rea-agents 3.1.0 → 3.2.0

package/dist/application/AbortablePromise.js

@@ -8,15 +8,18 @@ export const ABORTED = Symbol("aborted");
 export const waitForAbortable = async (pending, signal) => {
     if (signal === undefined)
         return pending;
-    if (signal.aborted)
-        return ABORTED;
     let onAbort;
     const cancelled = new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve(ABORTED);
+            return;
+        }
         onAbort = () => resolve(ABORTED);
         signal.addEventListener("abort", onAbort, { once: true });
     });
     try {
-        return await Promise.race([pending, cancelled]);
+        // Even an already-cancelled wait must own the producer's eventual rejection.
+        return await Promise.race([cancelled, pending]);
     }
     finally {
         if (onAbort !== undefined)

package/dist/application/AnalysisSnapshotCache.js

@@ -76,7 +76,6 @@ export class AnalysisSnapshotCache {
         if (target === undefined || profile === undefined)
             return err(new NoBinaryOpenError());
         return ok({
-            snapshot_version: 2,
             target: snapshotTarget(target),
             binding: snapshotBinding(profile),
             entries: this.entries(),

package/dist/application/AnalysisSnapshotFiles.js

@@ -1,10 +1,10 @@
 import { parseAnalysisSnapshot, serializeAnalysisSnapshot, } from "../domain/analysisSnapshot.js";
 import { EvidenceFileError, EvidenceIntegrityError } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-import { readBoundedJson, writeBoundedText } from "./BoundedJsonFiles.js";
-/** Read and validate a bounded analysis snapshot inside an approved root. */
-export const readAnalysisSnapshot = async (path, policy) => {
-    const loaded = await readBoundedJson(path, policy);
+import { readJsonFile, writeTextFile } from "./JsonFiles.js";
+/** Read and validate an analysis snapshot from the caller's path. */
+export const readAnalysisSnapshot = async (path) => {
+    const loaded = await readJsonFile(path);
     if (!loaded.ok)
         return loaded;
     try {
@@ -14,8 +14,8 @@ export const readAnalysisSnapshot = async (path, policy) => {
         return err(new EvidenceIntegrityError(snapshotValidationMessage(cause), { cause }));
     }
 };
-/** Atomically write a deterministic analysis snapshot inside an approved root. */
-export const writeAnalysisSnapshot = async (snapshot, path, overwrite, policy) => {
+/** Atomically write a deterministic analysis snapshot to the caller's path. */
+export const writeAnalysisSnapshot = async (snapshot, path, overwrite) => {
     let encoded;
     try {
         encoded = serializeAnalysisSnapshot(snapshot);
@@ -23,7 +23,7 @@ export const writeAnalysisSnapshot = async (snapshot, path, overwrite, policy) =
     catch (cause) {
         return err(new EvidenceIntegrityError(snapshotValidationMessage(cause), { cause }));
     }
-    return writeBoundedText(encoded, path, overwrite, policy);
+    return writeTextFile(encoded, path, overwrite);
 };
 const snapshotValidationMessage = (cause) => cause instanceof TypeError
     ? cause.message

package/dist/application/AndroidApplicationService.js

@@ -9,7 +9,7 @@ export const projectAndroidApplicationEvidence = (rawInput) => {
         schema: androidApplicationProjectionInputSchema,
         project: projectAndroidApplication,
         operation: OPERATION,
-        predicateType: "rea.android-application-graph/v1",
+        predicateType: "rea.android-application-graph",
         provider: ANDROID_APPLICATION_PROVIDER,
         subjectFormat: () => "apk",
         protocolError: "Android application projection produced an invalid result",

package/dist/application/AppleApplicationService.js

@@ -9,7 +9,7 @@ export const projectAppleApplicationEvidence = (rawInput) => {
         schema: appleApplicationProjectionInputSchema,
         project: projectAppleApplication,
         operation: OPERATION,
-        predicateType: "rea.apple-application-graph/v1",
+        predicateType: "rea.apple-application-graph",
         provider: APPLE_APPLICATION_PROVIDER,
         subjectFormat: () => "ipa",
         protocolError: "Apple application projection produced an invalid result",

