rea-agents 6.3.0 → 6.5.0

package/dist/artifacts/apple/MachoLoadCommandReader.js

@@ -1,12 +1,7 @@
-import { readFatSliceDeclarations, validateFatSlice, } from "../../domain/apple/machoContainer.js";
+import { machoCpuSubtypeBase } from "../../domain/apple/machoCpuIdentity.js";
+import { classifyFatContainerIdentity, readFatContainerHeader, validateFatSliceIdentity, } from "../../domain/apple/machoContainer.js";
 /** Load commands larger than this are refused instead of buffered. */
 export const MAX_LOAD_COMMAND_BYTES = 16 * 1024 * 1024;
-/** Target opening accepts up to 128 FAT records; Java class files share the FAT magic. */
-const MAX_FAT_ARCHITECTURES = 128;
-/** CPU types of real Mach-O slices (x86, x86_64, arm, arm64, arm64_32, ppc, ppc64). */
-const KNOWN_CPU_TYPES = [
-    7, 0x01000007, 12, 0x0100000c, 0x0200000c, 18, 0x01000012,
-];
 const MH_MAGIC = 0xfeedface;
 const MH_MAGIC_64 = 0xfeedfacf;
 const MH_CIGAM = 0xcefaedfe;
@@ -112,49 +107,35 @@ export const readMachoImage = async (readAt, size) => {
                 : { status: "not-mach-o" };
         const view = viewOf(head);
         const magic = view.getUint32(0, false);
-        if ([FAT_MAGIC, FAT_MAGIC_64, FAT_CIGAM, FAT_CIGAM_64].includes(magic)) {
-            // FAT headers are big-endian; the swapped magics store them little-endian.
-            const littleEndian = magic === FAT_CIGAM || magic === FAT_CIGAM_64;
-            const count = view.getUint32(4, littleEndian);
-            const wide = magic === FAT_MAGIC_64 || magic === FAT_CIGAM_64;
-            // A Java class file's nonzero major version reads as the count, so an
-            // empty architecture table can only be a malformed universal header.
-            if (count === 0)
-                return {
-                    status: "malformed",
-                    reason: "FAT header declares no architectures",
-                };
-            if (count > MAX_FAT_ARCHITECTURES || 8 + count * (wide ? 32 : 20) > size)
+        let header = readFatContainerHeader(head, size);
+        if (header.state !== "not-fat") {
+            if (header.state === "needs-data") {
+                header = readFatContainerHeader(await readAt(0, header.requiredBytes), size);
+            }
+            if (header.state === "not-fat")
                 return { status: "not-mach-o" };
-            const tableBytes = await readExact(readAt, 8, count * (wide ? 32 : 20), "FAT table");
-            const declarations = readFatSliceDeclarations(tableBytes, {
-                count,
-                wide,
-                littleEndian,
-            });
-            if (declarations.status !== "parsed")
-                throw new MachoFormatIssue("malformed", declarations.reason);
-            // A Java class file's version fields read as a FAT count; its "table" names no CPU.
