reverseport 0.0.0-stage → 1.2.0

package/dist/native/SignatureTargetBinding.js

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdtemp, open, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisAccessDeniedError, AnalysisArtifactChangedError, AnalysisCancelledError, AnalysisResourceConstraintError, } from "../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { err, ok } from "../domain/result.js";
+import { NATIVE_MACOS_PROVIDER_IDENTITY } from "./NativeMacOSProviderMetadata.js";
+const identity = (stat) => [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(":");
+const changedTarget = (target, reason) => err(new AnalysisArtifactChangedError("inspect_signature", target.path, reason));
+const signatureReadFailure = (target, cause) => {
+    if (cause instanceof AnalysisError)
+        return cause;
+    const code = cause instanceof Error && "code" in cause ? cause.code : undefined;
+    if (code === "EACCES" || code === "EPERM")
+        return new AnalysisAccessDeniedError("inspect_signature", target.path, code, { cause });
+    if (code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP")
+        return new AnalysisArtifactChangedError("inspect_signature", target.path, `Registered signature target is no longer readable (${code}): ${target.path}`, { cause });
+    return new ProviderAdapterError(NATIVE_MACOS_PROVIDER_IDENTITY.id, "inspect_signature", {
+        cause,
+        diagnostics: {
+            path: target.path,
+            phase: "target-version-binding",
+            system_code: typeof code === "string" ? code : null,
+            reason: cause instanceof Error ? cause.message : String(cause),
+        },
+    });
+};
+/** Inspect a digest-verified private copy, releasing it on every exit path. */
+export const withSignatureTarget = async (target, inspect, signal) => {
+    let directory;
+    try {
+        signal?.throwIfAborted();
+        directory = await mkdtemp(join(tmpdir(), "rea-signature-"));
+    }
+    catch (cause) {
+        return err(signal?.aborted
+            ? new AnalysisCancelledError("inspect_signature")
+            : snapshotFailure(target, "create", cause));
+    }
+    let result;
+    let cleanup;
+    try {
+        const binding = await bindSignatureTarget(target, join(directory, basename(target.path)), signal);
+        result = binding.ok ? await inspect(binding.value) : binding;
+    }
+    finally {
+        try {
+            await rm(directory, { recursive: true, force: true });
+            cleanup = ok(undefined);
+        }
+        catch (cause) {
+            cleanup = err(snapshotFailure(target, "cleanup", cause));
+        }
+    }
+    // Cleanup cannot replace the operation's original actionable failure.
+    return result.ok && !cleanup.ok ? cleanup : result;
+};
+const snapshotFailure = (target, phase, cause) => new ProviderAdapterError(NATIVE_MACOS_PROVIDER_IDENTITY.id, "inspect_signature", {
+    cause,
+    diagnostics: {
+        path: target.path,
+        phase: `signature-snapshot-${phase}`,
+        reason: cause instanceof Error ? cause.message : String(cause),
+    },
+});
+const snapshotIO = async (target, phase, operation) => {
+    try {
+        return await operation();
+    }
+    catch (cause) {
+        throw snapshotFailure(target, phase, cause);
+    }
+};
+const copySignatureBytes = async (target, source, snapshot, signal) => {
+    const size = Number(source.stat.size);
+    if (!Number.isSafeInteger(size))
+        throw new AnalysisResourceConstraintError("inspect_signature", "file-size", `Signature target size is not exactly representable: ${target.path}`, null);
+    const hash = createHash("sha256");
+    const chunk = Buffer.alloc(64 * 1024);
+    let position = 0;
+    while (position < size) {
+        signal?.throwIfAborted();
+        const { bytesRead } = await source.file.read(chunk, 0, Math.min(chunk.length, size - position), position);
+        signal?.throwIfAborted();
+        if (bytesRead === 0)
+            throw new AnalysisArtifactChangedError("inspect_signature", target.path, `Signature target was truncated while hashing: ${target.path}`);
+        const bytes = chunk.subarray(0, bytesRead);
+        hash.update(bytes);
+        // writeFile retries short writes; memory remains bounded to this chunk.
+        await snapshotIO(target, "write", () => snapshot.writeFile(bytes));
+        position += bytesRead;
+    }
+    return hash.digest("hex");
+};
+/** Hash and copy the same descriptor bytes, without reopening the mutable path. */
+const bindSignatureTarget = async (target, snapshotPath, signal) => {
+    try {
+        signal?.throwIfAborted();
+        const before = await lstat(target.path, { bigint: true });
+        signal?.throwIfAborted();
+        if (!before.isFile() || before.isSymbolicLink())
+            return changedTarget(target, `Signature target is no longer a regular file: ${target.path}`);
+        const file = await open(target.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const opened = await file.stat({ bigint: true });
+            signal?.throwIfAborted();
+            if (identity(opened) !== identity(before))
+                return changedTarget(target, `Signature target changed before open: ${target.path}`);
+            const snapshot = await snapshotIO(target, "create-file", () => open(snapshotPath, "wx", 0o600));
+            try {
+                const observed = await copySignatureBytes(target, { file, stat: opened }, snapshot, signal);
+                if (observed !== target.sha256)
+                    return changedTarget(target, `Signature target digest changed: ${target.path}; expected ${target.sha256}, observed ${observed}`);
+                const after = await file.stat({ bigint: true });
+                const current = await lstat(target.path, { bigint: true });
+                signal?.throwIfAborted();
+                if (identity(after) !== identity(opened) ||
+                    identity(current) !== identity(opened))
+                    return changedTarget(target, `Signature target changed while establishing its version: ${target.path}`);
+                await snapshotIO(target, "seal", () => snapshot.chmod(0o400));
+                return ok({ identity: identity(opened), snapshotPath });
+            }
+            finally {
+                await snapshotIO(target, "close", () => snapshot.close());
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch (cause) {
+        return err(signal?.aborted
+            ? new AnalysisCancelledError("inspect_signature")
+            : signatureReadFailure(target, cause));
+    }
+};
+/** Reject target drift across signature command captures. */
+export const verifySignatureTarget = async (target, binding, signal) => {
+    try {
+        signal?.throwIfAborted();
+        const current = await lstat(target.path, { bigint: true });
+        signal?.throwIfAborted();
+        return current.isFile() && identity(current) === binding.identity
+            ? ok(undefined)
+            : changedTarget(target, `Signature target changed during inspection: ${target.path}`);
+    }
+    catch (cause) {
+        return err(signal?.aborted
+            ? new AnalysisCancelledError("inspect_signature")
+            : signatureReadFailure(target, cause));
+    }
+};