package/dist/application/ArtifactExtraction.js

@@ -8,26 +8,35 @@ import { ZipArtifactReader } from "../artifacts/ZipArtifactReader.js";
 import { MachOSliceArtifactReader } from "../artifacts/MachOSliceArtifactReader.js";
 import { artifactExtractionResultSchema, } from "../domain/artifactGraph.js";
 import { scanArtifactInventory } from "./ArtifactInventory.js";
-import { digestCanonical, pageOf, toOutputLimits, } from "./ArtifactGraphConstruction.js";
-const PAGE_SIZE = 500;
-/** Extract selected inventory occurrences into an exclusively owned absent root. */
+import { digestCanonical } from "./ArtifactGraphConstruction.js";
+/** Extract every regular inventory occurrence into an exclusively owned absent root. */
 export const extractArtifact = async (input, signal) => {
-    validateSelection(input.occurrenceIds);
     const sourcePath = await realpath(input.inputPath);
-    const selectedIds = new Set(input.occurrenceIds);
-    const inventory = await loadInventory(sourcePath, input.limits, selectedIds, signal);
-    const selected = input.occurrenceIds.map((id) => {
-        const occurrence = inventory.occurrences.get(id);
-        if (occurrence === undefined)
-            throw new ArtifactReaderFailure("unavailable", `Selected artifact occurrence was not found: ${id}`);
+    const snapshot = await scanArtifactInventory(sourcePath, {
+        signal,
+    });
+    const selectedOccurrences = snapshot.occurrences.filter((occurrence) => (occurrence.entry_kind === "file" || occurrence.entry_kind === "slice") &&
+        occurrence.logical_path !== ".");
+    const selectedIds = new Set(selectedOccurrences.map(({ occurrence_id: id }) => id));
+    const occurrences = new Map();
+    const neededNodes = new Set();
+    collectOccurrences(snapshot.occurrences, selectedIds, occurrences, neededNodes);
+    const nodes = new Map();
+    collectNodes(snapshot.nodes, neededNodes, nodes);
+    const inventory = {
+        manifest: snapshot.manifest,
+        occurrences,
+        nodes,
+    };
+    const selected = selectedOccurrences.map((occurrence) => {
         if ((occurrence.entry_kind !== "file" && occurrence.entry_kind !== "slice") ||
             occurrence.artifact_id === null ||
             occurrence.encrypted ||
             occurrence.logical_path === ".")
-            throw new ArtifactReaderFailure("format", `Selected occurrence is not an extractable regular child file: ${id}`);
+            throw new ArtifactReaderFailure("format", `Selected occurrence is not an extractable regular child file: ${occurrence.occurrence_id}`);
         const node = inventory.nodes.get(occurrence.artifact_id);
         if (node === undefined)
-            throw new ArtifactReaderFailure("integrity", `Selected occurrence has no inventory node: ${id}`);
+            throw new ArtifactReaderFailure("integrity", `Selected occurrence has no inventory node: ${occurrence.occurrence_id}`);
         return { occurrence, node };
     });
     return materializeSelection({
@@ -41,23 +50,22 @@ export const extractArtifact = async (input, signal) => {
 const materializeSelection = async ({ input, sourcePath, inventory, selected, signal, }) => {
     const byPath = new Map(selected.map((item) => [item.occurrence.logical_path, item]));
     const reader = await createReader(sourcePath, input.inputFormat);
-    const output = await SafeOutputTree.create(input.outputRoot, input.limits);
+    const output = await SafeOutputTree.create(input.outputRoot);
     let readerClosed = false;
     const extracted = [];
     try {
-        const found = new Set();
+        const materialized = [];
         const registry = new ArtifactPathRegistry();
-        let entryCount = 0;
         for await (const entry of reader.entries(signal)) {
-            entryCount += 1;
-            if (entryCount > input.limits.maxEntries)
-                throw new ArtifactReaderFailure("limit", "Artifact entry limit exceeded during extraction");
-            const path = normalizeArtifactPath(entry.path, input.limits);
+            const path = normalizeArtifactPath(entry.path);
             registry.add(path, entry.kind);
             const selectedItem = byPath.get(path);
-            if (selectedItem === undefined)
+            if (selectedItem === undefined) {
+                if (entry.kind === "file" || entry.kind === "slice")
+                    throw new ArtifactReaderFailure("integrity", `Regular artifact entry is missing from inventory: ${path}`);
