rea-agents 1.1.0 → 1.3.0

package/dist/application/DirectAnalysis.js

@@ -3,6 +3,12 @@ import { EnhancedTools } from "./EnhancedTools.js";
 import { createBinarySession } from "./runtime.js";
 import { silentLogger } from "../logger.js";
 import { createEvidence } from "../domain/evidence.js";
+import { EvidenceIntegrityError, projectAnalysisError, } from "../domain/errors.js";
+import { access } from "node:fs/promises";
+import { readAnalysisSnapshot, writeAnalysisSnapshot, } from "./AnalysisSnapshotFiles.js";
+import { parseBinaryTarget } from "../domain/binaryTarget.js";
+import { snapshotEvidenceForQuery, snapshotMatchesTarget, } from "../domain/analysisSnapshot.js";
+import { err, ok } from "../domain/result.js";
 const WORKFLOW_PROVIDER = {
     id: "rea-workflow",
     name: "REA composed investigation workflow",
@@ -13,14 +19,17 @@ const WORKFLOW_PROVIDER = {
  * Unlike MCP mode, every CLI invocation is intentionally isolated and does not
  * retain a target or bridge resources for a subsequent command.
  */
-export const runDirectAnalysis = async (path, tool, arguments_, logger = silentLogger) => runAnalysis(path, tool, arguments_, logger);
+export const runDirectAnalysis = async (path, tool, arguments_, options = {}) => runAnalysis(path, tool, arguments_, {
+    logger: options.logger ?? silentLogger,
+    snapshotPath: options.snapshotPath,
+});
 /** Execute one provider-native semantic operation with atomic provenance. */
-export const runProviderAnalysis = async (path, tool, arguments_, logger = silentLogger) => runAnalysis(path, tool, arguments_, logger);
+export const runProviderAnalysis = async (path, tool, arguments_, logger = silentLogger) => runAnalysis(path, tool, arguments_, { logger, snapshotPath: undefined });
 /** Describe configured providers without opening a target or launching Hopper. */
 export const runSessionStatus = async (logger = silentLogger) => {
     const config = parseConfig(process.env);
     if (!config.ok)
-        return { error: config.error._tag, message: config.error.message };
+        return cliError(config.error);
     const session = createBinarySession(config.value, logger);
     try {
         return session.status();
@@ -29,21 +38,42 @@ export const runSessionStatus = async (logger = silentLogger) => {
         await session.close();
     }
 };
-const runAnalysis = async (path, tool, arguments_, logger) => {
+const runAnalysis = async (path, tool, arguments_, options) => {
+    const { logger, snapshotPath } = options;
     const config = parseConfig(process.env);
     if (!config.ok)
-        return { error: config.error._tag, message: config.error.message };
+        return cliError(config.error);
+    const unavailable = snapshotUnavailable(snapshotPath, config.value.hopperLoaderArgs);
+    if (unavailable !== undefined)
+        return cliError(unavailable);
     const session = createBinarySession(config.value, logger);
     try {
-        const opened = await session.open(path);
+        const prepared = await prepareSnapshot({
+            path,
+            tool,
+            arguments: arguments_,
+            snapshotPath,
+            policy: config.value.analysisSnapshotFilePolicy,
+            provider: replayProviderFor(session, tool),
+        });
+        if (!prepared.ok)
+            return cliError(prepared.error);
+        if (prepared.value.evidence !== undefined)
+            return prepared.value.evidence;
+        const { snapshot } = prepared.value;
+        const opened = await session.open(path, snapshot === undefined ? {} : { snapshot });
         if (!opened.ok)
-            return { error: opened.error._tag, message: opened.error.message };
+            return cliError(opened.error);
+        let output;
+        let evidence;
         if (tool === "binary_overview" ||
             tool === "analyze_function" ||
             tool === "trace_feature") {
             const result = await new EnhancedTools(session).execute(tool, arguments_);
-            return result.ok
-                ? createEvidence(opened.value, tool === "analyze_function"
