rea-agents 6.4.0 → 6.5.0

package/dist/artifacts/apple/AppleAssetCatalogAnalysis.js

@@ -1,66 +1,43 @@
 import { createHash } from "node:crypto";
 import { lstat } from "node:fs/promises";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
-import { ArtifactReaderFailure } from "../ArtifactReader.js";
+import { ArtifactReaderFailure, sameArtifactSourceIdentity, } from "../ArtifactReader.js";
 import { analyzeInterfaceBuilderBundle } from "./InterfaceBuilderAnalysis.js";
-import { appleAssetCatalogInputSchema, parseAppleAssetCatalogRecords, projectAppleAssetCatalogPage, } from "../../domain/apple/appleAssetCatalog.js";
+import { appleAssetCatalogInputSchema, appleResourceKeyFields, parseAppleAssetCatalogRecords, projectAppleAssetCatalogPage, } from "../../domain/apple/appleAssetCatalog.js";
 import { execFileOutput } from "../../process/ExecFileOutput.js";
 const ASSETUTIL = "/usr/bin/assetutil";
 const MAX_CATALOG_BYTES = 64 * 1024 * 1024;
 const MAX_TOTAL_METADATA_BYTES = 64 * 1024 * 1024;
-const RESOURCE_KEY_FIELDS = new Set([
-    "image",
-    "imageName",
-    "image_name",
-    "resourceName",
-    "resource_name",
-    "assetName",
-    "asset_name",
-    "UIImageName",
-    "NSImageName",
-]);
 /** Inspect compiled asset catalog metadata without extracting rendition bytes. */
 export const analyzeAppleAssetCatalogs = async (input) => {
     if (process.platform !== "darwin" && input.runAssetUtil === undefined)
         throw new ArtifactReaderFailure("unavailable", "Apple asset catalog inspection requires macOS assetutil");
     const page = appleAssetCatalogInputSchema.parse(input.page ?? {});
-    const reader = new DirectoryArtifactReader(input.bundlePath);
-    const catalogs = [];
-    const uninspected = [];
-    let totalMetadataBytes = 0;
+    // The Interface Builder graph only supplies resource keys for the join. Its
+    // bundle walk is independent of the catalog walk, so both run together; a
+    // catalog failure cancels it and is reported as the sequential order would.
+    const interfaceBuilderCancel = new AbortController();
+    const interfaceBuilderAnalysis = (input.analyzeInterfaceBuilder ?? analyzeInterfaceBuilderBundle)({
+        bundlePath: input.bundlePath,
+        targetSha256: input.targetSha256,
+        signal: input.signal === undefined
+            ? interfaceBuilderCancel.signal
+            : AbortSignal.any([input.signal, interfaceBuilderCancel.signal]),
+    }).then((value) => ({ ok: true, value }), (error) => ({ ok: false, error }));
+    let catalogs;
+    let uninspected;
     try {
-        for await (const entry of reader.entries(input.signal)) {
-            if (!entry.path.endsWith("Assets.car"))
-                continue;
-            if (entry.kind !== "file") {
-                uninspected.push(`${entry.path} (${entry.kind})`);
-                continue;
-            }
-            const inspected = await inspectAssetCatalogEntry({
-                reader,
-                entry,
-                runAssetUtil: input.runAssetUtil ??
-                    ((path, signal) => runAssetUtil(path, input.environment, signal)),
-                ...(input.signal === undefined ? {} : { signal: input.signal }),
-            });
-            totalMetadataBytes += inspected.metadataBytes;
-            if (totalMetadataBytes > MAX_TOTAL_METADATA_BYTES)
-                throw new ArtifactReaderFailure("limit", `Combined asset catalog metadata exceeds ${MAX_TOTAL_METADATA_BYTES} bytes`);
-            catalogs.push(inspected.catalog);
-        }
+        ({ catalogs, uninspected } = await collectAssetCatalogs(input));
     }
-    finally {
-        await reader.close();
+    catch (cause) {
+        interfaceBuilderCancel.abort();
+        await interfaceBuilderAnalysis;
+        throw cause;
     }
-    // Without any readable catalog, unmatched resource keys would overstate an
-    // absence that a skipped catalog entry may contradict.