                 continue;
-            preflight(entry, input.limits);
+            }
+            preflight(entry);
             const stream = await reader.open(entry, signal);
             const written = await output.write(path, stream, selectedItem.node.sha256, signal);
             extracted.push({
@@ -67,14 +75,12 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
                 bytes_written: written.bytesWritten,
                 created: true,
             });
-            found.add(path);
+            materialized.push(selectedItem);
         }
-        if (found.size !== selected.length)
-            throw new ArtifactReaderFailure("integrity", "Selected inventory occurrence disappeared before extraction");
         await reader.close();
         readerClosed = true;
         extracted.sort((left, right) => left.relative_path.localeCompare(right.relative_path, "en"));
-        const result = createExtractionResult(input, inventory, selected, extracted);
+        const result = createExtractionResult(input, inventory, materialized, extracted);
         await output.commit();
         return result;
     }
@@ -87,7 +93,6 @@ const materializeSelection = async ({ input, sourcePath, inventory, selected, si
 };
 const createExtractionResult = (input, inventory, selected, extracted) => {
     const extractionSemantic = {
-        schema_version: 1,
         source_manifest_id: inventory.manifest.manifest_id,
         selected_occurrence_ids: selected
             .map(({ occurrence }) => occurrence.occurrence_id)
@@ -101,26 +106,16 @@ const createExtractionResult = (input, inventory, selected, extracted) => {
             ...extractionSemantic,
             extraction_id: `aex_${digestCanonical(extractionSemantic)}`,
         },
-        output_root: "$OUTPUT_ROOT",
-        artifacts: pageOf(extracted, input.offset, input.limit),
+        output_root: input.outputRoot,
+        artifacts: extracted,
         containment_verified: true,
         cleanup: { attempted: false, verified: true, residual_paths: [] },
-        limits: toOutputLimits(input.limits),
         provenance: [],
         limitations: [
-            "Only caller-selected regular file occurrences were materialized.",
+            "All regular files in the active artifact were materialized; nested archive contents remain represented by their containing file.",
         ],
     });
 };
-const loadInventory = async (path, limits, selectedIds, signal) => {
-    const snapshot = await scanArtifactInventory(path, limits, { signal });
-    const occurrences = new Map();
-    const neededNodes = new Set();
-    collectOccurrences(snapshot.occurrences, selectedIds, occurrences, neededNodes);
-    const nodes = new Map();
-    collectNodes(snapshot.nodes, neededNodes, nodes);
-    return { manifest: snapshot.manifest, occurrences, nodes };
-};
 const collectOccurrences = (items, selected, output, neededNodes) => {
     for (const item of items) {
         if (!selected.has(item.occurrence_id))
@@ -150,21 +145,7 @@ const createReader = async (path, format) => {
         return new MachOSliceArtifactReader(path);
     throw new ArtifactReaderFailure("unavailable", `Artifact format has no extraction reader: ${format}`);
 };
-const validateSelection = (ids) => {
-    if (ids.length === 0 || ids.length > PAGE_SIZE)
-        throw new ArtifactReaderFailure("limit", "Extraction requires 1 to 500 explicitly selected occurrences");
-    if (new Set(ids).size !== ids.length)
-        throw new ArtifactReaderFailure("path", "Extraction occurrence selection contains duplicates");
-};
-const preflight = (entry, limits) => {
+const preflight = (entry) => {
     if ((entry.kind !== "file" && entry.kind !== "slice") || entry.encrypted)
         throw new ArtifactReaderFailure("format", `Selected artifact entry cannot be read: ${entry.path}`);
-    if (entry.declaredSize !== null && entry.declaredSize > limits.maxEntryBytes)
-        throw new ArtifactReaderFailure("limit", `Selected artifact exceeds byte limit: ${entry.path}`);
-    if (entry.declaredSize !== null &&
-        entry.compressedSize !== null &&
-        (entry.compressedSize === 0
-            ? entry.declaredSize > 0
-            : entry.declaredSize / entry.compressedSize > limits.maxCompressionRatio))
-        throw new ArtifactReaderFailure("limit", `Selected artifact exceeds compression ratio limit: ${entry.path}`);
 };

