rea-agents 3.0.0 → 3.2.0

package/skills/reverse-engineer-anything/SKILL.md

@@ -4,7 +4,7 @@ description: Reverse engineer native, managed, Electron/JavaScript, packaged, an
 metadata:
   version: "23"
   tool_count: 114
-  catalog_digest: "e83a177f5eca63bbad17886a61f5a1a376d44afe862c51c56e5d38339f7d41f8"
+  catalog_digest: "3e9ab4e05563ea2609b7cf4db67638a79cd8a74188c292718d99a63451d5b9db"
 ---
 
 # REA
@@ -23,13 +23,14 @@ Choose the first tool from the target the user supplied. Do not call
 - ASAR or extracted JavaScript/Electron tree:
   `analyze_javascript_application`.
 - Archive, application package, ZIP/APK/IPA/MSIX/AppX, or DMG:
-  `open_binary` with the supplied local path, then `inspect_artifact` or
-  `inventory_artifact` (both operate on the active target and accept no path).
+  `open_binary` with the supplied local path; use `inspect_artifact` when its
+  graph and findings help answer the question.
 - Managed PE/CLI assembly: `inspect_managed_artifact`.
 - User-owned browser page already open: `list_browser_targets`.
 - User-owned Electron runtime already open: `list_electron_targets`.
 - Native executable, library, or analysis database: `open_binary`, then
-  `binary_overview`.
+  use focused analysis tools directly; call `binary_overview` when metadata or
+  inventory context is useful.
 
 If the app is missing, ask which app to inspect. Resolve a human-readable app
 name to one clear installed artifact when possible; ask only when matches are
@@ -43,16 +44,48 @@ is unavailable.
 
 ## Work summary-first
 
-Start with the default summary projection. Do not repeat an identical tool call.
-Do not fetch full Evidence or a full application graph unless a specific claim
-requires detail absent from the summary. For JavaScript graphs, follow the
-paged resource URIs returned by the summary and fetch only the relevant page.
+Start with the default result and use its inline Evidence and graph context.
+Do not repeat an identical tool call. Make a focused follow-up only when the
+returned result leaves a specific question unanswered.
 
 Every conclusion must distinguish observations, inferences, and unknowns. Cite
 Evidence IDs, preserve limitations and incomplete coverage, and never imply
 that static analysis observed execution. Ask for approval only where a tool or
 policy requires it; approval never broadens a different authority boundary.
 
+## Plan broader investigations
+
+For requests that span multiple features or subsystems, use a staged workflow:
+
+1. Turn the request into a checklist of questions and the evidence each answer
+   needs. Resolve target identity and constraints from the conversation and
+   workspace before asking for information again.
+2. Inspect the current REA session, artifact identity, saved analysis database,
+   bookmarks, and prior evidence. Reuse matching state; do not open duplicate
+   sessions or repeat identical analysis.
+3. Start with the smallest useful overview or inventory. Follow each question
+   from its entry point through relevant data and state changes to its result.
+   Batch related operations around a specific hypothesis, then expand only when
+   the returned evidence leaves a concrete gap.
+4. Inspect relevant packaged resources and configuration alongside code when
+   they affect the question. Use format-aware inventory and parsers; do not
+   infer behavior from filenames, strings, or layout alone.
+5. Corroborate a conclusion with the evidence type it requires. Use runtime
+   observation or controlled replay only when static evidence cannot answer the
+   question and the required authority is available.
+6. Decompose work into independent questions. When parallel workers are
+   available and the questions do not depend on one another, assign distinct
+   scopes, point workers to existing evidence, and ask them to return sources,
+   conclusions, and unresolved gaps. Otherwise, work sequentially.
+7. Keep a concise finding ledger linking each conclusion to Evidence IDs,
+   confidence/evidence type, search boundary, and remaining unknowns. Update
+   the shared index or investigation report so later passes can reuse results.
+
+Before finishing, revisit the original checklist. Mark each question as
+answered, partially answered, or unresolved based on its evidence; keep
+bounded negative searches bounded, and do not describe a broad investigation
+as complete while required questions remain open.
+
 ## Read only the relevant guide
 
 - Native binaries, managed assemblies, archives, and extraction:
@@ -68,9 +101,11 @@ policy requires it; approval never broadens a different authority boundary.
 