-            if (!declarations.slices.some(({ cpuType }) => KNOWN_CPU_TYPES.includes(cpuType))) {
-                let hasMachOSliceHeader = false;
-                for (const declaration of declarations.slices) {
-                    if (validateFatSlice(declaration, size, 8 + count * (wide ? 32 : 20)) !== null)
-                        continue;
-                    const bytes = await readAt(declaration.offset, 4);
-                    if (bytes.byteLength < 4)
-                        continue;
-                    const sliceMagic = viewOf(bytes).getUint32(0, false);
-                    if ([MH_MAGIC, MH_MAGIC_64, MH_CIGAM, MH_CIGAM_64].includes(sliceMagic)) {
-                        hasMachOSliceHeader = true;
-                        break;
-                    }
+            if (header.state === "needs-data")
+                throw new MachoFormatIssue("malformed", "FAT table is truncated");
+            if (header.state === "malformed")
+                throw new MachoFormatIssue("malformed", header.reason);
+            let identity = classifyFatContainerIdentity(header, () => undefined);
+            if (identity.state === "needs-slice-header") {
+                const sliceHeaders = new Map();
+                for (const offset of identity.offsets) {
+                    const bytes = await readAt(offset, 4);
+                    sliceHeaders.set(offset, bytes.byteLength < 4 ? null : viewOf(bytes).getUint32(0, false));
                 }
-                if (!hasMachOSliceHeader)
-                    return { status: "not-mach-o" };
+                identity = classifyFatContainerIdentity(header, (offset) => sliceHeaders.get(offset));
             }
+            if (identity.state === "not-mach-o")
+                return { status: "not-mach-o" };
+            if (identity.state === "malformed")
+                throw new MachoFormatIssue(identity.category, identity.reason);
+            if (identity.state === "needs-slice-header")
+                return { status: "not-mach-o" };
             return {
                 status: "parsed",
-                slices: await readFatSlices(readAt, size, 8 + count * (wide ? 32 : 20), declarations.slices),
+                slices: await readFatSlices(readAt, header.slices),
             };
         }
         if (magic === MH_CIGAM || magic === MH_CIGAM_64)
@@ -169,19 +150,29 @@ export const readMachoImage = async (readAt, size) => {
         throw cause;
     }
 };
-const readFatSlices = async (readAt, size, tableEnd, declarations) => {
+const readFatSlices = async (readAt, declarations) => {
     const slices = [];
+    // Keep validating after an unsupported slice so a later malformed slice is
+    // reported as malformed whatever the slice order.
+    let unsupported;
     for (const declaration of declarations) {
-        const { index, offset, size: length, cpuType, cpuSubtype } = declaration;
-        const rangeIssue = validateFatSlice(declaration, size, tableEnd);
-        if (rangeIssue !== null)
-            throw new MachoFormatIssue(rangeIssue.includes("unsupported") ? "unsupported" : "malformed", rangeIssue);
-        const slice = await readSlice(readAt, offset, length, {
-            fatCpuType: cpuType,
-            fatCpuSubtype: cpuSubtype,
-            alignmentExponent: declaration.alignmentExponent,
-        });
-        const identityIssue = validateFatSlice(declaration, size, tableEnd, {
+        const { offset, size: length, cpuType, cpuSubtype } = declaration;
+        let slice;
+        try {
+            slice = await readSlice(readAt, offset, length, {
+                fatCpuType: cpuType,
+                fatCpuSubtype: cpuSubtype,
+                alignmentExponent: declaration.alignmentExponent,
+            });
+        }
+        catch (cause) {
+            if (!(cause instanceof MachoFormatIssue) ||
+                cause.status !== "unsupported")
+                throw cause;
+            unsupported ??= cause;
+            continue;
+        }
+        const identityIssue = validateFatSliceIdentity(declaration, {
             cpuType: slice.cpu_type,
             cpuSubtype: slice.cpu_subtype,
         });
@@ -189,6 +180,8 @@ const readFatSlices = async (readAt, size, tableEnd, declarations) => {
             throw new MachoFormatIssue("malformed", identityIssue);
         slices.push(slice);
     }
+    if (unsupported !== undefined)
+        throw unsupported;
     return slices;
 };
 const readSlice = async (readAt, base, length, fat = null) => {
@@ -289,7 +282,11 @@ const decodeCommand = (command, body, index, slice) => {
     if (command === LC_BUILD_VERSION) {
         if (body.byteLength < 24)
             throw new MachoFormatIssue("malformed", `load command ${index} is too short for LC_BUILD_VERSION`);
-        const platform = viewOf(body).getUint32(8, true);
+        const view = viewOf(body);
+        const toolCount = view.getUint32(20, true);
+        if (toolCount > Math.floor((body.byteLength - 24) / 8))
+            throw new MachoFormatIssue("malformed", `load command ${index} LC_BUILD_VERSION tool records exceed cmdsize`);
+        const platform = view.getUint32(8, true);
         slice.platforms.push(platform);
         return;
     }
@@ -336,7 +333,8 @@ const commandString = (body, minimumOffset, index) => {
     if (end < 0)
         throw new MachoFormatIssue("malformed", `load command ${index} has an unterminated string`);
     try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(body.subarray(offset, end));
+        // lc_str contains name/path data, so a leading U+FEFF is part of its identity.