package/dist/native/parsers/codesign.js

@@ -0,0 +1,93 @@
+import { inspectSignatureSchema, } from "../../domain/native/nativeInspection.js";
+/**
+ * Parse bounded `codesign -d --verbose=4` diagnostics, which Apple emits on
+ * stderr. codesign echoes the executable path and signing identifier
+ * verbatim, and an ad hoc identifier derives from the file name, so either
+ * can contain line breaks and text that resembles other fields. The path is
+ * removed by its exact value from `executablePaths`, and the identifier runs
+ * to the `Format=` field that codesign prints after it.
+ */
+export const parseCodeSignature = (output, unsigned, executablePaths = []) => {
+    const { identifier, fields } = splitEchoedValues(output.replaceAll("\r\n", "\n"), executablePaths);
+    const values = new Map();
+    const authorities = [];
+    const cdhashes = [];
+    for (const line of fields.split("\n")) {
+        if (line.startsWith("CodeDirectory ")) {
+            values.set("CodeDirectory", line.slice("CodeDirectory ".length));
+            continue;
+        }
+        const separator = line.indexOf("=");
+        if (separator < 1)
+            continue;
+        const key = line.slice(0, separator).trim();
+        const value = line.slice(separator + 1).trim();
+        if (key === "Authority")
+            authorities.push(value);
+        else if (key === "CDHash")
+            cdhashes.push(value);
+        else
+            values.set(key, value);
+    }
+    const parsed = inspectSignatureSchema.omit({ provenance: true }).parse({
+        signed: !unsigned,
+        identifier: identifier ?? null,
+        team_identifier: nullableCodeSignValue(values.get("TeamIdentifier")),
+        format: values.get("Format") ?? null,
+        cdhashes,
+        hash_algorithms: splitAlgorithms(values.get("Hash choices")),
+        authorities,
+        designated_requirement: values.get("designated") ?? null,
+        entitlements: null,
+        timestamp: values.get("Timestamp") ?? null,
+        hardened_runtime: parseRuntime(values.get("CodeDirectory")),
+        limitations: unsigned
+            ? ["Artifact is not signed."]
+            : [
+                "Entitlements and designated requirements require separate bounded commands.",
+            ],
+    });
+    return parsed;
+};
+/**
+ * Separate the echoed executable path and signing identifier, which codesign
+ * prints first, from the fields that follow them.
+ */
+const splitEchoedValues = (text, executablePaths) => {
+    const executable = executablePaths
+        .map((path) => `Executable=${path}\n`)
+        .find((line) => text.startsWith(line));
+    let rest = text;
+    if (executable !== undefined)
+        rest = text.slice(executable.length);
+    else if (text.startsWith("Executable=")) {
+        const identifierLine = text.indexOf("\nIdentifier=");
+        rest = identifierLine < 0 ? text : text.slice(identifierLine + 1);
+    }
+    if (!rest.startsWith("Identifier="))
+        return { identifier: undefined, fields: rest };
+    // Later fields come from the signature itself, so the last `Format=` line
+    // is the one codesign printed after the identifier.
+    const format = rest.lastIndexOf("\nFormat=");
+    const lineEnd = rest.indexOf("\n");
+    const end = format >= 0 ? format : lineEnd >= 0 ? lineEnd : rest.length;
+    return {
+        identifier: rest.slice("Identifier=".length, end),
+        fields: rest.slice(end),
+    };
+};
+const nullableCodeSignValue = (value) => value === undefined || value === "not set" ? null : value;
+const splitAlgorithms = (value) => value === undefined
+    ? []
+    : value
+        .split(/[,+\s]+/u)
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+const parseRuntime = (value) => {
+    if (value === undefined)
+        return null;
+    const flags = /(?:^|\s)flags=[^(]*\(([^)]*)\)/u.exec(value)?.[1];
+    if (flags === undefined)
+        return null;
+    return flags.split(",").some((flag) => flag.trim() === "runtime");
+};

package/dist/native/parsers/demangle.js

@@ -0,0 +1,30 @@
+import { z } from "zod";
+const resultSchema = z.object({
+    input: z.string(),
+    output: z.string(),
+    status: z.enum(["demangled", "unchanged", "invalid"]),
+});
+/**
+ * Preserve input ordering while parsing `swift-demangle --compact` lines.
+ * The demangler ends each record with LF, so a carriage return belongs to the
+ * symbol text.
+ */
+export const parseDemangledSymbols = (inputs, output) => {
+    const lines = output.replace(/\n$/u, "").split("\n");
+    if (lines.length !== inputs.length)
+        throw new TypeError("swift-demangle output count does not match input");
+    return inputs.map((input, index) => {
+        const value = lines[index];
+        if (value === undefined)
+            throw new TypeError("swift-demangle omitted an output line");
+        return resultSchema.parse({
+            input,
+            output: value,
+            status: value === input
+                ? input.startsWith("$s") || input.startsWith("_$s")
+                    ? "invalid"
+                    : "unchanged"
+                : "demangled",
+        });
+    });
+};