-    if (catalogs.length === 0 && uninspected.length > 0)
-        throw new ArtifactReaderFailure("path", `Asset catalog entries are not regular files and were not inspected: ${uninspected.join(", ")}`);
-    const interfaceBuilder = await analyzeInterfaceBuilderBundle({
-        bundlePath: input.bundlePath,
-        targetSha256: input.targetSha256,
-        ...(input.signal === undefined ? {} : { signal: input.signal }),
-    });
+    const analyzed = await interfaceBuilderAnalysis;
+    if (!analyzed.ok)
+        throw analyzed.error;
+    const interfaceBuilder = analyzed.value;
     const resourceReferences = collectInterfaceBuilderResourceKeys(interfaceBuilder.graph.nodes);
     const result = projectAppleAssetCatalogPage({
         targetSha256: input.targetSha256,
@@ -94,19 +71,53 @@ export const analyzeAppleAssetCatalogs = async (input) => {
         ],
     };
 };
+/** Inspect every regular Assets.car in the bundle; non-file entries are listed. */
+const collectAssetCatalogs = async (input) => {
+    const reader = new DirectoryArtifactReader(input.bundlePath);
+    const catalogs = [];
+    const uninspected = [];
+    let totalMetadataBytes = 0;
+    try {
+        for await (const entry of reader.entries(input.signal)) {
+            if (!entry.path.endsWith("Assets.car"))
+                continue;
+            if (entry.kind !== "file") {
+                uninspected.push(`${entry.path} (${entry.kind})`);
+                continue;
+            }
+            const inspected = await inspectAssetCatalogEntry({
+                reader,
+                entry,
+                runAssetUtil: input.runAssetUtil ??
+                    ((path, signal) => runAssetUtil(path, input.environment, signal)),
+                ...(input.signal === undefined ? {} : { signal: input.signal }),
+            });
+            totalMetadataBytes += inspected.metadataBytes;
+            if (totalMetadataBytes > MAX_TOTAL_METADATA_BYTES)
+                throw new ArtifactReaderFailure("limit", `Combined asset catalog metadata exceeds ${MAX_TOTAL_METADATA_BYTES} bytes`);
+            catalogs.push(inspected.catalog);
+        }
+    }
+    finally {
+        await reader.close();
+    }
+    // Without any readable catalog, unmatched resource keys would overstate an
+    // absence that a skipped catalog entry may contradict.
+    if (catalogs.length === 0 && uninspected.length > 0)
+        throw new ArtifactReaderFailure("path", `Asset catalog entries are not regular files and were not inspected: ${uninspected.join(", ")}`);
+    return { catalogs, uninspected };
+};
 const inspectAssetCatalogEntry = async (input) => {
     const { entry, reader, signal } = input;
     const sha256 = await digestBounded(reader, entry, signal);
-    const before = await lstat(entry.adapterKey);
-    if (entry.sourceIdentity === undefined ||
-        before.dev !== entry.sourceIdentity.device ||
-        before.ino !== entry.sourceIdentity.inode)
+    const before = await lstat(entry.adapterKey, { bigint: true });
+    if (!before.isFile() ||
+        !sameArtifactSourceIdentity(entry.sourceIdentity, before))
         throw new ArtifactReaderFailure("integrity", `Asset catalog changed before inspection: ${entry.path}`);
     const output = await input.runAssetUtil(entry.adapterKey, signal);
-    const after = await lstat(entry.adapterKey);
-    if (before.dev !== after.dev ||
-        before.ino !== after.ino ||
-        before.size !== after.size ||
+    const after = await lstat(entry.adapterKey, { bigint: true });
+    if (!after.isFile() ||
+        !sameArtifactSourceIdentity(entry.sourceIdentity, after) ||
         (await digestBounded(reader, entry, signal)) !== sha256)
         throw new ArtifactReaderFailure("integrity", `Asset catalog changed during inspection: ${entry.path}`);
     let parsed;
@@ -132,24 +143,22 @@ const inspectAssetCatalogEntry = async (input) => {
 };
 /** Return only explicit image or asset fields from decoded resource objects. */
 export const collectInterfaceBuilderResourceKeys = (nodes) => nodes.flatMap((node) => {
+    if (node.kind !== "resource")
+        return [];
     const source = node.evidence.find((item) => item.artifact_path !== null && item.artifact_sha256 !== null);
     const sourcePath = source?.artifact_path;
     const sourceArchiveSha256 = source?.artifact_sha256;
     if (sourcePath == null || sourceArchiveSha256 == null)
         return [];
