rea-agents 3.0.0 → 3.2.0

package/dist/application/EnhancedTools.js

@@ -1,11 +1,13 @@
+import { z } from "zod";
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
 import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
 import { addressDistance, functionDossierSchema, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
-import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, discoverSwiftClasses, } from "../domain/symbolAnalysis.js";
+import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, } from "../domain/symbolAnalysis.js";
+import { inspectNativeDispatchMetadata, nativeDispatchMetadataResultSchema, } from "../domain/objcSwiftMetadata.js";
+import { traceNativeUiAction } from "./NativeUiActionTrace.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
-import { readAllAddressed } from "./EnhancedToolPagination.js";
 import { traceCallPath } from "./CallPathTracing.js";
 import { traceLiteralFeature } from "./EnhancedLiteralTracing.js";
 import { projectNativeApiInspection } from "./NativeApiInspection.js";
@@ -25,11 +27,17 @@ export class EnhancedTools {
             name === "find_code_for_string" ||
             name === "trace_call_path")
             return this.#executeTracing(name, input, signal);
+        if (name === "trace_native_ui_action") {
+            const parsed = enhancedInputSchemas.trace_native_ui_action.safeParse(input);
+            return parsed.success
+                ? this.executeValidated({ name, input: parsed.data }, signal)
+                : invalidEnhancedInput(name, parsed.error);
+        }
         if (name === "analyze_function" || name === "inspect_native_api")
             return this.#executeFunctionAnalysis(name, input, signal);
         switch (name) {
-            case "swift_classes": {
-                const parsed = enhancedInputSchemas.swift_classes.safeParse(input);
+            case "inspect_native_dispatch_metadata": {
+                const parsed = enhancedInputSchemas.inspect_native_dispatch_metadata.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
                     : invalidEnhancedInput(name, parsed.error);
@@ -54,8 +62,12 @@ export class EnhancedTools {
                     ? this.executeValidated({ name, input: parsed.data }, signal)
                     : invalidEnhancedInput(name, parsed.error);
             }
-            case "analyze_swift_types":
-                return this.executeValidated({ name, input: {} }, signal);
+            case "analyze_swift_types": {
+                const parsed = enhancedInputSchemas.analyze_swift_types.safeParse(input);
+                return parsed.success
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
+            }
             case "find_xrefs_to_name": {
                 const parsed = enhancedInputSchemas.find_xrefs_to_name.safeParse(input);
                 return parsed.success
@@ -73,8 +85,8 @@ export class EnhancedTools {
     /** Dispatch input already parsed by a trusted adapter boundary. */
     executeValidated(call, signal) {
         switch (call.name) {
-            case "swift_classes":
-                return this.#swiftClasses(call.input.pattern, signal);
+            case "inspect_native_dispatch_metadata":
+                return this.#inspectNativeDispatchMetadata(call.input.max_records, signal);
             case "get_objc_classes":
                 return this.#objcClasses(call.input.pattern, signal);
             case "get_objc_protocols":
@@ -84,11 +96,11 @@ export class EnhancedTools {
             case "get_call_graph":
                 return this.#callGraph(call.input, signal);
             case "analyze_swift_types":
-                return this.#analyzeSwiftTypes(signal);
+                return this.#analyzeSwiftTypes(call.input, signal);
             case "find_xrefs_to_name":
                 return this.#findXrefs(call.input.name, signal);
             case "binary_overview":
-                return this.#binaryOverview(call.input, signal);
+                return this.#binaryOverview(signal);
             case "analyze_function":
                 return this.#analyzeFunction(call.input, signal);
             case "inspect_native_api":
@@ -99,35 +111,40 @@ export class EnhancedTools {
                 return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "string", signal);
             case "trace_call_path":
                 return traceCallPath((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, signal);
+            case "trace_native_ui_action": {
+                return traceNativeUiAction(this.analysis, call.input, signal);
+            }
         }
     }
     #executeTracing(name, input, signal) {
-        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (name === "trace_call_path") {
