@open-agent-toolkit/cli 0.3.10 → 0.3.12

package/dist/fs/io.js

@@ -1,7 +1,5 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { chmod, lstat, link, mkdir, open, readdir, readFile, readlink, realpath, rename, rm, stat, symlink, writeFile, } from 'node:fs/promises';
-import { hostname } from 'node:os';
-import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from 'node:path';
+import { chmod, lstat, mkdir, readdir, readFile, readlink, rename, rm, stat, symlink, writeFile, } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 export async function fileExists(path) {
     try {
         const s = await stat(path);
@@ -202,413 +200,3 @@ export async function atomicWriteJson(filePath, data) {
     await writeFile(tempPath, serializeJsonDocument(data), 'utf8');
     await rename(tempPath, filePath);
 }
-const WRITER_LOCK_RETRY_MS = 10;
-const WRITER_LOCK_TIMEOUT_MS = 5000;
-/** A lock younger than this is never reclaimed, so a writer that has not yet
- * written its holder file is not mistaken for a crash. */
-const WRITER_LOCK_MIN_RECLAIM_MS = 1000;
-/**
- * Hard cap. A lock older than this is reclaimed unconditionally — including one
- * whose holder is provably alive — because a dispatch write is a sub-second
- * operation and a holder past this bound is hung rather than working. This is
- * safe because the lock is not what protects the journal: the create-only
- * revision compare-and-swap is, and it holds independently of any lock, so a
- * wrongly reclaimed lock costs mutual exclusion but never correctness.
- */
-const WRITER_LOCK_HARD_STALE_MS = 15 * 60 * 1000;
-const HOLDER_FILE = 'holder.json';
-/**
- * Non-identifying, stable-per-host token. Liveness of a recorded pid is only
- * meaningful on the host that recorded it, and the raw hostname is never
- * written into a project artifact or an error message.
- */
-function hostId() {
-    return createHash('sha256')
-        .update(hostname(), 'utf8')
-        .digest('hex')
-        .slice(0, 16);
-}
-function processStartedAt() {
-    return Math.round(Date.now() - process.uptime() * 1000);
-}
-function holderIsRunning(holder) {
-    if (holder.hostId !== hostId()) {
-        // Another host's pid says nothing about this one; fall back to age alone.
-        return true;
-    }
-    try {
-        process.kill(holder.pid, 0);
-        return true;
-    }
-    catch (error) {
-        // EPERM means the process exists but is owned by somebody else.
-        return errorCode(error) !== 'ESRCH';
-    }
-}
-async function readWriterLockHolder(lockPath) {
-    try {
-        const parsed = JSON.parse(await readFile(join(lockPath, HOLDER_FILE), 'utf8'));
-        if (typeof parsed !== 'object' ||
-            parsed === null ||
-            typeof parsed.pid !== 'number' ||
-            typeof parsed.hostId !== 'string') {
-            return null;
-        }
-        return parsed;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Bounded staleness policy. A lock is reclaimable when it is old enough that a
- * live writer would have finished, and either its recorded holder is provably
- * gone on this host or its age exceeds the hard cap. Returns the reason so the
- * caller can report what it did.
- */
-async function writerLockStaleReason(lockPath, minReclaimMs, hardStaleMs) {
-    let age;
-    try {
-        age = Date.now() - (await lstat(lockPath)).mtimeMs;
-    }
-    catch {
-        return null;
-    }
-    if (age < minReclaimMs)
-        return null;
-    const holder = await readWriterLockHolder(lockPath);
-    if (holder !== null && !holderIsRunning(holder)) {
-        return 'its recorded holder process is no longer running';
-    }
-    return age >= hardStaleMs ? 'it exceeded the staleness cap' : null;
-}
-/**
- * Exclusive contained writer lock. `mkdir` without `recursive` is the atomic
- * primitive: exactly one caller can create the directory, and every other
- * caller observes `EEXIST`. The lock is validated as a real directory so a
- * planted symlink fails closed instead of redirecting the guarded section, it
- * records holder evidence so a crashed writer can be reclaimed rather than
- * wedging the project forever, and no message it raises contains an absolute
- * path.
- */
-export async function withContainedWriterLock(lockPath, scopeRoot, run, options = {}) {
-    const resolvedScope = resolve(scopeRoot);
-    const resolvedLock = resolve(lockPath);
-    if (dirname(resolvedLock) !== resolvedScope) {
-        throw new Error('Writer lock must live directly inside its scope root.');
-    }
-    const scopeStat = await lstat(resolvedScope);
