rea-agents 6.4.0 → 6.5.0

package/dist/domain/android/androidAnalysis.js

@@ -33,9 +33,19 @@ export const androidInputSchemas = {
             .string()
             .min(1)
             .optional()
-            .describe("Omit for class references; ambiguous overloaded methods are unsupported"),
+            .describe("Omit for class references; select ambiguous methods with overload_index"),
+        overload_index: z
+            .number()
+            .int()
+            .nonnegative()
+            .optional()
+            .describe("Index among same-name methods from inspect_android_class; requires method_name"),
     }),
 };
+/** Optional retained delivery is separate from the engine's APK request. */
+export const androidPackageInspectionInputSchema = androidInputSchemas.inspect_android_package.extend({
+    detail: z.enum(["complete", "summary"]).optional(),
+});
 /** Validate operation and input together so their types remain correlated. */
 export const androidRequestSchema = z.discriminatedUnion("operation", [
     z.strictObject({
@@ -64,12 +74,16 @@ const textCoverage = z.strictObject({
     text: z.string(),
     reported_total_bytes: z.number().int().nonnegative().nullable(),
 });
+/** A DEX prototype; hex parentheses also keep the advertised class valid in v mode. */
+export const dexDescriptorSchema = z
+    .string()
+    .regex(/^\((?:\[*(?:[ZBSCIJFD]|L[^;\x28\x29]+;))*\)(?:V|\[*(?:[ZBSCIJFD]|L[^;\x28\x29]+;))$/u);
 const method = z.strictObject({
     name: z.string(),
     reported_signature: z.string(),
     overload_index: z.number().int().nonnegative(),
     is_constructor: z.boolean(),
-    dex_descriptor: z.null(),
+    dex_descriptor: dexDescriptorSchema,
 });
 const engine = z.strictObject({
     name: z.string().min(1),
@@ -100,6 +114,10 @@ export const androidResultSchemas = {
         query: z.string(),
         total_classes: z.number().int().nonnegative(),
         matches: z.array(z.string()),
+        duplicate_names: z.array(z.strictObject({
+            name: z.string(),
+            occurrences: z.number().int().min(2),
+        })),
         coverage: z.literal("complete"),
     }),
     inspect_android_class: z.strictObject({
@@ -124,6 +142,9 @@ export const androidResultSchemas = {
         ...common,
         class_name: z.string(),
         method_name: z.string().nullable(),
+        overload_index: z.number().int().nonnegative().nullable(),
+        reported_signature: z.string().nullable(),
+        dex_descriptor: dexDescriptorSchema.nullable(),
         total: z.number().int().nonnegative(),
         references: z.array(z.strictObject({
             kind: z.string(),
@@ -133,7 +154,20 @@ export const androidResultSchemas = {
             top_class: z.string(),
             source_line: z.null(),
             dex_offset: z.null(),
+            /** false means transport-bounded instruction evidence; null is unknown. */
+            direct_invokes_exhaustive: z.boolean().nullable(),
+            /** Raw direct invoke instructions inside this using node, when available. */
+            direct_invokes: z
+                .array(z.strictObject({
+                dex_entry: z.string().min(1),
+                source_raw_method_id: z.string().min(1),
+                dex_code_unit_offset: z.number().int().nonnegative(),
+                dex_method_index: z.number().int().nonnegative(),
+                opcode: z.string().regex(/^INVOKE_/u),
+            }))
+                .nullable(),
         })),
         coverage: z.literal("complete"),
+        reference_unit: z.literal("using_node"),
     }),
 };