 ## Readiness and setup
 
-If REA tools are available, use them directly; do not run `doctor` on every
-task. If the MCP server is unavailable or registration is reported stale, run
-`npx -y rea-agents@latest doctor`. Propose
+The readiness rule is conditional: when REA tools are available and their
+registration is not known to be stale, proceed directly; do not run `doctor`
+before every task. Run `npx -y rea-agents@latest doctor` when the MCP server or
+required provider is unavailable, registration is reported stale, or the user
+asks for an environment diagnosis. Propose
 `npx -y rea-agents@latest setup` only when doctor identifies an alignment or
 provider problem. Show the exact plan and obtain approval before setup writes
 configuration or installs Hopper. Restart the agent after MCP registration

package/skills/reverse-engineer-anything/references/evidence-workflows.md

@@ -1,9 +1,11 @@
 # Evidence, comparison, and verification workflows
 
-REA results are Evidence v2. Cite evidence IDs and preserve authority,
-limitations, coverage, and residual unknowns. Read the smallest deterministic
-page that answers the question. Continue from a returned next offset while
-`has_more` is true only when exhaustive coverage matters.
+REA returns Evidence with each result. Read that result directly, cite its
+Evidence ID when another tool or your explanation needs a stable reference, and
+preserve authority, limitations, coverage, and residual unknowns. If a result
+is incomplete or paginated, continue only when the remaining data matters to
+the task; do not fetch a bundle or resource merely to read a result already
+returned inline.
 
 Use `record_unknown` only with explicit approval and name the authority or
 environment still required. Supply supporting and contradicting evidence IDs.

package/skills/reverse-engineer-anything/references/javascript-applications.md

@@ -1,10 +1,10 @@
 # JavaScript and Electron application artifacts
 
-Use `analyze_javascript_application` for an operator-supplied ASAR or extracted
-tree beneath an approved investigation root. Every call requires `approved:
-true`; source-map contents require separate approval. Keep the default summary.
-Use its counts, roots, node kinds, top findings, coverage, unknowns, and graph
-page URIs before requesting more data.
+Use `analyze_javascript_application` directly on the operator-supplied ASAR or
+extracted tree. The complete result, graph, and Evidence context are returned
+inline. Source-map contents are part of the static analysis. Start from its
+findings, coverage, unknowns, and graph context, then make a focused follow-up
+only when a specific question remains unanswered.
 
 BrowserWindow preferences, preload and contextBridge surfaces, IPC
 registrations, utility processes, and native binding requests are static syntax
@@ -15,8 +15,8 @@ registration, defaults, or policy enforcement from static analysis.
 
 Use `trace_application_feature` on existing application Evidence for one
 literal node ID, route, string, API, IPC channel, module, or native export.
-Choose a direction and finite bounds. Link Hopper or Ghidra Evidence only when
-the exact artifact digest matches.
+Choose a direction and include the complete application Evidence inline. Include
+Hopper or Ghidra Evidence only when its artifact digest matches exactly.
 
 For version comparison, analyze each version once, then call
 `compare_application_versions`. Accept only its digest, source-map, structural
@@ -27,9 +27,9 @@ opposite-side coverage; otherwise report unknown.
 When the question asks how one exact exported callable's returned object shape
 changed, analyze each version once and then call
 `compare_javascript_export_shapes` with explicit module paths and export names.
-Use the Evidence IDs returned by the two analysis calls. Accept variant pairing
-only through the tool's unique exact literal discriminant. Cite the comparison
-Evidence and report JSON Pointer changes; dynamic values, ambiguous variants,
-and incomplete parent-property coverage stay unknown. This is static inference,
-not runtime behavior. Use `run_controlled_replay` separately only when the user
-needs approved runtime semantics.
+Include the complete Evidence records from both analysis calls. Accept variant
+pairing only through the tool's unique exact literal discriminant. Cite the
+comparison Evidence and report JSON Pointer changes; dynamic values, ambiguous
+variants, and incomplete parent-property coverage stay unknown. This is static
+inference, not runtime behavior. Use `run_controlled_replay` separately only
+when the user needs approved runtime semantics.

