rea-agents 6.3.0 → 6.4.0

package/dist/native/AppleMachoFixups.js

@@ -134,6 +134,8 @@ const chainedFixups = (image, range) => {
         formats,
         failures: issues.map(({ message }) => message),
         issues,
+        examined: Math.max(ranges.length, 1),
+        unreadRebaseBytes: 0,
         decode(address, raw) {
             const segment = ranges.find(({ from, to }) => address >= from && address < to);
             // Pointers outside fixup segments, such as in __TEXT, are stored plainly.
@@ -211,6 +213,7 @@ const setBindRegister = (image, stream, state, byte) => {
             const segment = image.segments[immediate];
             if (segment === undefined)
                 throw new RangeError("Bind segment index is out of range");
+            state.segmentIndex = immediate;
             state.address = segment.address + uleb(bytes, cursor, end);
             return true;
         }
@@ -232,21 +235,50 @@ const readBindStream = (image, range, binds) => {
     const cursor = { at: range.offset };
     const state = {
         ordinal: 0,
+        segmentIndex: -1,
         symbol: "",
         weak: false,
         addend: 0n,
         address: 0n,
     };
-    const bind = (skip) => {
-        binds.set(state.address, {
+    const preflightRun = (count, skip) => {
+        if (count === 0n)
+            return;
+        const segment = image.segments[state.segmentIndex];
+        if (segment === undefined)
+            throw new RangeError("Bind location has no selected segment");
+        const stride = 8n + skip;
+        const end = state.address + (count - 1n) * stride + 8n;
+        if (state.address < segment.address || end > segment.address + segment.size)
+            throw new RangeError("Bind expansion leaves its file-backed segment");
+    };
+    const bind = (count, skip) => {
+        if (count === 0n)
+            return;
+        preflightRun(count, skip);
+        const stride = 8n + skip;
+        const binding = {
             symbol: state.symbol,
             library: range.stream === "weak"
                 ? null
                 : libraryName(state.ordinal, image.dylibs),
             weak: state.weak,
             addend: state.addend,
-        });
-        state.address += 8n + skip;
+        };
+        const previous = binds.at(-1);
+        if (previous !== undefined &&
+            previous.stride === stride &&
+            previous.start + previous.count * stride === state.address &&
+            previous.binding.symbol === binding.symbol &&
+            previous.binding.library === binding.library &&
+            previous.binding.weak === binding.weak &&
+            previous.binding.addend === binding.addend) {
+            previous.count += count;
+        }
+        else {
+            binds.push({ start: state.address, count, stride, binding });
+        }
+        state.address += count * stride;
     };
     while (cursor.at < end) {
         const byte = bytes[cursor.at++] ?? 0;
@@ -259,19 +291,20 @@ const readBindStream = (image, range, binds) => {
                     return;
                 break;
             case 0x90:
-                bind(0n);
+                bind(1n, 0n);
                 break;
             case 0xa0:
-                bind(uleb(bytes, cursor, end));
+                bind(1n, uleb(bytes, cursor, end));
                 break;
             case 0xb0:
-                bind(BigInt(byte & 0x0f) * 8n);
+                bind(1n, BigInt(byte & 0x0f) * 8n);
                 break;
             case 0xc0: {
+                if (range.stream === "lazy")
+                    throw new RangeError("Lazy bind streams do not support repeated bind opcodes");
                 const count = uleb(bytes, cursor, end);
                 const skip = uleb(bytes, cursor, end);
-                for (let index = 0n; index < count; index++)
-                    bind(skip);
+                bind(count, skip);
                 break;
             }
             default:
@@ -282,17 +315,24 @@ const readBindStream = (image, range, binds) => {
 /** Build pointer decoding for one slice from its fixup load commands. */
 export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
     const image = { bytes, segments, dylibs: commands.dylibs, baseAddress };
-    if (commands.chained !== null)
-        return chainedFixups(image, commands.chained);
+    const unreadRebaseBytes = commands.rebases.reduce((total, rebase) => total + rebase.size, 0);
+    if (commands.chained !== null) {
+        const chained = chainedFixups(image, commands.chained);
+        return unreadRebaseBytes === 0
+            ? chained
+            : { ...chained, unreadRebaseBytes };
+    }
     if (commands.binds.length === 0)
         return {
             kind: "none",
             formats: [],
             failures: [],
             issues: [],
+            examined: 0,
+            unreadRebaseBytes,
             decode: (_address, raw) => ({ kind: "rebase", target: raw }),
         };
-    const binds = new Map();
+    const binds = [];
     const failures = [];
     for (const stream of commands.binds)
         try {
@@ -306,11 +346,27 @@ export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
         formats: [],
         failures,
         issues: failures.map((message) => issue("pointer_fixups", "bind_stream_decode_failed", message)),
+        examined: commands.binds.length,
+        unreadRebaseBytes,
         decode(address, raw) {
-            const bound = binds.get(address);
-            return bound === undefined
+            let match;
+            for (const run of binds) {
+                const { start, count, stride } = run;
+                const distance = address - start;
+                if (distance >= 0n &&
+                    distance % stride === 0n &&
+                    distance / stride < count) {
+                    if (match !== undefined)
+                        return {
+                            kind: "unsupported",
+                            reason: `Ambiguous bind records target pointer location 0x${address.toString(16)}`,
+                        };
+                    match = run;
+                }
+            }
+            return match === undefined
                 ? { kind: "rebase", target: raw }
-                : { kind: "bind", ...bound };
+                : { kind: "bind", ...match.binding };
         },
     };
 };