+            const parsed = enhancedInputSchemas.trace_call_path.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        if (name === "trace_feature") {
+            const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        const parsed = enhancedInputSchemas.find_code_for_string.safeParse(input);
         if (!parsed.success)
             return invalidEnhancedInput(name, parsed.error);
-        if (name === "trace_call_path")
-            return this.executeValidated({
-                name,
-                input: enhancedInputSchemas.trace_call_path.parse(parsed.data),
-            }, signal);
-        return this.executeValidated({
-            name,
-            input: enhancedInputSchemas[name].parse(parsed.data),
-        }, signal);
+        return this.executeValidated({ name, input: parsed.data }, signal);
     }
     #executeFunctionAnalysis(name, input, signal) {
-        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (name === "analyze_function") {
+            const parsed = enhancedInputSchemas.analyze_function.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        const parsed = enhancedInputSchemas.inspect_native_api.safeParse(input);
         if (!parsed.success)
             return invalidEnhancedInput(name, parsed.error);
-        if (name === "analyze_function")
-            return this.executeValidated({
-                name,
-                input: enhancedInputSchemas.analyze_function.parse(parsed.data),
-            }, signal);
-        return this.executeValidated({
-            name,
-            input: enhancedInputSchemas.inspect_native_api.parse(parsed.data),
-        }, signal);
+        return this.executeValidated({ name, input: parsed.data }, signal);
     }
     async #analyzeFunction(input, signal) {
         const result = await this.#call("analyze_function", input, signal);
@@ -136,9 +153,6 @@ export class EnhancedTools {
     async #inspectNativeApi(input, signal) {
         const analysisInput = enhancedInputSchemas.analyze_function.parse({
             procedure: input.procedure,
-            include_assembly: true,
-            max_pseudocode_chars: input.max_pseudocode_chars,
-            max_instructions: input.max_instructions,
         });
         const result = await this.#call("analyze_function", analysisInput, signal);
         if (!result.ok)
@@ -149,16 +163,32 @@ export class EnhancedTools {
         const dossier = functionDossierSchema.parse(parsed.value);
         return ok(jsonValueSchema.parse(projectNativeApiInspection(dossier)));
     }
-    async #swiftClasses(pattern, signal) {
-        const procedures = await this.#allAddressed("list_procedures", signal);
-        return procedures.ok
-            ? ok(discoverSwiftClasses(procedures.value, pattern))
-            : procedures;
-    }
     async #objcClasses(pattern, signal) {
         const names = await this.#allAddressed("list_names", signal);
         return names.ok ? ok(discoverObjcClasses(names.value, pattern)) : names;
     }
+    async #inspectNativeDispatchMetadata(maxRecords, signal) {
+        const execution = await this.analysis.execute("list_names", {}, signal === undefined ? {} : { signal });
+        if (!execution.ok)
+            return err(execution.error);
+        const names = z
+            .array(z.union([
+            z.strictObject({ address: z.string(), value: z.string() }),
+            z.strictObject({ address: z.string(), name: z.string() }),
+        ]))
+            .safeParse(execution.value.result);
+        if (!names.success)
+            return err(new AnalysisOutputError("list_names", "provider returned an invalid inventory"));
+        return ok(nativeDispatchMetadataResultSchema.parse({
+            target_sha256: execution.value.subject?.sha256 ?? null,
+            provider: execution.value.provider,
+            analysis_profile_digest: execution.value.analysisProfile?.digest ?? null,
+            result: inspectNativeDispatchMetadata(names.data.map((entry) => ({
+                address: entry.address,
+                name: "value" in entry ? entry.value : entry.name,
+            })), maxRecords),
+        }));
+    }
     async #objcProtocols(signal) {
         const names = await this.#allAddressed("list_names", signal);
         return names.ok ? ok(discoverObjcProtocols(names.value)) : names;
@@ -199,9 +229,8 @@ export class EnhancedTools {
         const graph = {};
         while (queueIndex < queue.length) {
             const current = queue[queueIndex++];
-            if (current === undefined || current.depth >= input.depth) {
+            if (current === undefined)
                 continue;
-            }
