rea-agents 1.3.0 → 1.5.0

package/dist/application/CrossVersionInvestigation.js

@@ -2,8 +2,8 @@ import { compareArtifacts } from "../domain/artifactComparison.js";
 import { findChangedBehavior } from "../domain/changedBehavior.js";
 import { createEvidence } from "../domain/evidence.js";
 import { createEvidenceBundle, } from "../domain/evidenceBundle.js";
-import { AnalysisInputError, EvidenceIntegrityError, InvestigationWorkspaceError, } from "../domain/errors.js";
-import { createInvestigationRunIdentity, createInvestigationWorkspace, crossVersionInvestigationInputSchema, investigationRunSchema, investigationRunSummarySchema, reviseInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
+import { AnalysisCancelledError, AnalysisInputError, EvidenceIntegrityError, InvestigationWorkspaceError, } from "../domain/errors.js";
+import { createLegacyInvestigationRunIdentity, createInvestigationRunIdentity, createInvestigationWorkspace, crossVersionInvestigationInputSchema, investigationRunSchema, investigationRunSummarySchema, reviseInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { err, ok } from "../domain/result.js";
 import { AUTOMATIC_RUN_LIMITATION, createInventoryEvidencePages, runLimitations, scanVersions, targetFor, } from "./CrossVersionInventory.js";
@@ -22,15 +22,32 @@ export const runCrossVersionInvestigation = async (input, policy, execution) =>
     const preflight = validateWorkspaceRequest(initial.value, parsed.data);
     if (!preflight.ok)
         return preflight;
-    const snapshots = await scanVersions(parsed.data, execution.inputRoots, execution.signal);
+    if (isCancelled(execution.signal))
+        return err(new AnalysisCancelledError("find_changed_behavior"));
+    await execution.progress?.report({
+        phase: "scan_versions",
+        completed: 0,
+        total: 4,
+        message: "Scanning both version inputs",
+    });
+    const snapshots = await scanVersions(parsed.data, execution.inputRoots, execution.signal, execution.integrityContinueEnabled);
     if (!snapshots.ok)
         return snapshots;
+    await execution.progress?.report({
+        phase: "scan_versions",
+        completed: 1,
+        total: 4,
+        message: "Version inputs scanned",
+    });
     return continueInvestigation({
         input: parsed.data,
         initial: initial.value,
         snapshots: snapshots.value,
         policy,
         session: execution.session,
+        signal: execution.signal,
+        progress: execution.progress,
+        authorizeWorkspaceWrite: execution.authorizeWorkspaceWrite,
     });
 };
 const continueInvestigation = async (context) => {
@@ -40,13 +57,34 @@ const continueInvestigation = async (context) => {
         left,
         right,
         options: context.input.options,
+        integrity_policy: context.input.integrity_policy,
+        integrity_continue_approved: context.input.integrity_continue_approved,
+        max_integrity_mismatches: context.input.max_integrity_mismatches,
+    });
+    const legacyIdentity = createLegacyInvestigationRunIdentity({
+        left,
+        right,
+        options: context.input.options,
     });
-    const existing = context.initial?.runs.find(({ run_id: id }) => id === identity.runId);
+    const existing = context.initial?.runs.find((run) => run.run_id === identity.runId ||
+        (context.input.integrity_policy === "fail" &&
+            !context.input.integrity_continue_approved &&
+            context.input.max_integrity_mismatches === 10 &&
+            "legacy_request_identity" in run &&
+            run.max_integrity_mismatches === 10 &&
+            run.run_id === legacyIdentity.runId));
     if (context.initial !== null && existing?.status === "complete")
         return completeOutcome(context.initial, existing, true, context.session);
+    if (context.authorizeWorkspaceWrite !== undefined) {
+        const authorized = await context.authorizeWorkspaceWrite();
+        if (!authorized.ok)
+            return authorized;
+    }
     const pages = createInventoryEvidencePages(context.input, context.snapshots);
     if (!pages.ok)
         return pages;
+    if (isCancelled(context.signal))
+        return err(new AnalysisCancelledError("find_changed_behavior"));
     const inventoried = await ensureInventoryCheckpoint({
         input: context.input,
         current: context.initial,
@@ -57,11 +95,36 @@ const continueInvestigation = async (context) => {
     });
     if (!inventoried.ok)
         return inventoried;
+    await context.progress?.report({
+        phase: "inventory_versions",
+        completed: 2,
+        total: 4,
+        message: "Both artifact inventories checkpointed",
+    });
+    if (isCancelled(context.signal))
+        return err(new AnalysisCancelledError("find_changed_behavior"));
     const compared = await ensureComparisonCheckpoint(context.input, inventoried.value, context.policy);
     if (!compared.ok)
         return compared;
-    return finalizeInvestigation(context.input, compared.value, context.policy, context.session);
+    await context.progress?.report({
+        phase: "compare_artifacts",
+        completed: 3,
+        total: 4,
+        message: "Artifact comparison checkpointed",
+    });
+    if (isCancelled(context.signal))
+        return err(new AnalysisCancelledError("find_changed_behavior"));
+    const finalized = await finalizeInvestigation(context.input, compared.value, context.policy, context.session);
+    await context.progress?.report({
+        phase: "changed_behavior",
+        completed: 4,
+        total: 4,
+        message: finalized.ok ? "Investigation completed" : "Investigation failed",
+        terminal: true,
+    });
+    return finalized;
 };
+const isCancelled = (signal) => signal?.aborted === true;
 const ensureInventoryCheckpoint = async (input) => {
     if (input.existing !== undefined) {
         const consistent = validateInventoryCheckpoint(input.existing, input.pages);
@@ -77,6 +140,9 @@ const ensureInventoryCheckpoint = async (input) => {
         left,
         right,
         options: input.input.options,
+        integrity_policy: input.input.integrity_policy,
+        integrity_continue_approved: input.input.integrity_continue_approved,
+        max_integrity_mismatches: input.input.max_integrity_mismatches,
     });
     const run = investigationRunSchema.parse({
         schema_version: 1,
@@ -85,6 +151,9 @@ const ensureInventoryCheckpoint = async (input) => {
         left,
         right,
         options: input.input.options,
+        integrity_policy: input.input.integrity_policy,
+        integrity_continue_approved: input.input.integrity_continue_approved,
+        max_integrity_mismatches: input.input.max_integrity_mismatches,
         status: "running",
         completed_stages: ["inventory_left", "inventory_right"],
         left_inventory_evidence_ids: evidenceIds(input.pages.left),

