rea-agents 6.4.0 → 6.7.0

package/dist/native/parsers/otool.js

@@ -1,3 +1,67 @@
+const DYLIB_COMMANDS = new Set([
+    "LC_ID_DYLIB",
+    "LC_LOAD_DYLIB",
+    "LC_LOAD_WEAK_DYLIB",
+    "LC_REEXPORT_DYLIB",
+    "LC_LAZY_LOAD_DYLIB",
+    "LC_LOAD_UPWARD_DYLIB",
+]);
+const DYLIB_FIELDS = [
+    "cmd",
+    "cmdsize",
+    "name",
+    "current version",
+    "compatibility version",
+];
+// otool prints options for dylib_use_command and a timestamp for dylib_command.
+const DYLIB_ENCODING_FIELDS = ["time stamp", "options"];
+const EMPTY_VALUE_FIELDS = new Set(["options", "segname", "sectname"]);
+/**
+ * Non-verbose otool prints LC_BUILD_VERSION platform and tool codes as
+ * numbers. Name the codes declared in the SDK's <mach-o/loader.h>, without
+ * the PLATFORM_/TOOL_ prefix, so build metadata uses the same symbolic style
+ * as LC_VERSION_MIN_* platforms. Unknown codes keep their printed value.
+ */
+const BUILD_PLATFORM_NAMES = new Map([
+    ["1", "MACOS"],
+    ["2", "IOS"],
+    ["3", "TVOS"],
+    ["4", "WATCHOS"],
+    ["5", "BRIDGEOS"],
+    ["6", "MACCATALYST"],
+    ["7", "IOSSIMULATOR"],
+    ["8", "TVOSSIMULATOR"],
+    ["9", "WATCHOSSIMULATOR"],
+    ["10", "DRIVERKIT"],
+    ["11", "VISIONOS"],
+    ["12", "VISIONOSSIMULATOR"],
+    ["13", "FIRMWARE"],
+    ["14", "SEPOS"],
+    ["15", "MACOS_EXCLAVECORE"],
+    ["16", "MACOS_EXCLAVEKIT"],
+    ["17", "IOS_EXCLAVECORE"],
+    ["18", "IOS_EXCLAVEKIT"],
+    ["19", "TVOS_EXCLAVECORE"],
+    ["20", "TVOS_EXCLAVEKIT"],
+    ["21", "WATCHOS_EXCLAVECORE"],
+    ["22", "WATCHOS_EXCLAVEKIT"],
+    ["23", "VISIONOS_EXCLAVECORE"],
+    ["24", "VISIONOS_EXCLAVEKIT"],
+]);
+const BUILD_TOOL_NAMES = new Map([
+    ["1", "CLANG"],
+    ["2", "SWIFT"],
+    ["3", "LD"],
+    ["4", "LLD"],
+    ["1024", "METAL"],
+    ["1025", "AIRLLD"],
+    ["1026", "AIRNT"],
+    ["1027", "AIRNT_PLUGIN"],
+    ["1028", "AIRPACK"],
+    ["1031", "GPUARCHIVER"],
+    ["1032", "METAL_FRAMEWORK"],
+]);
+const buildCodeName = (names, value) => (value === null ? null : (names.get(value) ?? value));
 /**
  * otool emits LF, but a capture replayed from another host or toolchain can
  * carry CRLF. The section/command boundaries below match a bare `\n`, so a
@@ -10,11 +74,16 @@ const normalizeLineEndings = (output) => output.replaceAll("\r\n", "\n");
 export const parseOtoolLoadCommands = (raw) => {
     const output = normalizeLineEndings(raw);
     const header = parseHeader(output);
-    const state = createLoadCommandState(header?.flags);
+    if (header === undefined)
+        throw new TypeError("otool output is missing the Mach header");
+    const state = createLoadCommandState(header.flags);
     for (const block of output.split(/(?=^Load command \d+$)/mu))
         parseLoadCommand(block, state);
+    validateLoadCommandFraming(header, state.commands);
     return {
-        fileType: header?.fileType ?? null,
+        wordSize: WORD_SIZES.get(header.magic ?? "") ?? null,
+        endian: header.cpuType === null ? null : cpuEndian(header.cpuType),
+        fileType: header.fileType,
         flags: [...state.flags].sort(),
         uuid: state.uuid,
         commands: state.commands,
@@ -24,6 +93,20 @@ export const parseOtoolLoadCommands = (raw) => {
         builds: state.builds,
     };
 };
+/** otool prints the selected slice's magic in host order, symbolic with -v. */
+const WORD_SIZES = new Map([
+    ["0xfeedface", 32],
+    ["0xfeedfacf", 64],
+    ["MH_MAGIC", 32],
+    ["MH_MAGIC_64", 64],
+]);
+/** Mach-O byte order by CPU family, ignoring the ABI bits; others stay unknown. */
+const cpuEndian = (cpuType) => {
+    const family = cpuType & 0x00ffffff;
+    if (family === 7 || family === 12)
+        return "little";
+    return family === 18 ? "big" : null;
+};
 const parseHeader = (output) => {
