rea-agents 6.4.0 → 6.5.0

package/dist/domain/apple/dylibResolution.js

@@ -195,7 +195,7 @@ const evaluateCandidate = async (template, context) => {
     if (facts.status !== "parsed")
         outcome = facts.status;
     else {
-        const slice = compatibleSlice(facts.slices, context.architecture);
+        const slice = compatibleSlice(facts.slices, context.processIdentity);
         if (slice === undefined)
             outcome = "architecture-missing";
         // Dependency commands require a dylib; generic dyld image loadability
@@ -203,7 +203,7 @@ const evaluateCandidate = async (template, context) => {
         else if (slice.file_type_code !== 6)
             outcome = "not-loadable";
         else {
-            const platformResult = platformLoadability(context.platforms, slice.platforms, slice.file_type_code, context.architecture);
+            const platformResult = platformLoadability(context.platforms, slice.platforms, slice.file_type_code, context.processIdentity.architecture);
             outcome =
                 platformResult === "compatible"
                     ? "resolved"
@@ -278,7 +278,9 @@ const resolution = (candidates) => {
 const resolveDependency = async (dependency, loader, context) => {
     const current = context.loaded.get(loader);
     const chain = current?.chain ?? [loader];
-    const loaded = context.byInstallName.get(dependency.install_name);
+    const loaded = dependency.install_name.startsWith("@rpath/")
+        ? context.byInstallName.get(dependency.install_name)
+        : undefined;
     const candidates = [];
     if (loaded !== undefined)
         candidates.push({
@@ -318,11 +320,11 @@ const resolveDependency = async (dependency, loader, context) => {
         : searched;
     const image = resolved.image === null ? undefined : context.images.get(resolved.image);
     const slice = image?.status === "parsed"
-        ? compatibleSlice(image.slices, context.architecture)
+        ? compatibleSlice(image.slices, context.processIdentity)
         : undefined;
     return {
         root: context.root,
-        architecture: context.architecture,
+        architecture: context.processIdentity.architecture,
         loader,
         via: [...chain],
         ...dependency,
@@ -345,7 +347,8 @@ const traceProcess = async (context, rootSlice, signal) => {
         chain: [context.root],
         conditional: false,
     });
-    if (rootSlice.install_name !== null)
+    if (rootSlice.install_name !== null &&
+        rootSlice.install_name.startsWith("@rpath/"))
         context.byInstallName.set(rootSlice.install_name, context.root);
     const pending = [context.root];
     while (pending.length > 0) {
@@ -366,7 +369,7 @@ const traceProcess = async (context, rootSlice, signal) => {
                 continue;
             const facts = context.images.get(image);
             const slice = facts?.status === "parsed"
-                ? compatibleSlice(facts.slices, context.architecture)
+                ? compatibleSlice(facts.slices, context.processIdentity)
                 : undefined;
             if (slice === undefined)
                 continue;
@@ -377,6 +380,7 @@ const traceProcess = async (context, rootSlice, signal) => {
                 conditional: current.conditional || edge.resolution.status === "conditional",
             });
             if (slice.install_name !== null &&
+                slice.install_name.startsWith("@rpath/") &&
                 !context.byInstallName.has(slice.install_name))
                 context.byInstallName.set(slice.install_name, image);
             created.push(image);
@@ -391,6 +395,7 @@ export const traceDylibLoading = async (view, request) => {
     for (const path of request.unclassified ?? [])
         images.set(path, await view.image(path));
     const roots = [];
+    const rootSlices = [];
     const edges = [];
     const withoutArchitecture = [];
     const environmentRoots = new Set();
@@ -413,10 +418,15 @@ export const traceDylibLoading = async (view, request) => {
             if (searchOverrides.some(({ variable, value }) => variable === "DYLD_INSERT_LIBRARIES" && value !== ""))
                 environmentRoots.add(root);
             roots.push({ image: root, architecture: slice.architecture });
+            rootSlices.push({ image: root, slice });
             edges.push(...(await traceProcess({
                 view,
                 root,
-                architecture: slice.architecture,
+                processIdentity: {
+                    architecture: slice.architecture,
+                    cpu_type: slice.cpu_type,
+                    cpu_subtype: slice.cpu_subtype,
+                },
                 searchOverrides,
                 environmentRoots,
                 platforms: slice.platforms,
@@ -444,7 +454,7 @@ export const traceDylibLoading = async (view, request) => {
             slices: facts.status === "parsed" ? facts.slices.map(withoutDependencies) : [],
         })),
         edges,
-        findings: deriveFindings(edges, roots, images),
+        findings: deriveFindings(edges, rootSlices),
         coverage: {
             status: unparsed.length === 0 &&
                 withoutArchitecture.length === 0 &&