package/dist/native/AppleMachoSelection.js

@@ -35,7 +35,9 @@ export const selectMachoSlice = (bytes, architecture) => {
     const headerEnd = 8 + count * stride;
     if (count > 128 || headerEnd > bytes.length)
         throw malformed("Malformed FAT architecture table");
-    const cpu = architecture === "arm64" ? 0x0100000c : 0x01000007;
+    const cpu = MACHO_CPU_TYPE[architecture];
+    if (cpu === undefined)
+        throw invalid("Requested FAT architecture is absent");
     const declarations = readFatSliceDeclarations(bytes.subarray(8, headerEnd), {
         count,
         wide: fat64,
@@ -63,8 +65,22 @@ export const selectMachoSlice = (bytes, architecture) => {
     }
     if (selected === undefined)
         throw invalid("Requested FAT architecture is absent");
+    if (selected.slice + 4 > bytes.length)
+        throw malformed("Truncated Mach-O header");
+    const sliceMagic = bytes.readUInt32LE(selected.slice);
+    if (sliceMagic === MH_MAGIC || sliceMagic === MH_CIGAM)
+        throw invalid(`Unsupported 32-bit Mach-O metadata for requested CPU type ${architecture}`);
     return selected;
 };
+/** CPU types admitted by `machArchitecture` in the domain binary target parser. */
+const MACHO_CPU_TYPE = {
+    x86: 7,
+    x86_64: 0x01000007,
+    arm: 12,
+    arm64: 0x0100000c,
+};
+const MH_MAGIC = 0xfeedface;
+const MH_CIGAM = 0xcefaedfe;
 /** Parse segments/sections for a little-endian 64-bit Mach-O architecture slice. */
 export const parseMachoLayout = (bytes, architecture) => {
     if (bytes.length < 4)
@@ -95,6 +111,7 @@ export const parseMachoLayout = (bytes, architecture) => {
         sections: [],
         dylibs: [],
         binds: [],
+        rebases: [],
         chained: null,
         baseAddress: undefined,
     };
@@ -115,7 +132,7 @@ export const parseMachoLayout = (bytes, architecture) => {
             collectFixupCommand(bytes, command, state);
         cursor += command.size;
     }
-    const { segments, sections, chained, binds, dylibs } = state;
+    const { segments, sections, chained, binds, rebases, dylibs } = state;
     const offset = (address, size = 1) => {
         const matches = segments.filter((segment) => address >= segment.address &&
             address + BigInt(size) <= segment.address + segment.size);
@@ -130,7 +147,7 @@ export const parseMachoLayout = (bytes, architecture) => {
         segments,
         sections,
         offset,
-        fixups: { chained, binds, dylibs },
+        fixups: { chained, binds, rebases, dylibs },
         baseAddress: state.baseAddress ?? 0n,
     };
 };
@@ -190,6 +207,9 @@ const collectFixupCommand = (bytes, { cursor, kind, size }, state) => {
     else if (kind === LC_DYLD_INFO || kind === LC_DYLD_INFO_ONLY) {
         if (size < 48)
             throw new RangeError("Truncated dyld-info command");
+        const rebase = range(cursor + 8);
+        if (rebase.size > 0)
+            state.rebases.push(rebase);
         for (const [at, stream] of [
             [cursor + 16, "bind"],
             [cursor + 24, "weak"],