             const level = String(current.depth);
             graph[level] ??= [];
             const result = await this.#call(tool, { procedure: current.address }, signal);
@@ -227,21 +256,19 @@ export class EnhancedTools {
                 status: "ok",
                 calls: [...related.value],
             });
-            if (current.depth + 1 < input.depth) {
-                for (const address of related.value) {
-                    if (!discovered.has(address)) {
-                        discovered.add(address);
-                        queue.push({ address, depth: current.depth + 1 });
-                    }
+            for (const address of related.value) {
+                if (!discovered.has(address)) {
+                    discovered.add(address);
+                    queue.push({ address, depth: current.depth + 1 });
                 }
             }
         }
         return ok(graph);
     }
-    async #analyzeSwiftTypes(signal) {
+    async #analyzeSwiftTypes(input, signal) {
         const procedures = await this.#allAddressed("list_procedures", signal);
         return procedures.ok
-            ? ok(categorizeSwiftTypes(procedures.value))
+            ? ok(categorizeSwiftTypes(procedures.value, input))
             : procedures;
     }
     async #findXrefs(name, signal) {
@@ -264,12 +291,12 @@ export class EnhancedTools {
             xrefs: xrefs.value,
         });
     }
-    async #binaryOverview(input, signal) {
+    async #binaryOverview(signal) {
         const [segmentsResult, documentsResult, proceduresResult, stringsResult] = await Promise.all([
             this.#call("list_segments", {}, signal),
             this.#call("list_documents", {}, signal),
-            this.#call("list_procedures", { offset: 0, limit: 1 }, signal),
-            this.#call("list_strings", { offset: 0, limit: 1 }, signal),
+            this.#call("list_procedures", {}, signal),
+            this.#call("list_strings", {}, signal),
         ]);
         if (!segmentsResult.ok)
             return segmentsResult;
@@ -293,28 +320,35 @@ export class EnhancedTools {
             return stringCount;
         return ok({
             document: documents.value[0] ?? "unknown",
-            detail: input.detail,
-            segments: segments.value
-                .slice(0, input.limit)
-                .map(({ name, start, end }) => input.detail === "detailed"
-                ? { name, start, end, length: addressDistance(start, end) }
-                : { name, start, end }),
+            segments: segments.value.map(({ name, start, end }) => ({
+                name,
+                start,
+                end,
+                length: addressDistance(start, end),
+            })),
             segment_count: segments.value.length,
             procedure_count: procedureCount.value,
             string_count: stringCount.value,
         });
     }
     async #allAddressed(tool, signal) {
-        return readAllAddressed({
-            call: (name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal),
-            tool,
-            ...(signal === undefined ? {} : { signal }),
-        });
+        const result = await this.#call(tool, {}, signal);
+        if (!result.ok)
+            return result;
+        const parsed = z
+            .array(z.object({ address: z.string(), value: z.string() }))
+            .safeParse(result.value);
+        return parsed.success
+            ? ok(parsed.data.map(({ address, value: name }) => ({ address, name })))
+            : err(new AnalysisOutputError(tool, "provider returned an invalid inventory"));
     }
     async #call(name, arguments_, signal) {
-        if (signal?.aborted === true)
+        if (isAborted(signal))
             return err(new AnalysisCancelledError(name));
         const execution = await this.analysis.execute(name, arguments_, signal === undefined ? {} : { signal });
+        if (isAborted(signal))
+            return err(new AnalysisCancelledError(name));
         return execution.ok ? ok(execution.value.result) : execution;
     }
 }
+const isAborted = (signal) => signal?.aborted === true;

package/dist/application/EvidenceBundleCommands.js

@@ -4,36 +4,40 @@ import { err, ok } from "../domain/result.js";
 import { compareBundles } from "../domain/bundleComparison.js";
 import { EvidenceLedger } from "./EvidenceLedger.js";
 import { readEvidenceBundle, writeEvidenceBundle, } from "./EvidenceBundleFiles.js";
-/** Validate and merge one bundle using the same bounded ledger as MCP. */
-export const importEvidenceBundleCommand = async (path, policy) => {
-    const loaded = await readEvidenceBundle(path, policy);
+/** Validate and merge one bundle using the session Evidence ledger. */