package/dist/domain/apple/dylibResolutionFindings.js

@@ -1,4 +1,4 @@
-export const deriveFindings = (edges, roots, images) => {
+export const deriveFindings = (edges, roots) => {
     const findings = [];
     edges.forEach((edge, index) => {
         if (edge.resolution.status === "unresolved")
@@ -17,19 +17,18 @@ export const deriveFindings = (edges, roots, images) => {
                 explanation: `The modeled dyld search checks ${earlier.join(", ")} before ${edge.resolution.image ?? edge.install_name}. A compatible Mach-O placed at an earlier modeled path could take precedence over that fallback, subject to unmodeled search inputs and code-signing library validation; library validation is not evaluated here (see inspect_signature).${edge.loader_conditional ? " This loader loads only conditionally; if it never loads, this search never occurs." : ""}${edge.resolution.status === "conditional" ? " Unmodeled environment overrides or earlier unknown candidates may take precedence; placing an image at this rpath does not establish which image dyld will load." : ""}`,
             });
     });
-    for (const { image, architecture } of roots) {
-        const facts = images.get(image);
-        const slice = facts?.status === "parsed"
-            ? facts.slices.find((candidate) => candidate.architecture === architecture)
-            : undefined;
-        const environment = slice?.dyld_environment ?? [];
+    // Slices can share an architecture name (arm64e and arm64e.x1), so each
+    // finding uses the slice its root was traced from, not a name lookup.
+    for (const { image, slice } of roots) {
+        const { architecture } = slice;
+        const environment = slice.dyld_environment;
         if (environment.length > 0)
             findings.push({
                 kind: "dyld-environment-present",
                 edge_index: null,
                 image,
                 basis: "derived",
-                explanation: slice?.file_type === "execute"
+                explanation: slice.file_type === "execute"
                     ? `${image} (${architecture}) sets dyld environment variables through LC_DYLD_ENVIRONMENT (${environment.join(", ")}); any image-selection overrides they request are not modeled. Diagnostic settings alone do not alter resolution.`
                     : `${image} (${architecture}) contains LC_DYLD_ENVIRONMENT (${environment.join(", ")}). Dyld reads these commands only from the main executable; entries in this non-executable root are observations and do not alter resolution.`,
             });
@@ -70,7 +69,7 @@ export const DYLIB_RESOLUTION_LIMITATIONS = [
     "Slices are matched by dyld's graded architectures (an x86_64h process also loads x86_64). arm64e processes that disable pointer authentication can also load arm64 slices; that fallback is not modeled.",
     "Absolute install names and rpaths are outside the analyzed root and are not evaluated, including /System and /usr/lib libraries that the dyld shared cache usually provides.",
     "Leaf and relative install names depend on dyld fallback paths, DYLD_* variables, and the working directory; they are undetermined.",
-    "Load order follows dyld's dependents-first traversal in load-command order. An image reached through several chains is resolved once per process, with the rpath stack and conditionality of the first chain; a later request whose install name matches an already loaded image reuses it.",
+    "Load order follows dyld's dependents-first traversal in load-command order. An image reached through several chains is resolved once per process, with the rpath stack and conditionality of the first chain; a later @rpath request whose install name matches an already loaded image reuses it.",
     "@loader_path uses each image's symlink-resolved path within the analyzed root.",
     "Code-signing checks that can reject a found image, such as library validation and the hardened runtime, are not evaluated.",
     "Dylib compatibility versions are not compared. Apple's linker documentation describes a load-time rejection when an image's compatibility version is older than the loader requires, but dyld on macOS 26 was observed to load such an image.",

