rea-agents 6.1.0 → 6.3.0

package/dist/artifacts/NativeDmgOwnership.js

@@ -0,0 +1,109 @@
+import { relative, resolve, sep } from "node:path";
+import { parse } from "plist";
+import { z } from "zod";
+const systemEntitySchema = z.object({
+    "dev-entry": z.string().startsWith("/dev/"),
+    "mount-point": z.string().optional(),
+});
+const attachOutputSchema = z.object({
+    "system-entities": z.array(systemEntitySchema),
+});
+const infoOutputSchema = z.object({
+    images: z.array(z.object({
+        "system-entities": z.array(systemEntitySchema),
+    })),
+});
+/** Parse hdiutil's current image inventory. */
+export const parseNativeDmgInfo = (stdout) => infoOutputSchema.parse(parse(stdout));
+/** Parse hdiutil's attach response while preserving device and mount facts. */
+export const parseNativeDmgAttachOutput = (stdout) => attachOutputSchema.parse(parse(stdout));
+/** Classify only fresh image groups tied to the exclusively owned mount root. */
+export const resolveNativeDmgOwnership = (input) => {
+    const rootedImages = input.info.images.filter((image) => image["system-entities"].some(({ "mount-point": mountPoint }) => mountPoint !== undefined && isBelowRoot(input.mountRoot, mountPoint)));
+    if (rootedImages.length > 1)
+        return {
+            status: "unknown",
+            reason: "multiple hdiutil image groups report mounts beneath the owned root",
+        };
+    const rootedImage = rootedImages[0];
+    if (rootedImage !== undefined) {
+        const hasOutsideMount = rootedImage["system-entities"].some(({ "mount-point": mountPoint }) => mountPoint !== undefined && !isBelowRoot(input.mountRoot, mountPoint));
+        const groupDevices = rootedImage["system-entities"].map(({ "dev-entry": device }) => device);
+        const devices = topLevelDevices(groupDevices);
+        const overlapsBaseline = groupDevices.some((device) => input.baselineDevices.has(device));
+        if (hasOutsideMount || overlapsBaseline || devices.length === 0)
+            return {
+                status: "unknown",
+                reason: hasOutsideMount
+                    ? "the image group contains a mount outside the owned root"
+                    : overlapsBaseline
+                        ? "the image group includes a device present before attachment"
+                        : "the owned mount group contains no detachable device",
+            };
+        return { status: "owned", devices, source: "info" };
+    }
+    if (input.attachOutputReturned) {
+        const attachOwnership = ownershipFromAttachOutput(input.attachOutput, input.mountRoot, input.baselineDevices);
+        if (attachOwnership.status === "owned") {
+            return attachOwnership;
+        }
+        if (attachOwnership.status === "unknown")
+            return attachOwnership;
+    }
+    const newlyListedDevice = input.info.images.some((image) => image["system-entities"].some(({ "dev-entry": device }) => !input.baselineDevices.has(device)));
+    if (newlyListedDevice)
+        return {
+            status: "unknown",
+            reason: "hdiutil lists devices absent from the pre-attach baseline, but none is tied uniquely to the owned root; ownership is unknown",
+        };
+    return { status: "none" };
+};
+const ownershipFromAttachOutput = (output, mountRoot, baselineDevices) => {
+    if (output === undefined)
+        return {
+            status: "unknown",
+            reason: "hdiutil attach succeeded but its ownership facts were malformed",
+        };
+    const entities = output["system-entities"];
+    const hasRootMount = entities.some(({ "mount-point": mountPoint }) => mountPoint !== undefined && isBelowRoot(mountRoot, mountPoint));
+    const hasOutsideMount = entities.some(({ "mount-point": mountPoint }) => mountPoint !== undefined && !isBelowRoot(mountRoot, mountPoint));
+    const devices = entities.map(({ "dev-entry": device }) => device);
+    const uniqueDevices = topLevelDevices(devices);
+    const overlapsBaseline = devices.some((device) => baselineDevices.has(device));
+    if (hasRootMount) {
+        if (hasOutsideMount || overlapsBaseline || uniqueDevices.length === 0)
+            return {
+                status: "unknown",
+                reason: hasOutsideMount
+                    ? "the attach result includes a mount outside the owned root"
+                    : overlapsBaseline
+                        ? "the attach result includes a device present before attachment"
+                        : "the attach result's owned mount has no detachable device",
+            };
+        return { status: "owned", devices: uniqueDevices, source: "attach" };
+    }
+    if (devices.length === 0)
+        return {
+            status: "unknown",
+            reason: "hdiutil attach succeeded without reporting device ownership facts",
+        };
+    if (devices.some((device) => !baselineDevices.has(device)))
+        return {
+            status: "unknown",
+            reason: "the attach result reports new devices without a mount beneath the owned root",
+        };
+    return { status: "none" };
+};
+const topLevelDevices = (devices) => {
+    const unique = [...new Set(devices)];
+    return unique.filter((device) => !unique.some((parent) => /^\/dev\/disk\d+$/u.test(parent) &&
+        device.startsWith(`${parent}s`) &&
+        /^\d+$/u.test(device.slice(parent.length + 1))));
+};
+const isBelowRoot = (root, path) => {
+    const child = relative(root, resolve(path));
+    return (child !== "" &&
+        child !== "." &&
+        child !== ".." &&
+        !child.startsWith(`..${sep}`));
+};

