rea-agents 3.0.0 → 3.2.0

package/dist/application/AbortablePromise.js

@@ -8,15 +8,18 @@ export const ABORTED = Symbol("aborted");
 export const waitForAbortable = async (pending, signal) => {
     if (signal === undefined)
         return pending;
-    if (signal.aborted)
-        return ABORTED;
     let onAbort;
     const cancelled = new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve(ABORTED);
+            return;
+        }
         onAbort = () => resolve(ABORTED);
         signal.addEventListener("abort", onAbort, { once: true });
     });
     try {
-        return await Promise.race([pending, cancelled]);
+        // Even an already-cancelled wait must own the producer's eventual rejection.
+        return await Promise.race([cancelled, pending]);
     }
     finally {
         if (onAbort !== undefined)

package/dist/application/AnalysisContextQueries.js

@@ -69,10 +69,7 @@ export const inspectAddressContext = async (analysis, input, signal) => {
         comment,
         inline_comment: inlineComment,
         bookmarks: bookmarks.state === "available"
-            ? {
-                state: "available",
-                value: matchingBookmarks(bookmarks.value, resolvedAddress(results[1], input.address)),
-            }
+            ? matchingBookmarks(bookmarks.value, resolvedAddress(results[1], input.address))
             : bookmarks,
     });
 };
@@ -122,9 +119,24 @@ const resolvedAddress = (result, fallback) => {
 };
 const matchingBookmarks = (value, address) => {
     if (!Array.isArray(value))
-        return [];
-    return value.filter((bookmark) => typeof bookmark === "object" &&
-        bookmark !== null &&
-        !Array.isArray(bookmark) &&
-        bookmark.address === address);
+        return {
+            state: "unavailable",
+            reason: "list_bookmarks returned malformed output; expected an array.",
+            remediation: "Retry list_bookmarks directly and report the provider output shape if it remains malformed.",
+        };
+    if (!value.every(isBookmark))
+        return {
+            state: "unavailable",
+            reason: "list_bookmarks returned malformed entries; expected address and name strings.",
+            remediation: "Retry list_bookmarks directly and report the provider output shape if it remains malformed.",
+        };
+    return {
+        state: "available",
+        value: value.filter((bookmark) => bookmark.address === address),
+    };
 };
+const isBookmark = (value) => typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    typeof value.address === "string" &&
+    typeof value.name === "string";

package/dist/application/AnalysisSnapshotCache.js

@@ -76,7 +76,6 @@ export class AnalysisSnapshotCache {
         if (target === undefined || profile === undefined)
             return err(new NoBinaryOpenError());
         return ok({
-            snapshot_version: 2,
             target: snapshotTarget(target),
             binding: snapshotBinding(profile),
             entries: this.entries(),

package/dist/application/AnalysisSnapshotFiles.js

@@ -1,10 +1,10 @@
 import { parseAnalysisSnapshot, serializeAnalysisSnapshot, } from "../domain/analysisSnapshot.js";
 import { EvidenceFileError, EvidenceIntegrityError } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-import { readBoundedJson, writeBoundedText } from "./BoundedJsonFiles.js";
-/** Read and validate a bounded analysis snapshot inside an approved root. */
-export const readAnalysisSnapshot = async (path, policy) => {
-    const loaded = await readBoundedJson(path, policy);
+import { readJsonFile, writeTextFile } from "./JsonFiles.js";
+/** Read and validate an analysis snapshot from the caller's path. */
+export const readAnalysisSnapshot = async (path) => {
+    const loaded = await readJsonFile(path);
     if (!loaded.ok)
         return loaded;
     try {
@@ -14,8 +14,8 @@ export const readAnalysisSnapshot = async (path, policy) => {
         return err(new EvidenceIntegrityError(snapshotValidationMessage(cause), { cause }));
     }
 };
-/** Atomically write a deterministic analysis snapshot inside an approved root. */
-export const writeAnalysisSnapshot = async (snapshot, path, overwrite, policy) => {
+/** Atomically write a deterministic analysis snapshot to the caller's path. */
+export const writeAnalysisSnapshot = async (snapshot, path, overwrite) => {
     let encoded;
     try {
         encoded = serializeAnalysisSnapshot(snapshot);
@@ -23,7 +23,7 @@ export const writeAnalysisSnapshot = async (snapshot, path, overwrite, policy) =
     catch (cause) {
         return err(new EvidenceIntegrityError(snapshotValidationMessage(cause), { cause }));
     }
-    return writeBoundedText(encoded, path, overwrite, policy);
+    return writeTextFile(encoded, path, overwrite);
 };
 const snapshotValidationMessage = (cause) => cause instanceof TypeError
     ? cause.message