package/skills/reverse-engineer-anything/references/native-and-artifacts.md

@@ -2,8 +2,9 @@
 
 ## Native targets
 
-After `open_binary`, use `binary_overview` once and narrow around the requested
-feature. Prefer literal search, names, decompilation, callers, callees, and
+After `open_binary`, use focused search, procedure, or function tools directly.
+Use `binary_overview` when target metadata or inventory context helps answer the
+question. Prefer literal search, names, decompilation, callers, callees, and
 cross-references. Addresses and recovered pseudocode are analysis observations,
 not original source. Provider unavailability and unsupported metadata remain
 unknown rather than false.
@@ -23,13 +24,16 @@ parser and must not become an implicit setup dependency.
 
 ## Packages and extraction
 
-Call `inventory_artifact` before extraction for application bundles, archives,
-ZIP/APK/IPA/MSIX/AppX, ASAR, or DMG inputs. Continue deterministic occurrence
-pages from the returned offset only when needed. Cite graph manifest IDs.
+Use `inspect_artifact` for application bundles, archives, ZIP/APK/IPA/MSIX/AppX,
+ASAR, or DMG inputs when the artifact graph and findings help answer the
+question. It returns the complete artifact graph inline. Cite graph manifest
+IDs when using them.
 
-`extract_artifact` requires explicit approval, an absent absolute output root,
-and selected occurrence IDs. Never extract every entry implicitly. Symlinks and
-encrypted entries are inventory facts, not extractable files.
+Use `extract_artifact` when materialized files are needed. It takes no arguments
+and materializes all regular files into a fresh temporary directory chosen by
+REA. Symlinks and encrypted entries are inventory facts, not extractable files.
+The operation still requires the filesystem-write permission grant; callers do
+not choose the destination.
 
 Native DMG traversal is macOS-only, read-only, and requires both operator policy
 and `native_mount_approved: true`; without both, retain the root-hash-only result.

