rea-agents 6.4.0 → 6.7.0

package/dist/dotnet/ManagedMetadataInventoryRows.js

@@ -1,7 +1,13 @@
 import { managedDecodeBudget } from "./ManagedDecodeBudget.js";
+import { memberDeclaringTypeRowLookup } from "./ManagedMemberOwnership.js";
 import { metadataRowOffset, } from "./ManagedMetadataLayout.js";
 import { metadataRowCursor, metadataCodedToken, metadataCodedTokenInvalidReason, metadataToken, readMetadataBlob, readMetadataGuid, readMetadataString, } from "./ManagedMetadataHeaps.js";
-import { managedFailure } from "./ManagedReaderFailure.js";
+import { managedFailure, readManagedValue } from "./ManagedReaderFailure.js";
+const HAS_CUSTOM_ATTRIBUTE_TABLES = [
+    6, 4, 1, 2, 8, 9, 10, 0, 14, 23, 20, 17, 26, 27, 32, 35, 38, 39, 40, 42, 44,
+    43,
+];
+const CUSTOM_ATTRIBUTE_TYPE_TABLES = [undefined, undefined, 6, 10];
 const publicKeyIdentity = (bytes, kind, layout) => ({
     kind: bytes.length === 0 ? "none" : kind,
     byte_length: bytes.length,
@@ -106,46 +112,19 @@ const readTypeName = ({ bytes, layout, table, row, heapExtent, }) => {
     const namespace = readMetadataString(bytes, layout, cursor.readIndex(layout.stringIndexSize), heapExtent);
     return namespace.length === 0 ? name : `${namespace}.${name}`;
 };
-const declaringTypeForMethod = (bytes, layout, methodRow, heapExtent) => {
-    const types = layout.table(2);
-    const methods = layout.table(6);
-    if (types === undefined || methods === undefined)
+const declaringTypeForMethod = (bytes, layout, methodRow, heapExtent, memberLists) => {
+    const owner = memberDeclaringTypeRowLookup(bytes, layout, 6, memberLists)(methodRow);
+    if (owner === 0)
         return null;
-    for (let row = 1; row <= types.rowCount; row += 1) {
-        const cursor = metadataRowCursor(bytes, layout, 2, row);
-        cursor.readUInt32();
-        const nameIndex = cursor.readIndex(layout.stringIndexSize);
-        const namespaceIndex = cursor.readIndex(layout.stringIndexSize);
-        cursor.readIndex(layout.codedIndexSize("TypeDefOrRef"));
-        cursor.readIndex(layout.tableIndexSize(4));
-        const methodStart = cursor.readIndex(layout.tableIndexSize(6));
-        const methodEnd = row === types.rowCount
-            ? methods.rowCount + 1
-            : methodListForType(bytes, layout, row + 1);
-        if (methodRow < methodStart || methodRow >= methodEnd)
-            continue;
-        const name = readMetadataString(bytes, layout, nameIndex, heapExtent);
-        const namespace = readMetadataString(bytes, layout, namespaceIndex, heapExtent);
-        return namespace.length === 0 ? name : `${namespace}.${name}`;
-    }
-    return null;
+    return readTypeName({ bytes, layout, table: 2, row: owner, heapExtent });
 };
-const methodListForType = (bytes, layout, row) => {
-    const cursor = metadataRowCursor(bytes, layout, 2, row);
-    cursor.readUInt32();
-    cursor.readIndex(layout.stringIndexSize);
-    cursor.readIndex(layout.stringIndexSize);
-    cursor.readIndex(layout.codedIndexSize("TypeDefOrRef"));
-    cursor.readIndex(layout.tableIndexSize(4));
-    return cursor.readIndex(layout.tableIndexSize(6));
-};
-const attributeTypeName = (bytes, layout, rawType, heapExtent) => {
+const attributeTypeName = (bytes, layout, rawType, heapExtent, memberLists) => {
     const tag = rawType & 7;
     const row = Math.floor(rawType / 8);
     if (row === 0)
         return null;
     if (tag === 2)
-        return declaringTypeForMethod(bytes, layout, row, heapExtent);
+        return declaringTypeForMethod(bytes, layout, row, heapExtent, memberLists);
     if (tag !== 3)
         return null;
     const memberRefs = layout.table(10);
@@ -172,7 +151,7 @@ const attributeTypeName = (bytes, layout, rawType, heapExtent) => {
             heapExtent,
         });
     if (parentTag === 3)
-        return declaringTypeForMethod(bytes, layout, parentRow, heapExtent);
+        return declaringTypeForMethod(bytes, layout, parentRow, heapExtent, memberLists);
     return null;
 };
 const decodeCompressedLength = (blob, offset) => {
@@ -218,31 +197,36 @@ const decodeFixedString = (blob, layout) => {
         return null;
     }
 };
-export const readCustomAttribute = (bytes, layout, row, heapExtent) => {