package/dist/domain/android/androidApplication.js

@@ -1,24 +1,14 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
 import { z } from "zod";
-import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js";
-import { evidenceSchema } from "../evidence.js";
+import { hasCompleteInventoryCoverage, parseArtifactInventoryEvidence, } from "../artifactInventoryEvidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
-import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "../bridgeCandidateProjection.js";
 import { nativeRuntimeConvention } from "../nativeConvention.js";
-const evidenceIdSchema = prefixedDigestSchema("ev");
-const pathSchema = z.string().min(1);
-const componentSchema = z.strictObject({
-    path: pathSchema,
-    artifact_id: prefixedDigestSchema("art"),
-    sha256: digestSchema,
-    format: z.string().min(1),
-});
+import { applicationInventoryProjectionInputSchema, bridgeCandidateCoverageSchema, projectCartesianCandidates, projectedBridgeCandidateSchema, projectedComponentSchema, projectedComponents, projectionCoverage, projectionDigest, projectionEvidenceIdSchema, unavailableComponentSchema, unavailableComponents, } from "../mobileApplicationGraphProjection.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
+const evidenceIdSchema = projectionEvidenceIdSchema;
+const componentSchema = projectedComponentSchema;
 /** Authenticated APK inventory pages projected as one Android application. */
-export const androidApplicationProjectionInputSchema = z.strictObject({
-    inventory_evidence: z.array(evidenceSchema).min(1),
-});
+export const androidApplicationProjectionInputSchema = applicationInventoryProjectionInputSchema;
 /** Deterministic, execution-free Android application inventory projection. */
 export const androidApplicationProjectionResultSchema = z.strictObject({
     projection_id: prefixedDigestSchema("adp"),
@@ -34,6 +24,7 @@ export const androidApplicationProjectionResultSchema = z.strictObject({
         javascript: z.array(componentSchema),
         signing: z.array(componentSchema),
     }),
+    unavailable_components: z.array(unavailableComponentSchema),
     runtime_families: z.array(z.enum([
         "dalvik-art",
         "java-kotlin",
@@ -43,23 +34,20 @@ export const androidApplicationProjectionResultSchema = z.strictObject({
         "flutter",
         "unity",
     ])),
-    bridge_candidates: z.array(z.strictObject({
-        managed_path: pathSchema,
-        native_path: pathSchema,
-        basis: z.enum([
-            "managed-and-native-content",
-            "jni-library-convention",
-            "react-native-convention",
-            "flutter-convention",
-            "unity-convention",
-        ]),
-    })),
+    bridge_candidates: z.array(projectedBridgeCandidateSchema([
+        "managed-and-native-content",
+        "jni-library-convention",
+        "react-native-convention",
+        "flutter-convention",
+        "unity-convention",
+    ])),
     bridge_candidate_coverage: bridgeCandidateCoverageSchema,
     coverage: z.strictObject({
         status: z.enum(["complete-within-inventory", "partial"]),
+        // Count completeness is separate from the declared coverage status.
         inventory_complete: z.boolean(),
     }),
-    limitations: z.array(z.string().min(1)),
+    limitations: z.array(z.string()),
 });
 /** Project exact APK paths and hashes without decoding or executing target code. */
 export const projectAndroidApplication = (input) => {
@@ -67,26 +55,15 @@ export const projectAndroidApplication = (input) => {
     const { evidence, inventory } = parseArtifactInventoryEvidence(parsed.inventory_evidence);
     if (inventory.manifest.root_format !== "apk")
         throw new TypeError(`Android application projection requires APK inventory Evidence; the inventory root format is ${inventory.manifest.root_format}. APK is chosen for a ZIP archive whose name ends in .apk.`);
-    const nodes = new Map(inventory.nodes.map((node) => [node.artifact_id, node]));
-    const all = inventory.occurrences