+export const importEvidenceBundleCommand = async (path) => {
+    const loaded = await readEvidenceBundle(path);
     if (!loaded.ok)
         return loaded;
     const ledger = createLedger();
     const imported = ledger.import(loaded.value);
     return imported.ok
-        ? ok({ imported: imported.value, total: ledger.export().records.length })
+        ? ok({
+            imported: imported.value.recordsAdded,
+            unknowns_added: imported.value.unknownsAdded,
+            total: ledger.export().records.length,
+        })
         : imported;
 };
 /** Validate a source bundle and atomically export canonical bytes. */
-export const exportEvidenceBundleCommand = async (sourcePath, outputPath, overwrite, policy) => {
-    const loaded = await readEvidenceBundle(sourcePath, policy);
+export const exportEvidenceBundleCommand = async (sourcePath, outputPath, overwrite) => {
+    const loaded = await readEvidenceBundle(sourcePath);
     if (!loaded.ok)
         return loaded;
-    return projectWrite(loaded.value, await writeEvidenceBundle(loaded.value, outputPath, overwrite, policy));
+    return projectWrite(loaded.value, await writeEvidenceBundle(loaded.value, outputPath, overwrite));
 };
-/** Compare two validated canonical Evidence v2 bundles without session state. */
+/** Compare two validated canonical Evidence bundles without session state. */
 export const compareEvidenceBundlesCommand = async (input) => {
     const [left, right] = await Promise.all([
-        readEvidenceBundle(input.leftPath, input.policy),
-        readEvidenceBundle(input.rightPath, input.policy),
+        readEvidenceBundle(input.leftPath),
+        readEvidenceBundle(input.rightPath),
     ]);
     if (!left.ok)
         return left;
     if (!right.ok)
         return right;
     try {
-        return ok(jsonValueSchema.parse(compareBundles(left.value, right.value, [], input.offset, input.limit)));
+        return ok(jsonValueSchema.parse(compareBundles(left.value, right.value)));
     }
     catch (cause) {
         return err(new EvidenceIntegrityError("Evidence bundle comparison failed", {
@@ -41,7 +45,7 @@ export const compareEvidenceBundlesCommand = async (input) => {
         }));
     }
 };
-const createLedger = () => new EvidenceLedger({ maxRecords: 10_000, maxBytes: 64 * 1024 * 1024 });
+const createLedger = () => new EvidenceLedger();
 const projectWrite = (bundle, written) => written.ok
     ? ok({
         path: written.value.path,

package/dist/application/EvidenceBundleFiles.js

@@ -1,21 +1,17 @@
 import { parseEvidenceBundle, serializeEvidenceBundle, } from "../domain/evidenceBundle.js";
 import { EvidenceFileError, EvidenceIntegrityError } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-import { LEGACY_PROCESS_CAPTURE_MESSAGE, parseProcessCapture, } from "../domain/processCapture.js";
-import { readBoundedJson, writeBoundedText } from "./BoundedJsonFiles.js";
-/** Read and validate a bounded evidence bundle inside an approved root. */
-export const readEvidenceBundle = async (path, policy) => {
-    if (policy.roots.length === 0)
-        return err(new EvidenceFileError("read", "disabled"));
-    const loaded = await readBoundedJson(path, policy);
+import { parseProcessCapture } from "../domain/processCapture.js";
+import { readJsonFile, writeTextFile } from "./JsonFiles.js";
+/** Read and validate an evidence bundle at the caller-supplied path. */
+export const readEvidenceBundle = async (path) => {
+    const loaded = await readJsonFile(path);
     if (!loaded.ok)
         return loaded;
     try {
         const bundle = parseEvidenceBundle(loaded.value);
         for (const record of bundle.records) {
-            if (record.predicate_type === "rea.process-capture/v3")
-                throw new TypeError(LEGACY_PROCESS_CAPTURE_MESSAGE);
-            if (record.predicate_type === "rea.process-capture/v4")
+            if (record.predicate_type === "rea.process-capture")
                 parseProcessCapture(record.normalized_result);
         }
         return ok(bundle);
@@ -26,10 +22,8 @@ export const readEvidenceBundle = async (path, policy) => {
         }));
     }
 };
-/** Atomically write deterministic evidence JSON inside an approved root. */
-export const writeEvidenceBundle = async (bundle, path, overwrite, policy) => {
-    if (policy.roots.length === 0)
-        return err(new EvidenceFileError("write", "disabled"));
+/** Atomically write deterministic evidence JSON at the caller-supplied path. */
+export const writeEvidenceBundle = async (bundle, path, overwrite) => {
     let encoded;
     try {
         encoded = serializeEvidenceBundle(bundle);
@@ -39,5 +33,5 @@ export const writeEvidenceBundle = async (bundle, path, overwrite, policy) => {