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(body.subarray(offset, end));
     }
     catch {
         throw new MachoFormatIssue("malformed", `load command ${index} has a string that is not UTF-8`);
@@ -352,13 +350,16 @@ const CPU_ARCH_ABI64 = 0x01000000;
 const CPU_ARCH_ABI64_32 = 0x02000000;
 const CPU_TYPE_X86 = 7;
 const CPU_TYPE_ARM = 12;
-const CPU_SUBTYPE_MASK = 0xff000000;
 const CPU_SUBTYPE_ARM64E = 2;
+const CPU_SUBTYPE_ARM64E_X1 = 12;
 const CPU_SUBTYPE_X86_64_H = 8;
 const architectureName = (cpuType, cpuSubtype) => {
-    const subtype = cpuSubtype & ~CPU_SUBTYPE_MASK;
+    const subtype = machoCpuSubtypeBase(cpuSubtype);
     if (cpuType === (CPU_TYPE_ARM | CPU_ARCH_ABI64))
-        return subtype === CPU_SUBTYPE_ARM64E ? "arm64e" : "arm64";
+        // Both pointer-authentication subtypes belong to the arm64e family.
+        return subtype === CPU_SUBTYPE_ARM64E || subtype === CPU_SUBTYPE_ARM64E_X1
+            ? "arm64e"
+            : "arm64";
     if (cpuType === (CPU_TYPE_ARM | CPU_ARCH_ABI64_32))
         return "arm64_32";
     if (cpuType === (CPU_TYPE_X86 | CPU_ARCH_ABI64))

package/dist/artifacts/apple/NibArchive.js

@@ -1,10 +1,10 @@
+import { hasNibArchiveSignature } from "../../domain/apple/appleArchiveFormat.js";
 import { TextDecoder } from "node:util";
 import { InterfaceBuilderDecodeBudget, InterfaceBuilderDecodeBudgetExceeded, } from "./InterfaceBuilderDecodeBudget.js";
-const MAGIC = Buffer.from("NIBArchive", "ascii");
 const DEFAULT_DECODE_BUDGET_BYTES = 128 * 1024 * 1024;
 /** Decode Apple's length-prefixed NIBArchive representation without loading UI classes. */
 export const decodeNibArchive = (bytes, budget = new InterfaceBuilderDecodeBudget(DEFAULT_DECODE_BUDGET_BYTES)) => {
-    if (bytes.length < 50 || !bytes.subarray(0, MAGIC.length).equals(MAGIC))
+    if (bytes.length < 50 || !hasNibArchiveSignature(bytes))
         throw new TypeError("NIBArchive magic or header is invalid");
     const formatVersion = readU32(bytes, 10);
     const coderVersion = readU32(bytes, 14);
@@ -50,7 +50,13 @@ export const decodeNibArchive = (bytes, budget = new InterfaceBuilderDecodeBudge
                 continue;
             const key = keys[value.key_index];
             if (key !== undefined)
-                fields[key] = value.value;
+                // Archive keys are data, including the legacy __proto__ setter name.
+                Object.defineProperty(fields, key, {
+                    value: value.value,
+                    enumerable: true,
+                    configurable: true,
+                    writable: true,
+                });
         }
         return [{ id, class_name: className, values: fields }];
     });
@@ -296,7 +302,8 @@ const readU32 = (bytes, offset) => {
 };
 const decodeUtf8 = (bytes, start, end, label) => {
     try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(start, end));
+        // These are length-prefixed names, not standalone text documents.