-        .filter((occurrence) => occurrence.artifact_id !== null && occurrence.logical_path !== ".")
-        .map((occurrence) => {
-        const node = nodes.get(occurrence.artifact_id ?? "");
-        if (node === undefined)
-            throw new TypeError("Android application occurrence has no artifact node");
-        return {
-            path: occurrence.logical_path,
-            artifact_id: node.artifact_id,
-            sha256: node.sha256,
-            format: occurrence.artifact_format,
-        };
-    });
+    const all = projectedComponents(inventory);
+    const unavailable = unavailableComponents(inventory);
     const classified = classify(all);
     const bridgeProjection = bridgeCandidates([...classified.dex, ...classified.jvm_classes], classified.native_libraries);
     const components = classified;
     const limitations = [
-        ...(!inventory.complete
-            ? ["Source inventory pages are incomplete; absence is unknown."]
+        ...inventory.limitations,
+        ...(!hasCompleteInventoryCoverage(inventory, "container-entries")
+            ? ["Source inventory coverage is partial; absence is unknown."]
             : []),
         "Manifest, resource, signing, and bytecode semantics require a dedicated Android provider; this projection reports exact inventory paths and hashes only.",
         "Runtime families are inferred from inventory formats and paths; filename suffixes do not establish valid DEX or JVM class bytes.",
@@ -103,28 +80,30 @@ export const projectAndroidApplication = (input) => {
                 `Bridge candidate pairs exceeded the projection safety budget; ${bridgeProjection.coverage.omitted_candidates} hypotheses are omitted. Component arrays still include every component from the supplied inventory pages.`,
             ]
             : []),
+        ...(unavailable.length > 0
+            ? [
+                "Some inventoried occurrences have no authenticated content identity. Their paths and limitations are retained in unavailable_components; component absence is unknown.",
+            ]
+            : []),
     ];
     const withoutId = {
         root_sha256: inventory.manifest.root_sha256,
         root_format: "apk",
         source_evidence_ids: evidence
             .map(({ evidence_id: id }) => id)
-            .sort(compare),
+            .sort(compareUnicodeCodePoints),
         components,
+        unavailable_components: unavailable,
         runtime_families: runtimeFamilies(all),
         bridge_candidates: bridgeProjection.candidates,
         bridge_candidate_coverage: bridgeProjection.coverage,
-        coverage: {
-            status: inventory.complete && bridgeProjection.coverage.status === "complete"
-                ? "complete-within-inventory"
-                : "partial",
-            inventory_complete: inventory.complete,
-        },
+        coverage: projectionCoverage(inventory, bridgeProjection.coverage.status === "complete" &&
+            unavailable.length === 0),
         limitations,
     };
     return androidApplicationProjectionResultSchema.parse({
         ...withoutId,
-        projection_id: `adp_${digest(withoutId)}`,
+        projection_id: `adp_${projectionDigest(withoutId, "Android application projection")}`,
     });
 };
 const classify = (all) => ({
@@ -151,7 +130,7 @@ const runtimeFamilies = (all) => {
         if (convention !== null)
             families.add(convention);
     }
-    return [...families].sort(compare);
+    return [...families].sort(compareUnicodeCodePoints);
 };
 const bridgeCandidates = (managed, native) => {
     return projectCartesianCandidates({
@@ -175,10 +154,3 @@ const bridgeBasis = (path) => {
         return "jni-library-convention";
     return "managed-and-native-content";
 };
-const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
-const digest = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Android application projection is not canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};