-    return Object.entries(node.attributes).flatMap(([field, value]) => RESOURCE_KEY_FIELDS.has(field) &&
-        typeof value === "string" &&
-        value.length > 0
-        ? [
-            {
-                sourceNodeId: node.id,
-                sourcePath,
-                sourceArchiveSha256,
-                field,
-                key: value,
-            },
-        ]
-        : []);
+    return appleResourceKeyFields(node.attributes).flatMap(([field, value]) => [
+        {
+            sourceNodeId: node.id,
+            sourcePath,
+            sourceArchiveSha256,
+            field,
+            key: value,
+        },
+    ]);
 });
 const runAssetUtil = async (path, environment, signal) => {
     try {

package/dist/artifacts/apple/DylibResolutionReader.js

@@ -8,9 +8,12 @@ import { dylibResolutionInputSchema, dylibResolutionResultSchema, traceDylibLoad
 import { projectInputIssues } from "../../domain/inputIssueProjection.js";
 import { ArtifactReaderFailure } from "../ArtifactReader.js";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
+import { consumeWithOrderedReads } from "../OrderedReads.js";
 import { hasMachoMagic, readMachoImage } from "./MachoLoadCommandReader.js";
 const OPERATION = "trace_dylib_resolution";
 const HASH_CHUNK_BYTES = 1024 * 1024;
+/** Concurrent four-byte magic reads while enumerating bundle roots. */
+const MAGIC_READ_CONCURRENCY = 8;
 /** Lazily probed, symlink-preserving view of one analyzed directory. */
 class FilesystemTreeView {
     root;
@@ -134,17 +137,20 @@ export const traceDylibResolution = async (options) => {
 const executableRoots = async (root, view, signal) => {
     const roots = [];
     const unclassified = [];
-    for await (const entry of new DirectoryArtifactReader(root).entries(signal)) {
-        if (entry.kind !== "file" ||
-            !(await startsWithMachoMagic(entry.adapterKey)))
-            continue;
+    // Bundles hold tens of thousands of files and few Mach-O images, so the
+    // magic reads overlap the walk while results are classified in walk order.
+    await consumeWithOrderedReads(new DirectoryArtifactReader(root).entries(signal), MAGIC_READ_CONCURRENCY, (entry) => entry.kind === "file"
+        ? startsWithMachoMagic(entry.adapterKey)
+        : undefined, async (entry, macho) => {
+        if (!macho)
+            return;
         const facts = await view.image(entry.path);
         if (facts.status === "malformed" || facts.status === "unsupported")
             unclassified.push(entry.path);
         else if (facts.status === "parsed" &&
             facts.slices.some(({ file_type: type }) => type === "execute"))
             roots.push(entry.path);
-    }
+    });
     return {
         roots: roots.sort(compare),
         unclassified: unclassified.sort(compare),

package/dist/artifacts/apple/InterfaceBuilderAnalysis.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import { parseBinary } from "plist";
+import { appleResourceKeyFields } from "../../domain/apple/appleAssetCatalog.js";
+import { interfaceBuilderConnectionFieldNames, isUIKitRuntimeConnectionClass, } from "../../domain/apple/interfaceBuilderKeyedArchive.js";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { projectPlistValue } from "../../domain/apple/plistValue.js";
 import { omittedPrototypeKeysLimitation, parseXmlPropertyList, } from "../../domain/propertyListKeys.js";
@@ -10,6 +12,7 @@ import { mergeNibHierarchies, projectNibViewHierarchy, } from "./NibViewHierarch
 import { jsonValueSchema } from "../../domain/jsonValue.js";
 import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import { decodeXmlPlistText } from "../../domain/propertyListXmlText.js";
+import { hasBinaryPlistSignature, hasNibArchiveSignature, } from "../../domain/apple/appleArchiveFormat.js";
 const MAX_AGGREGATE_INPUT_BYTES = 32 * 1024 * 1024;
 const MAX_AGGREGATE_DECODE_BYTES = 256 * 1024 * 1024;
 const MAX_REPORTED_OMITTED_ARCHIVES = 64;
@@ -22,6 +25,7 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
     const omittedArchives = [];
     let unreportedOmittedArchives = 0;
     const incompleteHierarchies = new Map();
+    const unresolvedConnections = new Map();
     const prototypeKeyOmissions = new Map();
     let omitted = 0;
     let attempted = 0;
@@ -51,7 +55,7 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
                 attempted += 1;
                 const bytes = await readEntry(reader, entry, input.signal, remainingInputBytes);
                 aggregateInputBytes += bytes.length;