     const lines = output.split(/\r?\n/u).map((line) => line.trim());
     const columnsLine = lines.findIndex((line) => /(?:^|\s)magic\s/u.test(line));
@@ -34,6 +117,10 @@ const parseHeader = (output) => {
     const values = dataLine?.split(/\s+/u);
     if (columns === undefined || values === undefined)
         return undefined;
+    const commandCount = headerValue(columns, values, "ncmds");
+    const commandBytes = headerValue(columns, values, "sizeofcmds");
+    if (commandCount === null || commandBytes === null)
+        throw new TypeError("otool Mach header is missing valid command framing");
     const fileTypeIndex = columns.indexOf("filetype");
     const flagsIndex = columns.indexOf("flags");
     const complete = values.length >= columns.length;
@@ -41,7 +128,12 @@ const parseHeader = (output) => {
         ? values.length - (columns.length - fileTypeIndex)
         : fileTypeIndex;
     const flagsEnd = flagsIndex >= 0 ? values.length - (columns.length - flagsIndex - 1) : 0;
+    const magicIndex = columns.indexOf("magic");
     return {
+        magic: magicIndex < 0 ? null : (values[magicIndex] ?? null),
+        cpuType: headerValue(columns, values, "cputype"),
+        commandCount,
+        commandBytes,
         fileType: complete && fileTypeValueIndex >= 0 && fileTypeValueIndex < values.length
             ? (values[fileTypeValueIndex] ?? null)
             : null,
@@ -52,6 +144,32 @@ const parseHeader = (output) => {
                 .filter((value) => value.length > 0),
     };
 };
+const headerValue = (columns, values, name) => {
+    const index = columns.indexOf(name);
+    if (index < 0)
+        return null;
+    const flagsIndex = columns.indexOf("flags");
+    const valueIndex = flagsIndex >= 0 && index > flagsIndex
+        ? values.length - (columns.length - index)
+        : index;
+    const value = values[valueIndex];
+    return value === undefined ? null : numeric(value);
+};
+const validateLoadCommandFraming = (header, commands) => {
+    if (commands.length !== header.commandCount)
+        throw new TypeError("otool load-command count does not match the Mach header");
+    let totalBytes = 0;
+    for (const [expectedIndex, command] of commands.entries()) {
+        const size = numberField(command.fields, "cmdsize");
+        if (command.index !== expectedIndex || size === null || size < 8)
+            throw new TypeError("otool load-command sequence or size is invalid");
+        totalBytes += size;
+        if (!Number.isSafeInteger(totalBytes))
+            throw new TypeError("otool load-command byte count is unsafe");
+    }
+    if (totalBytes !== header.commandBytes)
+        throw new TypeError("otool load-command sizes do not match the Mach header");
+};
 const createLoadCommandState = (headerFlags) => ({
     commands: [],
     segments: [],
@@ -65,11 +183,23 @@ const parseLoadCommand = (block, state) => {
     const indexText = /^Load command (\d+)/u.exec(block)?.[1];
     if (indexText === undefined)
         return;
+    const index = Number(indexText);
+    if (!Number.isSafeInteger(index))
+        throw new TypeError("otool load-command index is unsafe");
     const header = block.split(/\n\s*Section\n/u)[0] ?? block;
-    const fields = parseFields(header);
-    const kind = stringField(fields, "cmd") ?? "unknown";
+    const parsed = parseFields(header);
+    const fields = parsed.values;
+    const kind = stringField(fields, "cmd");
+    if (kind === null)
+        throw new TypeError("otool load command is missing cmd");
+    for (const key of scalarFields(kind))
+        requireUniqueField(parsed, key);
+    if (DYLIB_COMMANDS.has(kind))
+        validateDylibCommandLines(parsed);
+    if (kind === "LC_LINKER_OPTION")
+        validateLinkerOptionLines(parsed);