package/dist/artifacts/SafeOutputTree.js

@@ -129,7 +129,13 @@ export class SafeOutputTree {
     async rollback() {
         if (this.#published)
             return structuredClone(this.#cleanup);
-        await rm(this.#outputRoot, { recursive: true, force: true });
+        let removalFailure;
+        try {
+            await rm(this.#outputRoot, { recursive: true, force: true });
+        }
+        catch (cause) {
+            removalFailure = cause;
+        }
         const absent = await isAbsent(this.#outputRoot);
         this.#cleanup = absent
             ? { status: "complete", residualPaths: [] }
@@ -138,7 +144,15 @@ export class SafeOutputTree {
                 residualPaths: [basename(this.#outputRoot)],
             };
         if (!absent)
-            throw new ArtifactReaderFailure("integrity", "Extraction output cleanup could not be verified");
+            throw new ArtifactReaderFailure("integrity", `Extraction output cleanup could not be verified${removalFailure === undefined ? "" : `: ${removalFailure instanceof Error ? removalFailure.message : String(removalFailure)}`}`, {
+                cause: removalFailure,
+                cleanup: {
+                    reason: removalFailure instanceof Error
+                        ? removalFailure.message
+                        : "Extraction output root remains after rollback",
+                    resources: [this.#outputRoot],
+                },
+            });
         return structuredClone(this.#cleanup);
     }
     async #prepareParent(relativePath) {

package/dist/artifacts/ZipArtifactReader.js

@@ -5,10 +5,12 @@ import { Reader, ZipReader } from "@zip.js/zip.js";
 import { ArtifactReaderFailure, } from "./ArtifactReader.js";
 class NodeFileReader extends Reader {
     path;
+    maximumReadBytes;
     #handle;
-    constructor(path) {
+    constructor(path, maximumReadBytes) {
         super(path);
         this.path = path;
+        this.maximumReadBytes = maximumReadBytes;
     }
     async init() {
         this.#handle = await open(this.path, "r");
@@ -18,7 +20,11 @@ class NodeFileReader extends Reader {
         const handle = this.#handle;
         if (handle === undefined)
             throw new Error("ZIP reader is not initialized");
-        const bytes = Buffer.alloc(Math.min(length, this.size - index));
+        const readBytes = Math.min(length, this.size - index);
+        if (this.maximumReadBytes !== undefined &&
+            readBytes > this.maximumReadBytes)
+            throw new ArtifactReaderFailure("limit", `ZIP metadata read requires ${readBytes} bytes, exceeding the ${this.maximumReadBytes}-byte read budget`);
+        const bytes = Buffer.alloc(readBytes);
         const read = await handle.read(bytes, 0, bytes.length, index);
         return bytes.subarray(0, read.bytesRead);
     }
@@ -33,9 +39,10 @@ export class ZipArtifactReader {
     #source;
     #reader;
     #entries = new Map();
-    constructor(path, format) {
+    /** Optionally bound each metadata read before allocating its backing buffer. */
+    constructor(path, format, maximumMetadataReadBytes) {
         this.format = format;
-        this.#source = new NodeFileReader(path);
+        this.#source = new NodeFileReader(path, maximumMetadataReadBytes);
         this.#reader = new ZipReader(this.#source, {
             checkSignature: true,
             checkOverlappingEntry: true,