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(start, end));
     }
     catch (cause) {
         throw new TypeError(`NIBArchive ${label} is not valid UTF-8`, {

package/dist/artifacts/apple/PlistNumberLiterals.js

@@ -1,4 +1,5 @@
 import { decodeXmlText } from "../../domain/propertyListKeys.js";
+import { hasBinaryPlistSignature } from "../../domain/apple/appleArchiveFormat.js";
 const collector = () => {
     const integers = new Map();
     const reals = new Set();
@@ -106,8 +107,7 @@ export const xmlPlistNumberLiterals = (xml) => {
 /** Observe bounded binary number markers without changing primary decode acceptance. */
 export const binaryPlistNumberLiterals = (bytes) => {
     const output = collector();
-    if (bytes.length < 40 ||
-        bytes.subarray(0, 8).toString("ascii") !== "bplist00")
+    if (bytes.length < 40 || !hasBinaryPlistSignature(bytes))
         return output.result(true);
     const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
     const trailer = bytes.length - 32;

package/dist/artifacts/extraction/ArtifactExtraction.js

@@ -7,25 +7,34 @@ import { ArtifactReaderFailure, } from "../ArtifactReader.js";
 import { abortIfNeeded } from "../ArtifactHash.js";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { SafeOutputTree } from "../SafeOutputTree.js";
+import { SafeOutputTreeCreationFailure } from "../SafeOutputTreeCreationFailure.js";
 import { ZipArtifactReader } from "../ZipArtifactReader.js";
+import { isZipPackageFormat } from "../../domain/zipPackageFormat.js";
 import { MachOSliceArtifactReader } from "../MachOSliceArtifactReader.js";
 import { artifactExtractionResultSchema, } from "../../domain/artifactGraph.js";
 import { AnalysisUnsupportedTargetError } from "../../domain/analysisErrorCore.js";
-import { scanArtifactInventory } from "../inventory/ArtifactInventory.js";
+import { isMachOFormat, } from "../../domain/binaryTargetTypes.js";
+import { scanArtifactInventoryInScope } from "../inventory/ArtifactInventory.js";
 /** Extract every regular inventory occurrence into an exclusively owned absent root. */
-export const extractArtifact = async (input, signal) => {
+export const extractArtifact = async (input, signal) => input.resourceScope.run(() => extractArtifactInScope(input, signal));
+const extractArtifactInScope = async (input, signal) => {
     // Cancellation wins over every later refusal, including unsupported formats.
     abortIfNeeded(signal);
     const sourcePath = await realpath(input.inputPath);
     await requireExtractableFormat(sourcePath, input);
-    const snapshot = await scanArtifactInventory(sourcePath, {
+    const snapshot = await scanArtifactInventoryInScope(sourcePath, {
+        resourceScope: input.resourceScope,
         signal,
         environment: input.environment,
+        integrity: { mode: input.integrityPolicy },
     });
-    return materializeArtifactInventory(input, sourcePath, snapshot, signal);
+    return materializeArtifactInventoryInScope(input, sourcePath, snapshot, signal);
 };
 /** Materialize a scanned inventory, verifying every current occurrence against it. */
 export const materializeArtifactInventory = async (input, sourcePath, snapshot, signal) => {
+    return input.resourceScope.run(() => materializeArtifactInventoryInScope(input, sourcePath, snapshot, signal));
+};
+const materializeArtifactInventoryInScope = async (input, sourcePath, snapshot, signal) => {
     abortIfNeeded(signal);
     const selectedOccurrences = snapshot.occurrences.filter((occurrence) => (occurrence.entry_kind === "file" || occurrence.entry_kind === "slice") &&
         occurrence.logical_path !== ".");
@@ -42,26 +51,36 @@ export const materializeArtifactInventory = async (input, sourcePath, snapshot,
         return true;
     });
     const selectedIds = new Set(activeOccurrences.map(({ occurrence_id: id }) => id));
-    const occurrences = new Map();
-    const neededNodes = new Set();
-    collectOccurrences(snapshot.occurrences, selectedIds, occurrences, neededNodes);
+    const neededNodes = new Set(activeOccurrences.map(({ artifact_id: id }) => id));
     const nodes = new Map();
-    collectNodes(snapshot.nodes, neededNodes, nodes);
+    for (const node of snapshot.nodes)
+        if (neededNodes.has(node.artifact_id))
+            nodes.set(node.artifact_id, node);
     const inventory = {
         manifest: snapshot.manifest,
-        occurrences,
-        nodes,
+        integrityContradictions: snapshot.integrity_contradictions.filter(({ occurrence_id: id }) => selectedIds.has(id)),
     };
     const selected = activeOccurrences.map((occurrence) => {
         // REA never decrypts archive entries, so an encrypted entry makes the
         // complete extraction unsupported rather than the archive invalid.
