rea-agents 6.4.0 → 6.7.0

package/dist/domain/javascript/javascriptSymbolicControlFlow.js

@@ -0,0 +1,44 @@
+import * as t from "@babel/types";
+import { symbolicTruth, } from "./javascriptSymbolicValues.js";
+/** Whether short-circuit evaluation reaches the right operand; unknown stays unknown. */
+export const symbolicLogicalRight = (operator, left) => {
+    if (left.kind === "namespace" && left.runtimeValueUnknown)
+        return undefined;
+    if (left.kind === "union") {
+        const choices = left.values.map((value) => symbolicLogicalRight(operator, value));
+        return choices.length > 0 &&
+            choices.every((choice) => choice === choices[0])
+            ? choices[0]
+            : undefined;
+    }
+    if (operator === "??") {
+        if (left.kind === "literal")
+            return left.value === null || left.value === undefined;
+        return [
+            "function",
+            "object",
+            "namespace",
+            "array",
+            "record",
+            "loader",
+            "promise",
+            "iterator",
+        ].includes(left.kind)
+            ? false
+            : undefined;
+    }
+    const truth = symbolicTruth(left);
+    return truth === undefined ? undefined : operator === "&&" ? truth : !truth;
+};
+/** Only definite synchronous exits; unsupported control flow stays unknown. */
+export const symbolicDefiniteExit = (node, depth = 0) => {
+    if (!node || depth >= 128)
+        return false;
+    if (t.isReturnStatement(node) || t.isThrowStatement(node))
+        return true;
+    if (t.isBlockStatement(node))
+        return node.body.some((child) => symbolicDefiniteExit(child, depth + 1));
+    return (t.isIfStatement(node) &&
+        symbolicDefiniteExit(node.consequent, depth + 1) &&
+        symbolicDefiniteExit(node.alternate, depth + 1));
+};

package/dist/domain/javascript/javascriptSymbolicValues.js

@@ -0,0 +1,45 @@
+export const symbolicUnknown = (reason) => ({
+    kind: "unknown",
+    reason,
+});
+export const symbolicVariants = (value) => value.kind === "union" ? value.values : [value];
+export const symbolicUnion = (values) => {
+    const unique = [...new Set(values.flatMap(symbolicVariants))];
+    return unique.length === 1 ? unique[0] : { kind: "union", values: unique };
+};
+export const symbolicTruth = (value) => {
+    if (value.kind === "namespace" && value.runtimeValueUnknown)
+        return undefined;
+    if (value.kind === "union") {
+        const choices = value.values.map(symbolicTruth);
+        return choices.length > 0 &&
+            choices.every((choice) => choice === choices[0])
+            ? choices[0]
+            : undefined;
+    }
+    return value.kind === "literal"
+        ? Boolean(value.value)
+        : [
+            "function",
+            "object",
+            "namespace",
+            "array",
+            "record",
+            "loader",
+            "promise",
+            "iterator",
+        ].includes(value.kind)
+            ? true
+            : undefined;
+};
+/** Attach selection predicates to values while preserving their representation. */
+export const symbolicCondition = (value, condition) => {
+    if (value.kind === "union")
+        return symbolicUnion(value.values.map((variant) => symbolicCondition(variant, condition)));
+    return { ...value, conditions: [...(value.conditions ?? []), condition] };
+};
+export const symbolicConditionsUnresolved = (value) => {
+    if (value.kind === "union")
+        return symbolicUnion(value.values.map(symbolicConditionsUnresolved));
+    return { ...value, conditionUnresolved: true };
+};

package/dist/domain/javascript/sourceToBundleComparison.js

@@ -169,7 +169,9 @@ const classifyMapping = (candidates, absenceComplete, digestComparable) => {
             confidence: "unknown",
             currentNodeIds: [],
             limitations: [
-                "Only weak basename or extension signals were available; no mapping was forced.",
+                candidates.some((candidate) => hasSignal(candidate, "unicode-equivalent-path"))
+                    ? "Unicode-equivalent paths are inferred candidates only; filesystem paths with distinct Unicode spellings may identify different files, so no mapping was forced."
+                    : "Only weak basename or extension signals were available; no mapping was forced.",
             ],
         };
     return absenceComplete