package/dist/application/DeferredFileAuthorization.js

@@ -0,0 +1,61 @@
+import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { PermissionPathError, } from "./PermissionAuthority.js";
+/** Authorize one root-scoped operation and project policy path failures. */
+export const authorizeRootPermission = async (authority, request) => {
+    const authorized = await authority.authorize({
+        capability: request.capability,
+        roots: request.roots,
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: `${request.operation}:${request.capability}:${request.roots.join(":")}`,
+    }, request.access);
+    return authorized.ok
+        ? ok(null)
+        : err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+};
+/** Authorize an existing file read and defer write authority until requested. */
+export const authorizeFileReadWithDeferredWrite = async (authority, input) => {
+    const read = await authority.authorize({
+        capability: input.readCapability,
+        roots: [input.path],
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: `${input.operation}:${input.readCapability}:${input.path}`,
+    }, "read");
+    let writeAuthorization;
+    if (!read.ok) {
+        if (!(read.error instanceof PermissionPathError) ||
+            read.error.reason !== "not_found")
+            return err(read.error instanceof PermissionRequiredError
+                ? read.error
+                : new AnalysisProtocolError(read.error.message, {
+                    cause: read.error,
+                }));
+        writeAuthorization = authorizeRootPermission(authority, {
+            capability: input.writeCapability,
+            roots: [input.path],
+            access: "write",
+            operation: input.operation,
+        });
+        const authorized = await writeAuthorization;
+        if (!authorized.ok)
+            return authorized;
+    }
+    return ok({
+        authorizeWrite: () => (writeAuthorization ??= authorizeRootPermission(authority, {
+            capability: input.writeCapability,
+            roots: [input.path],
+            access: "write",
+            operation: input.operation,
+        })),
+    });
+};