         if (occurrence.encrypted)
             throw new AnalysisUnsupportedTargetError("extract_artifact", input.inputPath, `Archive entry ${occurrence.logical_path} is encrypted; REA does not decrypt archive entries, so the archive cannot be extracted completely`);
+        // Inventory keeps an ASAR unpacked entry whose companion file is absent,
+        // but extraction cannot materialize bytes it never observed.
+        if (occurrence.entry_kind === "file" &&
+            occurrence.artifact_id === null &&
+            occurrence.hash_status === "unavailable")
+            throw new ArtifactReaderFailure("unavailable", `ASAR unpacked companion bytes are unavailable for ${occurrence.logical_path}`, undefined, {
+                logicalPath: occurrence.logical_path,
+                declaredSha256: null,
+                calculatedSha256: null,
+                unpacked: true,
+            });
         if ((occurrence.entry_kind !== "file" && occurrence.entry_kind !== "slice") ||
             occurrence.artifact_id === null ||
             occurrence.logical_path === ".")
             throw new ArtifactReaderFailure("format", `Selected occurrence is not an extractable regular child file: ${occurrence.logical_path} (${occurrence.occurrence_id})`);
-        const node = inventory.nodes.get(occurrence.artifact_id);
+        const node = nodes.get(occurrence.artifact_id);
         if (node === undefined)
             throw new ArtifactReaderFailure("integrity", `Selected occurrence has no inventory node: ${occurrence.occurrence_id}`);
         return { occurrence, node };
@@ -77,74 +96,36 @@ export const materializeArtifactInventory = async (input, sourcePath, snapshot,
 const materializeSelection = async ({ input, sourcePath, inventory, selected, signal, }) => {
     const byPath = new Map(selected.map((item) => [item.occurrence.logical_path, item]));
     const reader = await createReader(sourcePath, input);
+    const readerOwner = {
+        kind: "reader",
+        reader,
+        resource: `artifact reader for ${sourcePath}`,
+    };
+    let localReaderOwner = readerOwner;
     let output;
-    let readerCloseAttempted = false;
-    let readerClosed = false;
+    let completed;
     const extracted = [];
     try {
-        output = await SafeOutputTree.create(input.outputRoot);
-        const registry = new ArtifactPathRegistry();
-        for await (const entry of reader.entries(signal)) {
-            const path = normalizeArtifactPath(entry.path);
-            registry.add(path, entry.kind);
-            const selectedItem = byPath.get(path);
-            if (selectedItem === undefined) {
-                if (entry.kind === "file" || entry.kind === "slice")
-                    throw new ArtifactReaderFailure("integrity", `Regular artifact entry is missing from inventory: ${path}`);
-                continue;
-            }
-            preflight(entry);
-            const stream = await reader.open(entry, signal);
-            const written = await output.write(path, stream, selectedItem.node.sha256, signal);
-            extracted.push({
-                artifact_id: selectedItem.node.artifact_id,
-                relative_path: written.relativePath,
-                sha256: written.sha256,
-                bytes_written: written.bytesWritten,
-                created: true,
-            });
-            byPath.delete(path);
+        try {
+            output = await SafeOutputTree.create(input.outputRoot);
+        }
+        catch (cause) {
+            if (cause instanceof SafeOutputTreeCreationFailure)
+                output = cause.tree;
+            throw cause;
         }
-        if (byPath.size > 0)
-            throw new ArtifactReaderFailure("integrity", `Inventoried regular artifact entries were not materialized: ${[...byPath.keys()].sort(compareUnicodeCodePoints).join(", ")}`);
-        readerCloseAttempted = true;
-        await reader.close();
-        readerClosed = true;
+        await writeSelectedEntries({ reader, output, byPath, extracted, signal });
+        localReaderOwner = undefined;