package/dist/application/ArtifactExtractionDestination.js

@@ -0,0 +1,17 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** Choose a fresh temporary destination for an artifact extraction. */
+export const createArtifactExtractionDestination = () => join(tmpdir(), `rea-extracted-${randomUUID()}`);
+/** Stable parent scope used to authorize REA-owned extraction destinations. */
+export const artifactExtractionPermissionRoot = () => tmpdir();
+/** Stable filesystem scope for the destination selected internally by REA. */
+export const artifactExtractionPermissionRequest = () => ({
+    capability: "artifact_extract",
+    roots: [artifactExtractionPermissionRoot()],
+    executables: [],
+    environment_names: [],
+    network: "none",
+    mount: false,
+    operation_identity: "extract_artifact:temporary_output",
+});

package/dist/application/ArtifactGraphConstruction.js

@@ -19,7 +19,7 @@ export const createOccurrence = (entry, path, parent) => ({
     compressed_size: entry.compressedSize,
     executable: entry.executable,
     encrypted: entry.encrypted,
-    hash_status: entry.encrypted ? "unavailable" : "not-hashed-limit",
+    hash_status: entry.encrypted ? "unavailable" : "not-hashed",
     source_location: entry.byteOffset === null || entry.declaredSize === null
         ? null
         : { offset: entry.byteOffset, length: entry.declaredSize },
@@ -82,7 +82,7 @@ export const createRootNode = (input) => createArtifactNode({
     contentState: "materialized",
 });
 export const createArtifactNode = (input) => ({
-    artifact_id: `art_${digestCanonical({ schema_version: 1, sha256: input.sha256 })}`,
+    artifact_id: `art_${digestCanonical({ sha256: input.sha256 })}`,
     kind: input.kind,
     format: input.format,
     sha256: input.sha256,
@@ -222,21 +222,6 @@ export const classifyArtifactContent = (path, prefix) => {
         };
     return byPath;
 };
-export const pageOf = (items, offset, limit) => ({
-    items: items.slice(offset, offset + limit),
-    offset,
-    limit,
-    total: items.length,
-    next_offset: offset + limit < items.length ? offset + limit : null,
-});
-export const toOutputLimits = (limits) => ({
-    max_entries: limits.maxEntries,
-    max_total_bytes: limits.maxTotalBytes,
-    max_entry_bytes: limits.maxEntryBytes,
-    max_compression_ratio: limits.maxCompressionRatio,
-    max_depth: limits.maxDepth,
-    max_path_bytes: limits.maxPathBytes,
-});
 export const digestCanonical = (value) => {
     const encoded = canonicalize(value);
     if (encoded === undefined)

package/dist/application/ArtifactInventory/classify.js

@@ -1,6 +1,6 @@
 import { open } from "node:fs/promises";
 import { classifyArtifactPath } from "../ArtifactGraphConstruction.js";
-import { zipPackageFormatForPath } from "../../domain/zipPackageFormat.js";
+import { hasZipSignature, zipPackageFormatForPath, } from "../../domain/zipPackageFormat.js";
 const classifyContainerExtension = (path) => {
     const lower = path.toLowerCase();
     const zipPackage = zipPackageFormatForPath(lower);
@@ -21,11 +21,7 @@ export const classifyRoot = async (path, directory) => {
     try {
         const magic = Buffer.alloc(4);
         const observed = await handle.read(magic, 0, magic.length, 0);
-        if (observed.bytesRead === 4 &&
-            magic[0] === 0x50 &&
-            magic[1] === 0x4b &&
-            [0x03, 0x05, 0x07].includes(magic[2] ?? -1) &&
-            [0x04, 0x06, 0x08].includes(magic[3] ?? -1))
+        if (hasZipSignature(magic.subarray(0, observed.bytesRead)))
             return "zip";
         if (observed.bytesRead === 4) {
             const header = magic.readUInt32BE(0);