package/dist/application/DirectAnalysis.js

@@ -1,14 +1,18 @@
 import { parseConfig } from "../config.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { createServerIdentity } from "../serverIdentity.js";
 import { EnhancedTools } from "./EnhancedTools.js";
 import { createBinarySession } from "./runtime.js";
 import { silentLogger } from "../logger.js";
 import { createEvidence } from "../domain/evidence.js";
-import { EvidenceIntegrityError, projectAnalysisError, } from "../domain/errors.js";
+import { EvidenceIntegrityError, AnalysisProtocolError, PermissionRequiredError, projectAnalysisError, } from "../domain/errors.js";
 import { access } from "node:fs/promises";
 import { readAnalysisSnapshot, writeAnalysisSnapshot, } from "./AnalysisSnapshotFiles.js";
 import { parseBinaryTarget } from "../domain/binaryTarget.js";
 import { snapshotEvidenceForQuery, snapshotMatchesTarget, } from "../domain/analysisSnapshot.js";
 import { err, ok } from "../domain/result.js";
+import { loadConfiguredPermissionAuthority } from "./PermissionConfiguration.js";
+import { authorizeFileReadWithDeferredWrite, } from "./DeferredFileAuthorization.js";
 const WORKFLOW_PROVIDER = {
     id: "rea-workflow",
     name: "REA composed investigation workflow",
@@ -19,12 +23,20 @@ const WORKFLOW_PROVIDER = {
  * Unlike MCP mode, every CLI invocation is intentionally isolated and does not
  * retain a target or bridge resources for a subsequent command.
  */
-export const runDirectAnalysis = async (path, tool, arguments_, options = {}) => runAnalysis(path, tool, arguments_, {
+export const runDirectAnalysis = async (path, tool, arguments_, options = {}) => withProcessCancellation(options.signal, (signal) => runAnalysis(path, tool, arguments_, {
     logger: options.logger ?? silentLogger,
     snapshotPath: options.snapshotPath,
-});
+    signal,
+    ...(options.permissionAuthority === undefined
+        ? {}
+        : { permissionAuthority: options.permissionAuthority }),
+}));
 /** Execute one provider-native semantic operation with atomic provenance. */
-export const runProviderAnalysis = async (path, tool, arguments_, logger = silentLogger) => runAnalysis(path, tool, arguments_, { logger, snapshotPath: undefined });
+export const runProviderAnalysis = async (path, tool, arguments_, logger = silentLogger, signal) => withProcessCancellation(signal, (operationSignal) => runAnalysis(path, tool, arguments_, {
+    logger,
+    snapshotPath: undefined,
+    signal: operationSignal,
+}));
 /** Describe configured providers without opening a target or launching Hopper. */
 export const runSessionStatus = async (logger = silentLogger) => {
     const config = parseConfig(process.env);
@@ -32,17 +44,97 @@ export const runSessionStatus = async (logger = silentLogger) => {
         return cliError(config.error);
     const session = createBinarySession(config.value, logger);
     try {
-        return session.status();
+        return {
+            ...jsonObjectSchema.parse(session.status()),
+            server_identity: createServerIdentity({
+                startedAt: new Date().toISOString(),
+            }),
+        };
     }
     finally {
         await session.close();
     }
 };
+const authorizeAnalysis = async (authority, tool, arguments_) => {
+    const requests = [];
+    if (tool === "extract_artifact" && typeof arguments_.output_root === "string")
+        requests.push({
+            capability: "artifact_extract",
+            path: arguments_.output_root,
+            access: "write",
+        });
+    for (const request of requests) {
+        const result = await authority.authorize({
+            capability: request.capability,
+            roots: [request.path],
+            executables: [],
+            environment_names: [],
+            network: "none",
+            mount: false,
+            operation_identity: `${tool}:${request.capability}:${request.path}`,
+        }, request.access);
+        if (!result.ok)
+            return err(result.error instanceof PermissionRequiredError
+                ? result.error
+                : new AnalysisProtocolError(result.error.message, {
+                    cause: result.error,
+                }));
+    }
+    if (tool === "inventory_artifact" &&
+        arguments_.native_mount_approved === true) {
+        const result = await authority.authorize({
+            capability: "native_mount",
+            roots: [],
+            executables: [],
+            environment_names: [],