     state.commands.push({
-        index: Number.parseInt(indexText, 10),
+        index,
         kind,
         fields,
     });
@@ -79,6 +209,61 @@ const parseLoadCommand = (block, state) => {
     collectDependency(kind, fields, state);
     collectSegment(kind, block, fields, state);
 };
+const validateDylibCommandLines = (parsed) => {
+    const encodingFields = DYLIB_ENCODING_FIELDS.filter((key) => parsed.rows.some((field) => field?.[0] === key));
+    if (encodingFields.length !== 1)
+        throw new TypeError("otool dylib command must contain timestamp or options");
+    for (const key of encodingFields)
+        requireUniqueField(parsed, key);
+    const allowed = new Set([...DYLIB_FIELDS, ...DYLIB_ENCODING_FIELDS]);
+    for (const field of parsed.rows) {
+        const key = field?.[0];
+        if (key === undefined || !allowed.has(key))
+            throw new TypeError("otool dylib command contains ambiguous multiline text");
+    }
+};
+/** Each declared option appears once, in order, as `string #1..count`. */
+const validateLinkerOptionLines = (parsed) => {
+    const count = numberField(parsed.values, "count");
+    const labels = parsed.rows
+        .map((field) => field?.[0])
+        .filter((key) => key !== "cmd" && key !== "cmdsize" && key !== "count");
+    if (count === null ||
+        labels.length !== count ||
+        labels.some((key, index) => key !== `string #${String(index + 1)}`))
+        throw new TypeError("otool linker-option strings do not match count");
+};
+const scalarFields = (kind) => {
+    const common = ["cmd", "cmdsize"];
+    if (DYLIB_COMMANDS.has(kind))
+        return DYLIB_FIELDS;
+    if (kind === "LC_LINKER_OPTION")
+        return [...common, "count"];
+    if (kind === "LC_LOAD_DYLINKER" || kind === "LC_ID_DYLINKER")
+        return [...common, "name"];
+    if (kind === "LC_UUID")
+        return [...common, "uuid"];
+    if (kind === "LC_MAIN")
+        return [...common, "entryoff"];
+    if (kind === "LC_BUILD_VERSION")
+        return [...common, "platform", "minos", "sdk", "ntools"];
+    if (kind.startsWith("LC_VERSION_MIN_"))
+        return [...common, "version", "sdk"];
+    if (kind === "LC_SEGMENT" || kind === "LC_SEGMENT_64")
+        return [
+            ...common,
+            "segname",
+            "vmaddr",
+            "vmsize",
+            "fileoff",
+            "filesize",
+            "maxprot",
+            "initprot",
+            "nsects",
+            "flags",
+        ];
+    return common;
+};
 const collectUuid = (kind, fields, state) => {
     if (kind === "LC_UUID")
         state.uuid = stringField(fields, "uuid") ?? state.uuid;
@@ -92,11 +277,14 @@ const collectEntrypoint = (kind, fields, state) => {
 };
 const collectBuild = (kind, block, fields, state) => {
     if (kind === "LC_BUILD_VERSION") {
+        const tools = parseBuildTools(block);
+        if (numberField(fields, "ntools") !== tools.length)
+            throw new TypeError("otool build-tool count does not match ntools");
         state.builds.push({
-            platform: stringField(fields, "platform"),
+            platform: buildCodeName(BUILD_PLATFORM_NAMES, stringField(fields, "platform")),
             minimum_os: stringField(fields, "minos"),
             sdk: stringField(fields, "sdk"),
-            tools: parseBuildTools(block),
+            tools,
         });
         return;
     }
@@ -109,10 +297,8 @@ const collectBuild = (kind, block, fields, state) => {
         });
 };
 const collectDependency = (kind, fields, state) => {
-    if (!kind.startsWith("LC_LOAD_") &&
-        kind !== "LC_ID_DYLIB" &&
-        kind !== "LC_REEXPORT_DYLIB" &&
-        kind !== "LC_LAZY_LOAD_DYLIB")
+    // LC_ID_DYLIB names this image itself; it stays a raw load command only.