package/dist/domain/javascript/sourceToBundleComparisonSchemas.js

@@ -12,6 +12,7 @@ export const SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS = [
     ["source-map-original-path", 70],
     ["current-path-exact", 60],
     ["current-path-suffix", 40],
+    ["unicode-equivalent-path", 20],
     ["basename-match", 20],
     ["language-extension", 5],
 ];
@@ -20,6 +21,7 @@ const sourceToBundleSignalKindSchema = z.enum([
     "source-map-original-path",
     "current-path-exact",
     "current-path-suffix",
+    "unicode-equivalent-path",
     "basename-match",
     "language-extension",
 ]);

package/dist/domain/javascript/sourceToBundleSignals.js

@@ -3,6 +3,9 @@ import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrde
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, } from "./sourceToBundleComparisonSchemas.js";
 import { isDigest } from "../digests.js";
 const RELEVANT_NODE_KINDS = new Set([
+    // Non-JavaScript source files such as JSON are projected as artifacts.
+    // Their content digests and paths still identify historical source files.
+    "artifact",
     "javascript-asset",
     "javascript-module",
     "source-module",
@@ -41,8 +44,12 @@ export const buildSourceToBundleCandidateIndex = (nodes) => {
         for (const path of projection.paths) {
             for (const suffix of path.allowSuffix
                 ? pathSuffixes(path.value)
-                : [path.value])
+                : [path.value]) {
                 addIndexValue(byPathSuffix, suffix, projection.node.node_id);
+                const canonical = suffix.normalize("NFC");
+                if (canonical !== suffix)
+                    addIndexValue(byPathSuffix, canonical, projection.node.node_id);
+            }
             addIndexValue(byBasename, posix.basename(path.value), projection.node.node_id);
         }
     }
@@ -55,9 +62,13 @@ export const buildSourceToBundleCandidateIndex = (nodes) => {
 };
 /** Candidate identifiers ordered by strongest available signal, then ID. */
 export const candidateIdsForSource = (source, index) => {
+    const canonicalPath = source.path.normalize("NFC");
     const groups = [
         source.sha256 === null ? undefined : index.byDigest.get(source.sha256),
         index.byPathSuffix.get(source.path),
+        canonicalPath === source.path
+            ? undefined
+            : index.byPathSuffix.get(canonicalPath),
         index.byBasename.get(posix.basename(source.path)),
     ];
     const seen = new Set();
@@ -103,7 +114,7 @@ const projectCurrentNode = (node) => {
             digests.add(node.identity.source_sha256);
     }
     if (node.identity.strategy === "canonical-path")
-        addPath(paths, "canonical-path", node.identity.path);
+        addPath(paths, "canonical-path", node.identity.path, "artifact");
     for (const observation of node.observations) {
         if (node.identity.strategy === "source-map-original") {
             const resolution = observation.source_map_reference?.resolution;
@@ -118,8 +129,18 @@ const projectCurrentNode = (node) => {
             const sourceDigest = observation.properties.source_sha256;
             if (typeof sourceDigest === "string" && isDigest(sourceDigest))
                 digests.add(sourceDigest);
-            for (const key of PATH_PROPERTIES)
-                addJsonPath(paths, observation.properties[key]);
+            for (const key of PATH_PROPERTIES) {