package/dist/native/NativeMacOSProvider.js

@@ -12,8 +12,10 @@ import { NATIVE_TOOL_CONTRACTS, } from "../contracts/native/nativeToolContracts.
 import { toolContract } from "../contracts/toolContracts.js";
 import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
 import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisOutputError, AnalysisResourceConstraintError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { BinaryTargetError } from "../domain/configurationErrors.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { omittedPrototypeKeysLimitation, parseXmlPropertyList, } from "../domain/propertyListKeys.js";
@@ -26,6 +28,8 @@ import { parseDemangledSymbols } from "./parsers/demangle.js";
 import { parseLipoArchitectures } from "./parsers/lipo.js";
 import { parsePlistJson, parsePlistXml, plistJsonNeedsNumberTypes, } from "./parsers/plist.js";
 import { architectureLocations, inspectNativeMacho, } from "./NativeMachoInspection.js";
+import { analysisErrorWithCleanupFailure } from "../domain/analysisErrorCleanup.js";
+import { createNativeUiHelperRuntime, } from "./NativeUiHelperRuntime.js";
 /** Read-only semantic provider composed from Xcode command-line utilities. */
 export class NativeMacOSProvider {
     runner;
@@ -54,6 +58,9 @@ class NativeMacOSClient {
     runner;
     tracer;
     environment;
+    #pendingNativeUiRuntimes = new Set();
+    #nativeUiTail = Promise.resolve();
+    #closed = false;
     constructor(target, runner, tracer, environment) {
         this.target = target;
         this.runner = runner;
@@ -61,6 +68,8 @@ class NativeMacOSClient {
         this.environment = environment;
     }
     async execute(operation, parameters, options) {
+        if (this.#closed)
+            return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, "Native provider client is closed"));
         if (options?.signal?.aborted === true)
             return err(new AnalysisCancelledError(operation));
         if (operation === "health")
@@ -107,21 +116,12 @@ class NativeMacOSClient {
         }
         if (operation === "observe_native_ui" ||
             operation === "capture_native_ui_scenario") {
-            const result = await observeNativeUi(this.target, operation, parameters, {
-                environment: this.environment,
-                signal: options?.signal,
-            });
-            return result.ok
-                ? ok(createAnalysisExecution(result.value, IDENTITY, {
-                    limitations: result.value.limitations,
-                }))
-                : result;
+            return this.#observeNativeUi(operation, parameters, options?.signal);
         }
         try {
             const observation = await this.#dispatch(operation, parameters, options?.signal);
             return observation.ok
                 ? ok(createAnalysisExecution(observation.value.result, IDENTITY, {
-                    rawResult: { provenance: observation.value.provenance },
                     limitations: observation.value.limitations,
                     locations: observation.value.locations,
                 }))
@@ -133,8 +133,87 @@ class NativeMacOSClient {
             }));
         }
     }
-    close() {
-        return this.tracer.close();
+    async close() {
+        this.#closed = true;
+        const uiCleanupFailures = await this.#serializeNativeUi(() => this.#retryNativeUiCleanup());
+        const tracer = await this.tracer.close();
+        if (uiCleanupFailures.length === 0)
+            return tracer;
+        const uiCleanup = this.#nativeUiCleanupFailure(uiCleanupFailures, "close_binary");
+        return tracer.ok
+            ? err(uiCleanup)
+            : err(analysisErrorWithCleanupFailure(tracer.error, uiCleanup));
+    }
+    #observeNativeUi(operation, parameters, signal) {
+        return this.#serializeNativeUi(async () => {
+            if (this.#closed)
+                return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, "Native provider client is closed"));
+            const earlierCleanupFailures = await this.#retryNativeUiCleanup();
+            if (earlierCleanupFailures.length > 0)
+                return err(this.#nativeUiCleanupFailure(earlierCleanupFailures, operation));
+            const runtime = createNativeUiHelperRuntime(this.environment);
+            this.#pendingNativeUiRuntimes.add(runtime);
+            let result;
+            try {
+                result = await observeNativeUi(this.target, operation, parameters, {
+                    environment: this.environment,
+                    signal,
+                    runtime,
+                });
+            }
+            catch (cause) {
+                result = err(cause instanceof AnalysisError
+                    ? cause
+                    : new ProviderAdapterError(IDENTITY.id, operation, { cause }));
+            }
+            try {
+                await runtime.close();
+                this.#pendingNativeUiRuntimes.delete(runtime);
+            }
+            catch (cause) {
+                const cleanup = this.#nativeUiCleanupFailure([{ runtime, cause }], operation, result.ok ? result.value : undefined);
+                return err(result.ok
+                    ? cleanup
+                    : analysisErrorWithCleanupFailure(result.error, cleanup, operation));
+            }
+            return result.ok
+                ? ok(createAnalysisExecution(result.value, IDENTITY, {
+                    limitations: result.value.limitations,
+                }))
+                : result;
+        });
+    }
+    #serializeNativeUi(operation) {
+        const call = this.#nativeUiTail.then(operation, operation);
+        this.#nativeUiTail = call.then(() => undefined, () => undefined);
+        return call;
+    }
+    async #retryNativeUiCleanup() {
+        const failures = [];
+        for (const runtime of this.#pendingNativeUiRuntimes) {
+            try {
+                await runtime.close();
+                this.#pendingNativeUiRuntimes.delete(runtime);
+            }
+            catch (cause) {
+                failures.push({ runtime, cause });
+            }
+        }
+        return failures;
+    }
+    #nativeUiCleanupFailure(failures, operation, partialObservation) {
+        const resources = failures.flatMap(({ runtime }) => runtime.resources());
+        return new ProviderCleanupError(IDENTITY.id, resources.length === 0 ? ["native-ui-runtime"] : resources, {
+            reason: "Native UI runtime cleanup remains incomplete",
+            failures: failures.map(({ runtime, cause }) => ({
+                resources: [...runtime.resources()],
+                reason: cause instanceof Error ? cause.message : String(cause),
+            })),
+        }, {
+            operation,
+            cause: new AggregateError(failures.map(({ cause }) => cause), "Native UI runtime cleanup failed"),
+            ...(partialObservation === undefined ? {} : { partialObservation }),
+        });
     }
     #dispatch(operation, parameters, signal) {
         switch (operation) {
@@ -176,7 +255,6 @@ class NativeMacOSClient {
         });
         return ok({
             result: jsonValueSchema.parse(result),
-            provenance,
             limitations: [],
             locations: architectureLocations(result.architectures.items),
         });
@@ -198,7 +276,6 @@ class NativeMacOSClient {
         });
         return ok({
             result: jsonValueSchema.parse(result),
-            provenance,
             limitations: [],
             locations: [],
         });
@@ -271,7 +348,6 @@ class NativeMacOSClient {
         });
         return ok({
             result: jsonValueSchema.parse(result),
-            provenance,
             limitations: result.limitations,
             locations: [],
         });
@@ -385,7 +461,6 @@ class NativeMacOSClient {
         });
         return ok({
             result: jsonValueSchema.parse(result),
-            provenance,
             limitations: parsed.value.limitations,
             locations: [{ kind: "artifact-path", path: plist.value }],
         });