+    if (!DYLIB_COMMANDS.has(kind) || kind === "LC_ID_DYLIB")
         return;
     state.dependencies.push({
         path: stripOffsetSuffix(stringField(fields, "name")),
@@ -122,30 +308,66 @@ const collectDependency = (kind, fields, state) => {
     });
 };
 const collectSegment = (kind, block, fields, state) => {
-    if (kind === "LC_SEGMENT" || kind === "LC_SEGMENT_64")
-        state.segments.push(parseSegment(block, fields));
+    if (kind !== "LC_SEGMENT" && kind !== "LC_SEGMENT_64")
+        return;
+    const segment = parseSegment(block, fields);
+    if (numberField(fields, "nsects") !== segment.sections.length)
+        throw new TypeError("otool segment section count does not match its sections");
+    state.segments.push(segment);
 };
+/**
+ * A key otool prints more than once, such as each LC_BUILD_VERSION tool, is
+ * labeled `key #n` in print order so no row overwrites another. Linker-option
+ * strings keep otool's own `string #n` label at every count.
+ */
 const parseFields = (block) => {
+    const rows = [];
+    for (const rawLine of block.split(/\r?\n/u).slice(1))
+        if (rawLine.trim().length > 0)
+            rows.push(parseField(rawLine));
+    const occurrences = new Map();
+    for (const field of rows)
+        if (field !== undefined)
+            occurrences.set(field[0], (occurrences.get(field[0]) ?? 0) + 1);
     const fields = {};
-    for (const rawLine of block.split(/\r?\n/u).slice(1)) {
-        const line = rawLine.trim();
-        // Keys are `token` or a compound `token version`. `time stamp` is the one
-        // other real key, and it must be matched as a whole: treating `stamp` as a
-        // generic suffix would swallow an install name such as
-        // `name stamp plugin.dylib`, hiding the dependency path behind `unknown`.
-        const match = /^((?:time stamp)|\S+(?:\s+version)?)\s+(.+)$/u.exec(line);
-        if (match?.[1] === undefined || match[2] === undefined)
+    const ordinals = new Map();
+    for (const field of rows) {
+        if (field === undefined)
             continue;
-        const value = match[2].trim();
-        fields[match[1]] =
-            match[1] === "segname" || match[1] === "sectname"
-                ? value
-                : (numeric(value) ?? value);
+        const [key, value] = field;
+        const ordinal = (ordinals.get(key) ?? 0) + 1;
+        ordinals.set(key, ordinal);
+        const label = (occurrences.get(key) ?? 0) > 1 ? `${key} #${String(ordinal)}` : key;
+        fields[label] = TEXT_FIELDS.test(key) ? value : (numeric(value) ?? value);
     }
-    return fields;
+    return { values: fields, rows };
+};
+/** Names and linker options are text even when they look numeric. */
+const TEXT_FIELDS = /^(?:segname|sectname|string #\d+)$/u;
+const parseField = (rawLine) => {
+    // otool prints each linker option as `string #n <option>`; keep the option
+    // exactly, including surrounding spaces, under otool's ordinal label.
+    const option = /^\s*(string #[1-9]\d*)(?: (.*))?$/u.exec(rawLine);
+    if (option?.[1] !== undefined)
+        return [option[1], option[2] ?? ""];
+    const line = rawLine.trim();
+    // Match time stamp as a whole without swallowing `name stamp plugin.dylib`.
+    const match = /^((?:time stamp)|\S+(?:\s+version)?)(?:\s+(.+))?$/u.exec(line);
+    return match?.[1] === undefined
+        ? undefined
+        : [match[1], match[2]?.trim() ?? ""];
+};
+const requireUniqueField = (parsed, key) => {
+    const matches = parsed.rows.filter((field) => field?.[0] === key);
+    const field = matches[0];
+    if (matches.length !== 1 || field === undefined)
+        throw new TypeError(`otool field ${key} is missing or repeated`);
+    // Only options and fixed-width Mach-O names may legitimately be empty.