package/dist/application/ArtifactInventory/hash.js

@@ -1,25 +1,11 @@
 import { createHash } from "node:crypto";
-import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { streamChunkToBuffer } from "../../artifacts/StreamBytes.js";
 export const abortIfNeeded = (signal) => {
     if (signal?.aborted === true)
         throw new ArtifactReaderFailure("cancelled", "Artifact inventory cancelled");
 };
-export const preflightEntry = (entry, limits) => {
-    if (entry.declaredSize !== null && entry.declaredSize > limits.maxEntryBytes)
-        throw new ArtifactReaderFailure("limit", `Entry exceeds byte limit: ${entry.path}`);
-    if (entry.declaredSize !== null &&
-        entry.compressedSize !== null &&
-        entry.compressedSize === 0 &&
-        entry.declaredSize > 0)
-        throw new ArtifactReaderFailure("limit", `Invalid compression ratio: ${entry.path}`);
-    if (entry.declaredSize !== null &&
-        entry.compressedSize !== null &&
-        entry.compressedSize > 0 &&
-        entry.declaredSize / entry.compressedSize > limits.maxCompressionRatio)
-        throw new ArtifactReaderFailure("limit", `Compression ratio exceeds limit: ${entry.path}`);
-};
-export const hashReadable = async (stream, maximum, signal) => {
+export const hashReadable = async (stream, signal) => {
     const hash = createHash("sha256");
     const prefixes = [];
     let prefixBytes = 0;
@@ -28,10 +14,6 @@ export const hashReadable = async (stream, maximum, signal) => {
         abortIfNeeded(signal);
         const chunk = streamChunkToBuffer(raw);
         bytes += chunk.length;
-        if (bytes > maximum) {
-            stream.destroy();
-            throw new ArtifactReaderFailure("limit", "Observed entry bytes exceed limit");
-        }
         hash.update(chunk);
         if (prefixBytes < 16) {
             const selected = chunk.subarray(0, 16 - prefixBytes);