+export const readCustomAttribute = (bytes, layout, row, heapExtent, issues, memberLists) => {
     const cursor = metadataRowCursor(bytes, layout, 12, row);
     const parentRaw = cursor.readIndex(layout.codedIndexSize("HasCustomAttribute"));
     const typeOffset = cursor.offset;
     const typeRaw = cursor.readIndex(layout.codedIndexSize("CustomAttributeType"));
     const value = readMetadataBlob(bytes, layout, cursor.readIndex(layout.blobIndexSize), heapExtent);
-    const parent = metadataCodedToken(parentRaw, 5, [
-        6, 4, 1, 2, 8, 9, 10, 0, 14, 23, 20, 17, 26, 27, 32, 35, 38, 39, 40, 42,
-        44, 43,
-    ], layout.rowCounts);
-    const parentReason = metadataCodedTokenInvalidReason(parentRaw, 5, [
-        6, 4, 1, 2, 8, 9, 10, 0, 14, 23, 20, 17, 26, 27, 32, 35, 38, 39, 40, 42,
-        44, 43,
-    ], layout.rowCounts);
-    if (parent === null)
+    const parent = metadataCodedToken(parentRaw, 5, HAS_CUSTOM_ATTRIBUTE_TABLES, layout.rowCounts);
+    if (parent === null) {
+        const parentReason = metadataCodedTokenInvalidReason(parentRaw, 5, HAS_CUSTOM_ATTRIBUTE_TABLES, layout.rowCounts);
         throw managedFailure("invalid-row", `metadata.CustomAttribute:${metadataToken(12, row)}`, `CustomAttribute parent coded index 0x${parentRaw.toString(16)} is invalid${parentReason === null ? " because the required parent is null" : `: ${parentReason}`}`, cursor.start);
-    const typeReason = metadataCodedTokenInvalidReason(typeRaw, 3, [undefined, undefined, 6, 10], layout.rowCounts);
-    if (typeReason !== null || typeRaw === 0)
-        throw managedFailure("invalid-row", `metadata.CustomAttribute:${metadataToken(12, row)}`, typeReason === null
-            ? "CustomAttribute constructor coded index 0x0 is null, but Type must reference a MethodDef or MemberRef row"
-            : `CustomAttribute constructor coded index 0x${typeRaw.toString(16)} is invalid: ${typeReason}`, typeOffset);
-    const typeName = attributeTypeName(bytes, layout, typeRaw, heapExtent);
+    }
+    const constructor = metadataCodedToken(typeRaw, 3, CUSTOM_ATTRIBUTE_TYPE_TABLES, layout.rowCounts);
+    if (constructor === null) {
+        const typeReason = metadataCodedTokenInvalidReason(typeRaw, 3, CUSTOM_ATTRIBUTE_TYPE_TABLES, layout.rowCounts);
+        issues.push({
+            code: "invalid-row",
+            scope: `metadata.CustomAttribute:${metadataToken(12, row)}`,
+            offset: typeOffset,
+            detail: typeReason === null
+                ? "CustomAttribute constructor coded index 0x0 is null, but Type must reference a MethodDef or MemberRef row"
+                : `CustomAttribute constructor coded index 0x${typeRaw.toString(16)} is invalid: ${typeReason}`,
+        });
+    }
+    let typeName = null;
+    if (constructor !== null)
+        typeName =
+            readManagedValue(() => attributeTypeName(bytes, layout, typeRaw, heapExtent, memberLists), issues) ?? null;
     return {
         parent_token: parent,
-        constructor_token: metadataCodedToken(typeRaw, 3, [undefined, undefined, 6, 10], layout.rowCounts),
+        constructor_token: constructor,
         type_name: typeName,
         value_length: value.length,
         value_sha256: managedDecodeBudget(layout).digest(value, "sha256"),

package/dist/dotnet/ManagedMetadataLayout.js

@@ -70,25 +70,27 @@ const CODED_INDEXES = {
     TypeOrMethodDef: { bits: 1, tables: [2, 6] },
 };
 const SUPPORTED_TABLE_MASK = (1n << BigInt(METADATA_TABLE_NAMES.length)) - 1n;
-const requireRange = (bytes, offset, length, scope) => {
+/** Check a range within `bytes`, which start at artifact file offset `base`. */
+const requireRange = (bytes, base, offset, length, scope) => {
     if (!Number.isSafeInteger(offset) ||
         !Number.isSafeInteger(length) ||
         offset < 0 ||
         length < 0 ||
         offset > bytes.length - length)
-        throw managedFailure("invalid-metadata-root", scope, `${scope} leaves the metadata byte range`, Number.isSafeInteger(offset) && offset >= 0 ? offset : null);
+        throw managedFailure("invalid-metadata-root", scope, `${scope} leaves the metadata byte range`, Number.isSafeInteger(base + offset) && offset >= 0 ? base + offset : null);
 };