+    if (field[1] === "" && !EMPTY_VALUE_FIELDS.has(key))
+        throw new TypeError(`otool field ${key} has no value`);
 };
 const parseSegment = (block, fields) => ({
-    name: stringField(fields, "segname") ?? "unknown",
+    name: machoName(fields, "segname"),
     vm_address: hexField(fields, "vmaddr"),
     vm_size: numberField(fields, "vmsize"),
     file_offset: numberField(fields, "fileoff"),
@@ -158,10 +380,21 @@ const parseSections = (block) => block
     .split(/(?=\n\s*Section\n)/u)
     .slice(1)
     .map((sectionBlock) => {
-    const fields = parseFields(`Section${sectionBlock}`);
+    const parsed = parseFields(`Section${sectionBlock}`);
+    const fields = parsed.values;
+    for (const key of [
+        "sectname",
+        "segname",
+        "addr",
+        "size",
+        "offset",
+        "align",
+        "flags",
+    ])
+        requireUniqueField(parsed, key);
     return {
-        segment: stringField(fields, "segname") ?? "unknown",
-        name: stringField(fields, "sectname") ?? "unknown",
+        segment: machoName(fields, "segname"),
+        name: machoName(fields, "sectname"),
         address: hexField(fields, "addr"),
         size: numberField(fields, "size"),
         file_offset: numberField(fields, "offset"),
@@ -178,7 +411,7 @@ const parseBuildTools = (block) => {
         const tool = /^tool\s+(.+)$/u.exec(lines[index] ?? "")?.[1];
         const version = /^version\s+(.+)$/u.exec(lines[index + 1] ?? "")?.[1];
         if (tool !== undefined && version !== undefined)
-            tools.push({ name: tool, version });
+            tools.push({ name: BUILD_TOOL_NAMES.get(tool) ?? tool, version });
     }
     return tools;
 };
@@ -210,6 +443,16 @@ const numeric = (value) => {
     const parsed = Number.parseInt(value, value.startsWith("0x") ? 16 : 10);
     return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null;
 };
+/**
+ * A Mach-O segment or section name exactly as observed. Object files place
+ * every section in one unnamed segment, so the empty name is a source value.
+ */
+const machoName = (fields, key) => {
+    const name = stringField(fields, key);
+    if (name === null)
+        throw new TypeError(`otool field ${key} is missing`);
+    return name;
+};
 const stringField = (fields, name) => {
     const value = fields[name];
     return typeof value === "string"

package/dist/native/parsers/plist.js

@@ -1,19 +1,24 @@
 import { z } from "zod";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
-import { projectPlistValue, } from "../../domain/apple/plistValue.js";
+import { negativeZeroReal, negativeZeroRealLimitation, nonFiniteRealLimitation, projectPlistValue, unknownDateLimitation, unknownRealLimitation, } from "../../domain/apple/plistValue.js";
 import { omitPrototypeKeys, omittedPrototypeKeysLimitation, parseXmlPropertyList, } from "../../domain/propertyListKeys.js";
 import { err, ok } from "../../domain/result.js";
+import { incompletePlistNumberLimitation, } from "../../domain/apple/plistNumbers.js";
 const plistObject = z.record(z.string(), z.unknown());
 /** Digits of a JSON number literal that has no fraction or exponent. */
 const INTEGRAL_LITERAL = /^-?\d+$/u;
 /**
  * Decode plutil JSON, passing each integral number literal beyond the exact
- * range of a JavaScript number, with its source digits, to `unsafe`.
+ * range of a JavaScript number, with its source digits, to `unsafe`, and
+ * each negative zero to `negativeZero`.
  */
-const decodePlistJson = (output, unsafe) => {
+const decodePlistJson = (output, unsafe, negativeZero = (item) => item) => {
     // plutil output can carry a UTF-8 BOM, which JSON.parse rejects outright.
     const text = output.replace(/^\uFEFF/u, "");
     return JSON.parse(text, (_key, item, context) => {
+        // A plist integer has no signed zero, so -0 can only come from a real.
+        if (typeof item === "number" && Object.is(item, -0))
+            return negativeZero(item);
         const source = context?.source;
         return typeof item !== "number" ||
             Number.isSafeInteger(item) ||
@@ -48,13 +53,19 @@ export const plistJsonNeedsNumberTypes = (output) => {
  * from an `<integer>` rather than a `<real>`.