package/dist/artifacts/apple/AppleAssetCatalogAnalysis.js

@@ -39,7 +39,8 @@ export const analyzeAppleAssetCatalogs = async (input) => {
             const inspected = await inspectAssetCatalogEntry({
                 reader,
                 entry,
-                runAssetUtil: input.runAssetUtil ?? runAssetUtil,
+                runAssetUtil: input.runAssetUtil ??
+                    ((path, signal) => runAssetUtil(path, input.environment, signal)),
                 ...(input.signal === undefined ? {} : { signal: input.signal }),
             });
             totalMetadataBytes += inspected.metadataBytes;
@@ -150,9 +151,10 @@ export const collectInterfaceBuilderResourceKeys = (nodes) => nodes.flatMap((nod
         ]
         : []);
 });
-const runAssetUtil = async (path, signal) => {
+const runAssetUtil = async (path, environment, signal) => {
     try {
         return (await execFileOutput(ASSETUTIL, ["--info", path], {
+            env: environment,
             timeout: 60_000,
             maxBuffer: MAX_CATALOG_BYTES,
             ...(signal === undefined ? {} : { signal }),

package/dist/artifacts/apple/DylibResolutionReader.js

@@ -2,11 +2,14 @@ import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, open, readlink, realpath } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
 import { resolveTreePath } from "../../domain/apple/dyldPaths.js";
 import { dylibResolutionInputSchema, dylibResolutionResultSchema, traceDylibLoading, } from "../../domain/apple/dylibResolution.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
 import { ArtifactReaderFailure } from "../ArtifactReader.js";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { hasMachoMagic, readMachoImage } from "./MachoLoadCommandReader.js";
+const OPERATION = "trace_dylib_resolution";
 const HASH_CHUNK_BYTES = 1024 * 1024;
 /** Lazily probed, symlink-preserving view of one analyzed directory. */
 class FilesystemTreeView {
@@ -64,7 +67,7 @@ class FilesystemTreeView {
 export const traceDylibResolution = async (options) => {
     const parsed = dylibResolutionInputSchema.safeParse(options.parameters);
     if (!parsed.success)
-        throw new ArtifactReaderFailure("path", "roots must be normalized paths relative to the analyzed root");
+        throw new AnalysisInputError(OPERATION, { cause: parsed.error }, projectInputIssues(parsed.error.issues, options.parameters));
     // Canonicalization is inside the translated region: a revoked permission
     // keeps its reason and path.
     let root = options.rootPath;
@@ -79,7 +82,7 @@ export const traceDylibResolution = async (options) => {
             : options.enumerateRoots
                 ? await executableRoots(root, view, options.signal)
                 : { roots: [target], unclassified: [] };
-        const roots = await requireMachoRoots(view, requested);
+        const roots = await requireMachoRoots(view, requested, parsed.data.roots !== undefined);
         const trace = await traceDylibLoading(view, {
             roots,
             unclassified,
@@ -151,17 +154,24 @@ const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 /**
  * Resolve each root segment by segment, as dependency candidates are, so a
  * symlink in an intermediate directory cannot lead outside the analyzed root.
+ * A root the caller selected that fails is an input error on that root; a
+ * root REA derived itself keeps reporting an artifact failure.
  */
-const requireMachoRoots = async (view, roots) => {
+const requireMachoRoots = async (view, roots, callerSelected) => {
     const resolved = [];
-    for (const path of roots) {
+    for (const [index, path] of roots.entries()) {
+        const reject = (reason, message) => callerSelected
+            ? new AnalysisInputError(OPERATION, undefined, [
+                { path: ["roots", index], reason: "invalid_value", message },
+            ])
+            : new ArtifactReaderFailure(reason, message);
         const lookup = await resolveTreePath(view, path);
         if (lookup.kind === "escapes")
-            throw new ArtifactReaderFailure("path", `Root ${path} resolves outside the analyzed root`);
+            throw reject("path", `Root ${path} resolves outside the analyzed root`);
         if (lookup.kind !== "file")
-            throw new ArtifactReaderFailure("path", `Root ${path} is not a regular file in the analyzed root`);
+            throw reject("path", `Root ${path} is not a regular file in the analyzed root`);
         if ((await view.image(lookup.path)).status === "not-mach-o")
-            throw new ArtifactReaderFailure("format", `Root ${path} is not a Mach-O image`);
+            throw reject("format", `Root ${path} is not a Mach-O image`);
         if (!resolved.includes(lookup.path))
             resolved.push(lookup.path);
     }