-const align4 = (value) => (value + 3) & ~3;
-const readStreamName = (bytes, offset) => {
+const align4 = (value) => Math.ceil(value / 4) * 4;
+/** Read within the metadata root; report failures at artifact file offsets. */
+const readStreamName = (bytes, rootOffset, offset) => {
     const endLimit = Math.min(bytes.length, offset + 32);
     let end = offset;
     while (end < endLimit && bytes[end] !== 0)
         end += 1;
     if (end === endLimit)
-        throw managedFailure("invalid-stream", "metadata.stream-name", "Metadata stream name is missing a bounded terminator", offset);
+        throw managedFailure("invalid-stream", "metadata.stream-name", "Metadata stream name is missing a bounded terminator", rootOffset + offset);
     const nameBytes = bytes.subarray(offset, end);
     if (nameBytes.some((byte) => byte < 0x20 || byte > 0x7e))
-        throw managedFailure("invalid-stream", "metadata.stream-name", "Metadata stream name is not printable ASCII", offset);
+        throw managedFailure("invalid-stream", "metadata.stream-name", "Metadata stream name is not printable ASCII", rootOffset + offset);
     return {
         name: nameBytes.toString("ascii"),
         next: align4(end + 1),
@@ -120,7 +122,7 @@ const readMetadataStreams = (bytes, rootOffset, budget) => {
     if (bytes.readUInt32LE(0) !== 0x424a_5342)
         throw managedFailure("invalid-metadata-root", "metadata.signature", "CLI metadata signature is not BSJB", rootOffset);
     const versionLength = bytes.readUInt32LE(12);
-    requireRange(bytes, 16, versionLength, "metadata.version");
+    requireRange(bytes, rootOffset, 16, versionLength, "metadata.version");
     const versionBytes = bytes.subarray(16, 16 + versionLength);
     const zero = versionBytes.indexOf(0);
     const decodedVersionLength = zero < 0 ? versionBytes.length : zero;
@@ -129,20 +131,20 @@ const readMetadataStreams = (bytes, rootOffset, budget) => {
         .subarray(0, decodedVersionLength)
         .toString("utf8");
     let cursor = align4(16 + versionLength);
-    requireRange(bytes, cursor, 4, "metadata.stream-count");
+    requireRange(bytes, rootOffset, cursor, 4, "metadata.stream-count");
     const streamCount = bytes.readUInt16LE(cursor + 2);
     if (streamCount === 0 || streamCount > 64)
         throw managedFailure("invalid-stream", "metadata.stream-count", "Metadata stream count is outside the admitted range", rootOffset + cursor + 2);
     cursor += 4;
     const streams = new Map();
     for (let index = 0; index < streamCount; index += 1) {
-        requireRange(bytes, cursor, 8, "metadata.stream-header");
+        requireRange(bytes, rootOffset, cursor, 8, "metadata.stream-header");
         const relativeOffset = bytes.readUInt32LE(cursor);
         const streamSize = bytes.readUInt32LE(cursor + 4);
-        const named = readStreamName(bytes, cursor + 8);
+        const named = readStreamName(bytes, rootOffset, cursor + 8);
         if (streams.has(named.name))
             throw managedFailure("invalid-stream", "metadata.stream-header", `Duplicate metadata stream ${named.name}`, rootOffset + cursor);
-        requireRange(bytes, relativeOffset, streamSize, `metadata.${named.name}`);
+        requireRange(bytes, rootOffset, relativeOffset, streamSize, `metadata.${named.name}`);
         streams.set(named.name, {
             name: named.name,
             offset: rootOffset + relativeOffset,
@@ -157,7 +159,7 @@ const readTablesHeader = (bytes, streams) => {
     if (tablesStream === undefined)
         throw managedFailure("missing-stream", "metadata.tables", "Required metadata table stream #~ or #- is absent");
     const tableBytes = bytes.subarray(tablesStream.offset, tablesStream.offset + tablesStream.size);
-    requireRange(tableBytes, 0, 24, "metadata.tables-header");
+    requireRange(tableBytes, tablesStream.offset, 0, 24, "metadata.tables-header");
     const heapSizes = tableBytes[6] ?? 0;
     const heaps = {
         string: (heapSizes & 0x01) === 0 ? 2 : 4,
@@ -169,13 +171,13 @@ const readTablesHeader = (bytes, streams) => {
         throw managedFailure("invalid-tables", "metadata.valid-mask", "Metadata valid mask names unsupported tables outside the admitted ECMA-335 range", tablesStream.offset + 8);
