rea-agents 6.4.0 → 6.7.0

package/dist/contracts/inputSchemaPresentation.js

@@ -1,28 +1,9 @@
 import { isDeepStrictEqual } from "node:util";
-export const schemaMaps = new Set([
-    "$defs",
-    "definitions",
-    "properties",
-    "patternProperties",
-    "dependentSchemas",
-    "dependencies",
-]);
-export const schemaArrays = new Set(["allOf", "anyOf", "oneOf", "prefixItems"]);
-export const schemaChildren = new Set([
-    "items",
-    "additionalItems",
-    "contains",
-    "additionalProperties",
-    "unevaluatedProperties",
-    "unevaluatedItems",
-    "propertyNames",
-    "not",
-    "if",
-    "then",
-    "else",
-]);
+import { schemaArrays, schemaChildren, schemaMaps, } from "./jsonSchemaKeywords.js";
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const resolveReference = (root, reference) => {
+    if (reference === "#")
+        return root;
     if (!reference.startsWith("#/"))
         return undefined;
     let value = root;
@@ -112,6 +93,170 @@ const inputGroup = (branch) => {
         .map((name) => `[${name}]`);
     return [...required, ...optional].join(" + ");
 };
+const isBooleanLiteralSchema = (schema) => isObject(schema) &&
+    (typeof schema.const === "boolean" ||
+        (Array.isArray(schema.enum) &&
+            schema.enum.length > 0 &&
+            schema.enum.every((value) => typeof value === "boolean")));
+const isBooleanSchema = (schema) => isObject(schema) &&
+    (schema.type === "boolean" || isBooleanLiteralSchema(schema));
+const preserveSharedDefault = (schema, branches) => {
+    if (schema.default !== undefined)
+        return;
+    const defaults = branches
+        .filter(isObject)
+        .map((branch) => branch.default)
+        .filter((value) => value !== undefined);
+    if (defaults.length > 0 &&
+        defaults.every((value) => isDeepStrictEqual(value, defaults[0])))
+        schema.default = defaults[0];
+};
+const normalizeAdvertisedSchema = (value) => {
+    if (!isObject(value))
+        return { schema: value, changed: false };
+    const node = { ...value };
+    let changed = false;
+    const normalizeMap = (map) => Object.fromEntries(Object.entries(map).map(([name, child]) => {
+        const result = normalizeAdvertisedSchema(child);
+        changed ||= result.changed;
+        return [name, result.schema];
+    }));
+    const normalizeList = (list) => list.map((child) => {
+        const result = normalizeAdvertisedSchema(child);
+        changed ||= result.changed;
+        return result;
+    });
+    for (const [key, child] of Object.entries(value)) {
+        if (schemaMaps.has(key) && isObject(child)) {
+            node[key] = normalizeMap(child);
+        }
+        else if (schemaArrays.has(key) &&
+            key !== "anyOf" &&
+            key !== "oneOf" &&
+            Array.isArray(child)) {
+            node[key] = normalizeList(child).map((result) => result.schema);
+        }
+        else if (schemaChildren.has(key) &&
+            key !== "not" &&
+            key !== "if" &&
+            key !== "then" &&
+            key !== "else") {
+            const results = Array.isArray(child)
+                ? normalizeList(child)
+                : [normalizeAdvertisedSchema(child)];
+            const nestedChanged = results.some((result) => result.changed);
+            if (key === "contains" &&
+                nestedChanged &&
+                value.maxContains !== undefined) {
+                delete node.contains;
+                delete node.minContains;
+                delete node.maxContains;
+                changed = true;
+            }
+            else {
+                node[key] = Array.isArray(child)
+                    ? results.map((result) => result.schema)
+                    : results[0]?.schema;
+                changed ||= nestedChanged;
+            }
+        }
+    }
+    if (typeof node.const === "boolean") {
+        delete node.const;
+        if (node.type === undefined)
+            node.type = "boolean";
+        changed = true;
+    }
+    if (Array.isArray(node.enum) &&
+        node.enum.length > 0 &&
+        node.enum.every((item) => typeof item === "boolean")) {
+        delete node.enum;
+        if (node.type === undefined)
+            node.type = "boolean";
+        changed = true;
+    }
+    const negated = Object.hasOwn(value, "not")
+        ? normalizeAdvertisedSchema(value.not)
+        : undefined;
+    if (negated?.changed) {
+        // Widening a predicate under `not` narrows the containing schema.
+        changed = true;
+        delete node.not;
+    }
+    else if (negated !== undefined) {
+        node.not = negated.schema;
+    }
+    const conditional = Object.hasOwn(value, "if")
+        ? normalizeAdvertisedSchema(value.if)
+        : undefined;
+    const thenBranch = Object.hasOwn(value, "then")
+        ? normalizeAdvertisedSchema(value.then)
+        : undefined;
+    const elseBranch = Object.hasOwn(value, "else")
+        ? normalizeAdvertisedSchema(value.else)
+        : undefined;
+    if (conditional?.changed) {
+        // Changing the predicate can route canonical-valid inputs into a rejecting branch.
+        changed = true;
+        delete node.if;
+        delete node.then;
+        delete node.else;
+    }
+    else {
+        if (conditional !== undefined)
+            node.if = conditional.schema;
+        if (thenBranch !== undefined) {
+            node.then = thenBranch.schema;
+            changed ||= thenBranch.changed;
+        }
+        if (elseBranch !== undefined) {
+            node.else = elseBranch.schema;
+            changed ||= elseBranch.changed;
+        }
+    }
+    for (const combinator of ["anyOf", "oneOf"]) {
+        const branches = value[combinator];