package/dist/native/parsers/dyldInfo.js

@@ -0,0 +1,60 @@
+/** Decode Apple dyld inventory rows, projecting export offsets to VM addresses. */
+export const parseDyldSymbols = (output, mode, imageBase = null, knownExportNames = new Set()) => {
+    const offsets = /^\s*offset\s+symbol\s*$/mu.test(output);
+    return output.split(/\r?\n/u).flatMap((rawLine) => {
+        const line = rawLine.trim();
+        if (mode === "imports") {
+            const imported = /^(?:0x[\da-f]+\s+)?(.+?)(?:\s+\[([^\]]+)\])?\s+\(from (.+)\)$/iu.exec(line);
+            if (imported?.[1] !== undefined)
+                return [
+                    {
+                        name: imported[1],
+                        address: null,
+                        weak: /\bweak-import\b/u.test(imported[2] ?? "") ? true : null,
+                        reexport: null,
+                        source: imported[3] ?? null,
+                    },
+                ];
+            return [];
+        }
+        const reexport = /^\[re-export\]\s+(.+?)(?:\s+\(from (.+)\))?$/u.exec(line);
+        if (reexport?.[1] !== undefined)
+            return [
+                {
+                    name: reexport[1],
+                    address: null,
+                    weak: null,
+                    reexport: true,
+                    source: reexport[2] ?? null,
+                },
+            ];
+        const exported = /^(0x[\da-f]+)\s+(.+?)(?:\s+\[([^\]]+)\])?$/iu.exec(line);
+        if (exported?.[1] === undefined || exported[2] === undefined)
+            return [];
+        const rawName = /^0x[\da-f]+\s+(.+)$/iu.exec(line)?.[1];
+        const literalName = rawName !== undefined && knownExportNames.has(rawName);
+        // If nm establishes both interpretations, the textual row cannot bind an address or flags.
+        // Let the caller retain the exact nm names without guessing which one owns this row.
+        if (literalName &&
+            exported[3] !== undefined &&
+            knownExportNames.has(exported[2]))
+            return [];
+        const annotation = literalName ? undefined : exported[3];
+        const absolute = /\babsolute\b/u.test(annotation ?? "");
+        const address = offsets && !absolute
+            ? imageBase === null
+                ? null
+                : `0x${(BigInt(imageBase) + BigInt(exported[1])).toString(16)}`
+            : canonicalHex(exported[1]);
+        return [
+            {
+                name: literalName ? rawName : exported[2],
+                address,
+                weak: /\bweak-def\b/u.test(annotation ?? "") ? true : null,
+                reexport: false,
+                source: null,
+            },
+        ];
+    });
+};
+const canonicalHex = (value) => value === undefined ? null : `0x${BigInt(value).toString(16)}`;

package/dist/native/parsers/echoedPath.js

@@ -0,0 +1,14 @@
+/**
+ * Remove the header line otool and dyld_info print before a slice's output:
+ * `<path>:`, `<path> (architecture <arch>):`, or `<path> [<arch>]:`. File
+ * names may contain line breaks and tool keywords, so only the exact operand
+ * path is stripped; output without that header is returned unchanged.
+ */
+export const withoutEchoedPathHeader = (output, path) => {
+    if (path === undefined || !output.startsWith(path))
+        return output;
+    const header = /^(?: \(architecture [^)\n]*\)| \[[^\]\n]*\])?:\r?\n/u.exec(output.slice(path.length));
+    return header === null
+        ? output
+        : output.slice(path.length + header[0].length);
+};