package/dist/application/ApplicationWorkflowEvidenceResolver.js

@@ -1,180 +0,0 @@
-import { z } from "zod";
-import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, compareSourceToBundleRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "../contracts/applicationWorkflowInputContracts.js";
-import { AnalysisInputError } from "../domain/errors.js";
-import { projectInputIssues } from "../domain/inputIssueProjection.js";
-import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
-import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
-import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
-import { traceJavaScriptSemanticsInputSchema } from "../domain/javascriptSemanticTraceSchemas.js";
-import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
-import { err, ok } from "../domain/result.js";
-import { resolveEvidenceReferences, } from "./EvidenceReferenceResolver.js";
-const APPLICATION_GRAPH_IDENTITIES = [
-    {
-        operation: "analyze_javascript_application",
-        predicate: "rea.javascript-application-analysis/v1",
-    },
-    {
-        operation: "analyze_javascript_application",
-        predicate: "rea.javascript-application-analysis/v2",
-    },
-    {
-        operation: "reconcile_javascript_runtime",
-        predicate: "rea.javascript-runtime-reconciliation/v1",
-    },
-    {
-        operation: "project_managed_application_graph",
-        predicate: "rea.managed-application-graph/v1",
-    },
-];
-/** Parse and resolve one trace adapter request into its canonical domain input. */
-export const resolveTraceApplicationFeatureRequest = (input, lookup) => {
-    const parsed = traceApplicationFeatureRequestSchema.safeParse(input);
-    return parsed.success
-        ? resolveTraceApplicationFeatureRequestValidated(parsed.data, lookup)
-        : invalid("trace_application_feature", parsed.error, input);
-};
-/** Resolve a trace request already parsed by the caller-facing contract. */
-export const resolveTraceApplicationFeatureRequestValidated = (input, lookup) => {
-    const application = graphEvidence(input.application, input.application_evidence_id, lookup);
-    if (!application.ok)
-        return application;
-    const native = resolveEvidenceReferences(lookup, input.native_observation_evidence_ids);
-    if (!native.ok)
-        return native;
-    const raw = {
-        application: application.value,
-        native_observations: [...input.native_observations, ...native.value],
-        seed: input.seed,
-        direction: input.direction,
-        limits: input.limits,
-    };
-    const parsed = traceApplicationFeatureInputSchema.safeParse(raw);
-    return parsed.success
-        ? ok(parsed.data)
-        : invalid("trace_application_feature", parsed.error, raw);
-};
-/** Parse and resolve one semantic trace adapter request. */
-export const resolveTraceJavaScriptSemanticsRequest = (input, lookup) => {
-    const parsed = traceJavaScriptSemanticsRequestSchema.safeParse(input);
-    return parsed.success
-        ? resolveTraceJavaScriptSemanticsRequestValidated(parsed.data, lookup)
-        : invalid("trace_javascript_semantics", parsed.error, input);
-};
-/** Resolve a semantic trace request already parsed by its public contract. */
-export const resolveTraceJavaScriptSemanticsRequestValidated = (input, lookup) => {
-    const application = graphEvidence(input.application, input.application_evidence_id, lookup);
-    if (!application.ok)
-        return application;
-    const raw = { application: application.value, query: input.query };
-    const parsed = traceJavaScriptSemanticsInputSchema.safeParse(raw);
-    return parsed.success
-        ? ok(parsed.data)
-        : invalid("trace_javascript_semantics", parsed.error, raw);
-};
-/** Parse and resolve one comparison adapter request into canonical input. */
-export const resolveCompareApplicationVersionsRequest = (input, lookup) => {
-    const parsed = compareApplicationVersionsRequestSchema.safeParse(input);
-    return parsed.success
-        ? resolveCompareApplicationVersionsRequestValidated(parsed.data, lookup)
-        : invalid("compare_application_versions", parsed.error, input);
-};
-/** Resolve a comparison request parsed by the caller-facing contract. */
-export const resolveCompareApplicationVersionsRequestValidated = (input, lookup) => {
-    const left = graphEvidence(input.left, input.left_evidence_id, lookup);