package/dist/domain/apktool/apktoolResourceAnalysis.js

@@ -1,9 +1,25 @@
 import { z } from "zod";
 import { localPathStringSchema } from "../localPath.js";
 import { digestSchema } from "../digests.js";
-/** Upper bound for one decoded resource projection in one response. */
-const MAX_MANIFEST_BYTES = 512 * 1024;
 const MAX_STRINGS = 2_000;
+const ANDROID_NON_LOCALE_QUALIFIERS = new Set([
+    "car",
+    "desk",
+    "television",
+    "appliance",
+    "watch",
+    "vrheadset",
+    "night",
+    "notnight",
+]);
+const localeQualifierSchema = z
+    .string()
+    .min(2)
+    .max(16)
+    .regex(/^(?:[a-z]{2,3}(?:-(?:r?[A-Z]{2}|r?[0-9]{3}))?|b\+[a-z]{2,3}(?:\+[A-Za-z0-9]{2,8})*)$/u, "Locale must look like de, pt-BR, pt-rBR, or b+zh+Hans+CN")
+    .refine((value) => !ANDROID_NON_LOCALE_QUALIFIERS.has(value.toLowerCase()), "Android resource configuration qualifiers are not locales");
+/** Locale language tags admitted by Android resource table selection. */
+export const androidLocaleQualifierSchema = localeQualifierSchema;
 /**
  * Caller intent for Apktool-backed resource decoding. Apktool is
  * bring-your-own: REA never installs it, and decoding happens in a
@@ -17,11 +33,7 @@ export const apktoolInputSchemas = {
             .boolean()
             .default(true)
             .describe(`Project res/values/strings.xml entries (bounded to ${String(MAX_STRINGS)} entries)`),
-        locale: z
-            .string()
-            .min(2)
-            .max(16)
-            .regex(/^(?:[a-z]{2,3}(?:-(?:r?[A-Z]{2}|r?[0-9]{3}))?|b\+[a-z]{2,3}(?:\+[A-Za-z0-9]{2,8})*)$/u, "Locale must look like de, pt-BR, pt-rBR, or b+zh+Hans+CN")
+        locale: androidLocaleQualifierSchema
             .optional()
             .describe("Project strings from res/values-<locale>/strings.xml instead of the default table"),
     }),