+            if (!result.ok)
+                output = cliError(result.error);
+            else {
+                evidence = createEvidence(opened.value, tool === "analyze_function"
                     ? session.providerIdentity(tool)
                     : WORKFLOW_PROVIDER, {
                     operation: tool,
@@ -51,22 +81,85 @@ const runAnalysis = async (path, tool, arguments_, logger) => {
                     result: result.value,
                     confidence: "derived",
                     limitations: ["Derived by an REA composed workflow."],
-                })
-                : { error: result.error._tag, message: result.error.message };
+                });
+                output = evidence;
+            }
         }
-        const result = await session.execute(tool, arguments_);
-        return result.ok
-            ? createEvidence(result.value.subject ?? opened.value, result.value.provider, {
-                operation: tool,
-                parameters: arguments_,
-                result: result.value.result,
-                rawResult: result.value.rawResult,
-                limitations: result.value.limitations,
-                locations: result.value.locations,
-            })
-            : { error: result.error._tag, message: result.error.message };
+        else {
+            const result = await session.execute(tool, arguments_);
+            if (!result.ok)
+                output = cliError(result.error);
+            else {
+                evidence = createEvidence(result.value.subject ?? opened.value, result.value.provider, {
+                    operation: tool,
+                    parameters: arguments_,
+                    result: result.value.result,
+                    rawResult: result.value.rawResult,
+                    limitations: result.value.limitations,
+                    locations: result.value.locations,
+                });
+                output = evidence;
+            }
+        }
+        if (evidence !== undefined)
+            session.recordEvidence(evidence);
+        if (snapshotPath !== undefined && evidence !== undefined) {
+            const snapshot = session.exportAnalysisSnapshot();
+            if (!snapshot.ok)
+                return cliError(snapshot.error);
+            const written = await writeAnalysisSnapshot(snapshot.value, snapshotPath, true, config.value.analysisSnapshotFilePolicy);
+            if (!written.ok)
+                return cliError(written.error);
+        }
+        return output;
     }
     finally {
         await session.close();
     }
 };
+const prepareSnapshot = async (options) => {
+    const { path, tool, arguments: arguments_, snapshotPath, policy, provider, } = options;
+    if (snapshotPath === undefined || !(await fileExists(snapshotPath)))
+        return ok({});
+    const loaded = await readAnalysisSnapshot(snapshotPath, policy);
+    if (!loaded.ok)
+        return loaded;
+    const target = await parseBinaryTarget(path);
+    if (!target.ok)
+        return target;
+    if (!snapshotMatchesTarget(loaded.value.target, target.value))
+        return err(new EvidenceIntegrityError("Analysis snapshot target does not match the requested binary"));
+    const evidence = snapshotEvidenceForQuery(loaded.value, {
+        target: target.value,
+        operation: tool,
+        parameters: arguments_,
+        provider,
+    });
+    return ok(evidence === undefined
+        ? { snapshot: loaded.value }
+        : { snapshot: loaded.value, evidence });
+};
+const snapshotUnavailable = (snapshotPath, loaderArgs) => snapshotPath !== undefined && loaderArgs.length > 0
+    ? new EvidenceIntegrityError("Analysis snapshots are unavailable with custom Hopper loader arguments")
+    : undefined;
+const replayProviderFor = (session, tool) => tool === "binary_overview" || tool === "trace_feature"
+    ? WORKFLOW_PROVIDER
+    : session.providerIdentity(tool);
+const fileExists = async (path) => {
+    try {
+        await access(path);
+        return true;
+    }
+    catch (cause) {