package/dist/native/parsers/lipo.js

@@ -0,0 +1,177 @@
+import { z } from "zod";
+const architectureSchema = z.object({
+    name: z.string().min(1),
+    cpu_type: z.string().nullable(),
+    cpu_subtype: z.string().nullable(),
+    cpu_type_code: z.number().int().nonnegative().nullable(),
+    cpu_subtype_code: z.number().int().nonnegative().nullable(),
+    capabilities: z.string().nullable(),
+    file_offset: z.number().int().min(0).nullable(),
+    size: z.number().int().min(0).nullable(),
+    alignment: z.number().int().min(0).nullable(),
+});
+/** Parse `lipo -detailed_info` into deterministic slice metadata. */
+export const parseLipoArchitectures = (output) => {
+    // lipo echoes a thin file's pathname verbatim, including embedded newlines.
+    // Match its final architecture field before splitting records into lines.
+    const thinArchitecture = /(?:^|\r?\n)Non-fat file:[\s\S]* is architecture: ([^\s]+)\s*$/u.exec(output)?.[1];
+    if (thinArchitecture !== undefined)
+        return [
+            architectureSchema.parse({
+                name: thinArchitecture,
+                cpu_type: null,
+                cpu_subtype: null,
+                cpu_type_code: null,
+                cpu_subtype_code: null,
+                capabilities: null,
+                file_offset: null,
+                size: null,
+                alignment: null,
+            }),
+        ];
+    const architectures = [];
+    let current;
+    const flush = () => {
+        if (current === undefined)
+            return;
+        const name = current.architecture ?? current["Non-fat file"];
+        if (name !== undefined)
+            architectures.push(architectureSchema.parse({
+                name: name.includes(" is architecture: ")
+                    ? (name.split(" is architecture: ").at(-1) ?? name)
+                    : name,
+                cpu_type: current.cputype ?? null,
+                cpu_subtype: current.cpusubtype ?? null,
+                cpu_type_code: cpuTypeCode(current.cputype),
+                cpu_subtype_code: cpuSubtypeCode(current.cpusubtype, current.capabilities),
+                capabilities: current.capabilities ?? null,
+                file_offset: integer(current.offset),
+                size: integer(current.size),
+                alignment: alignment(current.align),
+            }));
+        current = undefined;
+    };
+    for (const rawLine of output.split(/\r?\n/u)) {
+        const line = rawLine.trim();
+        if (line.startsWith("Non-fat file:")) {
+            flush();
+            current = { "Non-fat file": line };
+            continue;
+        }
+        if (line.startsWith("architecture ")) {
+            flush();
+            current = { architecture: line.slice("architecture ".length).trim() };
+            continue;
+        }
+        const match = /^(cputype|cpusubtype|capabilities|offset|size|align)\s+(.+)$/u.exec(line);
+        if (match?.[1] !== undefined && match[2] !== undefined) {
+            current ??= {};
+            current[match[1]] = match[2].trim();
+        }
+    }
+    flush();
+    if (architectures.length === 0)
+        throw new TypeError("lipo output contained no architectures");
+    return architectures;
+};
+const integer = (value) => {
+    if (value === undefined || !/^\d+$/u.test(value))
+        return null;
+    const parsed = Number.parseInt(value, 10);
