marker >> 4;
+        if (type !== 1 && type !== 2)
+            continue;
+        const width = 2 ** (marker & 0xf);
+        if (offset + 1 + width > offsetTable)
+            return output.result(true);
+        if (type === 1 && width === 8)
+            output.integer(view.getBigInt64(offset + 1).toString());
+        else if (type === 1 && width > 4)
+            return output.result(true);
+        else if (type === 2 && width === 4)
+            output.real(view.getFloat32(offset + 1));
+        else if (type === 2 && width === 8)
+            output.real(view.getFloat64(offset + 1));
+        else if (type === 2)
+            return output.result(true);
+    }
+    return output.result();
+};

package/dist/artifacts/extraction/ArtifactExtraction.js

@@ -1,19 +1,26 @@
 import { lstat, realpath } from "node:fs/promises";
+import { compareCodePoints } from "../../domain/canonicalOrdering.js";
 import { canonicalDigest } from "../../domain/comparisonSemantics.js";
 import { AsarArtifactReader } from "../AsarArtifactReader.js";
 import { ArtifactPathRegistry, normalizeArtifactPath, } from "../ArtifactPaths.js";
 import { ArtifactReaderFailure, } from "../ArtifactReader.js";
+import { abortIfNeeded } from "../ArtifactHash.js";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { SafeOutputTree } from "../SafeOutputTree.js";
 import { ZipArtifactReader } from "../ZipArtifactReader.js";
 import { MachOSliceArtifactReader } from "../MachOSliceArtifactReader.js";
 import { artifactExtractionResultSchema, } from "../../domain/artifactGraph.js";
+import { AnalysisUnsupportedTargetError } from "../../domain/analysisErrorCore.js";
 import { scanArtifactInventory } from "../inventory/ArtifactInventory.js";
 /** Extract every regular inventory occurrence into an exclusively owned absent root. */
 export const extractArtifact = async (input, signal) => {
+    // Cancellation wins over every later refusal, including unsupported formats.
+    abortIfNeeded(signal);
     const sourcePath = await realpath(input.inputPath);
+    await requireExtractableFormat(sourcePath, input);
     const snapshot = await scanArtifactInventory(sourcePath, {
         signal,
+        environment: input.environment,
     });
     const selectedOccurrences = snapshot.occurrences.filter((occurrence) => (occurrence.entry_kind === "file" || occurrence.entry_kind === "slice") &&
         occurrence.logical_path !== ".");
@@ -29,11 +36,14 @@ export const extractArtifact = async (input, signal) => {
         nodes,
     };
     const selected = selectedOccurrences.map((occurrence) => {
+        // REA never decrypts archive entries, so an encrypted entry makes the
+        // complete extraction unsupported rather than the archive invalid.
+        if (occurrence.encrypted)
+            throw new AnalysisUnsupportedTargetError("extract_artifact", input.inputPath, `Archive entry ${occurrence.logical_path} is encrypted; REA does not decrypt archive entries, so the archive cannot be extracted completely`);
         if ((occurrence.entry_kind !== "file" && occurrence.entry_kind !== "slice") ||
             occurrence.artifact_id === null ||
-            occurrence.encrypted ||
             occurrence.logical_path === ".")
-            throw new ArtifactReaderFailure("format", `Selected occurrence is not an extractable regular child file: ${occurrence.occurrence_id}`);
+            throw new ArtifactReaderFailure("format", `Selected occurrence is not an extractable regular child file: ${occurrence.logical_path} (${occurrence.occurrence_id})`);
         const node = inventory.nodes.get(occurrence.artifact_id);
         if (node === undefined)
             throw new ArtifactReaderFailure("integrity", `Selected occurrence has no inventory node: ${occurrence.occurrence_id}`);
@@ -49,11 +59,13 @@ export const extractArtifact = async (input, signal) => {
 };
 const materializeSelection = async ({ input, sourcePath, inventory, selected, signal, }) => {
     const byPath = new Map(selected.map((item) => [item.occurrence.logical_path, item]));
-    const reader = await createReader(sourcePath, input.inputFormat);
-    const output = await SafeOutputTree.create(input.outputRoot);
+    const reader = await createReader(sourcePath, input);
+    let output;
+    let readerCloseAttempted = false;
     let readerClosed = false;
     const extracted = [];
     try {
+        output = await SafeOutputTree.create(input.outputRoot);
         const materialized = [];
         const registry = new ArtifactPathRegistry();
         for await (const entry of reader.entries(signal)) {
@@ -77,20 +89,53 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
             });
             materialized.push(selectedItem);
         }
+        readerCloseAttempted = true;
         await reader.close();
         readerClosed = true;
-        extracted.sort((left, right) => left.relative_path.localeCompare(right.relative_path, "en"));
+        extracted.sort((left, right) => compareCodePoints(left.relative_path, right.relative_path));
         const result = createExtractionResult(input, inventory, materialized, extracted);
         await output.commit();
         return result;
     }
     catch (cause) {
-        if (!readerClosed)
-            await reader.close().catch((cause) => {
-                // best-effort cleanup: reader close must not mask the extraction failure.