-    if (scopeStat.isSymbolicLink() || !scopeStat.isDirectory()) {
-        throw new Error('Writer lock scope must be a real directory.');
-    }
-    const reportedLock = scopeRelative(resolvedScope, resolvedLock);
-    const timeoutMs = options.timeoutMs ?? WRITER_LOCK_TIMEOUT_MS;
-    const deadline = Date.now() + timeoutMs;
-    let reclaimed = false;
-    for (;;) {
-        try {
-            await mkdir(resolvedLock);
-            break;
-        }
-        catch (error) {
-            if (errorCode(error) !== 'EEXIST') {
-                throw error;
-            }
-            if (!reclaimed) {
-                const stale = await writerLockStaleReason(resolvedLock, options.minReclaimMs ?? WRITER_LOCK_MIN_RECLAIM_MS, options.hardStaleMs ?? WRITER_LOCK_HARD_STALE_MS);
-                if (stale !== null) {
-                    const held = await lstat(resolvedLock);
-                    if (held.isSymbolicLink() || !held.isDirectory()) {
-                        throw new Error(`Writer lock ${reportedLock} is not a real directory.`, { cause: error });
-                    }
-                    await rm(resolvedLock, { recursive: true, force: true });
-                    reclaimed = true;
-                    continue;
-                }
-            }
-            if (Date.now() >= deadline) {
-                throw new Error(`Another writer holds ${reportedLock}. If no writer is running, remove ${reportedLock} inside the project and retry.`, { cause: error });
-            }
-            await new Promise((resolveDelay) => setTimeout(resolveDelay, WRITER_LOCK_RETRY_MS));
-        }
-    }
-    const holder = {
-        hostId: hostId(),
-        pid: process.pid,
-        processStartedAt: processStartedAt(),
-        acquiredAt: new Date().toISOString(),
-    };
-    const held = await lstat(resolvedLock);
-    if (held.isSymbolicLink() || !held.isDirectory()) {
-        throw new Error(`Writer lock ${reportedLock} is not a real directory.`);
-    }
-    const lockIdentity = identityOf(held);
-    try {
-        await writeFile(join(resolvedLock, HOLDER_FILE), `${JSON.stringify(holder, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
-        return await run();
-    }
-    finally {
-        await releaseWriterLock(resolvedLock, lockIdentity, holder);
-    }
-}
-/**
- * Release only a lock this call still provably holds. Both the directory
- * identity captured at acquisition and the holder record must still match. A
- * missing holder file counts as "not mine" — it is exactly the window in which
- * a reclaiming writer has re-created the directory but not yet written its own
- * record — so the replacement is left to the staleness policy rather than
- * removed from under its new owner.
- */
-async function releaseWriterLock(lockPath, identity, holder) {
-    try {
-        const current = await lstat(lockPath);
-        if (current.isSymbolicLink() || !current.isDirectory())
-            return;
-        if (!sameIdentity(identityOf(current), identity))
-            return;
-        const currentHolder = await readWriterLockHolder(lockPath);
-        if (currentHolder === null ||
-            currentHolder.hostId !== holder.hostId ||
-            currentHolder.pid !== holder.pid ||
-            currentHolder.acquiredAt !== holder.acquiredAt) {
-            return;
-        }
-        await rm(lockPath, { recursive: true, force: true });
-    }
-    catch {
-        // Nothing releasable remains.
-    }
-}
-function identityOf(entry) {
-    return { device: String(entry.dev), inode: String(entry.ino) };
-}
-function sameIdentity(left, right) {
-    return left.device === right.device && left.inode === right.inode;
-}
-async function assertUnchangedIdentity(path, expected, message) {
-    if (!sameIdentity(identityOf(await lstat(path)), expected)) {
-        throw new Error(message);
-    }
-}
-/**
- * Scope-relative rendering for any path this module reports. NFR1 requires that
- * home paths and user-specific absolute paths stay out of durable output, so no
- * error raised below may carry an absolute path.
- */
-function scopeRelative(resolvedScope, target) {
-    const rendered = relative(resolvedScope, resolve(target));
-    return rendered === '' ? '.' : rendered.split(sep).join('/');
-}
-export function journalErrorCode(error) {
-    return errorCode(error);
-}
-function errorCode(error) {
-    return typeof error === 'object' && error !== null && 'code' in error
-        ? String(error.code)
-        : null;
-}
-/**
- * Re-raise a filesystem error without Node's absolute-path message text while
- * preserving its `code` so callers can still branch on `EEXIST`/`ENOENT`.