+                // A resolved declaration already has an owning artifact-path fact.
+                if (key === "declared_path" &&
+                    typeof observation.properties.resolved_path === "string")
+                    continue;
+                addJsonPath(paths, observation.properties[key], key === "resolved_path" ||
+                    ((key === "path" || key === "module_path") &&
+                        !(typeof observation.properties[key] === "string" &&
+                            SCHEME_URL.test(observation.properties[key])))
+                    ? "artifact"
+                    : "reference");
+            }
         }
     }
     return {
@@ -135,6 +156,9 @@ const candidateSignals = (source, current) => {
     const sourceMapPaths = matchingPaths(source.path, current.paths.filter(({ kind }) => kind === "source-map-original"));
     if (sourceMapPaths.length > 0)
         signals.push(signal("source-map-original-path", source.path, sourceMapPaths));
+    const unicodeEquivalentPaths = matchingUnicodePaths(source.path, current.paths);
+    if (unicodeEquivalentPaths.length > 0)
+        signals.push(signal("unicode-equivalent-path", source.path, unicodeEquivalentPaths));
     const otherPaths = current.paths.filter(({ kind }) => kind !== "source-map-original");
     const exactPaths = otherPaths
         .filter(({ value }) => value === source.path)
@@ -180,24 +204,37 @@ const matchingPaths = (sourcePath, currentPaths) => currentPaths
     .filter(({ value, allowSuffix }) => value === sourcePath ||
     (allowSuffix && value.endsWith(`/${sourcePath}`)))
     .map(({ value }) => value);
-const addJsonPath = (paths, value) => {
+const matchingUnicodePaths = (sourcePath, currentPaths) => {
+    const canonicalSource = sourcePath.normalize("NFC");
+    return currentPaths
+        .filter(({ value, allowSuffix }) => {
+        if (value === sourcePath ||
+            (allowSuffix && value.endsWith(`/${sourcePath}`)))
+            return false;
+        const canonicalValue = value.normalize("NFC");
+        return (canonicalValue === canonicalSource ||
+            (allowSuffix && canonicalValue.endsWith(`/${canonicalSource}`)));
+    })
+        .map(({ value }) => value);
+};
+const addJsonPath = (paths, value, format) => {
     if (typeof value === "string")
-        addPath(paths, "observation-path", value);
+        addPath(paths, "observation-path", value, format);
 };
-const addPath = (paths, kind, raw) => {
-    const value = normalizeCurrentPath(raw);
+const addPath = (paths, kind, raw, format) => {
+    const value = normalizeCurrentPath(raw, format);
     if (value !== null)
         paths.push({ kind, value, allowSuffix: true });
 };
 const SCHEME_URL = /^[a-z][a-z0-9+.-]*:\/\//iu;
 const SCHEME_URL_PREFIX = /^[a-z][a-z0-9+.-]*:\/\/+/iu;
-const normalizeCurrentPath = (raw) => {
-    const withoutQuery = SCHEME_URL.test(raw)
+const normalizeCurrentPath = (raw, format) => {
+    const withoutQuery = format === "reference" && SCHEME_URL.test(raw)
         ? (raw.split(/[?#]/u, 1)[0] ?? "")
         : raw;
-    const portable = withoutQuery
-        .replace(SCHEME_URL_PREFIX, "")
-        .replaceAll("\\", "/");
+    const portable = format === "artifact"
+        ? withoutQuery
+        : withoutQuery.replace(SCHEME_URL_PREFIX, "").replaceAll("\\", "/");
     const parts = [];
     for (const part of portable.split("/")) {
         if (part === "" || part === ".")