-                void cause;
+        const cleanupFailures = [];
+        if (readerCloseAttempted && !readerClosed)
+            cleanupFailures.push({
+                cause,
+                resource: `artifact reader for ${sourcePath}`,
             });
-        await output.rollback();
+        if (!readerCloseAttempted) {
+            try {
+                readerCloseAttempted = true;
+                await reader.close();
+            }
+            catch (cleanupCause) {
+                cleanupFailures.push({
+                    cause: cleanupCause,
+                    resource: `artifact reader for ${sourcePath}`,
+                });
+            }
+        }
+        if (output !== undefined) {
+            try {
+                await output.rollback();
+            }
+            catch (cleanupCause) {
+                cleanupFailures.push({
+                    cause: cleanupCause,
+                    resource: input.outputRoot,
+                });
+            }
+        }
+        if (cleanupFailures.length > 0) {
+            const observations = cleanupFailures.map(({ cause: cleanupCause, resource }) => ArtifactReaderFailure.cleanupObservation(cleanupCause, resource));
+            throw ArtifactReaderFailure.withCleanup(cause, {
+                reason: observations.map(({ reason }) => reason).join("; "),
+                resources: [
+                    ...new Set(observations.flatMap(({ resources }) => resources)),
+                ],
+            });
+        }
         throw cause;
     }
 };
@@ -99,7 +144,7 @@ const createExtractionResult = (input, inventory, selected, extracted) => {
         source_manifest_id: inventory.manifest.manifest_id,
         selected_occurrence_ids: selected
             .map(({ occurrence }) => occurrence.occurrence_id)
-            .sort((left, right) => left.localeCompare(right)),
+            .sort(compareCodePoints),
         files_sha256: canonicalDigest(extracted, "Artifact"),
         output_root_alias: "$OUTPUT_ROOT",
     };
@@ -133,20 +178,32 @@ const collectNodes = (items, selected, output) => {
         if (selected.has(item.artifact_id))
             output.set(item.artifact_id, item);
 };
-const createReader = async (path, format) => {
-    if ((await lstat(path)).isDirectory())
+const ZIP_FORMATS = ["ipa", "apk", "msix", "appx", "zip"];
+const isZipFormat = (format) => ZIP_FORMATS.includes(format);
+/**
+ * Refuse a format without an extraction reader before inventory work starts.
+ * The target kind, not the host, is unsupported by extraction. The error keeps
+ * the caller's spelling of the path; I/O uses the canonical path.
+ */
+const requireExtractableFormat = async (path, input) => {
+    const format = input.inputFormat;
+    const directory = (await lstat(path)).isDirectory();
+    if (!directory &&
+        format !== "asar" &&
+        format !== "mach-o" &&
+        !isZipFormat(format))
+        throw new AnalysisUnsupportedTargetError("extract_artifact", input.inputPath, `Artifact format has no extraction reader: ${format}`);
+    return directory;
+};
+const createReader = async (path, input) => {
+    const format = input.inputFormat;
+    if (await requireExtractableFormat(path, input))
         return new DirectoryArtifactReader(path);
     if (format === "asar")
         return new AsarArtifactReader(path);
-    if (format === "ipa" ||
-        format === "apk" ||
-        format === "msix" ||
-        format === "appx" ||
-        format === "zip")
+    if (isZipFormat(format))
         return new ZipArtifactReader(path, format);
-    if (format === "mach-o")
-        return new MachOSliceArtifactReader(path);
-    throw new ArtifactReaderFailure("unavailable", `Artifact format has no extraction reader: ${format}`);
+    return new MachOSliceArtifactReader(path, input.environment);
 };
 const preflight = (entry) => {
     if ((entry.kind !== "file" && entry.kind !== "slice") || entry.encrypted)