package/dist/application/AndroidApplicationService.js

@@ -9,7 +9,7 @@ export const projectAndroidApplicationEvidence = (rawInput) => {
         schema: androidApplicationProjectionInputSchema,
         project: projectAndroidApplication,
         operation: OPERATION,
-        predicateType: "rea.android-application-graph/v1",
+        predicateType: "rea.android-application-graph",
         provider: ANDROID_APPLICATION_PROVIDER,
         subjectFormat: () => "apk",
         protocolError: "Android application projection produced an invalid result",

package/dist/application/AppleApplicationService.js

@@ -9,7 +9,7 @@ export const projectAppleApplicationEvidence = (rawInput) => {
         schema: appleApplicationProjectionInputSchema,
         project: projectAppleApplication,
         operation: OPERATION,
-        predicateType: "rea.apple-application-graph/v1",
+        predicateType: "rea.apple-application-graph",
         provider: APPLE_APPLICATION_PROVIDER,
         subjectFormat: () => "ipa",
         protocolError: "Apple application projection produced an invalid result",

package/dist/application/ArtifactExtraction.js

@@ -8,26 +8,35 @@ import { ZipArtifactReader } from "../artifacts/ZipArtifactReader.js";
 import { MachOSliceArtifactReader } from "../artifacts/MachOSliceArtifactReader.js";
 import { artifactExtractionResultSchema, } from "../domain/artifactGraph.js";
 import { scanArtifactInventory } from "./ArtifactInventory.js";
-import { digestCanonical, pageOf, toOutputLimits, } from "./ArtifactGraphConstruction.js";
-const PAGE_SIZE = 500;
-/** Extract selected inventory occurrences into an exclusively owned absent root. */
+import { digestCanonical } from "./ArtifactGraphConstruction.js";
+/** Extract every regular inventory occurrence into an exclusively owned absent root. */
 export const extractArtifact = async (input, signal) => {
-    validateSelection(input.occurrenceIds);
     const sourcePath = await realpath(input.inputPath);
-    const selectedIds = new Set(input.occurrenceIds);
-    const inventory = await loadInventory(sourcePath, input.limits, selectedIds, signal);
-    const selected = input.occurrenceIds.map((id) => {
-        const occurrence = inventory.occurrences.get(id);
-        if (occurrence === undefined)
-            throw new ArtifactReaderFailure("unavailable", `Selected artifact occurrence was not found: ${id}`);
+    const snapshot = await scanArtifactInventory(sourcePath, {
+        signal,
+    });
+    const selectedOccurrences = snapshot.occurrences.filter((occurrence) => (occurrence.entry_kind === "file" || occurrence.entry_kind === "slice") &&
+        occurrence.logical_path !== ".");
+    const selectedIds = new Set(selectedOccurrences.map(({ occurrence_id: id }) => id));
+    const occurrences = new Map();
+    const neededNodes = new Set();
+    collectOccurrences(snapshot.occurrences, selectedIds, occurrences, neededNodes);
+    const nodes = new Map();
+    collectNodes(snapshot.nodes, neededNodes, nodes);
+    const inventory = {
+        manifest: snapshot.manifest,
+        occurrences,
+        nodes,
+    };
+    const selected = selectedOccurrences.map((occurrence) => {
         if ((occurrence.entry_kind !== "file" && occurrence.entry_kind !== "slice") ||
             occurrence.artifact_id === null ||
             occurrence.encrypted ||
             occurrence.logical_path === ".")
-            throw new ArtifactReaderFailure("format", `Selected occurrence is not an extractable regular child file: ${id}`);
+            throw new ArtifactReaderFailure("format", `Selected occurrence is not an extractable regular child file: ${occurrence.occurrence_id}`);
         const node = inventory.nodes.get(occurrence.artifact_id);
         if (node === undefined)
-            throw new ArtifactReaderFailure("integrity", `Selected occurrence has no inventory node: ${id}`);
+            throw new ArtifactReaderFailure("integrity", `Selected occurrence has no inventory node: ${occurrence.occurrence_id}`);
         return { occurrence, node };
     });
     return materializeSelection({
@@ -41,23 +50,22 @@ export const extractArtifact = async (input, signal) => {
 const materializeSelection = async ({ input, sourcePath, inventory, selected, signal, }) => {
     const byPath = new Map(selected.map((item) => [item.occurrence.logical_path, item]));
     const reader = await createReader(sourcePath, input.inputFormat);
-    const output = await SafeOutputTree.create(input.outputRoot, input.limits);
+    const output = await SafeOutputTree.create(input.outputRoot);
     let readerClosed = false;
     const extracted = [];
     try {
-        const found = new Set();
+        const materialized = [];
         const registry = new ArtifactPathRegistry();
-        let entryCount = 0;
         for await (const entry of reader.entries(signal)) {
-            entryCount += 1;
-            if (entryCount > input.limits.maxEntries)