+        if (!Array.isArray(branches))
+            continue;
+        const normalized = normalizeList(branches);
+        const schemas = normalized.map((result) => result.schema);
+        const branchesChanged = normalized.some((result) => result.changed);
+        if (combinator === "oneOf" && branchesChanged) {
+            const booleanLiteralsOnly = branches.every(isBooleanLiteralSchema);
+            if (booleanLiteralsOnly) {
+                node.type = "boolean";
+                preserveSharedDefault(node, schemas);
+                delete node.oneOf;
+                changed = true;
+                continue;
+            }
+            // `anyOf` retains branch guidance without allowing widened branches to
+            // reject inputs that were accepted by exactly one canonical branch.
+            delete node.oneOf;
+            if (Array.isArray(node.anyOf)) {
+                const existingAllOf = Array.isArray(node.allOf) ? node.allOf : [];
+                node.allOf = [...existingAllOf, { anyOf: schemas }];
+            }
+            else {
+                node.anyOf = schemas;
+            }
+            changed = true;
+            continue;
+        }
+        if (branchesChanged &&
+            schemas.length > 0 &&
+            schemas.every(isBooleanSchema)) {
+            node.type = "boolean";
+            preserveSharedDefault(node, schemas);
+            delete node[combinator];
+            changed = true;
+            continue;
+        }
+        node[combinator] = schemas;
+        changed ||= branchesChanged;
+    }
+    return { schema: node, changed };
+};
 // Anthropic tool input schemas reject anyOf, oneOf, and allOf at the root, and
 // clients then drop the tool or advertise it without parameters. Present a
 // root union of strict object groups as one object whose properties are the
@@ -135,13 +280,8 @@ const flattenRootObjectUnion = (root) => {
             variants.set(name, known);
         }
     const required = sharedRequiredProperties(branches);
-    // A field unique to a group still needs that group's required partners.
-    // Counting properties alone would let optional fields pad an incomplete pair.
-    const dependencies = Object.fromEntries([...variants.keys()].flatMap((name) => {
-        const owners = branches.filter((branch) => Object.hasOwn(branch.properties ?? {}, name));
-        const partners = sharedRequiredProperties(owners).filter((partner) => partner !== name && !required.includes(partner));
-        return partners.length > 0 ? [[name, partners]] : [];
-    }));
+    // A coarse property minimum rejects underspecified objects. Partner fields
+    // and exact group membership remain enforced by the canonical runtime parser.
     const fewestRequired = Math.min(...branches.map((branch) => requiredProperties(branch).length));
     // Groups that differ only in property values add no caller guidance.
     const groups = [...new Set(branches.map(inputGroup))];
@@ -151,8 +291,9 @@ const flattenRootObjectUnion = (root) => {
             ? `Provide a complete input group: ${groups.join("; ")}.`
             : undefined,
     ].filter((text) => text !== undefined);
+    const { dependencies: _dependencies, dependentRequired: _dependentRequired, ...presentation } = rest;
     return {
-        ...rest,
+        ...presentation,
         type: "object",
         ...(description.length > 0 ? { description: description.join(" ") } : {}),
         properties: Object.fromEntries([...variants].map(([name, schemas]) => [
@@ -161,13 +302,6 @@ const flattenRootObjectUnion = (root) => {
         ])),
         ...(required.length > 0 ? { required } : {}),
         ...(fewestRequired > 0 ? { minProperties: fewestRequired } : {}),
-        ...(Object.keys(dependencies).length > 0
-            ? {
-                [root.$schema === "http://json-schema.org/draft-07/schema#"
-                    ? "dependencies"
-                    : "dependentRequired"]: dependencies,
-            }
-            : {}),
         ...(branches.every((branch) => branch.additionalProperties === false)
             ? { additionalProperties: false }
             : {}),
@@ -177,5 +311,32 @@ const flattenRootObjectUnion = (root) => {
 export const presentInputJsonSchema = (root, describeProperty) => {
     const flattened = flattenRootObjectUnion(root);
     const described = describeSchema(flattened, flattened, describeProperty);
-    return isObject(described) ? described : flattened;
+    if (!isObject(described))
+        return normalizeAdvertisedSchema(flattened).schema;
+    const { dependencies: _dependencies, dependentRequired: _dependentRequired, ...presentation } = described;
+    const rootDependencies = isObject(described.dependentRequired)
+        ? described.dependentRequired
+        : isObject(described.dependencies)
+            ? described.dependencies
+            : undefined;
+    const dependencyGuidance = rootDependencies === undefined
+        ? []
+        : Object.entries(rootDependencies).flatMap(([property, partners]) => Array.isArray(partners) &&
+            partners.every((partner) => typeof partner === "string")
+            ? [
+                `When ${property} is provided, also provide ${partners.join(" and ")}.`,
+            ]
+            : []);
+    if (dependencyGuidance.length === 0)
+        return normalizeAdvertisedSchema(presentation).schema;
+    const description = [
+        typeof presentation.description === "string"
+            ? presentation.description
+            : undefined,
+        ...dependencyGuidance,
+    ].filter((text) => text !== undefined);
+    return normalizeAdvertisedSchema({
+        ...presentation,
+        description: description.join(" "),
+    }).schema;
 };