+            network: "none",
+            mount: true,
+            operation_identity: "inventory_artifact:native_mount",
+        }, "read");
+        if (!result.ok)
+            return err(result.error instanceof PermissionRequiredError
+                ? result.error
+                : new AnalysisProtocolError(result.error.message, {
+                    cause: result.error,
+                }));
+    }
+    return ok(null);
+};
+const permissionAuthorityFor = (config, supplied) => supplied === undefined
+    ? loadConfiguredPermissionAuthority(config)
+    : Promise.resolve(ok(supplied));
+const authorizeSnapshotAccess = async (authority, tool, snapshotPath) => snapshotPath === undefined
+    ? ok(undefined)
+    : authorizeFileReadWithDeferredWrite(authority, {
+        path: snapshotPath,
+        readCapability: "snapshot_read",
+        writeCapability: "snapshot_write",
+        operation: tool,
+    });
+const authorizeDeferredWrite = (authorization) => authorization?.authorizeWrite() ?? Promise.resolve(ok(null));
+const authorizeAnalysisRun = async (input) => {
+    const authority = await permissionAuthorityFor(input.config, input.suppliedAuthority);
+    if (!authority.ok)
+        return authority;
+    const operation = await authorizeAnalysis(authority.value, input.tool, input.arguments);
+    if (!operation.ok)
+        return operation;
+    return authorizeSnapshotAccess(authority.value, input.tool, input.snapshotPath);
+};
 const runAnalysis = async (path, tool, arguments_, options) => {
-    const { logger, snapshotPath } = options;
+    const { logger, signal, snapshotPath } = options;
     const config = parseConfig(process.env);
     if (!config.ok)
         return cliError(config.error);
+    const authorization = await authorizeAnalysisRun({
+        config: config.value,
+        suppliedAuthority: options.permissionAuthority,
+        tool,
+        arguments: arguments_,
+        snapshotPath,
+    });
+    if (!authorization.ok)
+        return cliError(authorization.error);
     const unavailable = snapshotUnavailable(snapshotPath, config.value.hopperLoaderArgs);
     if (unavailable !== undefined)
         return cliError(unavailable);
@@ -60,8 +152,11 @@ const runAnalysis = async (path, tool, arguments_, options) => {
             return cliError(prepared.error);
         if (prepared.value.evidence !== undefined)
             return prepared.value.evidence;
+        const writable = await authorizeDeferredWrite(authorization.value);
+        if (!writable.ok)
+            return cliError(writable.error);
         const { snapshot } = prepared.value;
-        const opened = await session.open(path, snapshot === undefined ? {} : { snapshot });
+        const opened = await session.open(path, snapshot === undefined ? { signal } : { signal, snapshot });
         if (!opened.ok)
             return cliError(opened.error);
         let output;
@@ -69,7 +164,7 @@ const runAnalysis = async (path, tool, arguments_, options) => {
         if (tool === "binary_overview" ||
             tool === "analyze_function" ||
             tool === "trace_feature") {
-            const result = await new EnhancedTools(session).execute(tool, arguments_);
+            const result = await new EnhancedTools(session).execute(tool, arguments_, signal);
             if (!result.ok)
                 output = cliError(result.error);
             else {
@@ -86,7 +181,7 @@ const runAnalysis = async (path, tool, arguments_, options) => {
             }
         }
         else {
-            const result = await session.execute(tool, arguments_);
+            const result = await session.execute(tool, arguments_, { signal });
             if (!result.ok)
                 output = cliError(result.error);
             else {
@@ -117,6 +212,19 @@ const runAnalysis = async (path, tool, arguments_, options) => {
         await session.close();
     }
 };
+const withProcessCancellation = async (suppliedSignal, operation) => {
+    if (suppliedSignal !== undefined)
+        return operation(suppliedSignal);
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    process.once("SIGINT", cancel);
+    try {
+        return await operation(controller.signal);
+    }
+    finally {
+        process.off("SIGINT", cancel);
+    }
+};
 const prepareSnapshot = async (options) => {
     const { path, tool, arguments: arguments_, snapshotPath, policy, provider, } = options;
     if (snapshotPath === undefined || !(await fileExists(snapshotPath)))