package/dist/domain/apple/interfaceBuilderGraph.js

@@ -91,6 +91,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
         let hierarchyEdgeCount = 0;
         let documentOmittedConnections = 0;
         let documentOmittedHierarchyEdges = 0;
+        let hierarchyTruncated = false;
         const objectNodeId = (objectId) => graphId("object", [objectId]);
         const addEdge = (edge, isHierarchy) => {
             if (isHierarchy
@@ -98,6 +99,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                 : connectionEdgeCount >= input.limits.max_connections * 3) {
                 truncated = true;
                 if (isHierarchy) {
+                    hierarchyTruncated = true;
                     documentOmittedHierarchyEdges += 1;
                 }
                 else {
@@ -113,9 +115,11 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                 connectionEdgeCount += 1;
         };
         const connect = (id, from, to, relation, description, reason) => {
+            const isHierarchy = relation === "contains" && id.includes(":hierarchy:");
             if (!nodes.has(from)) {
                 truncated = true;
-                if (relation === "contains" && id.includes(":hierarchy:")) {
+                if (isHierarchy) {
+                    hierarchyTruncated = true;
                     documentOmittedHierarchyEdges += 1;
                 }
                 else {
@@ -126,8 +130,11 @@ export const buildInterfaceBuilderAnalysis = (input) => {
             }
             const evidence = evidenceFor(description);
             const unresolvedEndpoint = to !== null && !nodes.has(to);
-            if (unresolvedEndpoint)
+            if (unresolvedEndpoint) {
                 truncated = true;
+                if (isHierarchy)
+                    hierarchyTruncated = true;
+            }
             const edgeTo = unresolvedEndpoint ? null : to;
             const edgeReason = unresolvedEndpoint
                 ? "endpoint_omitted_by_object_limit"
@@ -151,10 +158,9 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                     resolution: "observed",
                     evidence,
                     limitations: [],
-                }, relation === "contains" && id.includes(":hierarchy:"));
+                }, isHierarchy);
         };
         let hierarchyCount = 0;
-        let hierarchyTruncated = false;
         const visitHierarchy = (initial, initialParentId) => {
             const pending = [{ value: initial, parentId: initialParentId }];
             while (pending.length > 0) {
@@ -280,25 +286,40 @@ export const buildInterfaceBuilderAnalysis = (input) => {
         }
         const objectsTruncated = parsed.omittedObjects > 0 || parsed.objects.length > documentObjectCount;
         const parserOmittedHierarchyReferences = parsed.omittedHierarchyReferences;
-        omittedHierarchyReferences += parserOmittedHierarchyReferences;
+        const omittedSerializedHierarchyReferences = document.omittedSerializedHierarchyReferences ?? 0;
+        omittedHierarchyReferences +=
+            parserOmittedHierarchyReferences + omittedSerializedHierarchyReferences;
         const parserOmittedConnections = parsed.omittedConnections;
         const connectionsTruncated = parserOmittedConnections > 0 ||
             parsed.connections.length > input.limits.max_connections;
+        // A recognized connector the parser could not attach to an owner produces
+        // no connection record, so its coverage is partial with its own reason
+        // rather than absent or truncated.
+        const connectionsUnresolved = parsed.unresolvedConnections > 0;
         omittedObjects +=
             parsed.omittedObjects +
                 Math.max(0, parsed.objects.length - documentObjectCount);
         omittedConnections +=
             Math.max(0, parsed.connections.length - input.limits.max_connections) +
-                parserOmittedConnections;
+                parserOmittedConnections +
+                parsed.unresolvedConnections;
+        const hierarchyStatus = parserOmittedHierarchyReferences > 0 ||
+            omittedSerializedHierarchyReferences > 0
+            ? "partial"
+            : parsed.hierarchy.length === 0
+                ? "unsupported"
+                : hierarchyTruncated
+                    ? "partial"
+                    : "complete";
         summaries.push({
             relative_path: document.relativePath,
             archive_sha256: document.archiveSha256,
             document_kind: document.documentKind,
             object_count: parsed.objectCount,
-            connection_count: parsed.connections.length + parserOmittedConnections,
-            hierarchy_complete: parsed.hierarchy.length > 0 &&
-                !truncated &&
-                parserOmittedHierarchyReferences === 0,
+            connection_count: parsed.connections.length +
+                parserOmittedConnections +
+                parsed.unresolvedConnections,
+            hierarchy_complete: hierarchyStatus === "complete",
         });
         coverage.push({
             facet: `objects:${document.relativePath}`,
@@ -309,34 +330,37 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                 Math.max(0, parsed.objects.length - documentObjectCount),
         }, {
             facet: `connections:${document.relativePath}`,
-            status: connectionsTruncated || documentOmittedConnections > 0
+            status: connectionsTruncated ||
+                documentOmittedConnections > 0 ||
+                connectionsUnresolved
                 ? "partial"
                 : "complete",
             reason: connectionsTruncated || documentOmittedConnections > 0
                 ? "connection_limit_reached"
-                : null,
+                : connectionsUnresolved
+                    ? "connection_unresolved"
+                    : null,
             examined: Math.min(parsed.connections.length, input.limits.max_connections),
             omitted: Math.max(0, parsed.connections.length - input.limits.max_connections) +
                 documentOmittedConnections +
-                parserOmittedConnections,
+                parserOmittedConnections +
+                parsed.unresolvedConnections,
         }, {
             facet: `hierarchy:${document.relativePath}`,
-            status: parserOmittedHierarchyReferences > 0
-                ? "partial"
-                : parsed.hierarchy.length === 0
-                    ? "unsupported"
-                    : hierarchyTruncated || documentOmittedHierarchyEdges > 0
-                        ? "partial"
-                        : "complete",
+            status: hierarchyStatus,
             reason: parserOmittedHierarchyReferences > 0
                 ? "archive_hierarchy_references_missing"
-                : parsed.hierarchy.length === 0
-                    ? "archive_hierarchy_not_decoded"
-                    : hierarchyTruncated || documentOmittedHierarchyEdges > 0
-                        ? "graph_limit_reached"
-                        : null,
+                : omittedSerializedHierarchyReferences > 0
+                    ? "serialized_view_hierarchy_incomplete"
+                    : parsed.hierarchy.length === 0
+                        ? "archive_hierarchy_not_decoded"
+                        : hierarchyTruncated
+                            ? "graph_limit_reached"
+                            : null,
             examined: hierarchyCount,
-            omitted: documentOmittedHierarchyEdges + parserOmittedHierarchyReferences,
+            omitted: documentOmittedHierarchyEdges +
+                parserOmittedHierarchyReferences +
+                omittedSerializedHierarchyReferences,
         }, {
             facet: `classes:${document.relativePath}`,
             status: Object.keys(parsed.classes).length > 0 ? "complete" : "unsupported",

package/dist/domain/apple/interfaceBuilderKeyedArchive.js

@@ -26,6 +26,12 @@ const connection = z.strictObject({
     label: z.string().nullable(),
     attributes: z.record(z.string(), jsonValueSchema),
 });
+/** UIKit runtime connection classes store their endpoints and labels under UI-prefixed keys. */
+export const isUIKitRuntimeConnectionClass = (className) => /^UIRuntime\w*Connection$/u.test(className);
+/** The connection class selects the source archive field namespace. */
+export const interfaceBuilderConnectionFieldNames = (className) => isUIKitRuntimeConnectionClass(className)
+    ? { source: "UISource", destination: "UIDestination", label: "UILabel" }
+    : { source: "NSSource", destination: "NSDestination", label: "NSLabel" };
 /** Parse ibtool dictionaries or compiled keyed archives into typed records. */
 export const parseInterfaceBuilderRecords = (value) => {
     const root = record(value);
@@ -91,6 +97,7 @@ export const parseInterfaceBuilderRecords = (value) => {
         objectCount: objectEntries.length,
         omittedObjects: Math.max(0, objectEntries.length - 20_000),
         omittedConnections,
+        unresolvedConnections: 0,
         omittedHierarchyReferences: 0,
     };
 };
@@ -269,6 +276,7 @@ const parseKeyedArchive = (root) => {
     const connections = [];
     let objectCount = 0;
     let omittedConnections = 0;
+    let unresolvedConnections = 0;
     for (const [index, raw] of objectTable.entries()) {
         if (index === 0)
             continue;
@@ -294,20 +302,31 @@ const parseKeyedArchive = (root) => {
             }));
         if (/(?:Outlet|Connection|Segue|ActionConnection|ControlConnector)/iu.test(className)) {
             const controlAction = /ControlConnector/iu.test(className);
-            // AppKit connectors (NSNibOutletConnector, NSNibControlConnector)
-            // archive NSSource as the outlet owner or sending control and
-            // NSDestination as the outlet value or action target, so they are read
-            // in that order without the inversion the unprefixed fields use.
-            const source = firstObjectReference(controlAction ? fields.destination : fields.source, archivedObjectReference(fields.NSSource), controlAction ? fields.to : fields.from, controlAction ? fields.target : fields.owner);
-            if (source === null)
+            const uiKit = isUIKitRuntimeConnectionClass(className);
+            // AppKit and UIKit archive the same endpoint roles under their own
+            // class-specific field namespaces; the source is the outlet owner.
+            const connectionFields = interfaceBuilderConnectionFieldNames(className);
+            const source = uiKit
+                ? archivedObjectReference(fields[connectionFields.source])
+                : firstObjectReference(controlAction ? fields.destination : fields.source, archivedObjectReference(fields[connectionFields.source]), controlAction ? fields.to : fields.from, controlAction ? fields.target : fields.owner);
+            if (source === null) {
+                // A recognized connector that cannot name its owner is an unresolved
+                // connection, not an absent one, and cannot be represented as a
+                // connection because connection identity requires a source.
+                unresolvedConnections += 1;
                 continue;
+            }
             const kind = controlAction ? "action" : classifyConnection(className);
             const parsedConnection = connection.parse({
                 id: `archive:${objectId}`,
                 kind,
                 source_id: source,
-                destination_id: firstObjectReference(controlAction ? fields.source : fields.destination, archivedObjectReference(fields.NSDestination), controlAction ? fields.from : fields.to, controlAction ? fields.owner : fields.target),
-                label: firstString(fields.label, fields.NSLabel, fields.selector, fields.identifier, fields.action),
+                destination_id: uiKit
+                    ? archivedObjectReference(fields[connectionFields.destination])
+                    : firstObjectReference(controlAction ? fields.source : fields.destination, archivedObjectReference(fields[connectionFields.destination]), controlAction ? fields.from : fields.to, controlAction ? fields.owner : fields.target),
+                label: uiKit
+                    ? firstString(fields[connectionFields.label])
+                    : firstString(fields.label, fields[connectionFields.label], fields.selector, fields.identifier, fields.action),
                 attributes: jsonSafeRecord(fields),
             });
             if (connections.length < 40_000)
@@ -340,6 +359,7 @@ const parseKeyedArchive = (root) => {
         objectCount,
         omittedObjects: Math.max(0, objectCount - 20_000),
         omittedConnections,
+        unresolvedConnections,
         omittedHierarchyReferences: hierarchy.omittedReferences,
     };
 };

package/dist/domain/apple/machoContainer.js

@@ -1,3 +1,92 @@
+const FAT_MAGIC = 0xcafebabe;
+const FAT_MAGIC_64 = 0xcafebabf;
+const FAT_CIGAM = 0xbebafeca;
+const FAT_CIGAM_64 = 0xbfbafeca;
+const MAX_FAT_ARCHITECTURES = 128;
+const KNOWN_MACHO_CPU_TYPES = [
+    7, 0x01000007, 12, 0x0100000c, 0x0200000c, 18, 0x01000012,
+];
+const MACHO_HEADER_MAGICS = [
+    0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe,
+];
+/** Parse a bounded FAT header and table without treating the magic alone as proof. */
+export const readFatContainerHeader = (bytes, fileSize) => {
+    if (bytes.byteLength < 4)
+        return { state: "not-fat" };
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const magic = view.getUint32(0, false);
+    if (![FAT_MAGIC, FAT_MAGIC_64, FAT_CIGAM, FAT_CIGAM_64].includes(magic))
+        return { state: "not-fat" };
+    if (!Number.isSafeInteger(fileSize) || fileSize < bytes.byteLength)
+        return {
+            state: "malformed",
+            reason: "FAT file size is invalid or contradicts retained bytes",
+        };
+    if (bytes.byteLength < 8) {
+        return fileSize < 8
+            ? { state: "malformed", reason: "FAT header is truncated" }
+            : { state: "needs-data", requiredBytes: 8 };
+    }
+    const littleEndian = magic === FAT_CIGAM || magic === FAT_CIGAM_64;
+    const wide = magic === FAT_MAGIC_64 || magic === FAT_CIGAM_64;
+    const count = view.getUint32(4, littleEndian);
+    if (count === 0)
+        return {
+            state: "malformed",
+            reason: "FAT header declares no architectures",
+        };
+    if (count > MAX_FAT_ARCHITECTURES)
+        return { state: "not-fat" };
+    const tableEnd = 8 + count * (wide ? 32 : 20);
+    if (tableEnd > fileSize)
+        return { state: "not-fat" };
+    if (tableEnd > bytes.byteLength)
+        return { state: "needs-data", requiredBytes: tableEnd };
+    const declarations = readFatSliceDeclarations(bytes.subarray(8, tableEnd), {
+        count,
+        wide,
+        littleEndian,
+    });
+    return declarations.status === "parsed"
+        ? {
+            state: "parsed",
+            magic,
+            count,
+            wide,
+            littleEndian,
+            tableEnd,
+            slices: declarations.slices,
+            rangeIssues: declarations.slices.map((slice) => inspectFatSliceRange(slice, fileSize, tableEnd)),
+        }
+        : { state: "malformed", reason: declarations.reason };
+};
+/** Confirm FAT identity from architecture records and observed slice headers. */
+export const classifyFatContainerIdentity = (header, sliceHeaderAt) => {
+    const hasKnownCpu = header.slices.some(({ cpuType }) => KNOWN_MACHO_CPU_TYPES.includes(cpuType));
+    const invalidRange = header.rangeIssues.find((issue) => issue !== null);
+    if (hasKnownCpu)
+        return invalidRange === undefined
+            ? { state: "mach-o" }
+            : { state: "malformed", ...invalidRange };
+    const validRanges = header.slices.filter((_slice, index) => header.rangeIssues[index] === null);
+    const missingHeaders = [];
+    let observedMachO = false;
+    for (const slice of validRanges) {
+        const magic = sliceHeaderAt(slice.offset);
+        if (magic === undefined)
+            missingHeaders.push(slice.offset);
+        else if (magic !== null && MACHO_HEADER_MAGICS.includes(magic))
+            observedMachO = true;
+    }
+    if (observedMachO) {
+        return invalidRange === undefined
+            ? { state: "mach-o" }
+            : { state: "malformed", ...invalidRange };
+    }
+    if (missingHeaders.length > 0)
+        return { state: "needs-slice-header", offsets: missingHeaders };
+    return { state: "not-mach-o" };
+};
 /** Decode FAT table entries once so artifact and native readers share identity facts. */