package/dist/native/NativeMachoInspection.js

@@ -1,3 +1,4 @@
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
 import { inspectMachoSchema, } from "../domain/native/nativeInspection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
@@ -30,7 +31,11 @@ export const inspectNativeMacho = async (context) => {
     const lipo = captures.find(({ tool }) => tool === "lipo");
     if (lipo === undefined)
         throw new TypeError("Missing lipo capture");
-    const selectedArchitecture = selectArchitecture(context.target, parseLipoArchitectures(lipo.stdout).map(({ name }) => name));
+    const availableArchitectures = parseLipoArchitectures(lipo.stdout).map(({ name }) => name);
+    const selection = selectArchitecture(context.target, availableArchitectures);
+    if (selection.status === "absent")
+        return err(new AnalysisOutputError("inspect_macho", `lipo did not list ${selection.architecture}; refusing to read another slice`));
+    const selectedArchitecture = selection.status === "selected" ? selection.architecture : null;
     for (const [tool, prefix] of REQUIRED_SLICE_COMMANDS) {
         const captured = await context.run(tool, [
             ...prefix,
@@ -67,7 +72,6 @@ export const inspectNativeMacho = async (context) => {
         : normalized;
     return ok({
         result: jsonValueSchema.parse(result),
-        provenance: result.provenance,
         limitations: result.limitations,
         locations: fileOffsetLocations(result, segmentOffset),
     });
@@ -226,19 +230,19 @@ const selectedArchitectureArguments = (tool, architecture) => {
 };
 const selectArchitecture = (target, available) => {
     if (target.kind !== "executable" || target.availableArchitectures.length < 2)
-        return null;
+        return { status: "unfiltered" };
     const normalized = target.architecture === "x86" ? "i386" : target.architecture;
     if (available.includes(normalized))
-        return normalized;
+        return { status: "selected", architecture: normalized };
     // BinaryTarget intentionally normalizes ARM64 CPU subtypes. Recover the
     // concrete arm64e slice name from lipo before invoking slice-aware tools.
     if (normalized === "arm64") {
         const arm64e = available.find((architecture) => architecture === "arm64e");
         if (arm64e !== undefined)
-            return arm64e;
+            return { status: "selected", architecture: arm64e };
         const variant = available.find((architecture) => /^arm64e\.[A-Za-z0-9_]+$/u.test(architecture));
         if (variant !== undefined)
-            return variant;
+            return { status: "selected", architecture: variant };
     }
-    return normalized;
+    return { status: "absent", architecture: normalized };
 };