+        if (typeof cause === "object" &&
+            cause !== null &&
+            "code" in cause &&
+            cause.code === "ENOENT")
+            return false;
+        throw cause;
+    }
+};
+const cliError = (error) => ({
+    error: "Analysis failed",
+    ...projectAnalysisError(error),
+});

package/dist/application/Doctor.js

@@ -8,7 +8,7 @@ import { promisify } from "node:util";
 import { parseBinaryTarget } from "../domain/binaryTarget.js";
 import { supportsNodeVersion } from "../domain/runtimeVersion.js";
 import { probeHomebrew } from "./homebrew.js";
-import { linuxHopperLauncherPath, linuxSharedLibrariesAvailable, readLinuxDistribution, } from "./LinuxHopper.js";
+import { linuxHopperBinarySupported, linuxHopperLauncherPath, linuxSharedLibrariesAvailable, readLinuxDistribution, } from "./LinuxHopper.js";
 const execFileAsync = promisify(execFile);
 const DEFAULT_HOPPER = "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
 const SYSTEM_LINUX_HOPPER = "/opt/hopper/bin/Hopper";
@@ -53,6 +53,16 @@ export const runDoctor = async (target, host = systemDoctorHost()) => {
         remediation: "Run rea setup to install Hopper, or set HOPPER_LAUNCHER_PATH.",
         classification: "missing_analysis_engine",
     }));
+    if (host.platform === "linux" && hopperPath !== undefined)
+        checks.push(check("hopper-version", await host.supportedLinuxHopper(hopperPath), hopperPath, {
+            remediation: unsupportedHopperRemediation(host.configuredHopperPath === hopperPath),
+            classification: "config_drift",
+        }));
+    if (host.platform === "linux" && hopperPath !== undefined)
+        checks.push(check("hopper-demo-runtime", await host.linuxDemoRuntimeReady(), undefined, {
+            remediation: "Rerun rea setup to install the Xvfb, xauth, Python, X11, and XTEST packages required for Linux demo sessions.",
+            classification: "missing_dependency",
+        }));
     if (target !== undefined)
         checks.push(check("target", await host.validTarget(target), target, {
             remediation: "Supply a readable local app or program path.",
@@ -64,6 +74,9 @@ export const runDoctor = async (target, host = systemDoctorHost()) => {
         checks,
     };
 };
+const unsupportedHopperRemediation = (configured) => configured
+    ? "Unset or update HOPPER_LAUNCHER_PATH, install the Hopper build supported by this REA release, or update REA."
+    : "Install the Hopper build supported by this REA release, or update REA for a newer Hopper build.";
 /** Create diagnostics backed by the current process and host commands. */
 export const systemDoctorHost = () => ({
     platform: process.platform,
@@ -97,6 +110,22 @@ export const systemDoctorHost = () => ({
             return false;
         }
     },
+    async linuxDemoRuntimeReady() {
+        try {
+            await access("/usr/bin/Xvfb", constants.X_OK);
+            await access("/usr/bin/xauth", constants.X_OK);
+            await access("/usr/bin/python3", constants.X_OK);
+            await execFileAsync("/usr/bin/python3", [
+                "-c",
+                "import ctypes; ctypes.CDLL('libX11.so.6'); ctypes.CDLL('libXtst.so.6')",
+            ]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    supportedLinuxHopper: linuxHopperBinarySupported,
     async brewHopperPath() {
         return probeHomebrew(async (command) => {
             try {

package/dist/application/EvidenceBundleFiles.js

@@ -1,46 +1,29 @@
-import { lstat, readFile, realpath } from "node:fs/promises";
-import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
-import writeFileAtomic from "write-file-atomic";
 import { parseEvidenceBundle, serializeEvidenceBundle, } from "../domain/evidenceBundle.js";
 import { EvidenceFileError, EvidenceIntegrityError } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
+import { LEGACY_PROCESS_CAPTURE_MESSAGE, parseProcessCapture, } from "../domain/processCapture.js";
+import { readBoundedJson, writeBoundedText } from "./BoundedJsonFiles.js";
 /** Read and validate a bounded evidence bundle inside an approved root. */