package/dist/domain/jsonValue.js

@@ -1,9 +1,9 @@
+import { types } from "node:util";
 import { z } from "zod";
 import { isImmutableJsonSnapshot } from "./immutableJson.js";
 /** Maximum JSON nesting accepted before recursive result cloning. */
 export const MAX_JSON_DEPTH = 1000;
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const recordShape = z.record(z.string(), z.unknown());
 const immutableValidation = new WeakMap();
 /** Validate JSON meaning and nesting without cloning a trusted immutable value. */
 export const jsonValueValidationIssue = (root) => {
@@ -41,6 +41,8 @@ export function* jsonValueValidationSteps(root) {
         if (item.depth > MAX_JSON_DEPTH)
             return finish(`JSON value exceeds maximum nesting depth of ${MAX_JSON_DEPTH}`);
         const value = item.value;
+        if (typeof value === "object" && value !== null && types.isProxy(value))
+            return finish("JSON values cannot contain proxies");
         if (value === null ||
             typeof value === "string" ||
             typeof value === "boolean")
@@ -50,13 +52,27 @@ export function* jsonValueValidationSteps(root) {
                 return finish("JSON numbers must be finite");
         }
         else if (Array.isArray(value)) {
-            for (const child of value)
-                pending.push({ value: child, depth: item.depth + 1 });
+            for (let index = 0; index < value.length; index += 1) {
+                const descriptor = Object.getOwnPropertyDescriptor(value, index);
+                if (descriptor === undefined || !Object.hasOwn(descriptor, "value"))
+                    return finish("JSON arrays require dense data properties without accessors");
+                pending.push({ value: descriptor.value, depth: item.depth + 1 });
+            }
         }
-        else if (isRecord(value) && recordShape.safeParse(value).success) {
-            // Inspect every own member, including keys Zod's record parser skips.
-            for (const child of Object.values(value))
-                pending.push({ value: child, depth: item.depth + 1 });
+        else if (isRecord(value)) {
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== Object.prototype && prototype !== null)
+                return finish("JSON objects require ordinary data properties");
+            for (const key of Reflect.ownKeys(value)) {
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                if (descriptor?.enumerable !== true)
+                    continue;
+                if (typeof key !== "string")
+                    return finish("JSON object keys must be strings");
+                if (!Object.hasOwn(descriptor, "value"))
+                    return finish("JSON objects cannot contain accessors");
+                pending.push({ value: descriptor.value, depth: item.depth + 1 });
+            }
         }
         else
             return finish("Invalid JSON value");
@@ -67,8 +83,12 @@ const preserveJsonValue = (value) => {
     const immutableCandidate = value;
     if (isImmutableJsonSnapshot(immutableCandidate))
         return value;
-    if (Array.isArray(value))
-        return value.map(preserveJsonValue);
+    if (Array.isArray(value)) {
+        const copy = [];
+        for (let index = 0; index < value.length; index += 1)
+            copy.push(preserveJsonValue(value[index]));
+        return copy;
+    }
     if (value !== null && typeof value === "object")
         return Object.fromEntries(Object.entries(value).map(([key, child]) => [
             key,
@@ -76,9 +96,14 @@ const preserveJsonValue = (value) => {
         ]));
     return value;
 };
-const validatedJsonValue = z.custom((value) => jsonValueValidationIssue(value) === undefined, {
-    error: (issue) => jsonValueValidationIssue(issue.input) ?? "Invalid JSON value",
-});
+const validatedJsonValue = z
+    .unknown()
+    .superRefine((value, context) => {
+    const issue = jsonValueValidationIssue(value);
+    if (issue !== undefined)
+        context.addIssue({ code: "custom", message: issue, continue: false });
+})
+    .transform((value) => value);
 // Keep both stages nonrecursive in public and Standard Schema projections.
 validatedJsonValue._zod.toJSONSchema = () => ({});
 /** Parse bounded JSON and retain all own data members without prototype setters. */

package/dist/domain/localPath.js

@@ -1,7 +1,9 @@
 import { isAbsolute, relative, sep } from "node:path";
 import { z } from "zod";
 /**
- * Preserve selected filesystem names while rejecting OS-invalid NUL bytes.
+ * Reject OS-invalid NUL bytes in a local filesystem name. This is not a path
+ * shape check: an empty or relative value is admitted here and narrowed by the
+ * callers that need a nonempty or absolute path.
  *
  * The pattern spells NUL as `\x00` rather than `\u0000`. Both accept exactly the
  * same strings. The hex form also avoids the short `\0` spelling rejected by
@@ -9,10 +11,11 @@ import { z } from "zod";
  * one advertised pattern cannot compile. See `offsetDateTimeSchema` for the
  * same hex-escape convention.
  */
-export const localPathStringSchema = z
+export const nulFreeStringSchema = z
     .string()
-    .min(1)
     .regex(/^[^\x00]*$/u, "Local filesystem paths cannot contain NUL");
+/** A selected local filesystem path: nonempty and free of NUL bytes. */
+export const localPathStringSchema = nulFreeStringSchema.min(1);
 /** Test lexical containment on the host platform; callers must resolve symlinks first. */
 export const isPathWithinRoot = (root, path) => {
     const value = relative(root, path);

package/dist/domain/managed/managedApplicationGraph.js

@@ -208,6 +208,11 @@ const projectionLimitations = (parsed, omissions) => [
     ...(omissions.partialInput
         ? ["At least one supplied managed Evidence record has partial coverage."]
         : []),
+    ...(omissions.selectedTypes === null
+        ? []
+        : [
+            `Managed member Evidence selected only these declaring types: ${omissions.selectedTypes.join(", ")}; type, method, and field nodes of other types are omitted, not absent.`,
+        ]),
     ...(omissions.unscopedTokenRelationships
         ? [
             "Managed boundary tokens were not linked to member nodes because matching module MVID scope was not established.",