-                throw new ArtifactReaderFailure("limit", "Artifact entry limit exceeded during extraction");
-            const path = normalizeArtifactPath(entry.path, input.limits);
+            const path = normalizeArtifactPath(entry.path);
             registry.add(path, entry.kind);
             const selectedItem = byPath.get(path);
-            if (selectedItem === undefined)
+            if (selectedItem === undefined) {
+                if (entry.kind === "file" || entry.kind === "slice")
+                    throw new ArtifactReaderFailure("integrity", `Regular artifact entry is missing from inventory: ${path}`);
                 continue;
-            preflight(entry, input.limits);
+            }
+            preflight(entry);
             const stream = await reader.open(entry, signal);
             const written = await output.write(path, stream, selectedItem.node.sha256, signal);
             extracted.push({
@@ -67,14 +75,12 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
                 bytes_written: written.bytesWritten,
                 created: true,
             });
-            found.add(path);
+            materialized.push(selectedItem);
         }
-        if (found.size !== selected.length)
-            throw new ArtifactReaderFailure("integrity", "Selected inventory occurrence disappeared before extraction");
         await reader.close();
         readerClosed = true;
         extracted.sort((left, right) => left.relative_path.localeCompare(right.relative_path, "en"));
-        const result = createExtractionResult(input, inventory, selected, extracted);
+        const result = createExtractionResult(input, inventory, materialized, extracted);
         await output.commit();
         return result;
     }
@@ -87,7 +93,6 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
 };
 const createExtractionResult = (input, inventory, selected, extracted) => {
     const extractionSemantic = {
-        schema_version: 1,
         source_manifest_id: inventory.manifest.manifest_id,
         selected_occurrence_ids: selected
             .map(({ occurrence }) => occurrence.occurrence_id)
@@ -101,26 +106,16 @@ const createExtractionResult = (input, inventory, selected, extracted) => {
             ...extractionSemantic,
             extraction_id: `aex_${digestCanonical(extractionSemantic)}`,
         },
-        output_root: "$OUTPUT_ROOT",
-        artifacts: pageOf(extracted, input.offset, input.limit),
+        output_root: input.outputRoot,
+        artifacts: extracted,
         containment_verified: true,
         cleanup: { attempted: false, verified: true, residual_paths: [] },
-        limits: toOutputLimits(input.limits),
         provenance: [],
         limitations: [
-            "Only caller-selected regular file occurrences were materialized.",
+            "All regular files in the active artifact were materialized; nested archive contents remain represented by their containing file.",
         ],
     });
 };
-const loadInventory = async (path, limits, selectedIds, signal) => {
-    const snapshot = await scanArtifactInventory(path, limits, { signal });
-    const occurrences = new Map();
-    const neededNodes = new Set();
-    collectOccurrences(snapshot.occurrences, selectedIds, occurrences, neededNodes);
-    const nodes = new Map();
-    collectNodes(snapshot.nodes, neededNodes, nodes);
-    return { manifest: snapshot.manifest, occurrences, nodes };
-};
 const collectOccurrences = (items, selected, output, neededNodes) => {
     for (const item of items) {
         if (!selected.has(item.occurrence_id))
@@ -150,21 +145,7 @@ const createReader = async (path, format) => {
         return new MachOSliceArtifactReader(path);
     throw new ArtifactReaderFailure("unavailable", `Artifact format has no extraction reader: ${format}`);
 };
-const validateSelection = (ids) => {
-    if (ids.length === 0 || ids.length > PAGE_SIZE)
-        throw new ArtifactReaderFailure("limit", "Extraction requires 1 to 500 explicitly selected occurrences");
-    if (new Set(ids).size !== ids.length)
-        throw new ArtifactReaderFailure("path", "Extraction occurrence selection contains duplicates");
-};
-const preflight = (entry, limits) => {
+const preflight = (entry) => {
     if ((entry.kind !== "file" && entry.kind !== "slice") || entry.encrypted)
         throw new ArtifactReaderFailure("format", `Selected artifact entry cannot be read: ${entry.path}`);
-    if (entry.declaredSize !== null && entry.declaredSize > limits.maxEntryBytes)
-        throw new ArtifactReaderFailure("limit", `Selected artifact exceeds byte limit: ${entry.path}`);
-    if (entry.declaredSize !== null &&
-        entry.compressedSize !== null &&
-        (entry.compressedSize === 0
-            ? entry.declaredSize > 0
-            : entry.declaredSize / entry.compressedSize > limits.maxCompressionRatio))
-        throw new ArtifactReaderFailure("limit", `Selected artifact exceeds compression ratio limit: ${entry.path}`);
 };