     return { tableBytes, tablesOffset: tablesStream.offset, heaps, valid };
 };
-const readRowCounts = (tableBytes, valid) => {
+const readRowCounts = (tableBytes, tablesOffset, valid) => {
     const rowCounts = Array(METADATA_TABLE_NAMES.length).fill(0);
     let tableCursor = 24;
     for (let index = 0; index < METADATA_TABLE_NAMES.length; index += 1) {
         if ((valid & (1n << BigInt(index))) === 0n)
             continue;
-        requireRange(tableBytes, tableCursor, 4, "metadata.table-row-count");
+        requireRange(tableBytes, tablesOffset, tableCursor, 4, "metadata.table-row-count");
         const count = tableBytes.readUInt32LE(tableCursor);
         rowCounts[index] = count;
         tableCursor += 4;
@@ -198,6 +200,13 @@ const buildMetadataTables = ({ tableBytes, rowCounts, heaps, valid, tablesOffset
             continue;
         tableCursor += 4;
     }
+    // CLR readers honor an optional extra-data word after the row counts.
+    // Its value is opaque; it is not a length or part of the first table row.
+    if (((tableBytes[6] ?? 0) & 0x40) !== 0) {
+        if (tableCursor > tableBytes.length - 4)
+            throw managedFailure("invalid-metadata-root", "metadata.tables-extra-data", "Metadata tables extra-data word is truncated", tablesOffset + tableCursor);
+        tableCursor += 4;
+    }
     for (let index = 0; index < METADATA_TABLE_NAMES.length; index += 1) {
         const count = rowCounts[index] ?? 0;
         if ((valid & (1n << BigInt(index))) === 0n)
@@ -206,7 +215,7 @@ const buildMetadataTables = ({ tableBytes, rowCounts, heaps, valid, tablesOffset
         const byteLength = count * sizeOfRow;
         if (!Number.isSafeInteger(byteLength))
             throw managedFailure("invalid-tables", "metadata.tables", "Metadata table byte size overflowed", tablesOffset + tableCursor);
-        requireRange(tableBytes, tableCursor, byteLength, "metadata.table-data");
+        requireRange(tableBytes, tablesOffset, tableCursor, byteLength, "metadata.table-data");
         tables.set(index, {
             index,
             name: METADATA_TABLE_NAMES[index] ?? `Table${String(index)}`,
@@ -226,7 +235,7 @@ export const readManagedMetadataLayout = (artifact, rootOffset, size) => {
     const budget = new ManagedDecodeBudget();
     const { streams, version } = readMetadataStreams(bytes, rootOffset, budget);
     const { tableBytes, tablesOffset, heaps, valid } = readTablesHeader(artifact, streams);
-    const rowCounts = readRowCounts(tableBytes, valid);
+    const rowCounts = readRowCounts(tableBytes, tablesOffset, valid);
     const tables = buildMetadataTables({
         tableBytes,
         rowCounts,
@@ -242,6 +251,7 @@ export const readManagedMetadataLayout = (artifact, rootOffset, size) => {
         strings: requireStream(streams, "#Strings"),
         guid: requireStream(streams, "#GUID"),
         blob: requireStream(streams, "#Blob"),
+        userStrings: streams.get("#US") ?? null,
         tables,
         rowCounts,
         stringIndexSize: heaps.string,

package/dist/dotnet/ManagedMetadataRowSizes.js

@@ -2,7 +2,7 @@ import { managedFailure } from "./ManagedReaderFailure.js";
 const ROW_SIZE_FACTORIES = [
     ({ stringSize: s, guidSize: g }) => 2 + s + g * 3,
     ({ codedSize: c, stringSize: s }) => c("ResolutionScope") + s * 2,
-    ({ tableSize: t, codedSize: c, stringSize: s }) => 4 + s * 2 + c("TypeDefOrRef") + t(4) + t(6),
+    ({ tableSize: t, codedSize: c, stringSize: s }) => 4 + s * 2 + c("TypeDefOrRef") + Math.max(t(3), t(4)) + Math.max(t(5), t(6)),
     ({ tableSize: t }) => t(4),
     ({ stringSize: s, blobSize: b }) => 2 + s + b,
     ({ tableSize: t }) => t(6),

package/dist/dotnet/ManagedMethodBodyReader.js

@@ -1,3 +1,4 @@
+import { admitManagedProjection, } from "./ManagedDecodeBudget.js";
 import { decodeInstructions, parseExceptionRegions, } from "./ManagedMemberInstructionDecoder.js";
 import { validateExceptionRegionRanges } from "./ManagedExceptionRegionValidation.js";
 import { sha256Bytes } from "./ManagedMetadataHeaps.js";
@@ -45,11 +46,15 @@ export const methodBody = (bytes, pe, rva, implementation = {
     implFlags: 0,
     flags: 0,
 }, budget) => {
+    // Without CIL there is nothing left unscanned.