package/dist/native/NativeUiHelperRuntime.js

@@ -41,6 +41,7 @@ export const createNativeUiHelperRuntime = (environment) => {
         const output = await execFileOutput(executable, [JSON.stringify(parameters)], {
             timeout: 30_000,
             maxBuffer: NATIVE_UI_HELPER_MAX_BUFFER,
+            stopSignal: "SIGTERM",
             env: selectedEnvironment,
             ...(signal === undefined ? {} : { signal }),
         });
@@ -54,8 +55,12 @@ export const createNativeUiHelperRuntime = (environment) => {
     return {
         invoke,
         close: async () => {
-            if (root !== undefined)
+            if (root !== undefined) {
                 await rm(root, { recursive: true, force: true });
+                root = undefined;
+                executable = undefined;
+            }
         },
+        resources: () => (root === undefined ? [] : [root]),
     };
 };

package/dist/native/NativeUiObservation.js

@@ -5,7 +5,7 @@ import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInp
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import {} from "../domain/analysisErrorBase.js";
 import { err, ok } from "../domain/result.js";
-import { createNativeUiHelperRuntime } from "./NativeUiHelperRuntime.js";
+import { createNativeUiHelperRuntime, } from "./NativeUiHelperRuntime.js";
 import { NATIVE_UI_OUTPUT_BUDGET_BYTES, NATIVE_UI_OUTPUT_WEIGHT, } from "./NativeUiOutputBudget.js";
 const helper = fileURLToPath(new URL("../../bridge/native/ReaNativeUI.swift", import.meta.url));
 const responseSchema = z.discriminatedUnion("ok", [
@@ -18,7 +18,7 @@ const responseSchema = z.discriminatedUnion("ok", [
 ]);
 /** Capture a selected existing app window and run explicitly selected scenarios. */
 export const observeNativeUi = async (target, operation, parameters, options) => {
-    const runtime = createNativeUiHelperRuntime(options.environment);
+    const runtime = options.runtime ?? createNativeUiHelperRuntime(options.environment);
     try {
         return await observeWithHelper(target, operation, parameters, {
             ...options,
@@ -26,7 +26,8 @@ export const observeNativeUi = async (target, operation, parameters, options) =>
         });
     }
     finally {
-        await runtime.close();
+        if (options.runtime === undefined)
+            await runtime.close();
     }
 };
 const observeWithHelper = async (target, operation, parameters, options) => {