 export const readEvidenceBundle = async (path, policy) => {
     if (policy.roots.length === 0)
         return err(new EvidenceFileError("read", "disabled"));
+    const loaded = await readBoundedJson(path, policy);
+    if (!loaded.ok)
+        return loaded;
     try {
-        const canonicalPath = await realpath(resolve(path));
-        if (!(await isApproved(canonicalPath, policy.roots)))
-            return err(new EvidenceFileError("read", "outside-root"));
-        const stats = await lstat(canonicalPath);
-        if (!stats.isFile())
-            return err(new EvidenceFileError("read", "not-file"));
-        if (stats.size > policy.maxBytes)
-            return err(new EvidenceFileError("read", "too-large"));
-        const encoded = await readFile(canonicalPath);
-        if (encoded.byteLength > policy.maxBytes)
-            return err(new EvidenceFileError("read", "too-large"));
-        let decoded;
-        try {
-            decoded = JSON.parse(encoded.toString("utf8"));
-        }
-        catch (cause) {
-            return err(new EvidenceFileError("read", "invalid-json", { cause }));
-        }
-        const limits = validateJsonLimits(decoded, policy);
-        if (!limits.ok)
-            return limits;
-        try {
-            return ok(parseEvidenceBundle(decoded));
-        }
-        catch (cause) {
-            return err(new EvidenceIntegrityError("Evidence bundle validation failed", {
-                cause,
-            }));
+        const bundle = parseEvidenceBundle(loaded.value);
+        for (const record of bundle.records) {
+            if (record.predicate_type === "rea.process-capture/v3")
+                throw new TypeError(LEGACY_PROCESS_CAPTURE_MESSAGE);
+            if (record.predicate_type === "rea.process-capture/v4")
+                parseProcessCapture(record.normalized_result);
         }
+        return ok(bundle);
     }
     catch (cause) {
-        return err(new EvidenceFileError("read", "io", { cause }));
+        return err(new EvidenceIntegrityError("Evidence bundle validation failed", {
+            cause,
+        }));
     }
 };
 /** Atomically write deterministic evidence JSON inside an approved root. */
@@ -56,73 +39,5 @@ export const writeEvidenceBundle = async (bundle, path, overwrite, policy) => {
             cause,
         }));
     }
-    const bytes = Buffer.byteLength(encoded, "utf8");
-    if (bytes > policy.maxBytes)
-        return err(new EvidenceFileError("write", "too-large"));
-    try {
-        const requestedPath = resolve(path);
-        const canonicalParent = await realpath(dirname(requestedPath));
-        const destination = resolve(canonicalParent, basename(requestedPath));
-        if (!(await isApproved(destination, policy.roots)))
-            return err(new EvidenceFileError("write", "outside-root"));
-        const existing = await lstat(destination).catch((cause) => {
-            if (isFileNotFound(cause))
-                return undefined;
-            throw cause;
-        });
-        if (existing !== undefined) {
-            if (!overwrite)
-                return err(new EvidenceFileError("write", "exists"));
-            if (!existing.isFile() || existing.isSymbolicLink())
-                return err(new EvidenceFileError("write", "not-file"));
-        }
-        await writeFileAtomic(destination, encoded, {
-            encoding: "utf8",
-            mode: 0o600,
-            fsync: true,
-        });
-        return ok({ path: requestedPath, bytes });
-    }
-    catch (cause) {
-        return err(new EvidenceFileError("write", "io", { cause }));
-    }
-};
-const isApproved = async (candidate, roots) => {
-    for (const configuredRoot of roots) {
-        const root = await realpath(resolve(configuredRoot));
-        const relation = relative(root, candidate);
-        if (relation === "" ||
-            (!relation.startsWith("..") && !isAbsolute(relation)))
-            return true;
-    }
-    return false;
-};
-const validateJsonLimits = (root, policy) => {