package/dist/application/ArtifactInventory/scanCanonical.js

@@ -2,29 +2,28 @@ import { createReadStream } from "node:fs";
 import { lstat } from "node:fs/promises";
 import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
 import { artifactInventoryResultSchema, } from "../../domain/artifactGraph.js";
-import { createArtifactEdges, createRootNode, digestCanonical, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, toOutputLimits, } from "../ArtifactGraphConstruction.js";
+import { createArtifactEdges, createRootNode, digestCanonical, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, } from "../ArtifactGraphConstruction.js";
 import { classifyRoot } from "./classify.js";
 import { hashReadable } from "./hash.js";
 import { createReader, inventoryLimitations } from "./reader.js";
 import { scanReader, } from "./scanReader.js";
 import { NATIVE_MOUNT_DISABLED, STRICT_INTEGRITY_POLICY, } from "./types.js";
-export const scanCanonicalArtifactInventory = async (path, limits, options = {}) => {
+export const scanCanonicalArtifactInventory = async (path, options = {}) => {
     const integrity = options.integrity ?? STRICT_INTEGRITY_POLICY;
     const metadata = await lstat(path);
     const rootFormat = await classifyRoot(path, metadata.isDirectory());
     const rootDigest = metadata.isDirectory()
         ? null
-        : await hashReadable(createReadStream(path), limits.maxTotalBytes, options.signal);
+        : await hashReadable(createReadStream(path), options.signal);
     const reader = await createReader(path, rootFormat, options.nativeMount ?? NATIVE_MOUNT_DISABLED, options.signal);
     try {
-        const { nodes, occurrences, pendingContradictions } = await scanReader(reader, limits, options.signal, integrity);
+        const { nodes, occurrences, pendingContradictions } = await scanReader(reader, options.signal, integrity);
         return await buildInventorySnapshot({
             path,
             metadata,
             rootFormat,
             rootDigest,
             reader,
-            limits,
             signal: options.signal,
             nodes,
             occurrences,
@@ -36,7 +35,7 @@ export const scanCanonicalArtifactInventory = async (path, limits, options = {})
     }
 };
 const buildInventorySnapshot = async (input) => {
-    const { path, metadata, rootFormat, rootDigest, reader, limits, signal } = input;
+    const { path, metadata, rootFormat, rootDigest, reader, signal } = input;
     materializeDirectoryNodes(input.occurrences, input.nodes);
     const rootNode = createRootNode({
         path,
@@ -62,7 +61,7 @@ const buildInventorySnapshot = async (input) => {
     const orderedNodes = sortNodes([...input.nodes.values()]);
     const orderedOccurrences = sortOccurrences(input.occurrences);
     const orderedEdges = sortEdges(edges);
-    await verifyRootDigest(path, rootDigest, limits.maxTotalBytes, signal);
+    await verifyRootDigest(path, rootDigest, signal);
     const graphSha256 = digestCanonical({
         nodes: orderedNodes,
         occurrences: orderedOccurrences,
@@ -81,7 +80,6 @@ const buildInventorySnapshot = async (input) => {
         nodes: orderedNodes,
         occurrences: orderedOccurrences,
         edges: orderedEdges,
-        limits: toOutputLimits(limits),
         provenance: reader?.provenance() ?? [],
         integrity_contradictions: integrityContradictions,
         limitations: buildLimitations(rootFormat, reader, integrityContradictions),
@@ -116,10 +114,10 @@ const buildIntegrityContradictions = (pending, occurrenceByPath, occurrenceById,
         ],
     };
 });
-const verifyRootDigest = async (path, rootDigest, maxTotalBytes, signal) => {
+const verifyRootDigest = async (path, rootDigest, signal) => {
     if (rootDigest === null)
         return;
-    const verified = await hashReadable(createReadStream(path), maxTotalBytes, signal);
+    const verified = await hashReadable(createReadStream(path), signal);
     if (verified.sha256 !== rootDigest.sha256 ||
         verified.bytes !== rootDigest.bytes)
         throw new ArtifactReaderFailure("integrity", "Root artifact changed during inventory");
@@ -128,9 +126,7 @@ const sortNodes = (nodes) => nodes.sort((left, right) => left.artifact_id.locale
 const sortOccurrences = (occurrences) => occurrences.sort((left, right) => left.logical_path.localeCompare(right.logical_path, "en"));
 const sortEdges = (edges) => edges.sort((left, right) => left.edge_id.localeCompare(right.edge_id));
 const buildManifest = ({ rootNode, graphSha256, orderedNodes, orderedOccurrences, orderedEdges, }) => artifactInventoryResultSchema.shape.manifest.parse({
-    schema_version: 1,
     manifest_id: `agm_${digestCanonical({
-        schema_version: 1,
         root_artifact_id: rootNode.artifact_id,
         graph_sha256: graphSha256,
     })}`,