package/dist/contracts/investigationExamples.js

@@ -20,6 +20,7 @@ export const FUNCTION_COMPARISON_EVIDENCE = createEvidence(undefined, {
     result: jsonValueSchema.parse(comparison),
     confidence: "derived",
     authority: "analyst-inference",
+    limitations: comparison.limitations,
     evidenceLinks: [
         FUNCTION_COMPARISON_EXAMPLE.left.evidence_id,
         FUNCTION_COMPARISON_EXAMPLE.right.evidence_id,

package/dist/contracts/javascript/electronToolContracts.js

@@ -1,7 +1,10 @@
 import { toolContractMetadata } from "../toolEffects.js";
+import { electronFuseOutputSchemas } from "../toolOutputSchemaGroups.js";
 import { evidenceResultOf } from "../toolOutputSchemaPrimitives.js";
+import { inspectElectronFusesInputSchema } from "../../domain/electron/electronFuses.js";
 import { electronPageInspectionSchema, electronTargetListSchema, inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../../domain/javascript/electronObservation.js";
 import { electronActiveObservationInputSchema, electronActiveObservationResultSchema, } from "../../domain/javascript/electronActiveObservation.js";
+import { javascriptApplicationSummaryViewResultSchema } from "../../domain/analysisView/analysisView.js";
 import { analysisDetailOutputSchemaOf, analysisDetailSchema, } from "../analysisDetail.js";
 import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { javascriptRuntimeReconciliationResultSchema, reconcileJavaScriptRuntimeInputSchema, } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
@@ -12,7 +15,7 @@ const inspectionOutputSchema = evidenceResultOf(electronPageInspectionSchema);
 export const analyzeJavaScriptApplicationRequestSchema = analyzeJavaScriptApplicationInputSchema.extend({
     detail: analysisDetailSchema,
 });
-const applicationOutputSchema = analysisDetailOutputSchemaOf(javascriptApplicationAnalysisResultSchema);
+const applicationOutputSchema = analysisDetailOutputSchemaOf(javascriptApplicationAnalysisResultSchema, javascriptApplicationSummaryViewResultSchema);
 const reconciliationOutputSchema = evidenceResultOf(javascriptRuntimeReconciliationResultSchema);
 const endpoint = "http://127.0.0.1:9223";
 const activeExample = {
@@ -59,7 +62,7 @@ export const ELECTRON_TOOL_CONTRACTS = [
     {
         name: "analyze_javascript_application",
         ...toolContractMetadata("analyze_javascript_application"),
-        description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Select detail summary to retain the complete analysis Evidence in this session and receive only its summary view, then inspect selected modules or pages with inspect_analysis_view. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial.",
+        description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Select source_paths to acquire and analyze only exact inventoried file paths; the complete artifact inventory and identity remain intact, and unselected sources remain explicit unknowns. Dependencies are not implicitly analyzed. Select detail summary to retain the complete analysis Evidence in this session and receive only its summary view, then inspect selected modules or pages with inspect_analysis_view. Summary detail reduces delivery, whereas source_paths bounds source analysis. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial.",
         kind: "electron-provider",
         inputSchema: analyzeJavaScriptApplicationRequestSchema,
         outputSchema: applicationOutputSchema,
@@ -72,6 +75,14 @@ export const ELECTRON_TOOL_CONTRACTS = [
                     integrity_policy: "fail",
                 },
             },
+            {
+                title: "Analyze selected entry sources before unrelated vendor files",
+                input: {
+                    input_path: "/Applications/Example.app/Contents/Resources/app.asar",
+                    source_paths: ["package.json", "main.js", "preload.js"],
+                    detail: "summary",
+                },
+            },
             {
                 title: "Retain the complete analysis and return its summary view",
                 input: {
@@ -106,4 +117,18 @@ export const ELECTRON_TOOL_CONTRACTS = [
             { title: "Exercise an owned Electron application", input: activeExample },
         ],
     },
+    {
+        name: "inspect_electron_fuses",
+        ...toolContractMetadata("inspect_electron_fuses"),
+        kind: "artifact-provider",
+        description: "Inspect packaged Electron fuse bytes in one local macOS app bundle, Electron Framework binary, Windows PE executable, or Linux ELF executable. Returns the artifact digest, per-slice wire version, fuse index, version-1 name, state, and raw byte, plus derived implications for Inspector flags, ELECTRON_RUN_AS_NODE, embedded ASAR integrity, and app.asar-only loading. A missing sentinel is unknown fuse state. Reads artifact bytes only and does not modify the selected file or open a runtime target.",
+        inputSchema: inspectElectronFusesInputSchema,
+        outputSchema: electronFuseOutputSchemas.inspect_electron_fuses,
+        examples: [
+            {
+                title: "Read packaged Electron fuse state",
+                input: { path: "/Applications/Example.app" },
+            },
+        ],
+    },
 ];

package/dist/contracts/javascript/javascriptExportShapeComparisonExample.js

@@ -54,6 +54,7 @@ const statistics = {
     text_bytes_read: 60,
     invalid_utf8_files: 0,
     parsed_javascript_files: 1,
+    skipped_javascript_files: 0,
     visited_ast_nodes: 12,
     findings: 1,
     modules: 0,