- * Exported so every journal producer redacts identically instead of each one
- * re-deriving the rule.
- */
-export function redactedFsError(error, operation, relativeTarget) {
-    const code = errorCode(error);
-    const raised = new Error(`Journal ${operation} failed for ${relativeTarget}${code === null ? '' : ` (${code})`}.`, { cause: error });
-    return code === null ? raised : Object.assign(raised, { code });
-}
-/**
- * Node exposes no `openat`/`renameat`/`linkat`, so a path-based final operation
- * cannot be bound to a directory file descriptor. Publication is therefore
- * append-only and create-only: the destination must not already exist, the only
- * publishing syscall is `link`, and this module never issues `rename`, `rm`, or
- * `unlink` against a publication destination. A pathname swapped after the last
- * check can therefore cause at most an unreferenced create, never a replacement
- * or a deletion of content this call did not create.
- */
-async function publicationIsMisplaced(resolvedFile, tempIdentity, parentIdentity, realScope) {
-    let published;
-    try {
-        published = await lstat(resolvedFile);
-    }
-    catch {
-        return 'the published name disappeared';
-    }
-    if (published.isSymbolicLink() || !published.isFile()) {
-        return 'the published name is not a regular file';
-    }
-    if (!sameIdentity(identityOf(published), tempIdentity)) {
-        return 'the published name is not the staged file';
-    }
-    try {
-        if (!sameIdentity(identityOf(await lstat(dirname(resolvedFile))), parentIdentity)) {
-            return 'the parent directory identity changed';
-        }
-        const currentRealParent = await realpath(dirname(resolvedFile));
-        const currentRelative = relative(realScope, currentRealParent);
-        if (currentRelative === '..' ||
-            currentRelative.startsWith(`..${sep}`) ||
-            isAbsolute(currentRelative)) {
-            return 'the parent directory resolves outside the allowed scope';
-        }
-    }
-    catch {
-        return 'the parent directory could not be re-validated';
-    }
-    return null;
-}
-/**
- * Remove the staging file only when the name still resolves to the exact inode
- * this call created. A swapped directory pathname therefore strands the staged
- * file rather than deleting an unrelated one. Returns whether the staged data
- * was provably removed, so callers can report the outcome accurately.
- *
- * Precisely: this removes only the *inode* this call created, not only the
- * *names* it created. A privileged process that hard-links the staged file into
- * a directory it controls and then swaps the journal pathname at it can have
- * that alias unlinked here. No data is destroyed — the inode stays linked from
- * the real directory, and no pre-existing foreign file can ever match, since a
- * distinct file has a distinct dev/ino pair.
- */
-async function removeStagedFile(tempPath, tempIdentity) {
-    try {
-        if (tempIdentity === null) {
-            await rm(tempPath, { force: true });
-            return 'removed';
-        }
-        const current = await lstat(tempPath);
-        if (!sameIdentity(identityOf(current), tempIdentity)) {
-            return 'stranded';
-        }
-        await rm(tempPath, { force: true });
-        return 'removed';
-    }
-    catch {
-        return 'stranded';
-    }
-}
-/**
- * Publish one immutable JSON journal revision.
- *
- * Guarantees, stated as what the code does:
- * - The destination is created with `link` only. An occupied destination raises
- *   `EEXIST`; the destination is never renamed onto, removed, or truncated.
- * - After publication the destination is proven to be the exact staged inode,
- *   inside the same directory inode validated before staging, still resolving
- *   inside `scopeRoot`. Failure raises and removes nothing.
- * - Staging cleanup removes only the inode this call created.
- * - No raised message contains an absolute path.
- *
- * Residual, unchanged by this design: a privileged concurrent process that
- * swaps the validated directory pathname can cause the `link` to create an
- * unreferenced file under a directory it controls, and can strand the staged
- * file. Neither outcome replaces or deletes pre-existing content.
- */
-export async function publishContainedJsonRevision(filePath, data, scopeRoot) {
-    const resolvedScope = resolve(scopeRoot);
-    const resolvedFile = resolve(filePath);
-    const relativeFile = relative(resolvedScope, resolvedFile);
-    if (relativeFile === '..' ||