package/dist/application/ArtifactInventory/scanReader.js

@@ -3,16 +3,15 @@ import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
 import { AsarArtifactReader } from "../../artifacts/AsarArtifactReader.js";
 import { classifyArtifactContent, createArtifactNode, createOccurrence, nearestParent, } from "../ArtifactGraphConstruction.js";
 import { STRICT_INTEGRITY_POLICY, } from "./types.js";
-import { hashReadable, preflightEntry } from "./hash.js";
+import { hashReadable } from "./hash.js";
 const UNAVAILABLE_UNPACKED_LIMITATION = "ASAR unpacked companion bytes were unavailable; no content hash or child artifact was produced.";
 const emptyScan = () => ({ nodes: new Map(), occurrences: [], pendingContradictions: [] });
-export const scanReader = async (reader, limits, signal, integrity = STRICT_INTEGRITY_POLICY) => {
+export const scanReader = async (reader, signal, integrity = STRICT_INTEGRITY_POLICY) => {
     const { nodes, occurrences, pendingContradictions } = emptyScan();
     if (reader === undefined)
         return { nodes, occurrences, pendingContradictions };
     const context = {
         reader,
-        limits,
         signal,
         integrity,
         nodes,
@@ -20,54 +19,84 @@ export const scanReader = async (reader, limits, signal, integrity = STRICT_INTE
         pendingContradictions,
         occurrenceByPath: new Map(),
         registry: new ArtifactPathRegistry(),
-        totalBytes: 0,
     };
     await visitArtifactEntries(context, reader, "");
     return { nodes, occurrences, pendingContradictions };
 };
 const visitArtifactEntries = async (context, currentReader, prefix) => {
-    for await (const entry of currentReader.entries(context.signal)) {
-        if (context.occurrences.length >= context.limits.maxEntries)
-            throw new ArtifactReaderFailure("limit", "Artifact entry limit exceeded");
-        const logicalPath = normalizeArtifactPath(prefix.length === 0 ? entry.path : `${prefix}/${entry.path}`, context.limits);
-        const expandableAsar = isExpandableAsar(entry, logicalPath);
-        context.registry.add(logicalPath, expandableAsar ? "directory" : entry.kind);
-        preflightEntry(entry, context.limits);
-        const parent = nearestParent(logicalPath, context.occurrenceByPath);
-        const occurrence = createOccurrence(entry, logicalPath, parent?.occurrence_id ?? null);
-        let digested;
-        try {
-            digested = await digestArtifactEntry(context, currentReader, entry, logicalPath);
-        }
-        catch (cause) {
-            if (!isUnavailableUnpackedEntry(cause, entry))
-                throw cause;
-            occurrence.hash_status = "unavailable";
-            occurrence.limitations.push(UNAVAILABLE_UNPACKED_LIMITATION);
-        }
-        if (digested !== undefined) {
-            context.nodes.set(digested.node.artifact_id, digested.node);
-            occurrence.artifact_id = digested.node.artifact_id;
-            occurrence.hash_status = digested.mismatched ? "mismatched" : "verified";
-            if (digested.mismatched)
-                occurrence.limitations.push("Declared integrity metadata contradicts observed bytes.");
+    const stack = [
+        {
+            reader: currentReader,
+            prefix,
+            iterator: currentReader.entries(context.signal)[Symbol.asyncIterator](),
+            owned: false,
+        },
+    ];
+    try {
+        while (stack.length > 0) {
+            const frame = stack.at(-1);
+            if (frame === undefined)
+                break;
+            const next = await frame.iterator.next();
+            if (next.done) {
+                stack.pop();
+                if (frame.owned)
+                    await frame.reader.close();
+                continue;
+            }
+            const entry = next.value;
+            const logicalPath = normalizeArtifactPath(frame.prefix.length === 0
+                ? entry.path
+                : `${frame.prefix}/${entry.path}`);
+            const expandableAsar = isExpandableAsar(entry, logicalPath);
+            context.registry.add(logicalPath, expandableAsar ? "directory" : entry.kind);
+            const parent = nearestParent(logicalPath, context.occurrenceByPath);
+            const occurrence = createOccurrence(entry, logicalPath, parent?.occurrence_id ?? null);
+            let digested;
+            try {
+                digested = await digestArtifactEntry(context, frame.reader, entry, logicalPath);
+            }
+            catch (cause) {
+                if (!isUnavailableUnpackedEntry(cause, entry))
+                    throw cause;
+                occurrence.hash_status = "unavailable";
+                occurrence.limitations.push(UNAVAILABLE_UNPACKED_LIMITATION);
+            }
+            if (digested !== undefined) {
+                context.nodes.set(digested.node.artifact_id, digested.node);
+                occurrence.artifact_id = digested.node.artifact_id;
+                occurrence.hash_status = digested.mismatched
+                    ? "mismatched"
+                    : "verified";
+                if (digested.mismatched)
+                    occurrence.limitations.push("Declared integrity metadata contradicts observed bytes.");
+            }
+            context.occurrences.push(occurrence);
+            context.occurrenceByPath.set(logicalPath, occurrence);
+            if (expandableAsar && digested?.mismatched !== true) {
+                const nested = new AsarArtifactReader(entry.adapterKey);
+                stack.push({
+                    reader: nested,
+                    prefix: logicalPath,
+                    iterator: nested.entries(context.signal)[Symbol.asyncIterator](),
+                    owned: true,
+                });
+            }
         }
-        context.occurrences.push(occurrence);
-        context.occurrenceByPath.set(logicalPath, occurrence);
-        if (expandableAsar && digested?.mismatched !== true)
-            await visitNestedAsar(context, entry.adapterKey, logicalPath);
+    }
+    finally {
+        await Promise.allSettled(stack
+            .filter(({ owned }) => owned)
+            .map(async ({ reader, iterator }) => {
+            await iterator.return?.();
+            await reader.close();
+        }));
     }
 };
 const digestArtifactEntry = async (context, currentReader, entry, logicalPath) => {
     if ((entry.kind !== "file" && entry.kind !== "slice") || entry.encrypted)
         return undefined;
-    const remainingBytes = context.limits.maxTotalBytes - context.totalBytes;
-    if (remainingBytes <= 0)
-        throw new ArtifactReaderFailure("limit", "Artifact total byte limit exceeded");
-    if (entry.declaredSize !== null && entry.declaredSize > remainingBytes)
-        throw new ArtifactReaderFailure("limit", "Declared artifact bytes exceed remaining cumulative limit");
-    const digest = await hashReadable(await currentReader.open(entry, context.signal), Math.min(context.limits.maxEntryBytes, remainingBytes), context.signal);
-    context.totalBytes += digest.bytes;
+    const digest = await hashReadable(await currentReader.open(entry, context.signal), context.signal);
     const mismatched = entry.declaredSha256 !== null && entry.declaredSha256 !== digest.sha256;
     if (mismatched && entry.declaredSha256 !== null) {
         if (context.integrity.mode === "fail")
@@ -77,8 +106,6 @@ const digestArtifactEntry = async (context, currentReader, entry, logicalPath) =
                 calculatedSha256: digest.sha256,
                 unpacked: entry.unpacked,
             });
-        if (context.pendingContradictions.length >= context.integrity.maxMismatches)
-            throw new ArtifactReaderFailure("limit", "Artifact integrity mismatch limit exceeded");
         context.pendingContradictions.push({
             logicalPath,
             declaredSha256: entry.declaredSha256,
@@ -107,15 +134,6 @@ const digestArtifactEntry = async (context, currentReader, entry, logicalPath) =
         mismatched,
     };
 };
-const visitNestedAsar = async (context, adapterKey, logicalPath) => {
-    const nested = new AsarArtifactReader(adapterKey);
-    try {
-        await visitArtifactEntries(context, nested, logicalPath);
-    }
-    finally {
-        await nested.close();
-    }
-};
 const isExpandableAsar = (entry, logicalPath) => entry.kind === "file" &&
     logicalPath.toLowerCase().endsWith(".asar") &&
     entry.adapterKey.startsWith("/");