-    if (!left.ok)
-        return left;
-    const right = graphEvidence(input.right, input.right_evidence_id, lookup);
-    if (!right.ok)
-        return right;
-    const leftNative = resolveEvidenceReferences(lookup, input.left_native_observation_evidence_ids);
-    if (!leftNative.ok)
-        return leftNative;
-    const rightNative = resolveEvidenceReferences(lookup, input.right_native_observation_evidence_ids);
-    if (!rightNative.ok)
-        return rightNative;
-    const raw = {
-        left: left.value,
-        right: right.value,
-        left_native_observations: [
-            ...input.left_native_observations,
-            ...leftNative.value,
-        ],
-        right_native_observations: [
-            ...input.right_native_observations,
-            ...rightNative.value,
-        ],
-        limits: input.limits,
-        ...(input.unknown_registry_approved === undefined
-            ? {}
-            : { unknown_registry_approved: input.unknown_registry_approved }),
-    };
-    const parsed = compareApplicationVersionsInputSchema.safeParse(raw);
-    return parsed.success
-        ? ok(parsed.data)
-        : invalid("compare_application_versions", parsed.error, raw);
-};
-/** Parse and resolve one historical-source comparison adapter request. */
-export const resolveCompareSourceToBundleRequest = (input, lookup) => {
-    const parsed = compareSourceToBundleRequestSchema.safeParse(input);
-    return parsed.success
-        ? resolveCompareSourceToBundleRequestValidated(parsed.data, lookup)
-        : invalid("compare_source_to_bundle", parsed.error, input);
-};
-/** Resolve a historical-source comparison request parsed by its public contract. */
-export const resolveCompareSourceToBundleRequestValidated = (input, lookup) => {
-    const application = graphEvidence(input.application, input.application_evidence_id, lookup);
-    if (!application.ok)
-        return application;
-    const raw = {
-        reference: input.reference,
-        application: application.value,
-        limits: input.limits,
-        ...(input.unknown_registry_approved === undefined
-            ? {}
-            : { unknown_registry_approved: input.unknown_registry_approved }),
-    };
-    const parsed = compareSourceToBundleInputSchema.safeParse(raw);
-    return parsed.success
-        ? ok(parsed.data)
-        : invalid("compare_source_to_bundle", parsed.error, raw);
-};
-/** Parse and resolve an export-shape adapter request into canonical input. */
-export const resolveCompareJavaScriptExportShapesRequest = (input, lookup) => {
-    const parsed = compareJavaScriptExportShapesRequestSchema.safeParse(input);
-    return parsed.success
-        ? resolveCompareJavaScriptExportShapesRequestValidated(parsed.data, lookup)
-        : invalid("compare_javascript_export_shapes", parsed.error, input);
-};
-/** Resolve an export-shape request already parsed by the adapter contract. */
-export const resolveCompareJavaScriptExportShapesRequestValidated = (input, lookup) => {
-    const left = graphEvidence(input.left, input.left_evidence_id, lookup);
-    if (!left.ok)
-        return left;
-    const right = graphEvidence(input.right, input.right_evidence_id, lookup);
-    if (!right.ok)
-        return right;
-    const raw = {
-        left: left.value,
-        right: right.value,
-        left_module_path: input.left_module_path,
-        left_export_name: input.left_export_name,
-        right_module_path: input.right_module_path,
-        right_export_name: input.right_export_name,
-        limits: input.limits,
-        ...(input.unknown_registry_approved === undefined
-            ? {}
-            : { unknown_registry_approved: input.unknown_registry_approved }),
-    };
-    const parsed = compareJavaScriptExportShapesInputSchema.safeParse(raw);
-    return parsed.success
-        ? ok(parsed.data)
-        : invalid("compare_javascript_export_shapes", parsed.error, raw);
-};
-const graphEvidence = (evidence, evidenceId, lookup) => {
-    if (evidence !== undefined)
-        return ok(evidence);
-    const resolved = resolveEvidenceReferences(lookup, evidenceId === undefined ? [] : [evidenceId], APPLICATION_GRAPH_IDENTITIES);
-    return resolved.ok ? ok(resolved.value[0]) : resolved;
-};
-const invalid = (operation, cause, input) => err(new AnalysisInputError(operation, undefined, projectInputIssues(cause.issues, input)));