package/dist/artifacts/apple/KeyedArchiveReader.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
+import { join } from "node:path";
 import { parseBinary } from "plist";
 import { z } from "zod";
-import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import { AnalysisInputError, AnalysisUnsupportedTargetError, } from "../../domain/analysisErrorCore.js";
 import { projectPlistValue } from "../../domain/apple/plistValue.js";
 import { createPlistNumberProjection } from "../../domain/apple/plistNumbers.js";
 import { binaryPlistNumberLiterals, xmlPlistNumberLiterals, } from "./PlistNumberLiterals.js";
 import { omittedPrototypeKeysLimitation, parseXmlPropertyList, } from "../../domain/propertyListKeys.js";
-import { keyedArchiveInputSchema, keyedArchiveResultSchema, projectKeyedArchive, } from "../../domain/apple/keyedArchive.js";
+import { KeyedArchiveKindError, keyedArchiveInputSchema, keyedArchiveResultSchema, projectKeyedArchive, } from "../../domain/apple/keyedArchive.js";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { ArtifactReaderFailure } from "../ArtifactReader.js";
 import { decodeXmlPlistText } from "../../domain/propertyListXmlText.js";
@@ -16,13 +17,14 @@ export const decodeKeyedArchiveBytes = (bytes, selection) => {
     if (bytes.length > MAX_BYTES)
         throw new RangeError("Keyed archive exceeds 64 MiB");
     if (bytes.subarray(0, 10).toString("ascii") === "NIBArchive")
-        throw new TypeError("Selected file is a compiled NIBArchive, not a Foundation plist archive; decode it with decode_interface_builder");
+        throw new KeyedArchiveKindError("Selected file is a compiled NIBArchive, not a Foundation plist archive; decode it with decode_interface_builder", "nib-archive");
     const binary = bytes.subarray(0, 8).toString("ascii") === "bplist00";
     const xmlText = binary ? undefined : decodeXmlPlistText(bytes);
     const parsed = binary
         ? { value: parseBinary(bytes), omittedPrototypeKeys: 0 }
         : parseXmlPropertyList(xmlText ?? "");
-    const graph = projectKeyedArchive(normalizePlist(parsed.value), selection);
+    const { value: plistValue, unknownRealCount } = projectPlistValue(parsed.value);
+    const graph = projectKeyedArchive(plistValue, selection);
     const numbers = createPlistNumberProjection(binary
         ? binaryPlistNumberLiterals(bytes)
         : xmlPlistNumberLiterals(xmlText ?? ""));
@@ -47,14 +49,24 @@ export const decodeKeyedArchiveBytes = (bytes, selection) => {
             ...(parsed.omittedPrototypeKeys === 0
                 ? []
                 : [omittedPrototypeKeysLimitation(parsed.omittedPrototypeKeys)]),
+            ...(unknownRealCount === 0
+                ? []
+                : [
+                    `${String(unknownRealCount)} non-finite real value(s) are reported as { "$plist_type": "real", "value": null } because JSON evidence cannot preserve NaN vs infinity.`,
+                ]),
         ],
     };
 };
-const normalizePlist = (value) => {
-    const projected = projectPlistValue(value);
-    if (projected.unknownRealCount > 0)
-        throw new RangeError("Keyed archive contains a non-finite real");
-    return projected.value;
+/**
+ * Point to the workflow that reads the selected kind of file on this host.
+ * decode_interface_builder is portable; inspect_plist requires macOS.
+ */
+const keyedArchiveKindRemediation = (kind, platform) => {
+    if (kind === "nib-archive")
+        return "Decode compiled NIBArchive files with decode_interface_builder on the app bundle.";
+    return platform === "darwin"
+        ? "Inspect an ordinary property list with inspect_plist; inspect_keyed_archive decodes NSKeyedArchiver archives only."
+        : "Select an NSKeyedArchiver archive; inspect_keyed_archive decodes only those. inspect_plist, which reads ordinary property lists, requires a macOS host.";
 };
 /** Read exactly one regular, contained bundle entry without following symlinks. */
 export const inspectBundleKeyedArchive = async (input) => {
@@ -68,45 +80,59 @@ export const inspectBundleKeyedArchive = async (input) => {
             : `Archive path must be a canonical relative bundle path without empty, '.', or '..' segments: ${selected.path}`);
     const reader = new DirectoryArtifactReader(input.bundlePath);
     try {
+        // Match inventory spelling while retaining the raw path for I/O and evidence.
+        const wanted = selected.path.normalize("NFC");
+        const matches = [];
         for await (const entry of reader.entries(input.signal)) {