package/dist/contracts/javascript/javascriptRecoveryToolContracts.js

@@ -7,7 +7,7 @@ export const JAVASCRIPT_RECOVERY_TOOL_CONTRACTS = [
         name: "recover_javascript_sources",
         ...toolContractMetadata("recover_javascript_sources"),
         kind: "application",
-        description: "Recover readable modules from one local UTF-8 JavaScript script/bundle into an absent directory, using caller-supplied Wakaru ^1.13.0 (verified with 1.14.0) on Linux x64. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
+        description: "Recover readable modules from local UTF-8 JavaScript scripts/bundles into an absent directory, using caller-supplied Wakaru ^1.13.0 (verified with 1.14.0) on Linux x64. Use additional_paths for related chunks; each input retains its own snapshot and provenance. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB total input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.",
         inputSchema: javascriptRecoveryInputSchema,
         outputSchema: evidenceResultOf(javascriptRecoveryResultSchema),
         examples: [
@@ -18,6 +18,18 @@ export const JAVASCRIPT_RECOVERY_TOOL_CONTRACTS = [
                     output_directory: "/tmp/recovered-app",
                 },
             },
+            {
+                title: "Recover a code-split bundle together",
+                input: {
+                    path: "/tmp/web-scripts/main.js",
+                    additional_paths: [
+                        "/tmp/web-scripts/runtime.js",
+                        "/tmp/web-scripts/shared.js",
+                        "/tmp/web-scripts/checkout.chunk.js",
+                    ],
+                    output_directory: "/tmp/recovered-chunks",
+                },
+            },
         ],
     },
 ];

package/dist/contracts/javascript/javascriptRuntimeReconciliationExample.js

@@ -147,6 +147,7 @@ export const JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE = createEvidence({ path: in
             text_bytes_read: script.bytes,
             invalid_utf8_files: 0,
             parsed_javascript_files: 1,
+            skipped_javascript_files: 0,
             visited_ast_nodes: 1,
             findings: 0,
             modules: 0,

package/dist/contracts/jsonSchemaKeywords.js

@@ -0,0 +1,29 @@
+export const schemaMaps = new Set([
+    "$defs",
+    "definitions",
+    "properties",
+    "patternProperties",
+    "dependentSchemas",
+    "dependencies",
+]);
+export const schemaArrays = new Set(["allOf", "anyOf", "oneOf", "prefixItems"]);
+export const schemaChildren = new Set([
+    "items",
+    "additionalItems",
+    "contains",
+    "additionalProperties",
+    "unevaluatedProperties",
+    "unevaluatedItems",
+    "propertyNames",
+    "not",
+    "if",
+    "then",
+    "else",
+]);
+/** Instance values, unless explicitly reached by a schema reference. */
+export const schemaLiteralValues = new Set([
+    "const",
+    "enum",
+    "default",
+    "examples",
+]);