package/dist/application/BoundedJsonFiles.js

@@ -1,86 +0,0 @@
-import { lstat, readFile, realpath } from "node:fs/promises";
-import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
-import writeFileAtomic from "write-file-atomic";
-import { EvidenceFileError } from "../domain/errors.js";
-import { isJsonWithinLimits } from "../domain/jsonLimits.js";
-import { err, ok } from "../domain/result.js";
-import { canonicalizeConfiguredRoots } from "./ConfiguredRoots.js";
-/** Read bounded JSON data from a regular file beneath an approved root. */
-export const readBoundedJson = async (path, policy) => {
-    if (policy.roots.length === 0)
-        return err(new EvidenceFileError("read", "disabled"));
-    try {
-        const canonicalPath = await realpath(resolve(path));
-        if (!(await isApproved(canonicalPath, policy.roots)))
-            return err(new EvidenceFileError("read", "outside-root"));
-        const stats = await lstat(canonicalPath);
-        if (!stats.isFile())
-            return err(new EvidenceFileError("read", "not-file"));
-        if (stats.size > policy.maxBytes)
-            return err(new EvidenceFileError("read", "too-large"));
-        const encoded = await readFile(canonicalPath);
-        if (encoded.byteLength > policy.maxBytes)
-            return err(new EvidenceFileError("read", "too-large"));
-        let decoded;
-        try {
-            decoded = JSON.parse(encoded.toString("utf8"));
-        }
-        catch (cause) {
-            return err(new EvidenceFileError("read", "invalid-json", { cause }));
-        }
-        return isJsonWithinLimits(decoded, policy)
-            ? ok(decoded)
-            : err(new EvidenceFileError("read", "too-large"));
-    }
-    catch (cause) {
-        return err(new EvidenceFileError("read", "io", { cause }));
-    }
-};
-/** Atomically write bounded text to a regular file beneath an approved root. */
-export const writeBoundedText = async (encoded, path, overwrite, policy) => {
-    if (policy.roots.length === 0)
-        return err(new EvidenceFileError("write", "disabled"));
-    const bytes = Buffer.byteLength(encoded, "utf8");
-    if (bytes > policy.maxBytes)
-        return err(new EvidenceFileError("write", "too-large"));
-    try {
-        const requestedPath = resolve(path);
-        const canonicalParent = await realpath(dirname(requestedPath));
-        const destination = resolve(canonicalParent, basename(requestedPath));
-        if (!(await isApproved(destination, policy.roots)))
-            return err(new EvidenceFileError("write", "outside-root"));
-        const existing = await lstat(destination).catch((cause) => {
-            if (isFileNotFound(cause))
-                return undefined;
-            throw cause;
-        });
-        if (existing !== undefined) {
-            if (!overwrite)
-                return err(new EvidenceFileError("write", "exists"));
-            if (!existing.isFile() || existing.isSymbolicLink())
-                return err(new EvidenceFileError("write", "not-file"));
-        }
-        await writeFileAtomic(destination, encoded, {
-            encoding: "utf8",
-            mode: 0o600,
-            fsync: true,
-        });
-        return ok({ path: requestedPath, bytes });
-    }
-    catch (cause) {
-        return err(new EvidenceFileError("write", "io", { cause }));
-    }
-};
-const isApproved = async (candidate, roots) => {
-    for (const root of await canonicalizeConfiguredRoots(roots.map((configuredRoot) => resolve(configuredRoot)))) {
-        const relation = relative(root, candidate);
-        if (relation === "" ||
-            (!relation.startsWith("..") && !isAbsolute(relation)))
-            return true;
-    }
-    return false;
-};
-const isFileNotFound = (cause) => typeof cause === "object" &&
-    cause !== null &&
-    "code" in cause &&
-    cause.code === "ENOENT";