-            if (entry.path !== selected.path)
+            if (entry.path.normalize("NFC") !== wanted)
                 continue;
-            if (entry.kind !== "file")
-                throw archivePathError("invalid_value", `Archive path selects a ${entry.kind}, not a regular file: ${selected.path}`);
-            if ((entry.declaredSize ?? 0) > MAX_BYTES)
+            matches.push(entry);
+        }
+        if (matches.length > 1)
+            throw archivePathError("invalid_value", `Archive path matches ${String(matches.length)} Unicode-equivalent bundle entries; selection is ambiguous: ${selected.path}`);
+        const entry = matches[0];
+        if (entry === undefined)
+            throw archivePathError("invalid_value", `No regular file exists at ${selected.path} in the active app bundle.`);
+        if (entry.kind !== "file")
+            throw archivePathError("invalid_value", `Archive path selects a ${entry.kind}, not a regular file: ${selected.path}`);
+        if ((entry.declaredSize ?? 0) > MAX_BYTES)
+            throw new ArtifactReaderFailure("limit", "Keyed archive exceeds 64 MiB");
+        const stream = await reader.open(entry, input.signal);
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of stream) {
+            if (input.signal?.aborted) {
+                stream.destroy();
+                throw new ArtifactReaderFailure("cancelled", "Archive inspection cancelled");
+            }
+            const bytes = z.instanceof(Buffer).parse(chunk);
+            size += bytes.length;
+            if (size > MAX_BYTES) {
+                stream.destroy();
                 throw new ArtifactReaderFailure("limit", "Keyed archive exceeds 64 MiB");
-            const stream = await reader.open(entry, input.signal);
-            const chunks = [];
-            let size = 0;
-            for await (const chunk of stream) {
-                if (input.signal?.aborted) {
-                    stream.destroy();
-                    throw new ArtifactReaderFailure("cancelled", "Archive inspection cancelled");
-                }
-                const bytes = z.instanceof(Buffer).parse(chunk);
-                size += bytes.length;
-                if (size > MAX_BYTES) {
-                    stream.destroy();
-                    throw new ArtifactReaderFailure("limit", "Keyed archive exceeds 64 MiB");
-                }
-                chunks.push(bytes);
             }
-            const bytes = Buffer.concat(chunks, size);
-            try {
-                return keyedArchiveResultSchema.parse({
-                    target_sha256: input.targetSha256,
-                    archive_path: entry.path,
-                    archive_sha256: createHash("sha256").update(bytes).digest("hex"),
-                    ...decodeKeyedArchiveBytes(bytes, selected),
+            chunks.push(bytes);
+        }
+        const bytes = Buffer.concat(chunks, size);
+        try {
+            return keyedArchiveResultSchema.parse({
+                target_sha256: input.targetSha256,
+                archive_path: entry.path,
+                archive_sha256: createHash("sha256").update(bytes).digest("hex"),
+                ...decodeKeyedArchiveBytes(bytes, selected),
+            });
+        }
+        catch (cause) {
+            if (cause instanceof AnalysisInputError)
+                throw cause;
+            // An intact file of another kind is not a damaged archive.
+            if (cause instanceof KeyedArchiveKindError)
+                throw new AnalysisUnsupportedTargetError("inspect_keyed_archive", join(input.bundlePath, entry.path), cause.message, {
+                    cause,
+                    remediationAction: keyedArchiveKindRemediation(cause.kind, input.platform ?? process.platform),
                 });
-            }
-            catch (cause) {
-                if (cause instanceof AnalysisInputError)
-                    throw cause;
-                throw new ArtifactReaderFailure(cause instanceof RangeError ? "limit" : "format", `Cannot decode selected Foundation keyed archive: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-            }
+            throw new ArtifactReaderFailure(cause instanceof RangeError ? "limit" : "format", `Cannot decode selected Foundation keyed archive: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
         }
-        throw archivePathError("invalid_value", `No regular file exists at ${selected.path} in the active app bundle.`);
     }
     finally {
         await reader.close();