package/dist/application/ArtifactExtractionDestination.js

@@ -0,0 +1,17 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** Choose a fresh temporary destination for an artifact extraction. */
+export const createArtifactExtractionDestination = () => join(tmpdir(), `rea-extracted-${randomUUID()}`);
+/** Stable parent scope used to authorize REA-owned extraction destinations. */
+export const artifactExtractionPermissionRoot = () => tmpdir();
+/** Stable filesystem scope for the destination selected internally by REA. */
+export const artifactExtractionPermissionRequest = () => ({
+    capability: "artifact_extract",
+    roots: [artifactExtractionPermissionRoot()],
+    executables: [],
+    environment_names: [],
+    network: "none",
+    mount: false,
+    operation_identity: "extract_artifact:temporary_output",
+});

package/dist/application/ArtifactGraphConstruction.js

@@ -19,7 +19,7 @@ export const createOccurrence = (entry, path, parent) => ({
     compressed_size: entry.compressedSize,
     executable: entry.executable,
     encrypted: entry.encrypted,
-    hash_status: entry.encrypted ? "unavailable" : "not-hashed-limit",
+    hash_status: entry.encrypted ? "unavailable" : "not-hashed",
     source_location: entry.byteOffset === null || entry.declaredSize === null
         ? null
         : { offset: entry.byteOffset, length: entry.declaredSize },
@@ -82,7 +82,7 @@ export const createRootNode = (input) => createArtifactNode({
     contentState: "materialized",
 });
 export const createArtifactNode = (input) => ({
-    artifact_id: `art_${digestCanonical({ schema_version: 1, sha256: input.sha256 })}`,
+    artifact_id: `art_${digestCanonical({ sha256: input.sha256 })}`,
     kind: input.kind,
     format: input.format,
     sha256: input.sha256,
@@ -222,21 +222,6 @@ export const classifyArtifactContent = (path, prefix) => {
         };
     return byPath;
 };
-export const pageOf = (items, offset, limit) => ({
-    items: items.slice(offset, offset + limit),
-    offset,
-    limit,
-    total: items.length,
-    next_offset: offset + limit < items.length ? offset + limit : null,
-});
-export const toOutputLimits = (limits) => ({
-    max_entries: limits.maxEntries,
-    max_total_bytes: limits.maxTotalBytes,
-    max_entry_bytes: limits.maxEntryBytes,
-    max_compression_ratio: limits.maxCompressionRatio,
-    max_depth: limits.maxDepth,
-    max_path_bytes: limits.maxPathBytes,
-});
 export const digestCanonical = (value) => {
     const encoded = canonicalize(value);
     if (encoded === undefined)

package/dist/application/ArtifactInventory/classify.js

@@ -1,6 +1,6 @@
 import { open } from "node:fs/promises";
 import { classifyArtifactPath } from "../ArtifactGraphConstruction.js";
-import { zipPackageFormatForPath } from "../../domain/zipPackageFormat.js";
+import { hasZipSignature, zipPackageFormatForPath, } from "../../domain/zipPackageFormat.js";
 const classifyContainerExtension = (path) => {
     const lower = path.toLowerCase();
     const zipPackage = zipPackageFormatForPath(lower);
@@ -21,11 +21,7 @@ export const classifyRoot = async (path, directory) => {
     try {
         const magic = Buffer.alloc(4);
         const observed = await handle.read(magic, 0, magic.length, 0);
-        if (observed.bytesRead === 4 &&
-            magic[0] === 0x50 &&
-            magic[1] === 0x4b &&
-            [0x03, 0x05, 0x07].includes(magic[2] ?? -1) &&
-            [0x04, 0x06, 0x08].includes(magic[3] ?? -1))
+        if (hasZipSignature(magic.subarray(0, observed.bytesRead)))
             return "zip";
         if (observed.bytesRead === 4) {
             const header = magic.readUInt32BE(0);