             cause,
         }));
     }
-    return writeBoundedText(encoded, path, overwrite, policy);
+    return writeTextFile(encoded, path, overwrite);
 };

package/dist/application/EvidenceLedger.js

@@ -1,23 +1,14 @@
 import canonicalize from "canonicalize";
 import { createEvidenceBundle, parseEvidenceBundle, validateResidualUnknownAddition, } from "../domain/evidenceBundle.js";
-import { EvidenceIntegrityError, EvidenceLimitError, UnknownRegistryError, } from "../domain/errors.js";
+import { EvidenceIntegrityError, UnknownRegistryError, } from "../domain/errors.js";
 import { parseEvidence } from "../domain/evidence.js";
 import { createResidualUnknown, updateResidualUnknown, } from "../domain/residualUnknown.js";
 import { err, ok } from "../domain/result.js";
-/** Bounded, session-owned set of immutable evidence records. */
+/** Session-owned set of immutable evidence records. */
 export class EvidenceLedger {
-    limits;
     #records = new Map();
     #unknownRevisions = new Map();
     #unknownHeads = new Map();
-    #bytes = 0;
-    constructor(limits) {
-        this.limits = limits;
-        if (!Number.isSafeInteger(limits.maxRecords) || limits.maxRecords < 1)
-            throw new RangeError("maxRecords must be a positive safe integer");
-        if (!Number.isSafeInteger(limits.maxBytes) || limits.maxBytes < 1)
-            throw new RangeError("maxBytes must be a positive safe integer");
-    }
     /** Record evidence idempotently; conflicting content is rejected. */
     record(input) {
         let evidence;
@@ -35,13 +26,7 @@ export class EvidenceLedger {
                 ? ok("duplicate")
                 : err(new EvidenceIntegrityError("Conflicting evidence record"));
         }
-        if (this.#exceedsRecordLimit(this.#records.size + 1, this.#unknownRevisions.size))
-            return err(new EvidenceLimitError("records", this.limits.maxRecords));
-        const bytes = serializedBytes(evidence);
-        if (this.#bytes + bytes > this.limits.maxBytes)
-            return err(new EvidenceLimitError("bytes", this.limits.maxBytes));
         this.#records.set(evidence.evidence_id, evidence);
-        this.#bytes += bytes;
         return ok("added");
     }
     /** Validate an entire bundle before atomically merging its records. */
@@ -63,6 +48,7 @@ export class EvidenceLedger {
             pending.set(evidence.evidence_id, evidence);
         }
         const pendingUnknowns = new Map(this.#unknownRevisions);
+        let unknownsAdded = 0;
         for (const unknown of bundle.unknowns) {
             const key = unknownRevisionKey(unknown);
             const existing = pendingUnknowns.get(key);
@@ -70,6 +56,8 @@ export class EvidenceLedger {
                 existing.revision_digest !== unknown.revision_digest)
                 return err(new EvidenceIntegrityError("Conflicting unknown revision"));
             pendingUnknowns.set(key, unknown);
+            if (existing === undefined)
+                unknownsAdded += 1;
         }
         const checked = this.#validateCandidate(pending, pendingUnknowns);
         if (!checked.ok) {
@@ -80,8 +68,12 @@ export class EvidenceLedger {
             return err(checked.error);
         }
         const added = pending.size - this.#records.size;
-        this.#commit(pending, pendingUnknowns, checked.value);
-        return ok(added);
+        this.#commit(pending, pendingUnknowns);
+        return ok({
+            recordsAdded: added,
+            unknownsAdded,
+            changed: added > 0 || unknownsAdded > 0,
+        });
     }
     /** Export records in deterministic, semantically irrelevant ID order. */
     export() {
@@ -118,7 +110,7 @@ export class EvidenceLedger {
             return err(new UnknownRegistryError("already-exists"));
         return this.#appendUnknown(unknown, parsedMutation);
     }
-    /** Atomically record derived Evidence and an approved residual unknown. */
+    /** Atomically record derived Evidence and a linked residual unknown. */
     recordWithUnknown(evidenceInput, input, mutationInput) {
         let evidence;
         let mutation;
@@ -199,7 +191,6 @@ export class EvidenceLedger {
         this.#records.clear();
         this.#unknownRevisions.clear();
         this.#unknownHeads.clear();
-        this.#bytes = 0;
     }
     #appendUnknown(unknown, mutationEvidenceInput) {
         let mutationEvidence;
@@ -218,7 +209,6 @@ export class EvidenceLedger {
     }
     #appendIncremental(records, unknown) {
         const additions = new Map();
-        let addedBytes = 0;
         for (const evidence of records) {
             const existing = additions.get(evidence.evidence_id) ??