package/dist/application/ArtifactInventory.js

@@ -1,24 +1,16 @@
 import { realpath } from "node:fs/promises";
 import { artifactInventoryResultSchema, } from "../domain/artifactGraph.js";
-import { pageOf } from "./ArtifactGraphConstruction.js";
 import { abortIfNeeded } from "./ArtifactInventory/hash.js";
 import { scanCanonicalArtifactInventory } from "./ArtifactInventory/scanCanonical.js";
 export { scanCanonicalArtifactInventory } from "./ArtifactInventory/scanCanonical.js";
-/** Inventory one local artifact without extracting or mounting it. */
-export const inventoryArtifact = async (inputPath, limits, page, options = {}) => {
-    const snapshot = await scanArtifactInventory(inputPath, limits, options);
-    return paginateArtifactInventory(snapshot, page);
+/** Inventory one local artifact and return every graph collection inline. */
+export const inventoryArtifact = async (inputPath, options = {}) => {
+    const snapshot = await scanArtifactInventory(inputPath, options);
+    return artifactInventoryResultSchema.parse(snapshot);
 };
 /** Scan an artifact once and retain the complete immutable graph for projection. */
-export const scanArtifactInventory = async (inputPath, limits, options = {}) => {
+export const scanArtifactInventory = async (inputPath, options = {}) => {
     abortIfNeeded(options.signal);
     const path = await realpath(inputPath);
-    return scanCanonicalArtifactInventory(path, limits, options);
+    return scanCanonicalArtifactInventory(path, options);
 };
-/** Project independently paged graph collections from one inventory snapshot. */
-export const paginateArtifactInventory = (snapshot, page) => artifactInventoryResultSchema.parse({
-    ...snapshot,
-    nodes: pageOf(snapshot.nodes, page.nodeOffset, page.nodeLimit),
-    occurrences: pageOf(snapshot.occurrences, page.occurrenceOffset, page.occurrenceLimit),
-    edges: pageOf(snapshot.edges, page.edgeOffset, page.edgeLimit),
-});