-    const pending = [
-        { value: root, depth: 0 },
-    ];
-    let nodes = 0;
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (current === undefined)
-            break;
-        nodes += 1;
-        if (nodes > policy.maxNodes || current.depth > policy.maxDepth)
-            return err(new EvidenceFileError("read", "too-large"));
-        if (typeof current.value === "string" &&
-            current.value.length > policy.maxStringLength)
-            return err(new EvidenceFileError("read", "too-large"));
-        if (typeof current.value !== "object" || current.value === null)
-            continue;
-        for (const [key, value] of Object.entries(current.value)) {
-            if (key.length > policy.maxStringLength)
-                return err(new EvidenceFileError("read", "too-large"));
-            pending.push({ value, depth: current.depth + 1 });
-        }
-    }
-    return ok(null);
+    return writeBoundedText(encoded, path, overwrite, policy);
 };
-const isFileNotFound = (cause) => typeof cause === "object" &&
-    cause !== null &&
-    "code" in cause &&
-    cause.code === "ENOENT";

package/dist/application/EvidenceLedger.js

@@ -1,3 +1,4 @@
+import canonicalize from "canonicalize";
 import { createEvidenceBundle, parseEvidenceBundle, } from "../domain/evidenceBundle.js";
 import { EvidenceIntegrityError, EvidenceLimitError, UnknownRegistryError, } from "../domain/errors.js";
 import { parseEvidence } from "../domain/evidence.js";
@@ -258,8 +259,8 @@ export class EvidenceLedger {
 }
 const serializedBytes = (value) => Buffer.byteLength(JSON.stringify(value), "utf8");
 const unknownRevisionKey = (unknown) => `${unknown.unknown_id}:${String(unknown.revision)}`;
-const recordsAgree = (left, right) => JSON.stringify(withoutLocalPath(left)) ===
-    JSON.stringify(withoutLocalPath(right));
+const recordsAgree = (left, right) => canonicalize(withoutLocalPath(left)) ===
+    canonicalize(withoutLocalPath(right));
 const withoutLocalPath = (evidence) => ({
     ...evidence,
     subject: evidence.subject === null

package/dist/application/InvestigationProviders.js

@@ -0,0 +1,48 @@
+/** Provider identity for deterministic artifact inventories. */
+export const ARTIFACT_GRAPH_PROVIDER = {
+    id: "rea-artifact-graph",
+    name: "REA safe artifact graph provider",
+    version: "1",
+};
+/** Provider identity for deterministic cross-artifact comparisons. */
+export const ARTIFACT_COMPARISON_PROVIDER = {
+    id: "rea-artifact-comparison",
+    name: "REA artifact comparison",
+    version: "1",
+};
+/** Provider identity for deterministic cross-function comparisons. */
+export const FUNCTION_COMPARISON_PROVIDER = {
+    id: "rea-function-comparison",
+    name: "REA function comparison",
+    version: "1",
+};
+/** Provider identity for deterministic Evidence bundle comparisons. */
+export const BUNDLE_COMPARISON_PROVIDER = {
+    id: "rea-bundle-comparison",
+    name: "REA Evidence bundle comparison",
+    version: "1",
+};
+/** Provider identity for comparison-Evidence behavior aggregation. */
+export const CHANGED_BEHAVIOR_PROVIDER = {
+    id: "rea-changed-behavior",
+    name: "REA changed behavior investigation",
+    version: "1",
+};
+/** Provider identity for Evidence-backed call-path reconstruction. */
+export const CALL_PATH_PROVIDER = {
+    id: "rea-call-path",
+    name: "REA call path reconstruction",
+    version: "1",
+};
+/** Provider identity for explicit static/runtime hypothesis correlation. */
+export const STATIC_RUNTIME_PROVIDER = {
+    id: "rea-static-runtime-correlation",
+    name: "REA static/runtime correlation",
+    version: "1",
+};
+/** Provider identity for finite reconstruction specification verification. */
+export const RECONSTRUCTION_PROVIDER = {
+    id: "rea-reconstruction-verifier",
+    name: "REA reconstruction verifier",
+    version: "1",
+};

package/dist/application/InvestigationWorkspaceStore.js

@@ -0,0 +1,214 @@
+import { lstat, open, readFile, realpath, unlink, } from "node:fs/promises";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+import writeFileAtomic from "write-file-atomic";