-                const isNibArchive = bytes.subarray(0, 10).toString("ascii") === "NIBArchive";
+                const isNibArchive = hasNibArchiveSignature(bytes);
                 let nib = null;
                 let xmlText;
                 let binaryPrototypeKeyObserved = false;
@@ -61,7 +65,7 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
                     decodeBudget.reserve(documentBudget.usedBytes, "NIBArchive representation exceeds the aggregate Interface Builder decode budget");
                 }
                 else {
-                    if (bytes.subarray(0, 8).toString("ascii") !== "bplist00")
+                    if (!hasBinaryPlistSignature(bytes))
                         xmlText = decodeXmlPlistText(bytes);
                     const decodedReservation = preflightPropertyListDecode(bytes, decodeBudget.remainingBytes, xmlText);
                     decodeBudget.reserve(decodedReservation.estimatedBytes, "plist representation exceeds the aggregate Interface Builder decode budget");
@@ -73,6 +77,8 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
                     : { value: nib.raw, omittedPrototypeKeys: 0 };
                 if (nib !== null && nib.omitted > 0)
                     incompleteHierarchies.set(entry.path, nib.omitted);
+                if (nib !== null && nib.unresolvedConnections > 0)
+                    unresolvedConnections.set(entry.path, nib.unresolvedConnections);
                 if (omittedPrototypeKeys !== 0)
                     prototypeKeyOmissions.set(entry.path, omittedPrototypeKeys);
                 const documentHash = createHash("sha256").update(bytes).digest("hex");
@@ -83,6 +89,9 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
                         ? "storyboard_scene"
                         : "nib",
                     raw,
+                    ...(nib === null || nib.omitted === 0
+                        ? {}
+                        : { omittedSerializedHierarchyReferences: nib.omitted }),
                 });
             }
             catch (cause) {
@@ -108,6 +117,7 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
     });
     return finalizeHierarchyCoverage(result, {
         incompleteHierarchies,
+        unresolvedConnections,
         prototypeKeyOmissions,
         invalid,
         omittedArchives,
@@ -153,7 +163,7 @@ const retainCandidate = (candidates, entry, maximum) => {
         candidates.pop();
 };
 const finalizeHierarchyCoverage = (result, counts) => {
-    const { incompleteHierarchies, prototypeKeyOmissions, invalid, omittedArchives, unreportedOmittedArchives, } = counts;
+    const { incompleteHierarchies, unresolvedConnections, prototypeKeyOmissions, invalid, omittedArchives, unreportedOmittedArchives, } = counts;
     const archiveDecodePartial = invalid.length > 0 ||
         prototypeKeyOmissions.size > 0 ||
         omittedArchives.length > 0;
@@ -161,20 +171,24 @@ const finalizeHierarchyCoverage = (result, counts) => {
         ...result,
         documents: result.documents.map((document) => ({
             ...document,
-            hierarchy_complete: document.hierarchy_complete &&
-                !incompleteHierarchies.has(document.relative_path),
+            connection_count: document.connection_count +
+                (unresolvedConnections.get(document.relative_path) ?? 0),
         })),
         graph: {
             ...result.graph,
             coverage: [
                 ...result.graph.coverage.map((facet) => {
-                    const omitted = incompleteHierarchies.get(facet.facet.replace(/^hierarchy:/u, ""));
-                    return facet.facet.startsWith("hierarchy:") && omitted !== undefined
+                    const omittedConnection = unresolvedConnections.get(facet.facet.replace(/^connections:/u, ""));
+                    return facet.facet.startsWith("connections:") &&
+                        omittedConnection !== undefined
                         ? {
                             ...facet,
                             status: "partial",
-                            reason: "serialized_view_hierarchy_incomplete",
-                            omitted: facet.omitted + omitted,
+                            // A connection dropped by the limit is recoverable by raising
+                            // it, so that cause keeps the reason the graph already named.
+                            // Only a facet with no other cause reports the omission.