package/dist/application/CrossVersionInventory.js

@@ -1,128 +0,0 @@
-import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
-import { createEvidence } from "../domain/evidence.js";
-import { AnalysisCancelledError, ArtifactOperationError, } from "../domain/errors.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
-import { err, ok } from "../domain/result.js";
-import { paginateArtifactInventory, } from "./ArtifactInventory.js";
-import { scanAuthorizedArtifactInventory } from "./AuthorizedArtifactInventory.js";
-import { ARTIFACT_GRAPH_PROVIDER } from "./InvestigationProviders.js";
-export const AUTOMATIC_RUN_LIMITATION = "Automatic cross-version runs compare shipped artifact structure only; they do not execute either version.";
-/** Start both independent version scans while preserving left/right identity. */
-export const scanVersionInventories = async (options, scanner = scanAuthorizedArtifactInventory) => {
-    const [left, right] = await Promise.all([
-        scanner(options.leftPath, options.inputRoots, options.limits, {
-            signal: options.signal,
-            integrity: options.integrity,
-        }),
-        scanner(options.rightPath, options.inputRoots, options.limits, {
-            signal: options.signal,
-            integrity: options.integrity,
-        }),
-    ]);
-    return { left, right };
-};
-/** Authorize and scan both inputs once under the same bounded traversal policy. */
-export const scanVersions = async (input, inputRoots, signal, integrityContinueEnabled = false) => {
-    try {
-        if (signal?.aborted === true)
-            return err(new AnalysisCancelledError("find_changed_behavior"));
-        const limits = artifactLimits(input.options);
-        const integrity = {
-            mode: input.integrity_policy,
-            approved: input.integrity_continue_approved,
-            enabled: integrityContinueEnabled,
-            maxMismatches: input.max_integrity_mismatches,
-        };
-        return ok(await scanVersionInventories({
-            leftPath: input.left_path,
-            rightPath: input.right_path,
-            inputRoots,
-            limits,
-            ...(signal === undefined ? {} : { signal }),
-            integrity,
-        }));
-    }
-    catch (cause) {
-        if (cause instanceof ArtifactReaderFailure)
-            return err(new ArtifactOperationError("inventory_artifact", cause.reason, cause.details));
-        return err(new ArtifactOperationError("inventory_artifact", "io"));
-    }
-};
-/** Project complete snapshots into bounded, comparable Evidence page sets. */
-export const createInventoryEvidencePages = (input, snapshots) => {
-    const left = inventoryPages(input.left_path, snapshots.left, input);
-    const right = inventoryPages(input.right_path, snapshots.right, input);
-    if (left.length > 100 || right.length > 100)
-        return err(new ArtifactOperationError("inventory_artifact", "limit"));
-    return ok({ left, right });
-};
-/** Reduce a snapshot to the content commitments used by run identity. */
-export const targetFor = (snapshot) => ({
-    root_sha256: snapshot.manifest.root_sha256,
-    graph_sha256: snapshot.manifest.graph_sha256,
-    manifest_id: snapshot.manifest.manifest_id,
-    format: snapshot.manifest.root_format,
-});
-/** Preserve scan and execution limitations in stable order. */
-export const runLimitations = (snapshots) => [
-    ...new Set([
-        ...snapshots.left.limitations.map((item) => `Left: ${item}`),
-        ...snapshots.right.limitations.map((item) => `Right: ${item}`),
-        AUTOMATIC_RUN_LIMITATION,
-    ]),
-].sort((left, right) => left.localeCompare(right));
-const inventoryPages = (path, snapshot, input) => {
-    const options = input.options;
-    const count = Math.max(1, Math.ceil(snapshot.nodes.length / options.page_size), Math.ceil(snapshot.occurrences.length / options.page_size), Math.ceil(snapshot.edges.length / options.page_size));
-    return Array.from({ length: count }, (_, index) => inventoryPage(path, snapshot, input, index * options.page_size));
-};
-const inventoryPage = (path, snapshot, input, offset) => {
-    const options = input.options;
-    const result = paginateArtifactInventory(snapshot, {
-        nodeOffset: offset,
-        nodeLimit: options.page_size,
-        occurrenceOffset: offset,
-        occurrenceLimit: options.page_size,
-        edgeOffset: offset,
-        edgeLimit: options.page_size,
-    });
-    return createEvidence({
-        path,
-        sha256: snapshot.manifest.root_sha256,
-        format: snapshot.manifest.root_format,
-    }, ARTIFACT_GRAPH_PROVIDER, {
-        operation: "inventory_artifact",
-        parameters: {
-            node_offset: offset,
-            node_limit: options.page_size,
-            occurrence_offset: offset,
-            occurrence_limit: options.page_size,
-            edge_offset: offset,
-            edge_limit: options.page_size,
-            max_entries: options.max_entries,
-            max_total_bytes: options.max_total_bytes,
-            max_entry_bytes: options.max_entry_bytes,
-            max_compression_ratio: options.max_compression_ratio,
-            max_depth: options.max_depth,
-            max_path_bytes: options.max_path_bytes,
-            integrity_policy: input.integrity_policy,
-            integrity_continue_approved: input.integrity_continue_approved,
-            max_integrity_mismatches: input.max_integrity_mismatches,
-        },
-        result: jsonValueSchema.parse(result),
-        rawResult: null,
-        limitations: result.limitations,
-        locations: result.occurrences.items.map(({ logical_path: logicalPath }) => ({
-            kind: "artifact-path",
-            path: logicalPath,
-        })),
-    });
-};
-const artifactLimits = (options) => ({
-    maxEntries: options.max_entries,
-    maxTotalBytes: options.max_total_bytes,
-    maxEntryBytes: options.max_entry_bytes,
-    maxCompressionRatio: options.max_compression_ratio,
-    maxDepth: options.max_depth,
-    maxPathBytes: options.max_path_bytes,
-});