     if (rva === 0)
-        return emptyMethodBody(rva, "absent", null);
-    if ((implementation.implFlags & 7) !== 0 ||
-        (implementation.flags & 0x2000) !== 0)
-        return emptyMethodBody(rva, "partial", "CIL decoding is unavailable for native, runtime, unmanaged, or P/Invoke implementations");
+        return { body: emptyMethodBody(rva, "absent", null), scanned: true };
+    const native = (implementation.implFlags & 7) !== 0 ||
+        (implementation.flags & 0x2000) !== 0;
+    if (native) {
+        const issue = "CIL decoding is unavailable for native, runtime, unmanaged, or P/Invoke implementations";
+        return { body: emptyMethodBody(rva, "partial", issue), scanned: true };
+    }
     try {
         const offset = pe.rvaToOffset(rva, 1, "method.body");
         const methodExtent = pe.rvaAvailableBytes(rva, "method.body");
@@ -61,10 +66,12 @@ export const methodBody = (bytes, pe, rva, implementation = {
         if (ilOffset > bytes.length - header.ilSize)
             throw new RangeError("Method IL bytes leave artifact");
         const il = bytes.subarray(ilOffset, ilOffset + header.ilSize);
-        // One byte can produce an instruction record, start index, normalized tuple,
-        // and anchor. Reserve conservative bookkeeping capacity before decoding.
-        budget?.reserve(il.length * 256, ilOffset);
-        const decoded = decodeInstructions(il);
+        // Bound the actual instruction records before allocating them. One raw
+        // byte is only an upper bound on count; wide operands do not create a
+        // separate instruction for every byte. Retained output is charged below.
+        const decoded = decodeInstructions(il, budget === undefined
+            ? undefined
+            : (start) => budget.admitTransient(256, ilOffset + start));
         const opcodeCounts = {};
         for (const instruction of decoded.parsed)
             opcodeCounts[instruction.opcode] =
@@ -83,12 +90,12 @@ export const methodBody = (bytes, pe, rva, implementation = {
             operand,
         ])), "utf8");
         const methodEnd = ilOffset + header.ilSize;
-        const sectionOffset = (methodEnd + 3) & ~3;
+        const sectionOffset = Math.ceil(methodEnd / 4) * 4;
         const exceptionRegions = header.format === "fat" && (header.flags & 8) !== 0
             ? validateExceptionRegionRanges(parseExceptionRegions(bytes, sectionOffset, offset + methodExtent, budget), header.ilSize, decoded.instructionStarts)
             : null;
         const status = bodyStatus(decoded.issue, decoded.truncated, exceptionRegions);
-        return {
+        const body = {
             status,
             header_format: header.format,
             rva,
@@ -115,6 +122,10 @@ export const methodBody = (bytes, pe, rva, implementation = {
                     ? "Instruction decoding stopped before the end of the method body"
                     : null),
         };
+        return {
+            body: budget === undefined ? body : admitManagedProjection(body, budget),
+            scanned: decoded.issue === null && decoded.truncated === 0,
+        };
     }
     catch (cause) {
         if (cause instanceof ManagedReaderFailure &&
@@ -123,7 +134,14 @@ export const methodBody = (bytes, pe, rva, implementation = {
         if (!(cause instanceof ManagedReaderFailure) &&
             !(cause instanceof RangeError))
             throw cause;
-        return emptyMethodBody(rva, "malformed", cause instanceof Error ? cause.message : "Method body parse failed");
+        return {
+            body: emptyMethodBody(rva, "malformed", cause instanceof Error ? cause.message : "Method body parse failed"),
+            scanned: false,
+        };
+    }
+    finally {
+        // IL and exception-section bookkeeping coexist until the body is built.