+        const closeAttempt = await input.resourceScope.release(readerOwner);
+        if (closeAttempt.kind === "failed")
+            throw ArtifactReaderFailure.withCleanup(closeAttempt.cause, ArtifactReaderFailure.cleanupObservation(closeAttempt.cause, readerOwner.resource));
         extracted.sort((left, right) => compareUnicodeCodePoints(left.relative_path, right.relative_path));
-        const result = createExtractionResult(input, inventory, selected, extracted);
-        await output.commit();
-        return result;
+        completed = createExtractionResult(input, inventory, selected, extracted);
+        await output.commit(signal);
+        return completed;
     }
     catch (cause) {
-        const cleanupFailures = [];
-        if (readerCloseAttempted && !readerClosed)
-            cleanupFailures.push({
-                cause,
-                resource: `artifact reader for ${sourcePath}`,
-            });
-        if (!readerCloseAttempted) {
-            try {
-                readerCloseAttempted = true;
-                await reader.close();
-            }
-            catch (cleanupCause) {
-                cleanupFailures.push({
-                    cause: cleanupCause,
-                    resource: `artifact reader for ${sourcePath}`,
-                });
-            }
-        }
-        if (output !== undefined) {
-            try {
-                await output.rollback();
-            }
-            catch (cleanupCause) {
-                cleanupFailures.push({
-                    cause: cleanupCause,
-                    resource: input.outputRoot,
-                });
-            }
-        }
+        const cleanupFailures = await releaseExtractionOwners(input.resourceScope, localReaderOwner, output, input.outputRoot);
         if (cleanupFailures.length > 0) {
             const observations = cleanupFailures.map(({ cause: cleanupCause, resource }) => ArtifactReaderFailure.cleanupObservation(cleanupCause, resource));
             throw ArtifactReaderFailure.withCleanup(cause, {
@@ -152,11 +133,63 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
                 resources: [
                     ...new Set(observations.flatMap(({ resources }) => resources)),
                 ],
-            });
+            }, output?.published === true && completed !== undefined
+                ? { kind: "artifact-extraction", extraction: completed }
+                : undefined);
         }
+        if (output?.published === true && completed !== undefined)
+            return completed;
         throw cause;
     }
 };
+const writeSelectedEntries = async ({ reader, output, byPath, extracted, signal, }) => {
+    const registry = new ArtifactPathRegistry();
+    for await (const entry of reader.entries(signal)) {
+        const path = normalizeArtifactPath(entry.path);
+        registry.add(path, entry.kind);
+        const selectedItem = byPath.get(path);
+        if (selectedItem === undefined) {
+            if (entry.kind === "file" || entry.kind === "slice")
+                throw new ArtifactReaderFailure("integrity", `Regular artifact entry is missing from inventory: ${path}`);
+            continue;
+        }
+        preflight(entry);
+        const stream = await reader.open(entry, signal);
+        const written = await output.write(path, stream, {
+            sha256: selectedItem.node.sha256,
+            bytes: selectedItem.node.size,
+        }, signal);
+        extracted.push({
+            artifact_id: selectedItem.node.artifact_id,
+            relative_path: written.relativePath,
+            sha256: written.sha256,
+            bytes_written: written.bytesWritten,
+            created: true,
+        });
+        byPath.delete(path);
+    }
+    if (byPath.size > 0)
+        throw new ArtifactReaderFailure("integrity", `Inventoried regular artifact entries were not materialized: ${[...byPath.keys()].sort(compareUnicodeCodePoints).join(", ")}`);
+};
+const releaseExtractionOwners = async (resourceScope, readerOwner, output, outputRoot) => {
+    const failures = [];
+    if (readerOwner !== undefined) {