package/dist/application/Doctor.js

@@ -1,6 +1,5 @@
 import { constants } from "node:fs";
-import { access } from "node:fs/promises";
-import { readdir } from "node:fs/promises";
+import { access, readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { execFile } from "node:child_process";
@@ -9,6 +8,9 @@ import { parseBinaryTarget } from "../domain/binaryTarget.js";
 import { supportsNodeVersion } from "../domain/runtimeVersion.js";
 import { probeHomebrew } from "./homebrew.js";
 import { linuxHopperBinarySupported, linuxHopperLauncherPath, linuxSharedLibrariesAvailable, readLinuxDistribution, } from "./LinuxHopper.js";
+import { CATALOG_IDENTITY } from "../catalogIdentity.js";
+import { PRODUCT_IDENTITY, SDK_IDENTITY } from "../identity.js";
+import { readClientRegistrationStatuses, } from "./ClientRegistrationStatus.js";
 const execFileAsync = promisify(execFile);
 const DEFAULT_HOPPER = "/Applications/Hopper Disassembler.app/Contents/MacOS/hopper";
 const SYSTEM_LINUX_HOPPER = "/opt/hopper/bin/Hopper";
@@ -68,10 +70,54 @@ export const runDoctor = async (target, host = systemDoctorHost()) => {
             remediation: "Supply a readable local app or program path.",
             classification: "config_drift",
         }));
+    const installationPaths = (await host.installationPaths?.()) ?? [];
+    const installedSkillVersion = await host.installedSkillVersion?.();
+    const registrations = (await host.clientRegistrations?.()) ?? [];
+    for (const registration of registrations)
+        if (registration.state !== "aligned")
+            checks.push({
+                name: `registration:${registration.client}`,
+                ok: false,
+                classification: "config_drift",
+                detail: registration.config_path,
+                remediation: registration.remediation ??
+                    "Run rea setup, then restart the affected client.",
+            });
     return {
         healthy: checks.every(({ ok }) => ok),
         ...(hopperPath === undefined ? {} : { hopperPath }),
         checks,
+        identity: {
+            cli_package_version: PRODUCT_IDENTITY.packageVersion,
+            expected_skill_version: PRODUCT_IDENTITY.skillVersion,
+            sdk: SDK_IDENTITY,
+            catalog: CATALOG_IDENTITY,
+            live_server: {
+                state: "unknown",
+                remediation: "Compare rea://server/identity or binary_session from the active client; an on-disk registration cannot prove the running server version.",
+            },
+            installations: {
+                paths: installationPaths,
+                state: installationPaths.length === 0
+                    ? "unknown"
+                    : installationPaths.length === 1
+                        ? "single"
+                        : "multiple",
+            },
+            skill: {
+                installed_version: installedSkillVersion ?? null,
+                state: installedSkillVersion === undefined
+                    ? "unknown"
+                    : installedSkillVersion === PRODUCT_IDENTITY.skillVersion
+                        ? "aligned"
+                        : "stale",
+                remediation: installedSkillVersion === undefined ||
+                    installedSkillVersion === PRODUCT_IDENTITY.skillVersion
+                    ? null
+                    : "Run rea setup to update the installed REA skill.",
+            },
+            registrations,
+        },
     };
 };
 const unsupportedHopperRemediation = (configured) => configured
@@ -157,8 +203,34 @@ export const systemDoctorHost = () => ({
         }
         return paths;
     },
+    async installationPaths() {
+        try {
+            const command = process.platform === "win32" ? "where" : "which";
+            const arguments_ = process.platform === "win32" ? ["rea"] : ["-a", "rea"];
+            return uniqueLines((await execFileAsync(command, arguments_)).stdout);
+        }
+        catch {
+            return [];
+        }
+    },
+    async installedSkillVersion() {
+        try {
+            const content = await readFile(join(homedir(), ".agents/skills", PRODUCT_IDENTITY.skillName, "SKILL.md"), "utf8");
+            return /^\s{2}version:\s*"([^"]+)"\s*$/mu.exec(content)?.[1];
+        }
+        catch {
+            return undefined;
+        }
+    },
+    clientRegistrations: () => readClientRegistrationStatuses(homedir()),
 });
 const parseMajor = (version) => Number.parseInt(version.split(".")[0] ?? "0", 10);
+const uniqueLines = (value) => [
+    ...new Set(value
+        .split(/\r?\n/u)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0)),
+];
 const check = (name, ok, detail, failure) => ({
     name,
     ok,