+                            reason: facet.reason ?? "connection_unresolved",
+                            omitted: facet.omitted + omittedConnection,
                         }
                         : facet;
                 }),
@@ -201,7 +215,7 @@ const finalizeHierarchyCoverage = (result, counts) => {
             truncated: result.graph.truncated ||
                 counts.omitted > 0 ||
                 archiveDecodePartial ||
-                incompleteHierarchies.size > 0,
+                unresolvedConnections.size > 0,
         },
         limitations: [
             ...result.limitations,
@@ -211,6 +225,11 @@ const finalizeHierarchyCoverage = (result, counts) => {
                 : [
                     "Some serialized hierarchy links could not be projected within the bounded hierarchy; their parentage remains unknown.",
                 ]),
+            ...(unresolvedConnections.size === 0
+                ? []
+                : [
+                    "Some recognized NIBArchive connectors declare no resolvable owner; they carry no connection evidence and are reported as omissions.",
+                ]),
             ...(invalid.length === 0
                 ? []
                 : [
@@ -320,7 +339,7 @@ const projectNibArchive = (archive, budget, maxHierarchyNodes) => {
     const objects = Object.fromEntries(archive.objects
         .filter((object) => {
         const name = runtimeClass(object.id) ?? "";
-        return !/^(?:NSObject|NSIBObjectData|NSString|NSMutableString|NSNumber|NSArray|NSMutableArray|NSSet|NSMutableSet|NSDictionary|NSMutableDictionary|NSApplication|NSNib.*Connector|UIRuntime\w*Connection)$/u.test(name);
+        return (!/^(?:NSObject|NSIBObjectData|NSString|NSMutableString|NSNumber|NSArray|NSMutableArray|NSSet|NSMutableSet|NSDictionary|NSMutableDictionary|NSApplication|NSNib.*Connector)$/u.test(name) && !isUIKitRuntimeConnectionClass(name));
     })
         .map((object) => {
         const className = runtimeClass(object.id) ?? normalizeClassName(object.class_name);
@@ -336,21 +355,34 @@ const projectNibArchive = (archive, budget, maxHierarchyNodes) => {
             break;
         }
         budget.reserveJsonStringOccurrence(name);
+        const nibValues = Object.fromEntries(Object.entries(object.values).map(([key, value]) => {
+            budget.reserveJsonPropertyNameOccurrence(key);
+            return [key, dereference(value) ?? null];
+        }));
+        // Normalize only recognized scalar fields at the format owner. A keyed
+        // archive's authored nibValues dictionary must not gain this meaning.
+        const resourceFields = appleResourceKeyFields(nibValues);
+        for (const [field, value] of resourceFields) {
+            budget.reserveJsonPropertyNameOccurrence(field);
+            budget.reserveJsonStringOccurrence(value);
+        }
         return [
             String(object.id),
             {
                 customClass: className,
                 label: name,
                 objectID: String(object.id),
-                nibValues: Object.fromEntries(Object.entries(object.values).map(([key, value]) => {
-                    budget.reserveJsonPropertyNameOccurrence(key);
-                    return [key, dereference(value) ?? null];
-                })),
+                nibValues,
+                ...Object.fromEntries(resourceFields),
             },
         ];
     }));
     const connections = {};
     const hierarchy = [];
+    // A recognized connector whose owner reference cannot be resolved produces no
+    // connection entry, so the omission has to be counted here: the projected
+    // dictionary carries no trace of it for a downstream consumer to find.
+    let unresolvedConnections = 0;
     const reference = (value) => {
         if (typeof value !== "object" || value === null || Array.isArray(value))
             return null;
@@ -362,15 +394,18 @@ const projectNibArchive = (archive, budget, maxHierarchyNodes) => {
         const className = normalizeClassName(object.class_name);
         // AppKit connectors use NS-prefixed keys; UIKit's runtime outlet and
         // event connections use UI-prefixed keys with the same roles.