+        budget?.releaseTransient();
     }
 };
 const emptyMethodBody = (rva, status, issue) => ({

package/dist/dotnet/ManagedMethodSpecs.js

@@ -0,0 +1,78 @@
+import { methodGenericArity, specSignature, } from "./ManagedMemberInspectorCore.js";
+import { metadataCodedToken, metadataCodedTokenInvalidReason, metadataRowCursor, readMetadataBlob, } from "./ManagedMetadataHeaps.js";
+import { managedFailure, readManagedValue } from "./ManagedReaderFailure.js";
+/**
+ * Index fields, member references, and methods by token, then name each
+ * MethodSpec an inspected body calls after the generic method it instantiates,
+ * so every edge target resolves through one lookup.
+ */
+export const edgeTargets = (bytes, layout, methods, cores) => {
+    const members = new Map(cores.flatMap((core) => [...core]));
+    const issues = [];
+    const seen = new Set();
+    // Generic arity by method token, so instantiations of one method decode it once.
+    const arities = new Map();
+    for (const method of methods)
+        for (const { operand } of method.body.anchors) {
+            if (operand?.startsWith("0x2b") !== true || seen.has(operand))
+                continue;
+            seen.add(operand);
+            readManagedValue(() => readMethodSpec({ bytes, layout, members, issues, arities }, operand), issues);
+        }
+    return { members, issues };
+};
+/**
+ * Map one MethodSpec to its generic method, then check its instantiation
+ * decodes and matches that method's generic arity. A readable Method column
+ * keeps its name when the rest is malformed; the failure makes coverage partial.
+ */
+const readMethodSpec = ({ bytes, layout, members, issues, arities, }, token) => {
+    const scope = `metadata.MethodSpec:${token}`;
+    const cursor = metadataRowCursor(bytes, layout, 0x2b, Number.parseInt(token.slice(4), 16));
+    const methodRaw = cursor.readIndex(layout.codedIndexSize("MethodDefOrRef"));
+    const instantiation = cursor.readIndex(layout.blobIndexSize);
+    const methodReason = metadataCodedTokenInvalidReason(methodRaw, 1, [6, 10], layout.rowCounts);
+    if (methodReason !== null || methodRaw === 0)
+        issues.push({
+            code: "invalid-row",
+            scope,
+            offset: cursor.start,
+            detail: methodReason === null
+                ? "MethodSpec method coded index 0x0 is null, but the Method column must reference a row"
+                : `MethodSpec method coded index 0x${methodRaw.toString(16)} is invalid: ${methodReason}`,
+        });
+    const generic = metadataCodedToken(methodRaw, 1, [6, 10], layout.rowCounts);
+    const target = generic === null ? undefined : members.get(generic);
+    // A MethodSpec instantiates a method, so a field target never lends it a
+    // name, even to a field operand.
+    if (target !== undefined && target.kind !== "field")
+        members.set(token, { ...target, token });
+    const types = specSignature(layout, readMetadataBlob(bytes, layout, instantiation, layout.blob.size), { form: "instantiation", scope, offset: cursor.start });
+    if (generic === null)
+        return;
+    // Prefer the arity the target's owner decoded; read the raw signature only
+    // for a target nothing decoded, such as a MethodDef outside the selection.