-        relativeFile.startsWith(`..${sep}`) ||
-        isAbsolute(relativeFile)) {
-        throw new Error('JSON journal destination is outside its allowed scope.');
-    }
-    const reportedFile = scopeRelative(resolvedScope, resolvedFile);
-    const scopeStat = await lstat(resolvedScope);
-    if (scopeStat.isSymbolicLink() || !scopeStat.isDirectory()) {
-        throw new Error('JSON journal scope must be a real directory.');
-    }
-    const realScope = await realpath(resolvedScope);
-    const parentRelative = relative(resolvedScope, dirname(resolvedFile));
-    const segments = parentRelative === '' ? [] : parentRelative.split(sep);
-    let current = resolvedScope;
-    for (const segment of segments) {
-        current = join(current, segment);
-        try {
-            const currentStat = await lstat(current);
-            if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
-                throw new Error('JSON journal ancestry must not contain symlinks and must contain only real directories.');
-            }
-        }
-        catch (error) {
-            if (errorCode(error) !== 'ENOENT') {
-                throw error;
-            }
-            await mkdir(current);
-        }
-    }
-    const realParent = await realpath(dirname(resolvedFile));
-    const relativeParent = relative(realScope, realParent);
-    if (relativeParent === '..' ||
-        relativeParent.startsWith(`..${sep}`) ||
-        isAbsolute(relativeParent)) {
-        throw new Error('JSON journal ancestry resolves outside its allowed scope.');
-    }
-    // Publication is create-only, so an already-published revision is a lost
-    // compare-and-swap rather than something to overwrite.
-    try {
-        await lstat(resolvedFile);
-        throw Object.assign(new Error(`Journal revision ${reportedFile} already exists.`), { code: 'EEXIST' });
-    }
-    catch (error) {
-        if (errorCode(error) !== 'ENOENT') {
-            throw error;
-        }
-    }
-    const parentIdentity = identityOf(await lstat(dirname(resolvedFile)));
-    const content = serializeJsonDocument(data);
-    const tempPath = join(dirname(resolvedFile), `.${basename(resolvedFile)}.${randomUUID()}.tmp`);
-    const reportedTemp = scopeRelative(resolvedScope, tempPath);
-    let tempCreated = false;
-    let stagedIdentity = null;
-    try {
-        let handle;
-        try {
-            handle = await open(tempPath, 'wx');
-        }
-        catch (error) {
-            throw redactedFsError(error, 'staging', reportedTemp);
-        }
-        let tempIdentity;
-        try {
-            tempCreated = true;
-            await handle.writeFile(content, 'utf8');
-            tempIdentity = identityOf(await handle.stat());
-            stagedIdentity = tempIdentity;
-        }
-        finally {
-            await handle.close();
-        }
-        // Last ancestry check, then the identity binding that narrows the window
-        // between that check and the path-based publication below.
-        if ((await realpath(dirname(resolvedFile))) !== realParent) {
-            throw new Error('JSON journal ancestry changed before publication.');
-        }
-        await assertUnchangedIdentity(dirname(resolvedFile), parentIdentity, 'JSON journal directory identity changed before publication.');
-        await assertUnchangedIdentity(tempPath, tempIdentity, 'JSON journal staging file identity changed before publication.');
-        try {
-            await link(tempPath, resolvedFile);
-        }
-        catch (error) {
-            throw redactedFsError(error, 'publication', reportedFile);
-        }
-        const misplaced = await publicationIsMisplaced(resolvedFile, tempIdentity, parentIdentity, realScope);
-        if (misplaced) {
-            // Never remove the destination: under a swapped pathname it may name
-            // content this call did not create.
-            const staged = await removeStagedFile(tempPath, tempIdentity);
-            tempCreated = false;
-            throw new Error(`Journal revision ${reportedFile} could not be verified inside the validated directory (${misplaced}). It was not published to the project journal, and this call removed and replaced nothing. ${staged === 'removed'
-                ? 'Staged data was removed.'
-                : 'A staged copy may remain outside the validated directory.'}`);
-        }
-        await removeStagedFile(tempPath, tempIdentity);
-        tempCreated = false;
-    }
-    finally {
-        if (tempCreated) {
-            await removeStagedFile(tempPath, stagedIdentity);
-        }
-    }
-}