+import { InvestigationWorkspaceError } from "../domain/errors.js";
+import { parseInvestigationWorkspace, serializeInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
+import { err, ok } from "../domain/result.js";
+/** Read a validated workspace, returning null only when it does not exist. */
+export const readInvestigationWorkspace = async (path, policy) => {
+    if (policy.roots.length === 0)
+        return err(new InvestigationWorkspaceError("read", "disabled"));
+    try {
+        const destination = await resolveDestination(path, policy.roots);
+        if (destination === null)
+            return err(new InvestigationWorkspaceError("read", "outside-root"));
+        return await readWorkspaceFile(destination, policy);
+    }
+    catch (cause) {
+        return err(new InvestigationWorkspaceError("read", "io", { cause }));
+    }
+};
+/** Atomically append one CAS-linked workspace revision under an exclusive lock. */
+export const writeInvestigationWorkspace = async (workspace, path, expectedRevision, policy) => {
+    if (policy.roots.length === 0)
+        return err(new InvestigationWorkspaceError("update", "disabled"));
+    let encoded;
+    try {
+        encoded = serializeInvestigationWorkspace(workspace);
+    }
+    catch (cause) {
+        return err(new InvestigationWorkspaceError("update", "integrity", { cause }));
+    }
+    const bytes = Buffer.byteLength(encoded, "utf8");
+    if (bytes > policy.maxBytes)
+        return err(new InvestigationWorkspaceError("update", "too-large"));
+    let lock;
+    try {
+        const destination = await resolveDestination(path, policy.roots);
+        if (destination === null)
+            return err(new InvestigationWorkspaceError("update", "outside-root"));
+        const acquired = await acquireLock(destination);
+        if (!acquired.ok)
+            return acquired;
+        lock = acquired.value;
+        const current = await readWorkspaceFile(destination, policy);
+        if (!current.ok)
+            return current;
+        const checked = validateNextRevision(current.value, workspace, expectedRevision);
+        if (!checked.ok)
+            return checked;
+        await writeFileAtomic(destination, encoded, {
+            encoding: "utf8",
+            mode: 0o600,
+            fsync: true,
+        });
+        return ok({ path: resolve(path), bytes });
+    }
+    catch (cause) {
+        return err(new InvestigationWorkspaceError("update", "io", { cause }));
+    }
+    finally {
+        if (lock !== undefined)
+            await releaseLock(lock);
+    }
+};
+const resolveDestination = async (path, roots) => {
+    const requested = resolve(path);
+    const canonicalParent = await realpath(dirname(requested));
+    const destination = resolve(canonicalParent, basename(requested));
+    for (const configuredRoot of roots) {
+        const root = await realpath(resolve(configuredRoot));
+        const relation = relative(root, destination);
+        if (relation === "" ||
+            (!relation.startsWith("..") && !isAbsolute(relation)))
+            return destination;
+    }
+    return null;
+};
+const readWorkspaceFile = async (destination, policy) => {
+    const stats = await lstat(destination).catch((cause) => {
+        if (isFileNotFound(cause))
+            return undefined;
+        throw cause;
+    });
+    if (stats === undefined)
+        return ok(null);
+    if (!stats.isFile() || stats.isSymbolicLink())
+        return err(new InvestigationWorkspaceError("read", "not-file"));
+    if (stats.size > policy.maxBytes)
+        return err(new InvestigationWorkspaceError("read", "too-large"));
+    const encoded = await readFile(destination);
+    if (encoded.byteLength > policy.maxBytes)
+        return err(new InvestigationWorkspaceError("read", "too-large"));
+    let decoded;
+    try {
+        decoded = JSON.parse(encoded.toString("utf8"));
+    }
+    catch (cause) {
+        return err(new InvestigationWorkspaceError("read", "invalid-json", { cause }));