+    if (target?.genericArity === undefined && !arities.has(generic))
+        arities.set(generic, methodGenericArity(layout, methodSignatureBlob(bytes, layout, generic)));
+    const arity = target?.genericArity === undefined
+        ? (arities.get(generic) ?? null)
+        : target.genericArity;
+    if (arity !== types.length)
+        throw managedFailure("invalid-row", scope, arity === null
+            ? "MethodSpec method does not have a decodable method signature"
+            : `MethodSpec supplies ${String(types.length)} type argument(s), but its method declares ${String(arity)} generic parameter(s)`, cursor.start);
+};
+/** The Signature column of a MethodDef or MemberRef row. */
+const methodSignatureBlob = (bytes, layout, token) => {
+    const table = Number.parseInt(token.slice(2, 4), 16);
+    const cursor = metadataRowCursor(bytes, layout, table, Number.parseInt(token.slice(4), 16));
+    if (table === 6) {
+        cursor.readUInt32();
+        cursor.readUInt16();
+        cursor.readUInt16();
+    }
+    else
+        cursor.readIndex(layout.codedIndexSize("MemberRefParent"));
+    cursor.readIndex(layout.stringIndexSize);
+    return readMetadataBlob(bytes, layout, cursor.readIndex(layout.blobIndexSize), layout.blob.size);
+};

package/dist/dotnet/ManagedNativeBoundaryHelpers.js

@@ -1,8 +1,8 @@
 import { admitManagedProjection, managedDecodeBudget, } from "./ManagedDecodeBudget.js";
 import { managedNativeBoundaryInspectionSchema, } from "../domain/managed/managedArtifact.js";
-import {} from "./ManagedMetadataLayout.js";
 import { metadataRowCursor, metadataCodedToken, metadataCodedTokenInvalidReason, metadataToken, readMetadataString, } from "./ManagedMetadataHeaps.js";
 import { managedTableRowCounts } from "./ManagedMetadataInventory.js";
+import { managedCli32BitRequirement, managedCliIsMixedClrNative, } from "./ManagedPeReader.js";
 import { readManagedValue } from "./ManagedReaderFailure.js";
 const flagsHex = (value) => `0x${value.toString(16).padStart(4, "0")}`;
 export const parseModuleRefs = (bytes, layout, heapExtent, issues) => {
@@ -253,30 +253,31 @@ const boundaryKind = (pinvokeDeclared, codeType, managedKind) => {
         return "unmanaged-method";
     return "mixed-or-unknown";
 };
-export const cliNative = (pe) => {
-    if (pe.cli === null)
+export const cliNative = (cli) => {
+    if (cli === null)
         return null;
     return {
-        il_only: (pe.cli.flags & 0x0000_0001) !== 0,
-        requires_32bit: (pe.cli.flags & 0x0000_0002) !== 0,
-        strong_name_signed: (pe.cli.flags & 0x0000_0008) !== 0,
-        native_entry_point: (pe.cli.flags & 0x0000_0010) !== 0,
-        ready_to_run_signature: pe.cli.readyToRunSignature,
-        managed_native_header_rva: pe.cli.managedNativeHeader.rva,
-        managed_native_header_size: pe.cli.managedNativeHeader.size,
+        il_only: (cli.flags & 0x0000_0001) !== 0,
+        requires_32bit: managedCli32BitRequirement(cli.flags) === "required",
+        strong_name_signed: (cli.flags & 0x0000_0008) !== 0,
+        native_entry_point: (cli.flags & 0x0000_0010) !== 0,
+        ready_to_run_signature: cli.readyToRunSignature,
+        managed_native_header_rva: cli.managedNativeHeader.rva,
+        managed_native_header_size: cli.managedNativeHeader.size,
     };
 };
 /** Summarize declaration counts with the native facets of the CLI header. */
-export const nativeBoundarySummary = (native, counts) => ({
+export const nativeBoundarySummary = (cli, counts) => ({
     ...counts,
-    ready_to_run: native?.ready_to_run_signature ?? null,
-    mixed_mode_or_native_header: native === null
+    ready_to_run: cli?.readyToRunSignature ?? null,
+    mixed_mode_or_native_header: cli === null
         ? null
-        : native.managed_native_header_rva !== 0 ||
-            native.managed_native_header_size !== 0 ||
-            native.native_entry_point,
+        : managedCliIsMixedClrNative(cli) ||
+            cli.managedNativeHeader.rva !== 0 ||
+            cli.managedNativeHeader.size !== 0 ||
+            (cli.flags & 0x0000_0010) !== 0,
 });
-export const buildNativeBoundaryInspection = ({ target, bytes, layout, inventory, moduleRefs, imports, implementations, native, issues, }) => managedNativeBoundaryInspectionSchema.parse(admitManagedProjection({
+export const buildNativeBoundaryInspection = ({ target, bytes, pe, layout, inventory, moduleRefs, imports, implementations, issues, }) => managedNativeBoundaryInspectionSchema.parse(admitManagedProjection({
     artifact: {
         path: target.path,
         sha256: target.sha256,
@@ -294,11 +295,11 @@ export const buildNativeBoundaryInspection = ({ target, bytes, layout, inventory
         requires_artifact_sha256: target.sha256,
         requires_mvid: inventory.module?.mvid ?? null,
     },
-    cli_native: native,
+    cli_native: cliNative(pe.cli),
     module_refs: moduleRefs,
     pinvoke_imports: imports,
     native_implementations: implementations,
-    summary: nativeBoundarySummary(native, {
+    summary: nativeBoundarySummary(pe.cli, {
         module_ref_count: moduleRefs.length,
         pinvoke_import_count: imports.length,
         native_implementation_count: implementations.length,

package/dist/dotnet/ManagedNativeBoundaryInspector.js

@@ -2,15 +2,16 @@ import { admitManagedProjection } from "./ManagedDecodeBudget.js";
 import { managedNativeBoundaryInspectionSchema, } from "../domain/managed/managedArtifact.js";
 import { readManagedMetadataInventory, readManagedResourceDirectory, } from "./ManagedMetadataInventory.js";
 import { readManagedMetadataLayout, } from "./ManagedMetadataLayout.js";
+import { readTypeMemberListFacts } from "./ManagedTypeMemberLists.js";
 import { readManagedPeLayout, } from "./ManagedPeReader.js";
 import { ManagedReaderFailure } from "./ManagedReaderFailure.js";
 import { buildNativeBoundaryInspection, cliNative, nativeBoundarySummary, nativeImplementations, parseFields, parseImplMaps, parseMethods, parseModuleRefs, } from "./ManagedNativeBoundaryHelpers.js";
 /**
- * Report a PE whose CLI metadata is absent or cannot be admitted. `native`
- * holds the CLI header facts when the header itself was admitted; otherwise
+ * Report a PE whose CLI metadata is absent or cannot be admitted. `cli`
+ * holds the CLI header when the header itself was admitted; otherwise
  * the header is absent (`not-managed`) or unreadable (`malformed`).