  */
 export const parsePlistJson = (output, xmlConversion) => {
-    const literals = xmlConversion === undefined ? undefined : xmlNumberLiterals(xmlConversion);
+    let literals;
     let exactIntegerCount = 0;
     let ambiguousNumberCount = 0;
+    let negativeZeroRealCount = 0;
+    const signedZero = () => {
+        negativeZeroRealCount += 1;
+        return negativeZeroReal();
+    };
     const classify = (item, digits) => {
         const exact = BigInt(digits).toString();
-        const integer = literals?.integers.get(item)?.has(exact) === true;
-        const real = literals?.reals.has(item) === true;
+        const integer = literals?.incomplete === false &&
+            literals.integers.get(item)?.has(exact) === true;
+        const real = literals?.incomplete === false && literals.reals.has(item);
         if (integer && !real) {
             exactIntegerCount += 1;
             return { $plist_type: "integer", decimal: digits };
@@ -67,7 +78,11 @@ export const parsePlistJson = (output, xmlConversion) => {
     };
     let decoded;
     try {
-        decoded = omitPrototypeKeys(decodePlistJson(output, classify));
+        literals =
+            xmlConversion === undefined
+                ? undefined
+                : parseXmlPropertyList(xmlConversion).numberLiterals;
+        decoded = omitPrototypeKeys(decodePlistJson(output, classify, signedZero));
     }
     catch (cause) {
         return err(new AnalysisOutputError("inspect_plist", cause instanceof Error ? cause.message : String(cause), { cause }));
@@ -77,6 +92,10 @@ export const parsePlistJson = (output, xmlConversion) => {
         value,
         bundle: projectPlistBundle(value),
         limitations: [
+            ...negativeZeroLimitations(negativeZeroRealCount),
+            ...(literals?.incomplete === true
+                ? [incompletePlistNumberLimitation]
+                : []),
             ...numberLimitations(exactIntegerCount, ambiguousNumberCount),
             ...prototypeKeyLimitations(decoded.omittedPrototypeKeys),
         ],
@@ -89,9 +108,11 @@ export const parsePlistJson = (output, xmlConversion) => {
 export const parsePlistXml = (output) => {
     let projected;
     let omittedPrototypeKeys;
+    let literals;
     try {
         const decoded = parseXmlPropertyList(output);
         omittedPrototypeKeys = decoded.omittedPrototypeKeys;
+        literals = decoded.numberLiterals;
         projected = projectPlistValue(decoded.value);
     }
     catch (cause) {
@@ -99,7 +120,6 @@ export const parsePlistXml = (output) => {
     }
     // The XML decoder turns <integer> and <real> into numbers before REA sees
     // them, rounding integers beyond the exact range.
-    const literals = xmlNumberLiterals(output);
     let exactIntegerCount = 0;
     let ambiguousNumberCount = 0;
     const value = mapJsonNumbers(projected.value, (item) => {
@@ -107,7 +127,8 @@ export const parsePlistXml = (output) => {
         if (decimals === undefined)
             return item;
         const [decimal] = decimals;
-        if (decimals.size !== 1 ||
+        if (literals.incomplete ||
+            decimals.size !== 1 ||
             decimal === undefined ||
             literals.reals.has(item)) {
             ambiguousNumberCount += 1;
@@ -121,30 +142,24 @@ export const parsePlistXml = (output) => {
         bundle: projectPlistBundle(value),
         limitations: [
             'plutil cannot express this plist as JSON, so it was decoded from plutil\'s XML conversion; data and date values are typed objects such as { "$plist_type": "data", "base64": ... }.',
+            ...(projected.nonFiniteRealCount === 0
+                ? []
+                : [nonFiniteRealLimitation(projected.nonFiniteRealCount)]),
             ...(projected.unknownRealCount === 0
                 ? []
-                : [
-                    `${String(projected.unknownRealCount)} non-finite real value(s) are reported as { "$plist_type": "real", "value": null } because the XML decoder does not distinguish NaN from infinity.`,
-                ]),
+                : [unknownRealLimitation(projected.unknownRealCount)]),
+            ...negativeZeroLimitations(projected.negativeZeroRealCount),
+            ...(projected.unknownDateCount === 0
+                ? []
+                : [unknownDateLimitation(projected.unknownDateCount)]),
+            ...(literals.incomplete ? [incompletePlistNumberLimitation] : []),
             ...numberLimitations(exactIntegerCount, ambiguousNumberCount),
             ...prototypeKeyLimitations(omittedPrototypeKeys),
         ],
     });
 };
-// plutil escapes "<" in keys and strings, so these element literals can be
-// read from the XML text.