+    }
+    if (!withinJsonLimits(decoded, policy))
+        return err(new InvestigationWorkspaceError("read", "too-large"));
+    try {
+        return ok(parseInvestigationWorkspace(decoded));
+    }
+    catch (cause) {
+        return err(new InvestigationWorkspaceError("read", "integrity", { cause }));
+    }
+};
+const acquireLock = async (destination) => {
+    const path = `${destination}.lock`;
+    try {
+        return ok(await createLock(path));
+    }
+    catch (cause) {
+        if (isAlreadyExists(cause) && (await removeStaleLock(path))) {
+            try {
+                return ok(await createLock(path));
+            }
+            catch (retryCause) {
+                return err(new InvestigationWorkspaceError("update", isAlreadyExists(retryCause) ? "locked" : "io", { cause: retryCause }));
+            }
+        }
+        return err(new InvestigationWorkspaceError("update", isAlreadyExists(cause) ? "locked" : "io", { cause }));
+    }
+};
+const createLock = async (path) => {
+    const handle = await open(path, "wx", 0o600);
+    try {
+        await handle.writeFile(`${String(process.pid)}\n`, "utf8");
+        await handle.sync();
+        return { path, handle };
+    }
+    catch (cause) {
+        await handle.close().catch(() => undefined);
+        await unlink(path).catch(() => undefined);
+        throw cause;
+    }
+};
+const removeStaleLock = async (path) => {
+    try {
+        const stats = await lstat(path);
+        if (!stats.isFile() || stats.isSymbolicLink() || stats.size > 32)
+            return false;
+        const encoded = (await readFile(path, "utf8")).trim();
+        if (!/^[1-9][0-9]{0,9}$/u.test(encoded))
+            return false;
+        const pid = Number(encoded);
+        if (processIsAlive(pid))
+            return false;
+        await unlink(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const processIsAlive = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (cause) {
+        return errorCode(cause) !== "ESRCH";
+    }
+};
+const releaseLock = async (lock) => {
+    await lock.handle.close().catch(() => undefined);
+    await unlink(lock.path).catch(() => undefined);
+};
+const validateNextRevision = (current, next, expectedRevision) => {
+    if ((current?.revision ?? null) !== expectedRevision)
+        return err(new InvestigationWorkspaceError("update", "revision-conflict"));
+    if (current === null) {
+        return next.revision === 1 && next.previous_revision_digest === null
+            ? ok(null)
+            : err(new InvestigationWorkspaceError("update", "revision-conflict"));
+    }
+    if (current.name !== next.name || current.workspace_id !== next.workspace_id)
+        return err(new InvestigationWorkspaceError("update", "name-conflict"));
+    return next.revision === current.revision + 1 &&
+        next.previous_revision_digest === current.revision_digest
+        ? ok(null)
+        : err(new InvestigationWorkspaceError("update", "revision-conflict"));
+};
+const withinJsonLimits = (root, policy) => {
+    const pending = [
+        { value: root, depth: 0 },
+    ];
+    let nodes = 0;
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current === undefined)
+            break;
+        nodes += 1;
+        if (nodes > policy.maxNodes || current.depth > policy.maxDepth)
+            return false;
+        if (typeof current.value === "string" &&
+            current.value.length > policy.maxStringLength)
+            return false;
+        if (typeof current.value !== "object" || current.value === null)
+            continue;
+        for (const [key, value] of Object.entries(current.value)) {
+            if (key.length > policy.maxStringLength)
+                return false;
+            pending.push({ value, depth: current.depth + 1 });
+        }
+    }
+    return true;
+};
+const isFileNotFound = (cause) => errorCode(cause) === "ENOENT";
+const isAlreadyExists = (cause) => errorCode(cause) === "EEXIST";
+const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause
+    ? cause.code
+    : undefined;