  */
-const emptyInspection = (target, bytes, classification, { native = null, issues = [], } = {}) => {
+const emptyInspection = (target, bytes, classification, { cli = null, issues = [], } = {}) => {
     return managedNativeBoundaryInspectionSchema.parse(admitManagedProjection({
         artifact: {
             path: target.path,
@@ -33,11 +34,11 @@ const emptyInspection = (target, bytes, classification, { native = null, issues
             requires_artifact_sha256: target.sha256,
             requires_mvid: null,
         },
-        cli_native: native,
+        cli_native: cliNative(cli),
         module_refs: [],
         pinvoke_imports: [],
         native_implementations: [],
-        summary: nativeBoundarySummary(native, {
+        summary: nativeBoundarySummary(cli, {
             module_ref_count: 0,
             pinvoke_import_count: 0,
             native_implementation_count: 0,
@@ -52,24 +53,16 @@ const emptyInspection = (target, bytes, classification, { native = null, issues
 const readBoundaryInventory = (bytes, pe, cli, issues) => {
     const metadataOffset = pe.rvaToOffset(cli.metadata.rva, cli.metadata.size, "cli.metadata");
     const layout = readManagedMetadataLayout(bytes, metadataOffset, cli.metadata.size);
-    const inventory = readManagedMetadataInventory(bytes, layout, readManagedResourceDirectory(pe, issues));
+    const memberLists = readTypeMemberListFacts(bytes, layout);
+    const inventory = readManagedMetadataInventory(bytes, layout, readManagedResourceDirectory(pe, issues), memberLists);
     return { layout, inventory };
 };
 /** Inspect managed/native boundary declarations from PE metadata without execution. */
 export const inspectManagedNativeBoundariesBytes = (bytes, target) => {
-    let pe;
-    try {
-        pe = readManagedPeLayout(bytes);
-    }
-    catch (cause) {
-        if (!(cause instanceof ManagedReaderFailure))
-            throw cause;
-        return emptyInspection(target, bytes, "malformed", {
-            issues: [cause.issue],
-        });
-    }
+    // An unmappable PE layout is invalid input for every managed operation.
+    const pe = readManagedPeLayout(bytes);
     if (pe.cli === null)
-        return emptyInspection(target, bytes, pe.cliDirectoryPresent ? "malformed" : "not-managed", { issues: pe.cliIssue === null ? [] : [pe.cliIssue] });
+        return emptyInspection(target, bytes, pe.cliDirectoryState !== "absent" ? "malformed" : "not-managed", { issues: pe.cliIssue === null ? [] : [pe.cliIssue] });
     const issues = [];
     let layout;
     let inventory;
@@ -80,7 +73,7 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target) => {
         if (!(cause instanceof ManagedReaderFailure))
             throw cause;
         return emptyInspection(target, bytes, "malformed", {
-            native: cliNative(pe),
+            cli: pe.cli,
             issues: [cause.issue],
         });
     }
@@ -113,7 +106,6 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target) => {
             moduleRefs,
             imports,
             implementations,
-            native: cliNative(pe),
             issues,
         });
     }
@@ -121,7 +113,7 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target) => {
         if (!(cause instanceof ManagedReaderFailure))
             throw cause;
         return emptyInspection(target, bytes, "malformed", {
-            native: cliNative(pe),
+            cli: pe.cli,
             issues: [...issues, cause.issue],
         });
     }