-        const uiKit = /^UIRuntime\w*Connection$/u.test(className);
+        const uiKit = isUIKitRuntimeConnectionClass(className);
         if (!uiKit && !className.includes("Connector"))
             continue;
         const values = object.values;
-        const source = reference(uiKit ? values.UISource : values.NSSource);
-        if (source === null)
+        const connectionFields = interfaceBuilderConnectionFieldNames(className);
+        const source = reference(values[connectionFields.source]);
+        if (source === null) {
+            unresolvedConnections += 1;
             continue;
-        const destination = reference(uiKit ? values.UIDestination : values.NSDestination);
-        const label = referencedString(uiKit ? values.UILabel : values.NSLabel);
+        }
+        const destination = reference(values[connectionFields.destination]);
+        const label = referencedString(values[connectionFields.label]);
         const type = className.includes("Outlet")
             ? "outlet"
             : className.includes("Control") || className.includes("Event")
@@ -452,6 +487,7 @@ const projectNibArchive = (archive, budget, maxHierarchyNodes) => {
     const merged = mergeNibHierarchies(hierarchy, viewHierarchy.hierarchy ?? [], () => budget.tryReserve(96), maxHierarchyNodes);
     return {
         omitted: viewHierarchy.omitted + hierarchyOmitted + merged.omitted,
+        unresolvedConnections,
         raw: jsonValueSchema.parse({
             "com.apple.ibtool.document.objects": objects,
             "com.apple.ibtool.document.connections": connections,
@@ -489,7 +525,7 @@ const readEntry = async (reader, entry, signal, maxInputBytes = MAX_AGGREGATE_IN
 };
 /** Project decoded plist data and dates while retaining omitted-key coverage. */
 const decodePlist = (bytes, xmlText, binaryPrototypeKeyObserved) => {
-    const binary = bytes.subarray(0, 8).toString("ascii") === "bplist00";
+    const binary = hasBinaryPlistSignature(bytes);
     const { value, omittedPrototypeKeys } = binary
         ? {
             value: parseBinary(bytes),

package/dist/artifacts/apple/InterfaceBuilderDecodeBudget.js

@@ -1,4 +1,5 @@
 import { decodeXmlPlistText } from "../../domain/propertyListXmlText.js";
+import { hasBinaryPlistSignature } from "../../domain/apple/appleArchiveFormat.js";
 /** A named resource-limit failure that keeps budget exhaustion out of decode errors. */
 export class InterfaceBuilderDecodeBudgetExceeded extends Error {
     reason;
@@ -59,7 +60,7 @@ export class InterfaceBuilderDecodeBudget {
 }
 /** Preflight the representation created by the pinned plist decoder. */
 export const preflightPropertyListDecode = (bytes, maxBytes, xmlText) => {
-    const expansion = bytes.subarray(0, 8).toString("ascii") === "bplist00"
+    const expansion = hasBinaryPlistSignature(bytes)
         ? estimateBinaryPlistExpansion(bytes, maxBytes)
         : {
             estimatedBytes: estimateXmlPlistExpansion(bytes, maxBytes, xmlText),
@@ -71,23 +72,21 @@ export const preflightPropertyListDecode = (bytes, maxBytes, xmlText) => {
 };
 const estimateXmlPlistExpansion = (bytes, maxBytes, xmlText) => {
     const xml = xmlText ?? decodeXmlPlistText(bytes);
-    if (/<!DOCTYPE\b[^>]*\[/iu.test(xml))
-        throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "XML plist internal entity expansion exceeds the aggregate Interface Builder decode budget");
-    const elementPattern = /<!--[^]*?-->|<!\[CDATA\[[^]*?\]\]>|<!DOCTYPE[^>]*>|<\?[^]*?\?>|<\/?[A-Za-z][^>]*>/giu;
     const decodedSourceBytes = xml.length * 2;
     let elementCount = 0;
     let xmlDepth = 0;
-    for (const match of xml.matchAll(elementPattern)) {
-        const token = match[0] ?? "";
-        if (token.startsWith("<!--") ||
-            token.startsWith("<![CDATA[") ||
-            token.startsWith("<!DOCTYPE") ||
-            token.startsWith("<?"))
+    for (const token of xmlPreflightTokens(xml)) {
+        if (token.doctype) {
+            // Only a declaration outside opaque text can introduce an internal
+            // subset. Brackets in quoted external identifiers are literal text.