package/dist/application/EvidenceLedger.js

@@ -85,7 +85,7 @@ export class EvidenceLedger {
     }
     /** Export records in deterministic, semantically irrelevant ID order. */
     export() {
-        return createEvidenceBundle([...this.#records.values()], [...this.#unknownRevisions.values()]);
+        return structuredClone(createEvidenceBundle([...this.#records.values()], [...this.#unknownRevisions.values()]));
     }
     /** Check whether one immutable Evidence ID is present in this ledger. */
     has(evidenceId) {
@@ -162,7 +162,7 @@ export class EvidenceLedger {
         if (!checked.ok)
             return checked;
         this.#commit(pendingRecords, pendingUnknowns, checked.value);
-        return ok(unknown);
+        return ok(structuredClone(unknown));
     }
     /** Apply one approved full-state update using optimistic revision matching. */
     updateUnknown(input, mutationEvidence) {
@@ -187,7 +187,8 @@ export class EvidenceLedger {
             (filters.severity === undefined ||
                 unknown.severity === filters.severity) &&
             (filters.domain === undefined || unknown.domain === filters.domain))
-            .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id));
+            .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id))
+            .map((unknown) => structuredClone(unknown));
     }
     /** Return current resolution validity; imported invalid states are rejected. */
     verifyUnknownResolution(unknownId) {
@@ -197,7 +198,7 @@ export class EvidenceLedger {
         return ok({
             valid: unknown.status === "resolved",
             truthVerified: unknown.resolution?.disposition === "verified",
-            unknown,
+            unknown: structuredClone(unknown),
         });
     }
     /** Clear records when the owning session closes. */
@@ -225,7 +226,7 @@ export class EvidenceLedger {
         if (!checked.ok)
             return checked;
         this.#commit(pendingRecords, pendingUnknowns, checked.value);
-        return ok(unknown);
+        return ok(structuredClone(unknown));
     }
     #validateCandidate(records, unknowns) {
         if (records.size + unknowns.size > this.limits.maxRecords)

package/dist/application/InvestigationWorkspaceStore.js

@@ -1,6 +1,7 @@
 import { lstat, open, readFile, realpath, unlink, } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import writeFileAtomic from "write-file-atomic";
+import { isJsonWithinLimits } from "../domain/jsonLimits.js";
 import { InvestigationWorkspaceError } from "../domain/errors.js";
 import { parseInvestigationWorkspace, serializeInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { err, ok } from "../domain/result.js";
@@ -97,7 +98,7 @@ const readWorkspaceFile = async (destination, policy) => {
     catch (cause) {
         return err(new InvestigationWorkspaceError("read", "invalid-json", { cause }));
     }
-    if (!withinJsonLimits(decoded, policy))
+    if (!isJsonWithinLimits(decoded, policy))
         return err(new InvestigationWorkspaceError("read", "too-large"));
     try {
         return ok(parseInvestigationWorkspace(decoded));
@@ -182,31 +183,6 @@ const validateNextRevision = (current, next, expectedRevision) => {
         ? ok(null)
         : err(new InvestigationWorkspaceError("update", "revision-conflict"));
 };
-const withinJsonLimits = (root, policy) => {
-    const pending = [
-        { value: root, depth: 0 },
-    ];
-    let nodes = 0;
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (current === undefined)
-            break;
-        nodes += 1;
-        if (nodes > policy.maxNodes || current.depth > policy.maxDepth)
-            return false;
-        if (typeof current.value === "string" &&
-            current.value.length > policy.maxStringLength)
-            return false;
-        if (typeof current.value !== "object" || current.value === null)
-            continue;
-        for (const [key, value] of Object.entries(current.value)) {
-            if (key.length > policy.maxStringLength)
-                return false;
-            pending.push({ value, depth: current.depth + 1 });
-        }
-    }
-    return true;
-};
 const isFileNotFound = (cause) => errorCode(cause) === "ENOENT";
 const isAlreadyExists = (cause) => errorCode(cause) === "EEXIST";
 const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause