rea-agents 3.0.0 → 3.2.0

package/dist/domain/javascriptStaticAnalysisCalls.js

@@ -1,6 +1,7 @@
 import * as t from "@babel/types";
-import { addBoundedFinding, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
-import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, propertyName, range, rangeForOffsets, sanitizeCandidate, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { sanitizeEndpointCandidate } from "./browserObservation.js";
+import { addFindingOnce, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
+import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, propertyName, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
 export const inspectCall = (source, node, context) => {
     const { accumulator } = context;
@@ -91,9 +92,7 @@ const vitePreloadDependencyTable = (source) => {
         return [];
     return [
         ...body.matchAll(/"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gu),
-    ]
-        .map((literal) => (literal[1] ?? literal[2] ?? "").slice(0, 4_096))
-        .slice(0, 256);
+    ].map((literal) => literal[1] ?? literal[2] ?? "");
 };
 const inspectEndpointCall = (node, name, first, context) => {
     const route = STATIC_ROUTE_CALL_NAMES.some((candidate) => name === candidate || name.endsWith(`.${candidate}`));
@@ -161,18 +160,20 @@ const inspectStorageCall = (node, name, first, context) => {
     });
 };
 export const addReference = (context, input) => {
-    const boundedSpecifier = input.specifier?.slice(0, 4_096) ?? null;
-    const expression = boundedSpecifier === null
-        ? sourceSlice(context.source, input.node).slice(0, 4_096)
-        : null;
+    const specifier = input.specifier ?? null;
+    const reference = specifier === null
+        ? {
+            specifier: null,
+            expression: sourceSlice(context.source, input.node),
+        }
+        : { specifier, expression: null };
     addLocatedFinding(context, {
         collection: context.accumulator.references,
-        key: `reference\0${input.kind}\0${boundedSpecifier ?? expression}`,
+        key: `reference\0${input.kind}\0${reference.specifier ?? reference.expression}`,
         node: input.node,
         value: {
             kind: input.kind,
-            specifier: boundedSpecifier,
-            expression,
+            ...reference,
             module_key: null,
             location: range(input.node),
         },
@@ -184,19 +185,19 @@ const addEndpoint = (context, input) => addLocatedFinding(context, {
     node: input.node,
     value: {
         kind: input.kind,
-        value: sanitizeCandidate(input.value),
+        value: sanitizeEndpointCandidate(input.value),
         mechanism: input.mechanism,
         module_key: null,
         location: range(input.node),
     },
 });
-export const addSourceMapDirectives = (source, accumulator, maximum) => {
+export const addSourceMapDirectives = (source, accumulator) => {
     for (const match of source.matchAll(/\/\/[#@]\s*sourceMappingURL\s*=\s*([^\s]+)/gu)) {
-        const declared = match[1]?.slice(0, 4_096);
+        const declared = match[1];
         if (declared === undefined)
             continue;
         const start = match.index;
         const location = rangeForOffsets(source, start, start + match[0].length);
-        addBoundedFinding(accumulator, `source-map\0${declared}`, maximum, () => accumulator.sourceMaps.push({ declared_url: declared, location }));
+        addFindingOnce(accumulator, `source-map\0${declared}`, () => accumulator.sourceMaps.push({ declared_url: declared, location }));
     }
 };

package/dist/domain/javascriptStaticAnalysisFindings.js

@@ -1,16 +1,12 @@
-/** Add one module-attributable finding under the shared global finding bound. */
-export const addLocatedFinding = (context, input) => addBoundedFinding(context.accumulator, `${input.key}\0${String(input.node.start)}`, context.maximum, () => input.collection.push({
+/** Add one module-attributable finding once per source location. */
+export const addLocatedFinding = (context, input) => addFindingOnce(context.accumulator, `${input.key}\0${String(input.node.start)}`, () => input.collection.push({
     offset: input.node.start ?? -1,
     value: input.value,
 }));
 /** Reserve one deterministic finding key before mutating an accumulator. */
-export const addBoundedFinding = (accumulator, key, maximum, add) => {
+export const addFindingOnce = (accumulator, key, add) => {
     if (accumulator.seen.has(key))
         return;
-    if (accumulatedFindingCount(accumulator) >= maximum) {
-        accumulator.droppedFindings += 1;
-        return;
-    }
     accumulator.seen.add(key);
     add();
 };
@@ -25,15 +21,3 @@ export const moduleAtOffset = (offset, modules) => {
         return undefined;
     return modules.find(({ start, end }) => offset >= start && offset <= end);
 };
-const accumulatedFindingCount = (accumulator) => accumulator.references.length +
-    accumulator.endpoints.length +
-    accumulator.storage.length +
-    accumulator.roles.length +
-    accumulator.sourceMaps.length +
-    accumulator.registrations.length +
-    accumulator.browserWindows.length +
-    accumulator.contextBridgeApis.length +
-    accumulator.ipc.length +
-    accumulator.senderValidations.length +
-    accumulator.utilityProcesses.length +
-    accumulator.nativeAddonBindings.length;

package/dist/domain/javascriptStaticAnalysisHelpers.js

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto";
 import { posix } from "node:path";
 import * as t from "@babel/types";
-import { sanitizeBrowserUrl } from "./browserObservation.js";
+import { propertyName } from "./javascriptAstValues.js";
+export { propertyName } from "./javascriptAstValues.js";
 /** Explicit result for source text that Babel cannot parse. */
 export const failedJavaScriptStaticAnalysis = () => ({
     parse_status: "failed",
     parse_error_count: 1,
     visited_ast_nodes: 0,
-    dropped_findings: 0,
     references: [],
     endpoints: [],
     storage: [],
@@ -30,36 +30,30 @@ export const failedJavaScriptStaticAnalysis = () => ({
 });
 /** Normalize one Babel call/new argument into the inert node shared by inspectors. */
 export const argumentNode = (argument) => argument !== null && t.isNode(argument) ? argument : undefined;
-/** Recognize the bounded runtime name for a Webpack/Rspack push call. */
+/** Recognize the runtime name for a Webpack/Rspack push call. */
 export const chunkRuntime = (call) => {
     if (!t.isMemberExpression(call.callee) &&
         !t.isOptionalMemberExpression(call.callee))
         return undefined;
     if (propertyName(call.callee.property) !== "push")
         return undefined;
-    return findChunkRuntime(call.callee.object, 0);
+    return findChunkRuntime(call.callee.object);
 };
-const findChunkRuntime = (node, depth) => {
-    if (depth >= 128)
-        return undefined;
+const findChunkRuntime = (node) => {
     if (t.isIdentifier(node) && /(?:webpack|rspack)Chunk/iu.test(node.name))
-        return node.name.slice(0, 4_096);
+        return node.name;
     if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
         const property = propertyName(node.property);
         if (/(?:webpack|rspack)Chunk/iu.test(property))
-            return property.slice(0, 4_096);
-        return t.isNode(node.object)
-            ? findChunkRuntime(node.object, depth + 1)
-            : undefined;
+            return property;
+        return t.isNode(node.object) ? findChunkRuntime(node.object) : undefined;
     }
     if (t.isAssignmentExpression(node))
-        return (findChunkRuntime(node.left, depth + 1) ??
-            findChunkRuntime(node.right, depth + 1));
+        return findChunkRuntime(node.left) ?? findChunkRuntime(node.right);
     if (t.isLogicalExpression(node) || t.isBinaryExpression(node))
-        return (findChunkRuntime(node.left, depth + 1) ??
-            findChunkRuntime(node.right, depth + 1));
+        return findChunkRuntime(node.left) ?? findChunkRuntime(node.right);
     if (t.isParenthesizedExpression(node) || t.isTSAsExpression(node))
-        return findChunkRuntime(node.expression, depth + 1);
+        return findChunkRuntime(node.expression);
     return undefined;
 };
 /** Return a literal function factory from one module-table property. */
@@ -72,60 +66,57 @@ export const moduleFactory = (property) => {
         return property.value;
     return undefined;
 };
-/** Derive a bounded literal or explicitly computed module key. */
+/** Derive a literal or explicitly computed module key. */
 export const modulePropertyName = (property) => t.isObjectMethod(property) || t.isObjectProperty(property)
     ? property.computed &&
         !t.isStringLiteral(property.key) &&
         !t.isNumericLiteral(property.key)
         ? `[computed@${String(property.start ?? -1)}]`
-        : propertyName(property.key).slice(0, 4_096) ||
+        : propertyName(property.key) ||
             `[unknown@${String(property.start ?? -1)}]`
     : `[unknown@${String(property.start ?? -1)}]`;
 /** Read the factory-local bundler require parameter when declared. */
 export const factoryRequireName = (factory) => {
     const parameter = factory.params[2];
-    return t.isIdentifier(parameter) ? parameter.name.slice(0, 4_096) : null;
+    return t.isIdentifier(parameter) ? parameter.name : null;
 };
-/** Collect bounded unique literal values and explicit omissions from an array. */
-export const staticArrayValues = (array, maximum) => {
+/** Collect all unique static literal values from an array. */
+export const staticArrayValues = (array) => {
     const staticValues = array.elements.flatMap((element) => {
         const value = argumentValue(element);
-        return value === undefined ? [] : [value.slice(0, 4_096)];
+        return value === undefined ? [] : [value];
     });
     const values = [...new Set(staticValues)].sort(compareCodePoints);
     return {
-        values: values.slice(0, maximum),
-        omitted: Math.max(0, values.length - maximum),
+        values,
         unknown: array.elements.length - staticValues.length,
     };
 };
-/** Resolve a bounded path composed only from inert literal syntax. */
-export const staticPath = (node) => staticPathAt(node, 0);
+/** Resolve a path composed only from inert literal syntax. */
+export const staticPath = (node) => staticPathAt(node);
 /** Classify whether inert path syntax is a module specifier or file expression. */
-export const staticPathResolutionContext = (node) => isFilesystemPathExpression(node, 0)
+export const staticPathResolutionContext = (node) => isFilesystemPathExpression(node)
     ? "filesystem-expression"
     : "module-specifier";
-const staticPathAt = (node, depth) => {
-    if (depth >= 128)
-        return undefined;
+const staticPathAt = (node) => {
     if (t.isStringLiteral(node))
-        return node.value.slice(0, 4_096);
+        return node.value;
     if (t.isTemplateLiteral(node) && node.expressions.length === 0) {
         const value = node.quasis[0]?.value.cooked ?? node.quasis[0]?.value.raw;
-        return value?.slice(0, 4_096);
+        return value;
     }
     if (t.isBinaryExpression(node, { operator: "+" })) {
-        const left = staticPathAt(node.left, depth + 1);
-        const right = staticPathAt(node.right, depth + 1);
+        const left = staticPathAt(node.left);
+        const right = staticPathAt(node.right);
         return left === undefined || right === undefined
             ? undefined
-            : `${left}${right}`.slice(0, 4_096);
+            : `${left}${right}`;
     }
     if (t.isCallExpression(node) || t.isNewExpression(node))
-        return staticCallPath(node, depth);
+        return staticCallPath(node);
     return undefined;
 };
-const staticCallPath = (node, depth) => {
+const staticCallPath = (node) => {
     const name = calleeName(node.callee);
     if (name === "URL" || name.endsWith(".URL"))
         return isFileIdentity(argumentNode(node.arguments[1]))
@@ -133,9 +124,7 @@ const staticCallPath = (node, depth) => {
             : undefined;
     if (name === "fileURLToPath" || name.endsWith(".fileURLToPath")) {
         const argument = argumentNode(node.arguments[0]);
-        return argument === undefined
-            ? undefined
-            : staticPathAt(argument, depth + 1);
+        return argument === undefined ? undefined : staticPathAt(argument);
     }
     if ((name === "dirname" || name.endsWith(".dirname")) &&
         isFileIdentity(argumentNode(node.arguments[0])))
@@ -146,25 +135,21 @@ const staticCallPath = (node, depth) => {
     for (const argument of node.arguments) {
         if (isDirectoryIdentity(argumentNode(argument)))
             continue;
-        const value = t.isNode(argument)
-            ? staticPathAt(argument, depth + 1)
-            : undefined;
+        const value = t.isNode(argument) ? staticPathAt(argument) : undefined;
         if (value === undefined)
             return undefined;
         parts.push(value);
     }
-    return parts.length === 0 ? undefined : posix.join(...parts).slice(0, 4_096);
+    return parts.length === 0 ? undefined : posix.join(...parts);
 };
-const isFilesystemPathExpression = (node, depth) => {
-    if (depth >= 128)
-        return false;
+const isFilesystemPathExpression = (node) => {
     if (t.isStringLiteral(node))
         return node.value.startsWith("/");
     if (isFileIdentity(node) || isDirectoryIdentity(node))
         return true;
     if (t.isBinaryExpression(node, { operator: "+" }))
-        return (isFilesystemPathExpression(node.left, depth + 1) ||
-            isFilesystemPathExpression(node.right, depth + 1));
+        return (isFilesystemPathExpression(node.left) ||
+            isFilesystemPathExpression(node.right));
     if (t.isCallExpression(node) || t.isNewExpression(node)) {
         const name = calleeName(node.callee);
         if (name === "URL" || name.endsWith(".URL"))
@@ -172,11 +157,11 @@ const isFilesystemPathExpression = (node, depth) => {
         if (name === "fileURLToPath" || name.endsWith(".fileURLToPath"))
             return node.arguments.some((argument) => {
                 const value = argumentNode(argument);
-                return (value !== undefined && isFilesystemPathExpression(value, depth + 1));
+                return value !== undefined && isFilesystemPathExpression(value);
             });
         return node.arguments.some((argument) => {
             const value = argumentNode(argument);
-            return (value !== undefined && isFilesystemPathExpression(value, depth + 1));
+            return value !== undefined && isFilesystemPathExpression(value);
         });
     }
     return false;
@@ -235,38 +220,26 @@ export const storageKind = (name) => {
         return "sqlite";
     return undefined;
 };
-/** Produce a dotted bounded callee name from member syntax. */
-export const calleeName = (node) => calleeNameAt(node, 0);
-const calleeNameAt = (node, depth) => {
-    if (depth >= 128)
-        return "[deep]";
+/** Produce a dotted callee name from member syntax. */
+export const calleeName = (node) => calleeNameAt(node);
+const calleeNameAt = (node) => {
     if (t.isIdentifier(node))
-        return node.name.slice(0, 4_096);
+        return node.name;
     if (t.isImport(node))
         return "import";
     if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        const object = t.isNode(node.object)
-            ? calleeNameAt(node.object, depth + 1)
-            : "";
+        const object = t.isNode(node.object) ? calleeNameAt(node.object) : "";
         const property = propertyName(node.property);
-        return (object === "" ? property : `${object}.${property}`).slice(0, 4_096);
+        return object === "" ? property : `${object}.${property}`;
     }
     return "";
 };
-/** Read a literal property name without evaluating computed syntax. */
-export const propertyName = (node) => {
-    if (t.isIdentifier(node))
-        return node.name.slice(0, 4_096);
-    if (t.isStringLiteral(node) || t.isNumericLiteral(node))
-        return String(node.value).slice(0, 4_096);
-    return "";
-};
 /** Return a string literal value without evaluating an expression. */
-export const stringValue = (node) => t.isStringLiteral(node) ? node.value.slice(0, 4_096) : undefined;
+export const stringValue = (node) => (t.isStringLiteral(node) ? node.value : undefined);
 /** Return a string or numeric argument literal. */
 export const argumentValue = (node) => {
     if (t.isStringLiteral(node) || t.isNumericLiteral(node))
-        return String(node.value).slice(0, 4_096);
+        return String(node.value);
     return undefined;
 };
 /** Prefix a static argument value when one is available. */
@@ -274,7 +247,7 @@ export const prefixedArgument = (prefix, node) => {
     const value = argumentValue(node);
     return value === undefined ? undefined : `${prefix}${value}`;
 };
-/** Retain the exact bounded source span represented by an AST node. */
+/** Retain the exact source span represented by an AST node. */
 export const sourceSlice = (source, node) => typeof node.start !== "number" || typeof node.end !== "number"
     ? ""
     : source.slice(node.start, node.end);
@@ -307,22 +280,8 @@ const pointForOffset = (source, offset) => {
 };
 /** Observe known bundler/framework marker strings without claiming dependency use. */
 export const detectVendors = (source) => vendorPatterns.flatMap(({ name, patterns }) => patterns.some((pattern) => source.includes(pattern)) ? [name] : []);
-/** Remove credentials, fragments, and query values from endpoint candidates. */
-export const sanitizeCandidate = (value) => {
-    const bounded = value.slice(0, 4_096);
-    try {
-        const parsed = new URL(bounded, "https://rea.invalid");
-        const sanitized = sanitizeBrowserUrl(parsed.href).url;
-        return parsed.origin === "https://rea.invalid"
-            ? sanitized.replace("https://rea.invalid", "")
-            : sanitized;
-    }
-    catch {
-        return bounded.split("#", 1)[0]?.split("?", 1)[0] ?? "";
-    }
-};
 /** Commit the static semantic content used to deduplicate registrations. */
-export const registrationKey = (registration) => `${registration.runtime}\0${registration.chunk_keys.join("\0")}\0${String(registration.omitted_chunk_keys)}\0${String(registration.unknown_chunk_keys)}\0${registration.modules.map(({ module_key: key, source_sha256: digest }) => `${key}:${digest}`).join("\0")}`;
+export const registrationKey = (registration) => `${registration.runtime}\0${registration.chunk_keys.join("\0")}\0${String(registration.unknown_chunk_keys)}\0${registration.modules.map(({ module_key: key, source_sha256: digest }) => `${key}:${digest}`).join("\0")}`;
 /** Sort values by a deterministic unique semantic key. */
 export const sortedUnique = (values, key) => [...new Map(values.map((value) => [key(value), value])).values()].sort((left, right) => compareCodePoints(key(left), key(right)));
 /** Hash exact UTF-8 source text. */

package/dist/domain/javascriptStaticAnalysisState.js

@@ -1,4 +1,4 @@
-/** Create isolated mutable state for one bounded source analysis. */
+/** Create isolated mutable state for one source analysis. */
 export const createJavaScriptAnalysisAccumulator = () => ({
     references: [],
     endpoints: [],
@@ -15,9 +15,5 @@ export const createJavaScriptAnalysisAccumulator = () => ({
     modules: [],
     seen: new Set(),
     visitedNodes: 0,
-    droppedFindings: 0,
-    moduleCount: 0,
     unknownFindings: 0,
-    structuralTruncation: false,
-    truncated: false,
 });

package/dist/domain/javascriptStaticAnalysisTypes.js

@@ -1 +1,2 @@
 export {};
+/** Hard bounds applied to one AST-only JavaScript analysis. */

package/dist/domain/jsonShape.js

@@ -17,12 +17,9 @@ export const jsonShapeSchema = z.object({
         types: z.array(jsonValueTypeSchema).min(1),
         observations: z.number().int().min(1),
     })),
-    truncated: z.boolean(),
 });
 /** Parse approved JSON and immediately discard values after iterative shape inference. */
-export const inferJsonShape = (text, limits) => {
-    if (Buffer.byteLength(text) > limits.maximumBytes)
-        return null;
+export const inferJsonShape = (text) => {
     let root;
     try {
         root = JSON.parse(text);
@@ -34,28 +31,14 @@ export const inferJsonShape = (text, limits) => {
     const pending = [{ value: root, path: "", depth: 0 }];
     let nodeCount = 0;
     let maxDepthObserved = 0;
-    let truncated = false;
     while (pending.length > 0) {
         const current = pending.pop();
         if (current === undefined)
             break;
-        if (nodeCount >= limits.maximumNodes) {
-            truncated = true;
-            break;
-        }
         nodeCount += 1;
         maxDepthObserved = Math.max(maxDepthObserved, current.depth);
-        if (current.depth >= limits.maximumDepth) {
-            if (hasChildren(current.value))
-                truncated = true;
-            continue;
-        }
         if (Array.isArray(current.value)) {
-            const capacity = Math.max(0, limits.maximumNodes - nodeCount - pending.length);
-            const retained = Math.min(current.value.length, capacity);
-            if (retained < current.value.length)
-                truncated = true;
-            for (let index = retained - 1; index >= 0; index -= 1)
+            for (let index = current.value.length - 1; index >= 0; index -= 1)
                 pending.push({
                     value: current.value[index],
                     path: `${current.path}/*`,
@@ -66,16 +49,12 @@ export const inferJsonShape = (text, limits) => {
         if (!isRecord(current.value))
             continue;
         const allEntries = Object.entries(current.value);
-        const capacity = Math.max(0, limits.maximumNodes - nodeCount - pending.length);
-        const entries = allEntries.slice(0, capacity);
-        if (entries.length < allEntries.length)
-            truncated = true;
-        for (let index = entries.length - 1; index >= 0; index -= 1) {
-            const entry = entries[index];
+        for (let index = allEntries.length - 1; index >= 0; index -= 1) {
+            const entry = allEntries[index];
             if (entry === undefined)
                 continue;
             const [name, value] = entry;
-            const path = `${current.path}/${pointerName(name)}`.slice(0, 2_048);
+            const path = `${current.path}/${pointerName(name)}`;
             const type = jsonValueType(value);
             const existing = properties.get(path);
             if (existing === undefined)
@@ -97,9 +76,7 @@ export const inferJsonShape = (text, limits) => {
             types: [...value.types].sort(),
             observations: value.observations,
         }))
-            .sort((left, right) => left.path.localeCompare(right.path))
-            .slice(0, limits.maximumNodes),
-        truncated,
+            .sort((left, right) => left.path.localeCompare(right.path)),
     });
 };
 const jsonValueType = (value) => {
@@ -118,8 +95,5 @@ const jsonValueType = (value) => {
             return "object";
     }
 };
-const hasChildren = (value) => Array.isArray(value)
-    ? value.length > 0
-    : isRecord(value) && Object.keys(value).length > 0;
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const pointerName = (value) => value.slice(0, 256).replaceAll("~", "~0").replaceAll("/", "~1");
+const pointerName = (value) => value.replaceAll("~", "~0").replaceAll("/", "~1");

package/dist/domain/localPath.js

@@ -0,0 +1,7 @@
+import { isAbsolute, relative, sep } from "node:path";
+/** Test lexical containment on the host platform; callers must resolve symlinks first. */
+export const isPathWithinRoot = (root, path) => {
+    const value = relative(root, path);
+    return (value === "" ||
+        (value !== ".." && !value.startsWith(`..${sep}`) && !isAbsolute(value)));
+};

package/dist/domain/managedApplicationGraph.js

@@ -4,36 +4,17 @@ import { z } from "zod";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { createJavaScriptApplicationGraph, javascriptApplicationGraphSchema, } from "./javascriptApplicationGraph.js";
 import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "./managedArtifact.js";
-import { assessManagedGraphOmissions, managedGraphEvidenceCoverage, managedGraphResultCoverage, totalManagedGraphOmitted, } from "./managedApplicationGraphCoverage.js";
+import { assessManagedGraphOmissions, managedGraphEvidenceCoverage, managedGraphResultCoverage, } from "./managedApplicationGraphCoverage.js";
 import { addArtifactNode, addArtifactIdentityNodes, addBoundaryNodes, addMemberNodes, } from "./managedApplicationGraphNodes.js";
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-const boundedTextSchema = z.string().min(1).max(4_096);
-const managedApplicationGraphLimitsSchema = z.strictObject({
-    max_types: z.number().int().min(0).max(100_000).default(5_000),
-    max_methods: z.number().int().min(0).max(100_000).default(10_000),
-    max_fields: z.number().int().min(0).max(100_000).default(5_000),
-    max_pinvoke_imports: z.number().int().min(0).max(100_000).default(5_000),
-    max_native_implementations: z
-        .number()
-        .int()
-        .min(0)
-        .max(100_000)
-        .default(5_000),
-});
+const textSchema = z.string().min(1);
 /** Authenticated managed Evidence records projected into the application graph. */
 export const projectManagedApplicationGraphInputSchema = z
     .strictObject({
     managed_artifact: evidenceSchema.optional(),
     managed_members: evidenceSchema.optional(),
     managed_native_boundaries: evidenceSchema.optional(),
-    limits: managedApplicationGraphLimitsSchema.default({
-        max_types: 5_000,
-        max_methods: 10_000,
-        max_fields: 5_000,
-        max_pinvoke_imports: 5_000,
-        max_native_implementations: 5_000,
-    }),
 })
     .superRefine((input, context) => {
     if (input.managed_artifact === undefined &&
@@ -46,7 +27,6 @@ export const projectManagedApplicationGraphInputSchema = z
 });
 /** Managed-code projection result containing a validated application graph. */
 export const managedApplicationGraphResultSchema = z.strictObject({
-    schema_version: z.literal(1),
     projection_id: z.string().regex(/^magp_[a-f0-9]{64}$/u),
     root_artifact_sha256: digestSchema,
     source_evidence: z.strictObject({
@@ -67,15 +47,10 @@ export const managedApplicationGraphResultSchema = z.strictObject({
     }),
     graph: javascriptApplicationGraphSchema,
     coverage: z.strictObject({
-        status: z.enum(["complete-within-inputs", "partial", "truncated"]),
-        omitted_types: z.number().int().min(0),
-        omitted_methods: z.number().int().min(0),
-        omitted_fields: z.number().int().min(0),
-        omitted_pinvoke_imports: z.number().int().min(0),
-        omitted_native_implementations: z.number().int().min(0),
+        status: z.enum(["complete-within-inputs", "partial"]),
     }),
     evidence_links: z.array(evidenceIdSchema).min(1).max(3),
-    limitations: z.array(boundedTextSchema).max(1_000),
+    limitations: z.array(textSchema),
 });
 const sha256 = (value) => {
     const serialized = canonicalize(value);
@@ -105,13 +80,12 @@ export const projectManagedApplicationGraph = (input) => {
     };
     const artifactNode = addArtifactNode(state);
     addArtifactIdentityNodes(state, artifactNode, parsed);
-    const memberCounts = addMemberNodes(state, artifactNode, parsed, input.limits);
-    const boundaryCounts = addBoundaryNodes(state, artifactNode, parsed, input.limits);
-    const omissions = omittedCounts(parsed, input.limits);
+    const memberCounts = addMemberNodes(state, artifactNode, parsed);
+    const boundaryCounts = addBoundaryNodes(state, artifactNode, parsed);
+    const omissions = omittedCounts(parsed);
     const limitations = projectionLimitations(parsed, omissions);
     const graph = createJavaScriptApplicationGraph({
         schema: "JavaScriptApplicationGraph",
-        schema_version: 1,
         root_node_ids: [artifactNode.node_id],
         nodes: state.nodes,
         edges: state.edges,
@@ -119,7 +93,6 @@ export const projectManagedApplicationGraph = (input) => {
         limitations,
     });
     const withoutId = {
-        schema_version: 1,
         root_artifact_sha256: state.artifactSha256,
         source_evidence: {
             managed_artifact_evidence_id: parsed.artifact?.evidence.evidence_id ?? null,
@@ -178,11 +151,11 @@ const assertSameArtifact = (parsed, sha256Value) => {
         if (result !== undefined && result.artifact.sha256 !== sha256Value)
             throw new TypeError("Managed graph projection inputs must describe the same artifact SHA-256");
 };
-const omittedCounts = (parsed, limits) => assessManagedGraphOmissions({
+const omittedCounts = (parsed) => assessManagedGraphOmissions({
     artifact: parsed.artifact?.result ?? null,
     members: parsed.members?.result ?? null,
     boundaries: parsed.boundaries?.result ?? null,
-}, limits);
+});
 const projectionLimitations = (parsed, omissions) => [
     "Managed graph projection preserves static metadata observations only; it does not execute managed code, load assemblies, or map managed tokens to native addresses.",
     ...(parsed.members === null
@@ -198,9 +171,4 @@ const projectionLimitations = (parsed, omissions) => [
     ...(omissions.partialInput
         ? ["At least one supplied managed Evidence record has partial coverage."]
         : []),
-    ...(totalManagedGraphOmitted(omissions) > 0
-        ? [
-            "Projection output omits managed entities because of source pagination or managed application graph limits.",
-        ]
-        : []),
 ];