+            if (token.internalSubset)
+                throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "XML plist internal entity expansion exceeds the aggregate Interface Builder decode budget");
             continue;
+        }
         elementCount += 1;
-        if (token.startsWith("</"))
+        if (token.closing)
             xmlDepth -= 1;
-        else if (!token.endsWith("/>")) {
+        else if (!token.selfClosing) {
             xmlDepth += 1;
             if (xmlDepth > 128)
                 throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "XML plist nesting exceeds the aggregate Interface Builder decode budget");
@@ -97,6 +96,57 @@ const estimateXmlPlistExpansion = (bytes, maxBytes, xmlText) => {
     }
     return decodedSourceBytes * 2 + elementCount * 128;
 };
+/** Consume each XML span once; malformed tokens cannot restart suffix scans. */
+function* xmlPreflightTokens(xml) {
+    let cursor = 0;
+    while (cursor < xml.length) {
+        const start = xml.indexOf("<", cursor);
+        if (start < 0)
+            return;
+        const opaqueEnd = xml.startsWith("<!--", start)
+            ? "-->"
+            : xml.startsWith("<![CDATA[", start)
+                ? "]]>"
+                : xml.startsWith("<?", start)
+                    ? "?>"
+                    : undefined;
+        if (opaqueEnd !== undefined) {
+            const end = xml.indexOf(opaqueEnd, start + 2);
+            if (end < 0)
+                return;
+            cursor = end + opaqueEnd.length;
+            continue;
+        }
+        const doctype = /^<!DOCTYPE\b/iu.test(xml.slice(start, start + 10));
+        const element = /^<\/?[A-Za-z]/u.test(xml.slice(start, start + 4));
+        let quote;
+        let internalSubset = false;
+        let end = start + 1;
+        for (; end < xml.length; end += 1) {
+            const character = xml[end];
+            if (quote !== undefined) {
+                if (character === quote)
+                    quote = undefined;
+            }
+            else if (character === '"' || character === "'")
+                quote = character;
+            else if (character === ">")
+                break;
+            else if (doctype && character === "[")
+                internalSubset = true;
+        }
+        if (end === xml.length)
+            return;
+        cursor = end + 1;
+        if (doctype || element)
+            yield {
+                doctype,
+                internalSubset,
+                closing: xml[start + 1] === "/",
+                selfClosing: xml[end - 1] === "/",
+            };
+    }
+}
 const interfaceBuilderBudgetFailure = (_kind, message) => new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", message);
 const PROTOTYPE_KEY = "__proto__";
 /**
@@ -160,6 +210,8 @@ export const estimateBinaryPlistExpansion = (bytes, maxBytes, { budget = "the ag
             throw new TypeError("binary plist object offset is invalid");
         const marker = bytes[offset] ?? 0;
         const type = marker >> 4;
+        if (entry.dictionaryKey && type !== 5 && type !== 6)
+            throw new TypeError("binary plist dictionary key is not a string");
         let size = marker & 0x0f;
         let cursor = offset + 1;
         if (size === 0x0f && type !== 0 && type !== 8) {

package/dist/artifacts/apple/KeyedArchiveReader.js

@@ -11,6 +11,7 @@ import { KeyedArchiveKindError, keyedArchiveInputSchema, keyedArchiveResultSchem
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { ArtifactReaderFailure } from "../ArtifactReader.js";
 import { decodeXmlPlistText } from "../../domain/propertyListXmlText.js";
+import { hasBinaryPlistSignature, hasNibArchiveSignature, } from "../../domain/apple/appleArchiveFormat.js";
 import { estimateBinaryPlistExpansion } from "./InterfaceBuilderDecodeBudget.js";
 const MAX_BYTES = 64 * 1024 * 1024;
 /** Decoded representation budget, the same 8:1 ratio Interface Builder uses. */
@@ -19,9 +20,9 @@ const MAX_DECODE_BYTES = 8 * MAX_BYTES;
 export const decodeKeyedArchiveBytes = (bytes, selection) => {
     if (bytes.length > MAX_BYTES)
         throw new RangeError("Keyed archive exceeds 64 MiB");
-    if (bytes.subarray(0, 10).toString("ascii") === "NIBArchive")
+    if (hasNibArchiveSignature(bytes))
         throw new KeyedArchiveKindError("Selected file is a compiled NIBArchive, not a Foundation plist archive; decode it with decode_interface_builder", "nib-archive");
-    const binary = bytes.subarray(0, 8).toString("ascii") === "bplist00";
+    const binary = hasBinaryPlistSignature(bytes);
     const xmlText = binary ? undefined : decodeXmlPlistText(bytes);
     // plist.parseBinary recurses on every object reference and copies shared
     // containers, so a few hundred bytes can exhaust memory or the stack.