package/dist/contracts/managed/managedToolContracts.js

@@ -4,6 +4,7 @@ import { managedOutputSchemas } from "../toolOutputSchemaGroups.js";
 import { toolContractMetadata } from "../toolEffects.js";
 import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
 import { localPathStringSchema } from "../../domain/localPath.js";
+import { analysisDetailSchema } from "../analysisDetail.js";
 /** Exact caller boundary for execution-free PE/CLI triage and identity. */
 export const managedTargetInputSchema = z.strictObject({
     path: localPathStringSchema
@@ -13,6 +14,25 @@ export const managedTargetInputSchema = z.strictObject({
         .describe("Explicit absolute managed PE/CLI path; omit to reuse the previously selected managed target")
         .optional(),
 });
+/** Delivery selection belongs to artifact and member inspection, not native queries. */
+export const managedArtifactInputSchema = managedTargetInputSchema.extend({
+    detail: analysisDetailSchema.unwrap().optional(),
+});
+/** Member inspection may select declaring types before members are decoded. */
+export const managedMembersInputSchema = managedArtifactInputSchema.extend({
+    type_names: z
+        .array(z
+        .string()
+        .min(1)
+        .describe("Exact declaring-type full_name: namespace-qualified for top-level types (System.Threading.Monitor); nested types report their bare name, so it selects every nested type of that name"))
+        .min(1)
+        .refine((names) => new Set(names).size === names.length, {
+        message: "type_names must not repeat a name",
+    })
+        .meta({ uniqueItems: true })
+        .describe("Inspect only the fields, methods, call edges, and field accesses declared by these exact type full names, and the user strings their method bodies load; omit to inspect every type. Unmatched names are reported in selection.unmatched_type_names.")
+        .optional(),
+});
 const outputSchema = requireOutputSchema(managedOutputSchemas, "inspect_managed_artifact");
 const memberOutputSchema = requireOutputSchema(managedOutputSchemas, "inspect_managed_members");
 const nativeBoundaryOutputSchema = requireOutputSchema(managedOutputSchemas, "inspect_managed_native_boundaries");
@@ -21,29 +41,48 @@ export const MANAGED_TOOL_CONTRACTS = [
     {
         name: "inspect_managed_artifact",
         ...toolContractMetadata("inspect_managed_artifact"),
-        description: "Open and classify an explicit managed PE/CLI path, or inspect the active managed target, then inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns complete inline inventories when metadata is admitted and explicit partial or malformed coverage otherwise.",
+        description: 'Inspect an explicit PE/CLI path, or the selected managed target, without loading or executing target code. Omitted or complete detail returns complete metadata inventories with original coverage. Select detail: "summary" on the first call for complete identity, PE/CLI, classification with its evidence, module/MVID, assembly, frameworks, returned-collection counts, coverage/issues and limitations. It retains complete Evidence and returns a distinct linked inspect_analysis_view summary. Page original references/resources/attributes with view kind managed and normalized_result.parent_evidence_id. Counts cover producer-returned rows; partial, unavailable or malformed metadata remains explicit and tokens remain build-local.',
         kind: "managed-provider",
-        inputSchema: managedTargetInputSchema,
+        inputSchema: managedArtifactInputSchema,
         outputSchema,
         examples: [
             {
                 title: "Example inspect managed artifact request",
                 input: { path: "/tmp/Example.dll" },
             },
+            {
+                title: "Inspect identity and coverage without unrelated metadata inventories",
+                input: { path: "/tmp/Example.dll", detail: "summary" },
+            },
         ],
     },
     {
         name: "inspect_managed_members",
         ...toolContractMetadata("inspect_managed_members"),