+    return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null;
+};
+const CPU_TYPES = {
+    CPU_TYPE_X86: 7,
+    CPU_TYPE_X86_64: 0x01000007,
+    CPU_TYPE_ARM: 12,
+    CPU_TYPE_ARM64: 0x0100000c,
+    CPU_TYPE_ARM64_32: 0x0200000c,
+    CPU_TYPE_POWERPC: 18,
+    CPU_TYPE_POWERPC64: 0x01000012,
+};
+const CPU_SUBTYPES = {
+    CPU_SUBTYPE_X86_ALL: 3,
+    CPU_SUBTYPE_X86_64_ALL: 3,
+    CPU_SUBTYPE_X86_64_H: 8,
+    CPU_SUBTYPE_ARM64_ALL: 0,
+    CPU_SUBTYPE_ARM64_V8: 1,
+    CPU_SUBTYPE_ARM64E: 2,
+    CPU_SUBTYPE_ARM64_32_ALL: 0,
+    CPU_SUBTYPE_ARM64_32_V8: 1,
+    CPU_SUBTYPE_ARM_V7: 9,
+    CPU_SUBTYPE_ARM_V7S: 11,
+    CPU_SUBTYPE_ARM_V7K: 12,
+    CPU_SUBTYPE_POWERPC_ALL: 0,
+    CPU_SUBTYPE_POWERPC_970: 100,
+};
+/** Normalize known lipo names while retaining the producer's original text. */
+const cpuTypeCode = (value) => {
+    if (value === undefined)
+        return null;
+    const numeric = unsigned32(value);
+    return numeric ?? CPU_TYPES[value] ?? null;
+};
+/** Normalize the subtype and its separately printed capability bits. */
+const cpuSubtypeCode = (value, capabilities) => {
+    if (value === undefined)
+        return null;
+    const numeric = unsigned32(value);
+    if (numeric !== null)
+        return numeric;
+    const subtype = CPU_SUBTYPES[value];
+    if (subtype === undefined)
+        return null;
+    if (value !== "CPU_SUBTYPE_ARM64E") {
+        // Recent lipo prints an empty capabilities line, even for LIB64 slices.
+        const bits = capabilityBits(capabilities);
+        return bits === null ? null : ((bits << 24) | subtype) >>> 0;
+    }
+    const version = /PTR_AUTH_VERSION\s+USERSPACE\s+(\d+)/u.exec(capabilities ?? "")?.[1];
+    if (version === undefined)
+        return null;
+    const parsedVersion = Number(version);
+    if (!Number.isInteger(parsedVersion) ||
+        parsedVersion < 0 ||
+        parsedVersion > 15)
+        return null;
+    return (0x80000000 | (parsedVersion << 24) | subtype) >>> 0;
+};
+/** The subtype bits a lipo record names, without its capability byte. */
+export const lipoSubtypeBits = (value) => {
+    if (value === null)
+        return null;
+    const subtype = unsigned32(value) ?? CPU_SUBTYPES[value];
+    return subtype === undefined ? null : subtype & 0x00ffffff;
+};
+/** lipo names the LIB64 capability and prints other capability bits in hex. */
+const capabilityBits = (capabilities) => {
+    if (capabilities === "CPU_SUBTYPE_LIB64")
+        return 0x80;
+    const bits = /^0x([\da-f]{1,2})$/iu.exec(capabilities ?? "")?.[1];
+    return bits === undefined ? null : Number.parseInt(bits, 16);
+};
+const unsigned32 = (value) => {
+    if (!/^(?:\d+|0x[\da-f]+)$/iu.test(value))
+        return null;
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 0 && parsed <= 0xffffffff
+        ? parsed >>> 0
+        : null;
+};
+const alignment = (value) => {
+    if (value === undefined)
+        return null;
+    const exponent = /^2\^(\d+)(?: \((\d+)\))?$/u.exec(value);
+    const powerText = exponent?.[1];
+    if (powerText !== undefined) {
+        const power = Number.parseInt(powerText, 10);
+        if (power > 52)
+            return null;
+        const alignment = 2 ** power;
+        const reported = exponent?.[2];
+        return reported === undefined || integer(reported) === alignment
+            ? alignment
+            : null;
+    }
+    return integer(value);
+};