package/dist/application/ArtifactInventory/hash.js

@@ -1,25 +1,11 @@
 import { createHash } from "node:crypto";
-import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { streamChunkToBuffer } from "../../artifacts/StreamBytes.js";
 export const abortIfNeeded = (signal) => {
     if (signal?.aborted === true)
         throw new ArtifactReaderFailure("cancelled", "Artifact inventory cancelled");
 };
-export const preflightEntry = (entry, limits) => {
-    if (entry.declaredSize !== null && entry.declaredSize > limits.maxEntryBytes)
-        throw new ArtifactReaderFailure("limit", `Entry exceeds byte limit: ${entry.path}`);
-    if (entry.declaredSize !== null &&
-        entry.compressedSize !== null &&
-        entry.compressedSize === 0 &&
-        entry.declaredSize > 0)
-        throw new ArtifactReaderFailure("limit", `Invalid compression ratio: ${entry.path}`);
-    if (entry.declaredSize !== null &&
-        entry.compressedSize !== null &&
-        entry.compressedSize > 0 &&
-        entry.declaredSize / entry.compressedSize > limits.maxCompressionRatio)
-        throw new ArtifactReaderFailure("limit", `Compression ratio exceeds limit: ${entry.path}`);
-};
-export const hashReadable = async (stream, maximum, signal) => {
+export const hashReadable = async (stream, signal) => {
     const hash = createHash("sha256");
     const prefixes = [];
     let prefixBytes = 0;
@@ -28,10 +14,6 @@ export const hashReadable = async (stream, maximum, signal) => {
         abortIfNeeded(signal);
         const chunk = streamChunkToBuffer(raw);
         bytes += chunk.length;
-        if (bytes > maximum) {
-            stream.destroy();
-            throw new ArtifactReaderFailure("limit", "Observed entry bytes exceed limit");
-        }
         hash.update(chunk);
         if (prefixBytes < 16) {
             const selected = chunk.subarray(0, 16 - prefixBytes);

package/dist/application/ArtifactInventory/policy.js

@@ -0,0 +1,17 @@
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
+/** Resolve caller approval and operator policy before native reader selection. */
+export const resolveNativeMountPolicy = (approved, enabled) => {
+    if (!approved)
+        return { status: "disabled" };
+    if (!enabled)
+        throw new ArtifactReaderFailure("unavailable", "Native DMG mounting is disabled by operator policy");
+    return { status: "approved" };
+};
+/** Resolve parsed caller intent and operator policy before artifact scanning. */
+export const resolveArtifactIntegrityPolicy = (intent, enabled) => {
+    if (intent.mode === "fail")
+        return intent;
+    if (!enabled)
+        throw new ArtifactReaderFailure("policy", "Integrity continuation requires explicit approval and operator policy");
+    return intent;
+};

package/dist/application/ArtifactInventory/reader.js

@@ -1,5 +1,4 @@
 import { AsarArtifactReader } from "../../artifacts/AsarArtifactReader.js";
-import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
 import { DirectoryArtifactReader } from "../../artifacts/DirectoryArtifactReader.js";
 import { MachOSliceArtifactReader } from "../../artifacts/MachOSliceArtifactReader.js";
 import { NativeDmgArtifactReader } from "../../artifacts/NativeDmgArtifactReader.js";
@@ -21,10 +20,8 @@ export const createReader = async (path, format, nativeMount, signal) => {
                 ? new MachOSliceArtifactReader(path)
                 : undefined;
         case "dmg":
-            if (!nativeMount.nativeMountApproved)
+            if (nativeMount.status === "disabled")
                 return undefined;
-            if (!nativeMount.nativeMountEnabled)
-                throw new ArtifactReaderFailure("unavailable", "Native DMG mounting is disabled by operator policy");
             return NativeDmgArtifactReader.create(path, signal);
         default:
             return undefined;