-        description: "Inspect PE/CLI metadata members, signatures, raw CIL hashes, decoded-instruction-tuple hashes, separately reported exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID; the tuple hash does not resolve them or fully commit control flow.",
+        description: 'Inspect PE/CLI metadata members, signatures, raw CIL hashes, decoded-instruction-tuple hashes, separately reported exception regions, call edges, field-access anchors, and the #US string literals that ldstr loads, without loading or executing target code. Select type_names to decode only the members of those exact declaring types and the literals their bodies load, which keeps large assemblies such as a base class library within the representation budget. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID; the tuple hash does not resolve them or fully commit control flow. Omitted or complete detail returns every collection, including the assembly-wide member_refs and exported_types, which type_names does not narrow. Select detail: "summary" for identity, metadata status, selection with unmatched names, coverage/issues, limitations and per-collection counts; it retains complete Evidence and returns a linked inspect_analysis_view summary. Page original rows with view kind managed-members, normalized_result.parent_evidence_id and collection types/exported_types/fields/methods/member_refs/call_edges/field_accesses/user_strings.',
         kind: "managed-provider",
-        inputSchema: managedTargetInputSchema,
+        inputSchema: managedMembersInputSchema,
         outputSchema: memberOutputSchema,
         examples: [
             {
                 title: "Example inspect managed members request",
                 input: {},
             },
+            {
+                title: "Example inspect selected managed types request",
+                input: {
+                    path: "/tmp/mscorlib.dll",
+                    type_names: ["System.Threading.Monitor"],
+                },
+            },
+            {
+                title: "Summarize selected managed types and retain their members",
+                input: {
+                    path: "/tmp/mscorlib.dll",
+                    type_names: ["System.Threading.Monitor"],
+                    detail: "summary",
+                },
+            },
         ],
     },
     {

package/dist/contracts/managed/managedWorkflowExamples.js

@@ -10,6 +10,7 @@ const NATIVE_EXAMPLE_PROVIDER = {
     version: "1",
 };
 const emptyManagedMembers = (sha256, mvid) => ({
+    signature_resolution: null,
     artifact: {
         path: `/examples/${sha256.slice(0, 8)}.dll`,
         sha256,
@@ -36,11 +37,15 @@ const emptyManagedMembers = (sha256, mvid) => ({
         requires_mvid: mvid,
     },
     types: [],
+    nesting_read: true,
+    exported_types: [],
     fields: [],
     methods: [],
     member_refs: [],
     call_edges: [],
     field_accesses: [],
+    user_strings: { state: "complete", literals: [], issues: [] },
+    selection: null,
     coverage: { state: "complete", issues: [] },
     limitations: [],
 });
@@ -68,6 +73,7 @@ const runtimeMembers = () => {
                 signature: {
                     raw_length: 3,
                     raw_sha256: "3".repeat(64),
+                    resolved_sha256: "3".repeat(64),
                     kind: "method",
                     parse_status: "decoded",
                     calling_convention: "default",
@@ -197,6 +203,7 @@ const boundaryEvidence = () => {
 const nativeExportEvidence = () => {
     const result = {
         format: "mach-o",
+        selected_architecture: { name: "x86_64", container_file_offset: null },
         endian: "little",
         word_size: 64,
         file_type: "dylib",
@@ -219,7 +226,9 @@ const nativeExportEvidence = () => {
         ]),
         segments: coverage([]),
         provenance: [],
-        limitations: [],
+        limitations: [
+            "Selected Mach-O slice container offset is unknown in this synthetic example.",
+        ],
     };
     return createEvidence({
         path: "/examples/nativehelper.dll",