package/dist/native/parsers/machoUuid.js

@@ -0,0 +1,150 @@
+const MACHO_UUID = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/iu;
+/** Reconcile the selected slice's UUID observations from otool and dwarfdump. */
+export const reconcileMachoUuid = (commands, dwarfdumpOutput, artifactPath, selectedArchitecture) => reconcileObservations(loadCommandUuid(commands), parseDwarfdumpUuid(dwarfdumpOutput, artifactPath, selectedArchitecture));
+const parseDwarfdumpUuid = (output, artifactPath, selectedArchitecture) => {
+    const parsed = parseDwarfdumpRows(output, artifactPath);
+    return parsed.kind === "invalid"
+        ? parsed
+        : selectDwarfdumpRow(parsed.rows, selectedArchitecture);
+};
+const parseDwarfdumpRows = (output, artifactPath) => {
+    if (output.trim().length === 0)
+        return { kind: "rows", rows: [] };
+    // Frame the documented row header, then consume the exact operand path.
+    // Paths may contain newlines and text that resembles another UUID row.
+    const header = /UUID:[ \t]*([^\s]+)[ \t]+\(([^)\r\n]+)\) /uy;
+    const rows = [];
+    let offset = 0;
+    while (offset < output.length) {
+        if (output.startsWith("\r\n", offset)) {
+            offset += 2;
+            continue;
+        }
+        if (output[offset] === "\n") {
+            offset += 1;
+            continue;
+        }
+        header.lastIndex = offset;
+        const match = header.exec(output);
+        if (match === null)
+            return {
+                kind: "invalid",
+                reason: "dwarfdump --uuid output contains an unrecognized row",
+            };
+        const value = match[1] ?? "";
+        const architecture = match[2] ?? "";
+        offset = header.lastIndex;
+        if (!output.startsWith(artifactPath, offset))
+            return {
+                kind: "invalid",
+                reason: `dwarfdump --uuid row does not match the selected artifact path (UUID ${JSON.stringify(value)})`,
+            };
+        offset += artifactPath.length;
+        if (offset < output.length && output.startsWith("\r\n", offset))
+            offset += 2;
+        else if (output[offset] === "\n")
+            offset += 1;
+        else if (offset !== output.length)
+            return {
+                kind: "invalid",
+                reason: `dwarfdump --uuid returned malformed UUID row ${JSON.stringify(value)}`,
+            };
+        rows.push({ value, architecture });
+    }
+    return { kind: "rows", rows };
+};
+const selectDwarfdumpRow = (rows, selectedArchitecture) => {
+    if (rows.length === 0)
+        return { kind: "absent" };
+    const selectedRows = selectedArchitecture === null
+        ? rows
+        : rows.filter(({ architecture }) => architecture === selectedArchitecture);
+    const validRows = selectedRows.filter(({ value }) => MACHO_UUID.test(value));
+    const distinctValid = new Set(validRows.map(({ value }) => value.toLowerCase()));
+    if (distinctValid.size > 1)
+        return {
+            kind: "conflict",
+            reason: `dwarfdump --uuid returned conflicting UUIDs for selected architecture ${selectedArchitecture ?? "unknown"}`,
+        };
+    if (selectedRows.length !== 1)
+        return {
+            kind: "invalid",
+            reason: selectedRows.length > 1