 export const readFatSliceDeclarations = (tableBytes, options) => {
     const { count, wide, littleEndian } = options;
@@ -32,23 +121,46 @@ export const readFatSliceDeclarations = (tableBytes, options) => {
 };
 /** Validate byte-range and table/header identity facts shared by Mach-O readers. */
 export const validateFatSlice = (declaration, containerSize, tableEnd, embedded) => {
-    const { index, offset, size, alignmentExponent, cpuType, cpuSubtype } = declaration;
+    const rangeIssue = inspectFatSliceRange(declaration, containerSize, tableEnd);
+    if (rangeIssue !== null)
+        return rangeIssue.reason;
+    return embedded === undefined
+        ? null
+        : validateFatSliceIdentity(declaration, embedded);
+};
+/** Validate table placement, container bounds, and alignment with a typed failure. */
+export const inspectFatSliceRange = (declaration, containerSize, tableEnd) => {
+    const { index, offset, size, alignmentExponent } = declaration;
     if (!Number.isSafeInteger(offset) ||
         !Number.isSafeInteger(size) ||
         size <= 0 ||
         offset < tableEnd)
-        return `FAT architecture ${index} has an invalid slice range`;
+        return {
+            category: "malformed",
+            reason: `FAT architecture ${index} has an invalid slice range`,
+        };
     if (offset > containerSize || size > containerSize - offset)
-        return `FAT architecture ${index} slice range extends beyond the file`;
+        return {
+            category: "malformed",
+            reason: `FAT architecture ${index} slice range extends beyond the file`,
+        };
     if (!Number.isInteger(alignmentExponent) ||
         alignmentExponent < 0 ||
         alignmentExponent > 52)
-        return `FAT architecture ${index} alignment exponent ${alignmentExponent} is unsupported`;
+        return {
+            category: "unsupported",
+            reason: `FAT architecture ${index} alignment exponent ${alignmentExponent} is unsupported`,
+        };
     if (offset % 2 ** alignmentExponent !== 0)
-        return `FAT architecture ${index} offset is not aligned to 2^${alignmentExponent}`;
-    if (embedded !== undefined &&
-        (embedded.cpuType !== cpuType || embedded.cpuSubtype !== cpuSubtype))
-        return `FAT architecture ${index} CPU type/subtype disagrees with its Mach-O header`;
+        return {
+            category: "malformed",
+            reason: `FAT architecture ${index} offset is not aligned to 2^${alignmentExponent}`,
+        };
     return null;
 };
+/** Validate only the identity claim after the owner has validated its range. */
+export const validateFatSliceIdentity = (declaration, embedded) => embedded.cpuType === declaration.cpuType &&
+    embedded.cpuSubtype === declaration.cpuSubtype
+    ? null
+    : `FAT architecture ${declaration.index} CPU type/subtype disagrees with its Mach-O header`;
 const safeNumber = (value) => value > BigInt(Number.MAX_SAFE_INTEGER) ? null : Number(value);

package/dist/domain/apple/machoCpuIdentity.js

@@ -0,0 +1,4 @@
+/** CPU subtype bits reserved for ABI/capability flags, not the base subtype. */
+const CPU_SUBTYPE_CAPABILITY_MASK = 0xff000000;
+/** Return the CPU subtype identity shared across capability-flag variations. */
+export const machoCpuSubtypeBase = (cpuSubtype) => cpuSubtype & ~CPU_SUBTYPE_CAPABILITY_MASK;

package/dist/domain/apple/plistValue.js

@@ -1,5 +1,10 @@
 import { z } from "zod";
-const MAX_PLIST_DEPTH = 128;
+/**
+ * Maximum plist value nesting the JSON projection supports. The XML decode
+ * preflight shares this limit so oversized documents are rejected before any
+ * recursive pass rather than during one.
+ */
+export const MAX_PLIST_DEPTH = 128;
 /**
  * Project a decoded plist into JSON. Data and dates become explicit
  * `$plist_type` objects; a non-finite real becomes an explicit unknown