package/dist/application/ArtifactInventory/scanCanonical.js

@@ -2,32 +2,28 @@ import { createReadStream } from "node:fs";
 import { lstat } from "node:fs/promises";
 import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
 import { artifactInventoryResultSchema, } from "../../domain/artifactGraph.js";
-import { createArtifactEdges, createRootNode, digestCanonical, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, toOutputLimits, } from "../ArtifactGraphConstruction.js";
+import { createArtifactEdges, createRootNode, digestCanonical, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, } from "../ArtifactGraphConstruction.js";
 import { classifyRoot } from "./classify.js";
 import { hashReadable } from "./hash.js";
 import { createReader, inventoryLimitations } from "./reader.js";
 import { scanReader, } from "./scanReader.js";
 import { NATIVE_MOUNT_DISABLED, STRICT_INTEGRITY_POLICY, } from "./types.js";
-export const scanCanonicalArtifactInventory = async (path, limits, options = {}) => {
+export const scanCanonicalArtifactInventory = async (path, options = {}) => {
     const integrity = options.integrity ?? STRICT_INTEGRITY_POLICY;
-    if (integrity.mode === "record-and-continue" &&
-        (!integrity.approved || !integrity.enabled))
-        throw new ArtifactReaderFailure("policy", "Integrity continuation requires explicit approval and operator policy");
     const metadata = await lstat(path);
     const rootFormat = await classifyRoot(path, metadata.isDirectory());
     const rootDigest = metadata.isDirectory()
         ? null
-        : await hashReadable(createReadStream(path), limits.maxTotalBytes, options.signal);
+        : await hashReadable(createReadStream(path), options.signal);
     const reader = await createReader(path, rootFormat, options.nativeMount ?? NATIVE_MOUNT_DISABLED, options.signal);
     try {
-        const { nodes, occurrences, pendingContradictions } = await scanReader(reader, limits, options.signal, integrity);
+        const { nodes, occurrences, pendingContradictions } = await scanReader(reader, options.signal, integrity);
         return await buildInventorySnapshot({
             path,
             metadata,
             rootFormat,
             rootDigest,
             reader,
-            limits,
             signal: options.signal,
             nodes,
             occurrences,
@@ -39,7 +35,7 @@ export const scanCanonicalArtifactInventory = async (path, limits, options = {})
     }
 };
 const buildInventorySnapshot = async (input) => {
-    const { path, metadata, rootFormat, rootDigest, reader, limits, signal } = input;
+    const { path, metadata, rootFormat, rootDigest, reader, signal } = input;
     materializeDirectoryNodes(input.occurrences, input.nodes);
     const rootNode = createRootNode({
         path,
@@ -65,7 +61,7 @@ const buildInventorySnapshot = async (input) => {
     const orderedNodes = sortNodes([...input.nodes.values()]);
     const orderedOccurrences = sortOccurrences(input.occurrences);
     const orderedEdges = sortEdges(edges);
-    await verifyRootDigest(path, rootDigest, limits.maxTotalBytes, signal);
+    await verifyRootDigest(path, rootDigest, signal);
     const graphSha256 = digestCanonical({
         nodes: orderedNodes,
         occurrences: orderedOccurrences,
@@ -84,7 +80,6 @@ const buildInventorySnapshot = async (input) => {
         nodes: orderedNodes,
         occurrences: orderedOccurrences,
         edges: orderedEdges,
-        limits: toOutputLimits(limits),
         provenance: reader?.provenance() ?? [],
         integrity_contradictions: integrityContradictions,
         limitations: buildLimitations(rootFormat, reader, integrityContradictions),
@@ -119,10 +114,10 @@ const buildIntegrityContradictions = (pending, occurrenceByPath, occurrenceById,
         ],
     };
 });
-const verifyRootDigest = async (path, rootDigest, maxTotalBytes, signal) => {
+const verifyRootDigest = async (path, rootDigest, signal) => {
     if (rootDigest === null)
         return;
-    const verified = await hashReadable(createReadStream(path), maxTotalBytes, signal);
+    const verified = await hashReadable(createReadStream(path), signal);
     if (verified.sha256 !== rootDigest.sha256 ||
         verified.bytes !== rootDigest.bytes)
         throw new ArtifactReaderFailure("integrity", "Root artifact changed during inventory");
@@ -131,9 +126,7 @@ const sortNodes = (nodes) => nodes.sort((left, right) => left.artifact_id.locale
 const sortOccurrences = (occurrences) => occurrences.sort((left, right) => left.logical_path.localeCompare(right.logical_path, "en"));
 const sortEdges = (edges) => edges.sort((left, right) => left.edge_id.localeCompare(right.edge_id));
 const buildManifest = ({ rootNode, graphSha256, orderedNodes, orderedOccurrences, orderedEdges, }) => artifactInventoryResultSchema.shape.manifest.parse({
-    schema_version: 1,
     manifest_id: `agm_${digestCanonical({
-        schema_version: 1,
         root_artifact_id: rootNode.artifact_id,
         graph_sha256: graphSha256,
     })}`,