package/dist/providers/identity/absolute-paths.d.ts

@@ -11,9 +11,10 @@
  *
  * Before this module there were two independent notions of
  * "looks like a path": a regex inside `redactDispatchMessage`, which only
- * scrubbed error text, and nothing at all on the persistence boundary. The
- * durable journal is committed to a shared repository, so a username or local
- * layout that reaches it is in git history permanently.
+ * scrubbed error text, and nothing at all on the record boundary. A validated
+ * record is printed verbatim and a caller may copy it into a committed
+ * artifact, so a username or local layout that reaches it can land in git
+ * history permanently.
  *
  * Message redaction and record sanitization now share this detector, because
  * the gap between them is precisely what allowed paths to be scrubbed from a
@@ -68,14 +69,4 @@ export declare function collectAbsolutePathViolations(value: unknown, path: stri
  * corrupt the identifier it claims to be.
  */
 export declare function assertNoAbsolutePath(value: unknown, path: string): void;
-/**
- * The publication postcondition, scoped to what is actually guaranteed.
- *
- * It hard-fails on a path in an identity or control field, which is the half of
- * NFR1 that is enforceable. It deliberately does **not** claim that no absolute
- * path remains anywhere in the revision: prose redaction is best-effort, and a
- * postcondition that asserted more than the sanitizer can deliver would be a
- * false guarantee rather than a check.
- */
-export declare function assertJournalIdentityHasNoAbsolutePath(identityFields: Readonly<Record<string, unknown>>): void;
 //# sourceMappingURL=absolute-paths.d.ts.map

package/dist/providers/identity/absolute-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"absolute-paths.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/absolute-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA6BH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAM/C;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CActD;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,GACX,sBAAsB,EAAE,CAoB1B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAChD,IAAI,CAIN"}
+{"version":3,"file":"absolute-paths.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/absolute-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA6BH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAM/C;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CActD;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,GACX,sBAAsB,EAAE,CAoB1B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvE"}

package/dist/providers/identity/absolute-paths.js

@@ -11,9 +11,10 @@
  *
  * Before this module there were two independent notions of
  * "looks like a path": a regex inside `redactDispatchMessage`, which only
- * scrubbed error text, and nothing at all on the persistence boundary. The
- * durable journal is committed to a shared repository, so a username or local
- * layout that reaches it is in git history permanently.
+ * scrubbed error text, and nothing at all on the record boundary. A validated
+ * record is printed verbatim and a caller may copy it into a committed
+ * artifact, so a username or local layout that reaches it can land in git
+ * history permanently.
  *
  * Message redaction and record sanitization now share this detector, because
  * the gap between them is precisely what allowed paths to be scrubbed from a
@@ -141,17 +142,3 @@ export function assertNoAbsolutePath(value, path) {
     if (first)
         throw new Error(first.message);
 }
-/**
- * The publication postcondition, scoped to what is actually guaranteed.
- *
- * It hard-fails on a path in an identity or control field, which is the half of
- * NFR1 that is enforceable. It deliberately does **not** claim that no absolute
- * path remains anywhere in the revision: prose redaction is best-effort, and a
- * postcondition that asserted more than the sanitizer can deliver would be a
- * false guarantee rather than a check.
- */
-export function assertJournalIdentityHasNoAbsolutePath(identityFields) {
-    for (const [field, value] of Object.entries(identityFields)) {
-        assertNoAbsolutePath(value, `<journal>.${field}`);
-    }
-}

package/dist/providers/identity/generic-dispatch-record.d.ts

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { type DispatchValueViolation } from './absolute-paths.js';
 /**
  * Whole-record ceiling, applied at every parse entry point so no combination
- * of individually legal fields can produce an unbounded journal revision.
+ * of individually legal fields can produce an unbounded record.
  */
 export declare function assertBoundedDispatchRecordSize(value: unknown): void;
 /**

package/dist/providers/identity/generic-dispatch-record.js

@@ -34,7 +34,7 @@ const optionalSelector = identifier().nullable();
 /**
  * Every generic container field is validated as a closed, bounded JSON
  * projection so prompt bodies, transcripts, and other free-form content cannot
- * ride into a durable journal through an unbounded `unknown` value. `payload`
+ * ride into a validated record through an unbounded `unknown` value. `payload`
  * carries configured sandbox/tool controls; `candidates_considered`,
  * `configured_invocation_evidence`, `continuation_events`, `diagnostics`, and
  * `escalate_when` carry short references and identifiers, not narrative text.
@@ -134,7 +134,7 @@ function projectionAggregateViolation(value, path) {
 }
 /**
  * Whole-record ceiling, applied at every parse entry point so no combination
- * of individually legal fields can produce an unbounded journal revision.
+ * of individually legal fields can produce an unbounded record.
  */
 export function assertBoundedDispatchRecordSize(value) {
     const bytes = publishedByteLength(value);