                 this.#records.get(evidence.evidence_id);
@@ -228,16 +218,10 @@ export class EvidenceLedger {
                 continue;
             }
             additions.set(evidence.evidence_id, evidence);
-            addedBytes += serializedBytes(evidence);
         }
         const unknownKey = unknown === undefined ? undefined : unknownRevisionKey(unknown);
         if (unknownKey !== undefined && this.#unknownRevisions.has(unknownKey))
             return err(new UnknownRegistryError("integrity"));
-        const unknownBytes = unknown === undefined ? 0 : serializedBytes(unknown);
-        if (this.#exceedsRecordLimit(this.#records.size + additions.size, this.#unknownRevisions.size + (unknown === undefined ? 0 : 1)))
-            return err(new EvidenceLimitError("records", this.limits.maxRecords));
-        if (this.#bytes + addedBytes + unknownBytes > this.limits.maxBytes)
-            return err(new EvidenceLimitError("bytes", this.limits.maxBytes));
         if (unknown !== undefined)
             try {
                 validateResidualUnknownAddition(unknown, {
@@ -254,28 +238,18 @@ export class EvidenceLedger {
             this.#unknownRevisions.set(unknownKey, unknown);
             this.#unknownHeads.set(unknown.unknown_id, unknown);
         }
-        this.#bytes += addedBytes + unknownBytes;
         return ok(undefined);
     }
     #validateCandidate(records, unknowns) {
-        if (this.#exceedsRecordLimit(records.size, unknowns.size))
-            return err(new EvidenceLimitError("records", this.limits.maxRecords));
-        const bytes = [...records.values()].reduce((total, evidence) => total + serializedBytes(evidence), 0) +
-            [...unknowns.values()].reduce((total, unknown) => total + serializedBytes(unknown), 0);
-        if (bytes > this.limits.maxBytes)
-            return err(new EvidenceLimitError("bytes", this.limits.maxBytes));
         try {
             parseEvidenceBundle(createEvidenceBundle([...records.values()], [...unknowns.values()]));
         }
         catch (cause) {
             return err(new UnknownRegistryError("integrity", { cause }));
         }
-        return ok(bytes);
-    }
-    #exceedsRecordLimit(recordCount, unknownCount) {
-        return recordCount + unknownCount > this.limits.maxRecords;
+        return ok(undefined);
     }
-    #commit(records, unknowns, bytes) {
+    #commit(records, unknowns) {
         this.#records.clear();
         for (const [id, evidence] of records)
             this.#records.set(id, evidence);
@@ -287,10 +261,8 @@ export class EvidenceLedger {
             if (head === undefined || head.revision < unknown.revision)
                 this.#unknownHeads.set(unknown.unknown_id, unknown);
         }
-        this.#bytes = bytes;
     }
 }
-const serializedBytes = (value) => Buffer.byteLength(JSON.stringify(value), "utf8");
 const unknownRevisionKey = (unknown) => `${unknown.unknown_id}:${String(unknown.revision)}`;
 const recordsAgree = (left, right) => canonicalize(withoutLocalPath(left)) ===
     canonicalize(withoutLocalPath(right));

package/dist/application/FilesystemSnapshot.js

@@ -1,9 +1,8 @@
+import { isPathWithinRoot } from "../domain/localPath.js";
 import { createHash } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { lstat, open, readdir, readlink } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
-const isWithin = (candidate, root) => candidate === root ||
-    candidate.startsWith(`${root.endsWith("/") ? root.slice(0, -1) : root}/`);
 const hasSameIdentity = (before, after, expected) => before.dev === after.dev &&
     before.ino === after.ino &&
     (expected === "directory" ? after.isDirectory() : after.isSymbolicLink());
@@ -66,7 +65,7 @@ export const snapshotRoots = async (scenario, signal) => {
                 truncated = true;
                 return;
             }
-            const safeTarget = isWithin(target, root)
+            const safeTarget = isPathWithinRoot(root, target)
                 ? relative(root, target) || "."
                 : "<outside-declared-root>";
             if (safeTarget === "<outside-declared-root>")