package/dist/domain/apple/appleApplication.js

@@ -1,13 +1,13 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
 import { z } from "zod";
 import { anatomyNameIs, anatomyTailMatches, appleBundleSchema, appleComponentSchema, applicationRoots, detectBundles, isMachOFormat, isSidecar, isWithin, platformsOf, } from "./appleBundleAnatomy.js";
 import { isSwiftRuntimeLibrary, nativeRuntimeConvention, } from "../nativeConvention.js";
-import { parseArtifactInventoryEvidence } from "../artifactInventoryEvidence.js";
+import { hasCompleteInventoryCoverage, parseArtifactInventoryEvidence, } from "../artifactInventoryEvidence.js";
 import { evidenceSchema } from "../evidence.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
 import { bridgeCandidateCoverageSchema, projectCartesianCandidates, } from "../bridgeCandidateProjection.js";
+import { projectionDigest } from "../mobileApplicationGraphProjection.js";
+import { compareUnicodeCodePoints as compare } from "../unicodeCodePointOrder.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const pathSchema = z.string().min(1);
 const APPLE_ROOT_FORMATS = ["ipa", "directory", "zip", "dmg"];
@@ -57,9 +57,10 @@ export const appleApplicationProjectionResultSchema = z.strictObject({
     bridge_candidate_coverage: bridgeCandidateCoverageSchema,
     coverage: z.strictObject({
         status: z.enum(["complete-within-inventory", "partial"]),
+        // Count completeness is separate from the declared coverage status.
         inventory_complete: z.boolean(),
     }),
-    limitations: z.array(z.string().min(1)),
+    limitations: z.array(z.string()),
 });
 /** Project exact Apple application paths and hashes without parsing or executing target code. */
 export const projectAppleApplication = (input) => {
@@ -104,17 +105,21 @@ export const projectAppleApplication = (input) => {
         ...classified.native_libraries,
     ]), roots);
     const uninventoriedImage = rootFormat === "dmg" && inventory.occurrences.length === 1;
-    const complete = inventory.complete && !uninventoriedImage;
-    const limitations = projectionLimitations({
-        complete: inventory.complete,
-        uninventoriedImage,
-        roots,
-        bundles,
-        sidecars: entries.some(({ path }) => isSidecar(path)),
-        symlinks: entries.some(({ kind }) => kind === "symlink"),
-        unattributed,
-        bridgeCandidateCoverage: bridgeProjection.coverage,
-    });
+    const inventoryComplete = hasCompleteInventoryCoverage(inventory, "container-entries");
+    const complete = inventoryComplete && !uninventoriedImage;
+    const limitations = [
+        ...inventory.limitations,
+        ...projectionLimitations({
+            complete: inventoryComplete,
+            uninventoriedImage,
+            roots,
+            bundles,
+            sidecars: entries.some(({ path }) => isSidecar(path)),
+            symlinks: entries.some(({ kind }) => kind === "symlink"),
+            unattributed,
+            bridgeCandidateCoverage: bridgeProjection.coverage,
+        }),
+    ];
     const withoutId = {
         root_sha256: inventory.manifest.root_sha256,
         root_format: rootFormat,
@@ -148,14 +153,15 @@ export const projectAppleApplication = (input) => {
 /** Identify the complete projection, including source Evidence provenance. */
 export const appleProjectionId = (projection) => `aap_${digest(projection)}`;
 /**
- * IPA projection keeps every archive component, as before. Directory, ZIP,
- * and DMG inventories can hold installers and other siblings, so only
+ * AppleDouble sidecars describe neighbouring files and are never components.
+ * IPA projection keeps every other archive component, as before. Directory,
+ * ZIP, and DMG inventories can hold installers and other siblings, so only
  * components inside an application root are attributed to it.
  */
 const attributeComponents = (inventoried, roots, rootFormat) => {
-    if (rootFormat === "ipa")
-        return { all: [...inventoried], unattributed: 0 };
     const visible = inventoried.filter(({ path }) => !isSidecar(path));
+    if (rootFormat === "ipa")
+        return { all: visible, unattributed: 0 };
     const all = visible.filter(({ path }) => roots.some((root) => isWithin(path, root)));
     return { all, unattributed: visible.length - all.length };
 };
@@ -165,6 +171,7 @@ const appleRootFormat = (format) => {
         throw new TypeError(`Apple application projection requires IPA, directory, ZIP, or DMG inventory Evidence (got ${format})`);
     return root;
 };
+const isNativeLibrary = (path) => /\.(?:dylib|so)$/iu.test(path);
 const classifyComponents = (entries, all, roots) => {
     const withinApp = (path) => roots.some((root) => isWithin(path, root));
     const matching = (predicate) => entries.flatMap(({ path, kind, component }) => kind === "file" &&
@@ -177,9 +184,10 @@ const classifyComponents = (entries, all, roots) => {
     const lastSegment = (path) => path.split("/").at(-1) ?? "";
     return {
         bundle_metadata: all.filter(({ path }) => anatomyNameIs(lastSegment(path), "Info.plist")),
-        executables: all.filter(({ path, format }) => withinApp(path) && isMachOFormat(format)),
+        // An unrooted IPA library is listed only under native_libraries.
+        executables: all.filter(({ path, format }) => isMachOFormat(format) && (withinApp(path) || !isNativeLibrary(path))),
         frameworks: all.filter(({ path }) => /\.framework\//u.test(path)),
-        native_libraries: all.filter(({ path }) => /\.(?:dylib|so)$/iu.test(path)),
+        native_libraries: all.filter(({ path }) => isNativeLibrary(path)),
         javascript: all.filter(({ format }) => format === "javascript-bundle"),
         signing: all.filter(({ path }) => anatomyTailMatches(path, ["_CodeSignature", "CodeResources"]) ||
             anatomyNameIs(lastSegment(path), "embedded.mobileprovision") ||
@@ -268,7 +276,7 @@ const bridgeBasis = (path) => {
 };
 const projectionLimitations = (facts) => [
     ...(!facts.complete
-        ? ["Source inventory pages are incomplete; absence is unknown."]
+        ? ["Source inventory coverage is partial; absence is unknown."]
         : []),
     ...(facts.uninventoriedImage
         ? [
@@ -312,10 +320,4 @@ const projectionLimitations = (facts) => [
     "Bridge candidates are path-based hypotheses, not observed runtime calls.",
     "A bridge basis is inferred from the native path and is repeated for every managed component.",
 ];
-const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
-const digest = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Apple application projection is not canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};
+const digest = (value) => projectionDigest(value, "Apple application projection");

package/dist/domain/apple/appleArchiveFormat.js

@@ -0,0 +1,184 @@
+const BINARY_PLIST_MAGIC = [0x62, 0x70, 0x6c, 0x69, 0x73, 0x74, 0x30, 0x30];
+const NIB_ARCHIVE_MAGIC = [
+    0x4e, 0x49, 0x42, 0x41, 0x72, 0x63, 0x68, 0x69, 0x76, 0x65,
+];
+/** Shared format-probe bound; this does not bound the plist document itself. */
+export const MAX_XML_PLIST_PROBE_BYTES = 1024 * 1024;
+/** Recognize the binary plist version supported by the decoder, without validating its body. */
+export const hasBinaryPlistSignature = (bytes) => BINARY_PLIST_MAGIC.every((byte, index) => bytes[index] === byte);
+/** Incremental, bounded XML signature scanner. Consumed prolog text is discarded. */
+export const createXmlPlistSignatureProbe = () => {
+    let state = "pending";
+    let preview;
+    let validator;
+    let utf16 = false;
+    let bomBytes = 0;
+    let fedBytes = 0;
+    let decodedBytes = 0;
+    let preamble = new Uint8Array();
+    const scanner = createXmlPlistPrologScanner();
+    const encodedLength = (text) => utf16 ? text.length * 2 : new TextEncoder().encode(text).length;
+    return {
+        get state() {
+            return state;
+        },
+        write(bytes) {
+            if (state !== "pending" || bytes.length === 0)
+                return state;
+            let selected = bytes.subarray(0, MAX_XML_PLIST_PROBE_BYTES - fedBytes - preamble.length);
+            if (preview === undefined) {
+                if (preamble.length !== 0 || selected.length < 4) {
+                    const joined = new Uint8Array(preamble.length + selected.length);
+                    joined.set(preamble);
+                    joined.set(selected, preamble.length);
+                    selected = joined;
+                    if (selected.length < 4) {
+                        preamble = selected;
+                        return state;
+                    }
+                    preamble = new Uint8Array();
+                }
+                const little = selected[0] === 0xff && selected[1] === 0xfe;
+                const big = selected[0] === 0xfe && selected[1] === 0xff;
+                utf16 = little || big;
+                bomBytes = utf16
+                    ? 2
+                    : selected[0] === 0xef && selected[1] === 0xbb && selected[2] === 0xbf
+                        ? 3
+                        : 0;
+                const encoding = little ? "utf-16le" : big ? "utf-16be" : "utf-8";
+                preview = new TextDecoder(encoding);
+                validator = new TextDecoder(encoding, { fatal: true });
+            }
+            const text = preview.decode(selected, { stream: true });
+            const result = scanner(text);
+            // Validate only through the observed signature. Invalid document bytes
+            // after that signature cannot undo the format observation.
+            const through = result.state === "matched"
+                ? bomBytes +
+                    decodedBytes +
+                    encodedLength(text.slice(0, result.consumed)) -
+                    fedBytes
+                : selected.length;
+            try {
+                validator.decode(selected.subarray(0, through), { stream: true });
+                state = result.state;
+            }
+            catch {
+                state = "rejected";
+            }
+            decodedBytes += encodedLength(text);
+            fedBytes += selected.length;
+            if (fedBytes === MAX_XML_PLIST_PROBE_BYTES && state === "pending")
+                state = "rejected";
+            return state;
+        },
+    };
+};
+/** Recognize a plist prolog without claiming that its XML document is valid. */
+export const hasXmlPlistSignature = (bytes) => createXmlPlistSignatureProbe().write(bytes) === "matched";
+const createXmlPlistPrologScanner = () => {
+    let text = "";
+    let totalCharacters = 0;
+    let pending;
+    let doctypeName = false;
+    return (chunk) => {
+        const before = totalCharacters;
+        totalCharacters += chunk.length;
+        text += chunk;
+        let cursor = 0;
+        const result = (state, through = cursor) => ({
+            state,
+            consumed: totalCharacters - text.length + through - before,
+        });
+        while (true) {
+            if (pending !== undefined) {
+                const end = text.indexOf(pending, cursor);
+                if (end < 0) {
+                    text = text.slice(Math.max(cursor, text.length - pending.length + 1));
+                    return result("pending");
+                }
+                cursor = end + pending.length;
+                pending = undefined;
+            }
+            while (cursor < text.length && isXmlWhitespace(text[cursor]))
+                cursor++;
+            if (cursor === text.length) {
+                text = "";
+                return result("pending");
+            }
+            if (doctypeName) {
+                const token = tokenAt(text, cursor, "plist");
+                if (token === "partial" ||
+                    (token === "match" && cursor + 5 === text.length)) {
+                    text = text.slice(cursor);
+                    return result("pending");
+                }
+                const delimiter = text[cursor + 5];
+                return result(token === "match" &&
+                    (delimiter === ">" ||
+                        delimiter === "[" ||
+                        (delimiter !== undefined && isXmlWhitespace(delimiter)))
+                    ? "matched"
+                    : "rejected", cursor + 6);
+            }
+            for (const [token, terminator] of [
+                ["<!--", "-->"],
+                ["<?", "?>"],
+            ]) {
+                const match = tokenAt(text, cursor, token);
+                if (match === "partial") {
+                    text = text.slice(cursor);
+                    return result("pending");
+                }
+                if (match === "match") {
+                    pending = terminator;
+                    cursor += token.length;
+                    break;
+                }
+            }
+            if (pending !== undefined)
+                continue;
+            const doctype = tokenAt(text, cursor, "<!DOCTYPE");
+            if (doctype === "partial" ||
+                (doctype === "match" && cursor + 9 === text.length)) {
+                text = text.slice(cursor);
+                return result("pending");
+            }
+            if (doctype === "match") {
+                if (!isXmlWhitespace(text[cursor + 9]))
+                    return result("rejected");
+                cursor += 10;
+                doctypeName = true;
+                continue;
+            }
+            const root = tokenAt(text, cursor, "<plist");
+            if (root === "partial" ||
+                (root === "match" && cursor + 6 === text.length)) {
+                text = text.slice(cursor);
+                return result("pending");
+            }
+            const delimiter = text[cursor + 6];
+            return result(root === "match" &&
+                (delimiter === "/" ||
+                    delimiter === ">" ||
+                    (delimiter !== undefined && isXmlWhitespace(delimiter)))
+                ? "matched"
+                : "rejected", cursor + 7);
+        }
+    };
+};
+const tokenAt = (text, offset, token) => {
+    const available = text.slice(offset, offset + token.length);
+    return available === token
+        ? "match"
+        : token.startsWith(available)
+            ? "partial"
+            : "none";
+};
+const isXmlWhitespace = (character) => character === " " ||
+    character === "\t" ||
+    character === "\r" ||
+    character === "\n";
+/** Recognize the serialized signature without claiming a valid NIB object table. */
+export const hasNibArchiveSignature = (bytes) => NIB_ARCHIVE_MAGIC.every((byte, index) => bytes[index] === byte);

package/dist/domain/apple/appleAssetCatalog.js

@@ -1,6 +1,21 @@
 import { z } from "zod";
 import { jsonValueSchema } from "../jsonValue.js";
 import { AnalysisOutputError } from "../analysisErrorCore.js";
+const RESOURCE_KEY_FIELDS = new Set([
+    "image",
+    "imageName",
+    "image_name",
+    "resourceName",
+    "resource_name",
+    "assetName",
+    "asset_name",
+    "UIImageName",
+    "NSImageName",
+]);
+/** Recognized direct scalar resource fields; nested dictionaries are not inferred. */
+export const appleResourceKeyFields = (attributes) => Object.entries(attributes).filter((entry) => RESOURCE_KEY_FIELDS.has(entry[0]) &&
+    typeof entry[1] === "string" &&
+    entry[1].length > 0);
 /** Caller-controlled page bounds for compiled Apple asset metadata. */
 export const appleAssetCatalogInputSchema = z.strictObject({
     offset: z.number().int().min(0).default(0),

package/dist/domain/apple/appleBundleAnatomy.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { digestSchema, prefixedDigestSchema } from "../digests.js";
+import { compareUnicodeCodePoints as compare } from "../unicodeCodePointOrder.js";
 const pathSchema = z.string().min(1);
 const BUNDLE_EXTENSION = /\.(?:app|appex|xpc|framework|systemextension|dext|bundle|plugin|qlgenerator|mdimporter)$/iu;
 const MACH_O_FORMATS = ["mach-o", "mach-o-universal"];
@@ -300,4 +301,3 @@ export const platformsOf = (bundles) => [
         return [];
     })),
 ].sort(compare);
-const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/domain/apple/dyldPaths.js

@@ -1,3 +1,4 @@
+import { machoCpuSubtypeBase } from "./machoCpuIdentity.js";
 const MAX_SYMLINK_HOPS = 32;
 /**
  * Resolve a root-relative path one segment at a time, as `open` would:
@@ -80,8 +81,14 @@ const COMPATIBLE_ARCHITECTURES = {
     x86_64h: ["x86_64h", "x86_64"],
 };
 export const compatibleSlice = (slices, process) => {
-    for (const architecture of COMPATIBLE_ARCHITECTURES[process] ?? [process]) {
-        const slice = slices.find((item) => item.architecture === architecture);
+    for (const architecture of COMPATIBLE_ARCHITECTURES[process.architecture] ?? [
+        process.architecture,
+    ]) {
+        const slice = slices.find((item) => item.architecture === architecture &&
+            (process.architecture !== "arm64e" ||
+                (item.cpu_type === process.cpu_type &&
+                    machoCpuSubtypeBase(item.cpu_subtype) ===
+                        machoCpuSubtypeBase(process.cpu_subtype))));
         if (slice !== undefined)
             return slice;
     }