package/dist/artifacts/apple/MachoLoadCommandReader.js

@@ -29,6 +29,41 @@ const LC_VERSION_MIN_IPHONEOS = 0x25;
 const LC_VERSION_MIN_TVOS = 0x2f;
 const LC_VERSION_MIN_WATCHOS = 0x30;
 const LC_BUILD_VERSION = 0x32;
+// `mach-o/loader.h` `PLATFORM_*` numbers observed via Apple linker output.
+const PLATFORM_MACOS = 1;
+const PLATFORM_IOS = 2;
+const PLATFORM_TVOS = 3;
+const PLATFORM_WATCHOS = 4;
+const PLATFORM_IOSSIMULATOR = 7;
+const PLATFORM_TVOSSIMULATOR = 8;
+const PLATFORM_WATCHOSSIMULATOR = 9;
+const CPU_TYPE_I386 = 7;
+const CPU_TYPE_X86_64 = 0x01000007;
+/**
+ * Legacy `LC_VERSION_MIN_*` commands predate explicit simulator platform
+ * IDs. Per Apple's dyld rules the image CPU type distinguishes simulator
+ * from device: Intel images are simulator, ARM images are device
+ * (tvOS simulator applies to x86_64 only). `LC_BUILD_VERSION` platform
+ * numbers are preserved verbatim; unknown future numbers stay unknown
+ * downstream, never mapped to nearest.
+ */
+const legacyVersionMinPlatform = (command, cpuType) => {
+    const isIntel = cpuType === CPU_TYPE_I386 || cpuType === CPU_TYPE_X86_64;
+    switch (command) {
+        case LC_VERSION_MIN_MACOSX:
+            return PLATFORM_MACOS;
+        case LC_VERSION_MIN_IPHONEOS:
+            return isIntel ? PLATFORM_IOSSIMULATOR : PLATFORM_IOS;
+        case LC_VERSION_MIN_TVOS:
+            return cpuType === CPU_TYPE_X86_64
+                ? PLATFORM_TVOSSIMULATOR
+                : PLATFORM_TVOS;
+        case LC_VERSION_MIN_WATCHOS:
+            return isIntel ? PLATFORM_WATCHOSSIMULATOR : PLATFORM_WATCHOS;
+        default:
+            return undefined;
+    }
+};
 /** `mach-o/loader.h` `dylib_use_command`: `nameoff == 28` and this marker. */
 const DYLIB_USE_MARKER = 0x1a741800;
 const DYLIB_USE_WEAK_LINK = 0x1;
@@ -258,12 +293,7 @@ const decodeCommand = (command, body, index, slice) => {
         slice.platforms.push(platform);
         return;
     }
-    const legacyPlatform = new Map([
-        [LC_VERSION_MIN_MACOSX, 1],
-        [LC_VERSION_MIN_IPHONEOS, 2],
-        [LC_VERSION_MIN_TVOS, 3],
-        [LC_VERSION_MIN_WATCHOS, 4],
-    ]).get(command);
+    const legacyPlatform = legacyVersionMinPlatform(command, slice.cpu_type);
     if (legacyPlatform !== undefined) {
         if (body.byteLength < 16)
             throw new MachoFormatIssue("malformed", `load command ${index} is too short for a version-min command`);