+        const attempt = await resourceScope.release(readerOwner);
+        if (attempt.kind === "failed")
+            failures.push({ cause: attempt.cause, resource: readerOwner.resource });
+    }
+    if (output !== undefined) {
+        const owner = {
+            kind: "output-tree",
+            tree: output,
+            resource: outputRoot,
+        };
+        const attempt = await resourceScope.release(owner);
+        if (attempt.kind === "failed")
+            failures.push({ cause: attempt.cause, resource: owner.resource });
+    }
+    return failures;
+};
 const createExtractionResult = (input, inventory, selected, extracted) => {
     const extractionSemantic = {
         source_manifest_id: inventory.manifest.manifest_id,
@@ -177,27 +210,17 @@ const createExtractionResult = (input, inventory, selected, extracted) => {
         containment_verified: true,
         cleanup: { attempted: false, verified: true, residual_paths: [] },
         provenance: [],
+        integrity_contradictions: inventory.integrityContradictions,
         limitations: [
             "All regular files in the active artifact were materialized; nested archive contents remain represented by their containing file.",
+            ...(inventory.integrityContradictions.length === 0
+                ? []
+                : [
+                    `${String(inventory.integrityContradictions.length)} extracted file(s) contradict declared integrity metadata; their bytes are observed-untrusted.`,
+                ]),
         ],
     });
 };
-const collectOccurrences = (items, selected, output, neededNodes) => {
-    for (const item of items) {
-        if (!selected.has(item.occurrence_id))
-            continue;
-        output.set(item.occurrence_id, item);
-        if (item.artifact_id !== null)
-            neededNodes.add(item.artifact_id);
-    }
-};
-const collectNodes = (items, selected, output) => {
-    for (const item of items)
-        if (selected.has(item.artifact_id))
-            output.set(item.artifact_id, item);
-};
-const ZIP_FORMATS = ["ipa", "apk", "msix", "appx", "zip"];
-const isZipFormat = (format) => ZIP_FORMATS.includes(format);
 /**
  * Refuse a format without an extraction reader before inventory work starts.
  * The target kind, not the host, is unsupported by extraction. The error keeps
@@ -208,8 +231,8 @@ const requireExtractableFormat = async (path, input) => {
     const directory = (await lstat(path)).isDirectory();
     if (!directory &&
         format !== "asar" &&
-        format !== "mach-o" &&
-        !isZipFormat(format))
+        !isMachOFormat(format) &&
+        !isZipPackageFormat(format))
         throw new AnalysisUnsupportedTargetError("extract_artifact", input.inputPath, `Artifact format has no extraction reader: ${format}`);
     return directory;
 };
@@ -219,7 +242,7 @@ const createReader = async (path, input) => {
         return new DirectoryArtifactReader(path);
     if (format === "asar")
         return new AsarArtifactReader(path);
-    if (isZipFormat(format))
+    if (isZipPackageFormat(format))
         return new ZipArtifactReader(path, format);
     return new MachOSliceArtifactReader(path, input.environment);
 };

package/dist/artifacts/hostExecutableMarking.js

@@ -0,0 +1,16 @@
+import { extname } from "node:path";
+/** Extensions Windows launches directly through CreateProcess or cmd.exe. */
+const windowsLaunchableExtensions = new Set([".bat", ".cmd", ".com", ".exe"]);
+/**
+ * Whether a host filesystem entry carries the host's executable marking.
+ *
+ * POSIX hosts mark executability with permission bits. Windows has no execute
+ * bit (Node reports file modes from the read-only attribute alone), so it marks
+ * launchable files by extension instead.
+ */
+export const hostExecutableMarking = (path, metadata, platform = process.platform) => platform === "win32"
+    ? metadata.isFile() &&
+        windowsLaunchableExtensions.has(extname(path).toLowerCase())
+    : typeof metadata.mode === "bigint"
+        ? (metadata.mode & 73n) !== 0n
+        : (metadata.mode & 0o111) !== 0;