package/dist/native/pe/PeResourceLayout.js

@@ -0,0 +1,120 @@
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
+export const peFailure = (message) => {
+    throw new ArtifactReaderFailure("format", message);
+};
+export const requirePeRange = (bytes, offset, length) => {
+    if (!Number.isSafeInteger(offset) ||
+        !Number.isSafeInteger(length) ||
+        offset < 0 ||
+        length < 0 ||
+        offset > bytes.length - length)
+        peFailure(`PE range ${String(offset)} + ${String(length)} leaves the artifact.`);
+};
+// RVA ownership follows the declared virtual extent. Raw size describes
+// initialized file bytes and can include file-alignment padding; loaders may
+// map page-rounded tails, but those bytes are outside the declared section.
+const virtualExtent = (section) => section.virtualSize === 0 ? section.size : section.virtualSize;
+/** Header admission and unambiguous file-backed RVA mapping, independent of section names. */
+export const readPeResourceLayout = (bytes) => {
+    requirePeRange(bytes, 0, 64);
+    if (bytes.readUInt16LE(0) !== 0x5a4d)
+        peFailure("Expected an MZ PE image.");
+    const pe = bytes.readUInt32LE(60);
+    requirePeRange(bytes, pe, 24);
+    if (bytes.readUInt32LE(pe) !== 0x4550)
+        peFailure("Expected a PE signature.");
+    const sectionCount = bytes.readUInt16LE(pe + 6);
+    const optionalSize = bytes.readUInt16LE(pe + 20);
+    const optional = pe + 24;
+    requirePeRange(bytes, optional, optionalSize);
+    if (optionalSize < 64)
+        peFailure("Truncated PE optional header.");
+    const magic = bytes.readUInt16LE(optional);
+    if (magic !== 0x10b && magic !== 0x20b)
+        peFailure("Unsupported PE optional header magic.");
+    const countAt = magic === 0x10b ? 92 : 108;
+    const directoriesAt = countAt + 4;
+    if (optionalSize < directoriesAt)
+        peFailure("Truncated PE data directory count.");
+    const directoryCount = bytes.readUInt32LE(optional + countAt);
+    if (directoryCount > Math.floor((optionalSize - directoriesAt) / 8))
+        peFailure("PE directory count exceeds its optional header.");
+    const headerSize = bytes.readUInt32LE(optional + 60);
+    const table = optional + optionalSize;
+    requirePeRange(bytes, table, sectionCount * 40);
+    if (headerSize < table + sectionCount * 40 || headerSize > bytes.length)
+        peFailure("Invalid PE SizeOfHeaders.");
+    const sections = [];
+    for (let index = 0; index < sectionCount; index++) {
+        const at = table + index * 40;
+        const section = {
+            rva: bytes.readUInt32LE(at + 12),
+            virtualSize: bytes.readUInt32LE(at + 8),
+            offset: bytes.readUInt32LE(at + 20),
+            size: bytes.readUInt32LE(at + 16),
+        };
+        if (section.rva + virtualExtent(section) > 0x100000000)
+            peFailure("PE section RVA range overflows.");
+        if (section.size > 0) {
+            requirePeRange(bytes, section.offset, section.size);
+            if (section.offset < headerSize)
+                peFailure("PE section raw bytes overlap headers.");
+        }
+        sections.push(section);
+    }
+    const backed = sections
+        .filter(({ size }) => size > 0)
+        .sort((left, right) => left.offset - right.offset);
+    for (let index = 1; index < backed.length; index++) {
+        const previous = backed[index - 1];
+        const current = backed[index];
+        if (previous !== undefined &&
+            current !== undefined &&
+            current.offset < previous.offset + previous.size)
+            peFailure("PE sections have overlapping raw file ranges.");
+    }
+    const map = (rva, size) => {
+        if (rva + size > 0x100000000)
+            peFailure("Resource RVA range overflows.");
+        const candidates = sections.filter((section) => rva >= section.rva && rva - section.rva < virtualExtent(section));
+        if (rva < headerSize) {
+            if (sections.some((section) => section.rva < rva + size &&
+                section.rva + virtualExtent(section) > rva) ||
+                size > headerSize - rva)
+                peFailure("Ambiguous resource header RVA mapping.");
+            requirePeRange(bytes, rva, size);
+            return rva;
+        }
+        if (candidates.length !== 1)
+            peFailure("Resource RVA has missing or overlapping section mappings.");
+        const section = candidates[0];
+        if (section === undefined)
+            return peFailure("Missing resource section.");
+        const within = rva - section.rva;
+        if (size > virtualExtent(section) - within)
+            peFailure("Resource range leaves its section's virtual size.");
+        if (within > section.size || size > section.size - within)
+            peFailure("Resource range is not entirely file-backed in one section.");
+        // A second section starting inside the requested interval is ambiguous too.
+        if (sections.some((other) => other !== section &&
+            other.rva < rva + size &&
+            other.rva + virtualExtent(other) > rva))
+            peFailure("Resource interval intersects overlapping virtual sections.");
+        const offset = section.offset + within;
+        requirePeRange(bytes, offset, size);
+        return offset;
+    };
+    const directoryAt = optional + directoriesAt + 16;
+    const rva = directoryCount > 2 ? bytes.readUInt32LE(directoryAt) : 0;
+    const size = directoryCount > 2 ? bytes.readUInt32LE(directoryAt + 4) : 0;
+    if ((rva === 0) !== (size === 0))
+        peFailure("Inconsistent PE resource directory RVA/size.");
+    return {
+        format: magic === 0x10b ? "pe32" : "pe32-plus",
+        machine: bytes.readUInt16LE(pe + 4),
+        directoryAt,
+        rva,
+        size,
+        map,
+    };
+};