+                ? `dwarfdump --uuid returned multiple rows for selected architecture ${selectedArchitecture}`
+                : `dwarfdump --uuid returned no row for selected architecture ${selectedArchitecture}`,
+        };
+    const [row] = selectedRows;
+    if (row === undefined)
+        return { kind: "absent" };
+    if (!MACHO_UUID.test(row.value))
+        return {
+            kind: "invalid",
+            reason: `dwarfdump --uuid returned malformed UUID ${JSON.stringify(row.value)}`,
+        };
+    return { kind: "valid", value: row.value };
+};
+const loadCommandUuid = (commands) => {
+    const loadCommands = commands.filter(({ kind }) => kind === "LC_UUID");
+    if (loadCommands.length === 0)
+        return { kind: "absent" };
+    if (loadCommands.length > 1) {
+        const observed = loadCommands
+            .map(({ fields }) => fields.uuid)
+            .filter((value) => typeof value === "string" && MACHO_UUID.test(value));
+        const distinct = new Set(observed.map((value) => value.toLowerCase()));
+        return {
+            kind: distinct.size > 1 ? "conflict" : "invalid",
+            reason: distinct.size > 1
+                ? `otool returned conflicting LC_UUID values ${observed.map((value) => JSON.stringify(value)).join(" and ")}`
+                : `otool returned ${String(loadCommands.length)} LC_UUID commands`,
+        };
+    }
+    const value = loadCommands[0]?.fields.uuid;
+    return typeof value === "string" && MACHO_UUID.test(value)
+        ? { kind: "valid", value }
+        : {
+            kind: "invalid",
+            reason: `otool LC_UUID contains malformed UUID ${JSON.stringify(value ?? null)}`,
+        };
+};
+const reconcileObservations = (loadUuid, dwarfdump) => {
+    if (dwarfdump.kind === "valid" && loadUuid.kind === "valid") {
+        if (dwarfdump.value.toLowerCase() === loadUuid.value.toLowerCase())
+            return { value: dwarfdump.value, limitations: [] };
+        return {
+            value: null,
+            limitations: [
+                `dwarfdump --uuid (${dwarfdump.value}) conflicts with otool LC_UUID (${loadUuid.value}); the image UUID is unknown.`,
+            ],
+        };
+    }
+    if (dwarfdump.kind === "valid" && loadUuid.kind === "conflict")
+        return { value: null, limitations: [loadUuid.reason] };
+    if (loadUuid.kind === "valid" && dwarfdump.kind === "conflict")
+        return { value: null, limitations: [dwarfdump.reason] };
+    if (dwarfdump.kind === "valid")
+        return {
+            value: dwarfdump.value,
+            limitations: loadUuid.kind === "invalid"
+                ? [`${loadUuid.reason}; using the unambiguous dwarfdump UUID.`]
+                : [],
+        };
+    if (loadUuid.kind === "valid")
+        return {
+            value: loadUuid.value,
+            limitations: dwarfdump.kind === "invalid"
+                ? [`${dwarfdump.reason}; using the unambiguous otool LC_UUID.`]
+                : [],
+        };
+    return {
+        value: null,
+        limitations: [
+            ...(dwarfdump.kind === "invalid" || dwarfdump.kind === "conflict"
+                ? [dwarfdump.reason]
+                : []),
+            ...(loadUuid.kind === "invalid" || loadUuid.kind === "conflict"
+                ? [loadUuid.reason]
+                : []),
+        ],
+    };
+};