package/dist/contracts/managed/managedWorkflowToolContracts.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { evidenceSchema } from "../../domain/evidence.js";
+import { managedNativeVerificationInputSchema } from "../../domain/managed/managedNativeVerificationSchemas.js";
 import { managedReconstructionImportInputSchema } from "../../domain/managed/managedReconstruction.js";
 import { managedWorkflowOutputSchemas } from "../toolOutputSchemaGroups.js";
 import { MANAGED_MEMBER_COMPARISON_EXAMPLE, MANAGED_NATIVE_VERIFICATION_EXAMPLE, MANAGED_APPLICATION_GRAPH_EXAMPLE, MANAGED_RECONSTRUCTION_IMPORT_EXAMPLE, } from "./managedWorkflowExamples.js";
@@ -23,33 +24,6 @@ export const compareManagedMembersReferenceInputSchema = z
 export const managedReconstructionReferenceInputSchema = managedReconstructionImportInputSchema.extend({
     static_members: evidenceSchema,
 });
-/** Inline Evidence inputs for managed/native verification. */
-export const managedNativeVerificationReferenceInputSchema = z
-    .strictObject({
-    managed_boundaries: evidenceSchema,
-    native_observations: z
-        .array(evidenceSchema)
-        .min(1)
-        .describe("Native function or export Evidence records"),
-})
-    .superRefine((input, context) => {
-    const ids = new Set([input.managed_boundaries.evidence_id]);
-    for (const [index, evidence] of input.native_observations.entries()) {
-        if (evidence.evidence_id === input.managed_boundaries.evidence_id)
-            context.addIssue({
-                code: "custom",
-                path: ["native_observations", index],
-                message: "Native observation Evidence must be distinct from managed boundary Evidence",
-            });
-        if (ids.has(evidence.evidence_id))
-            context.addIssue({
-                code: "custom",
-                path: ["native_observations", index],
-                message: "Native observation Evidence IDs must be unique",
-            });
-        ids.add(evidence.evidence_id);
-    }
-});
 const managedApplicationGraphReferenceFacts = {};
 const managedApplicationGraphReferenceShape = z.strictObject({
     ...managedApplicationGraphReferenceFacts,
@@ -96,7 +70,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     {
         name: "compare_managed_members",
         ...toolContractMetadata("compare_managed_members"),
-        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact CIL/signature, exact declared type, name, and raw signature (decoded or not), and decoded structural method shape. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
+        description: "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact declared type, name, and CIL/signature; exact declared type, name, and signature (decoded or not); exact declared type, name, and decoded structural method shape; then exact CIL/signature or decoded structural method shape alone, which never takes a member whose own declared type and name remain unpaired on the other side or whose declaring type is unresolved. Signatures compare type operands by name, not by build-local metadata row. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.",
         kind: "application",
         inputSchema: compareManagedMembersReferenceInputSchema,
         outputSchema: comparisonOutputSchema,
@@ -113,9 +87,9 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [
     {
         name: "verify_managed_native_boundaries",
         ...toolContractMetadata("verify_managed_native_boundaries"),
-        description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states.",
+        description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states; a name candidate with missing managed or native module identity remains unresolved with its candidate evidence retained.",
         kind: "application",
-        inputSchema: managedNativeVerificationReferenceInputSchema,
+        inputSchema: managedNativeVerificationInputSchema,
         outputSchema: nativeVerificationOutputSchema,
         examples: [
             {