-const xmlNumberLiterals = (xml) => {
-    const integers = new Map();
-    for (const [, decimal = ""] of xml.matchAll(/<integer>\s*([+-]?\d+)\s*<\/integer>/gu)) {
-        const rounded = Number(decimal);
-        if (Number.isSafeInteger(rounded))
-            continue;
-        integers.set(rounded, (integers.get(rounded) ?? new Set()).add(BigInt(decimal).toString()));
-    }
-    const reals = new Set([...xml.matchAll(/<real>([^<]*)<\/real>/gu)].map(([, text = ""]) => Number.parseFloat(text)));
-    return { integers, reals };
-};
 const prototypeKeyLimitations = (count) => count === 0 ? [] : [omittedPrototypeKeysLimitation(count)];
+const negativeZeroLimitations = (count) => count === 0 ? [] : [negativeZeroRealLimitation(count)];
 const numberLimitations = (exactIntegerCount, ambiguousNumberCount) => [
     ...(exactIntegerCount === 0
         ? []

package/dist/native/pe/PeResourceLayout.js

@@ -14,6 +14,16 @@ export const requirePeRange = (bytes, offset, length) => {
 // initialized file bytes and can include file-alignment padding; loaders may
 // map page-rounded tails, but those bytes are outside the declared section.
 const virtualExtent = (section) => section.virtualSize === 0 ? section.size : section.virtualSize;
+// Intersection normalized with those ownership rules: a section without
+// virtual extent owns no byte and never conflicts, while an empty resource
+// owns exactly its start point, so a positive-extent section starting there
+// conflicts with header-backed ownership of the same RVA.
+const intersectsResource = (section, rva, size) => {
+    const extent = virtualExtent(section);
+    return (extent > 0 &&
+        section.rva < rva + Math.max(size, 1) &&
+        rva < section.rva + extent);
+};
 /** Header admission and unambiguous file-backed RVA mapping, independent of section names. */
 export const readPeResourceLayout = (bytes) => {
     requirePeRange(bytes, 0, 64);
@@ -76,10 +86,16 @@ export const readPeResourceLayout = (bytes) => {
     const map = (rva, size) => {
         if (rva + size > 0x100000000)
             peFailure("Resource RVA range overflows.");
-        const candidates = sections.filter((section) => rva >= section.rva && rva - section.rva < virtualExtent(section));
+        const containing = sections.filter((section) => rva >= section.rva && rva - section.rva < virtualExtent(section));
+        // An empty interval reads no bytes, so the Windows resource loader also
+        // resolves it exactly at a section's virtual end. A section starting at
+        // that RVA still owns it.
+        const candidates = size === 0 && containing.length === 0
+            ? sections.filter((section) => virtualExtent(section) > 0 &&
+                rva - section.rva === virtualExtent(section))
+            : containing;
         if (rva < headerSize) {
-            if (sections.some((section) => section.rva < rva + size &&
-                section.rva + virtualExtent(section) > rva) ||
+            if (sections.some((section) => intersectsResource(section, rva, size)) ||
                 size > headerSize - rva)
                 peFailure("Ambiguous resource header RVA mapping.");
             requirePeRange(bytes, rva, size);
@@ -95,10 +111,9 @@ export const readPeResourceLayout = (bytes) => {
             peFailure("Resource range leaves its section's virtual size.");
         if (within > section.size || size > section.size - within)
             peFailure("Resource range is not entirely file-backed in one section.");
-        // A second section starting inside the requested interval is ambiguous too.
-        if (sections.some((other) => other !== section &&
-            other.rva < rva + size &&
-            other.rva + virtualExtent(other) > rva))
+        // A second section with virtual extent inside the requested interval is
+        // ambiguous too; a zero-extent section owns no byte there.
+        if (sections.some((other) => other !== section && intersectsResource(other, rva, size)))
             peFailure("Resource interval intersects overlapping virtual sections.");
         const offset = section.offset + within;
         requirePeRange(bytes, offset, size);