package/dist/domain/managed/managedApplicationGraphCoverage.js

@@ -1,4 +1,7 @@
 import { managedTokenScopesMatch } from "./managedInspectionEvidence.js";
+const omitsAny = (omissions) => omissions.partialInput ||
+    omissions.unscopedTokenRelationships ||
+    omissions.selectedTypes !== null;
 const completeCoverage = () => ({
     status: "complete",
     truncated: false,
@@ -26,9 +29,10 @@ export const assessManagedGraphOmissions = (sources) => ({
         sources.boundaries?.coverage.state,
         sources.artifact?.coverage.state,
     ].some((state) => state !== undefined && state !== "complete"),
+    selectedTypes: sources.members?.selection?.type_names ?? null,
 });
 /** Derive graph coverage solely from the coverage of supplied source evidence. */
-export const managedGraphEvidenceCoverage = (omissions) => omissions.partialInput || omissions.unscopedTokenRelationships
+export const managedGraphEvidenceCoverage = (omissions) => omitsAny(omissions)
     ? {
         status: "partial",
         truncated: false,
@@ -38,7 +42,7 @@ export const managedGraphEvidenceCoverage = (omissions) => omissions.partialInpu
     : completeCoverage();
 /** Report whether all supplied source evidence was complete. */
 export const managedGraphResultCoverage = (omissions) => ({
-    status: omissions.partialInput || omissions.unscopedTokenRelationships
+    status: omitsAny(omissions)
         ? "partial"
         : "complete-within-inputs",
 });

package/dist/domain/managed/managedApplicationGraphNodes.js

@@ -2,7 +2,11 @@ import { basename } from "node:path";
 import { createJavaScriptApplicationEdge, createJavaScriptApplicationNode, } from "../javascript/javascriptApplicationGraph.js";
 import { managedSourceCoverage } from "./managedApplicationGraphCoverage.js";
 import { managedTokenScopesMatch } from "./managedInspectionEvidence.js";
-import {} from "./managedArtifact.js";
+/**
+ * Display label for a metadata name. Metadata may hold an empty name; the
+ * graph then has no label, while the node's properties keep the source value.
+ */
+const metadataLabel = (name) => name === "" ? null : name;
 /** Add the root managed artifact node to the graph state. */
 export const addArtifactNode = (state) => {
     const node = createJavaScriptApplicationNode({
@@ -37,7 +41,7 @@ export const addArtifactIdentityNodes = (state, artifactNode, parsed) => {
             identity: artifactLocalIdentity(state.artifactSha256, "managed-assembly", assemblyFacts.token),
             observations: [
                 {
-                    label: assemblyFacts.name,
+                    label: metadataLabel(assemblyFacts.name),
                     properties: {
                         name: assemblyFacts.name,
                         version: assemblyFacts.version,
@@ -63,7 +67,7 @@ export const addArtifactIdentityNodes = (state, artifactNode, parsed) => {
             identity: artifactLocalIdentity(state.artifactSha256, "managed-module", module.mvid?.toLowerCase() ?? module.token),
             observations: [
                 {
-                    label: module.name,
+                    label: metadataLabel(module.name),
                     properties: {
                         name: module.name,
                         mvid: module.mvid,
@@ -158,7 +162,7 @@ const typeNode = (state, type, evidence) => createJavaScriptApplicationNode({
     identity: artifactLocalIdentity(state.artifactSha256, "managed-type-token", type.token),
     observations: [
         {
-            label: type.full_name,
+            label: metadataLabel(type.full_name),
             properties: {
                 token: type.token,
                 namespace: type.namespace,
@@ -177,9 +181,9 @@ const methodNode = (state, method, evidence) => createJavaScriptApplicationNode(
     identity: artifactLocalIdentity(state.artifactSha256, "managed-method-token", method.token),
     observations: [
         {
-            label: method.declaring_type === null
+            label: metadataLabel(method.declaring_type === null
                 ? method.name
-                : `${method.declaring_type}.${method.name}`,
+                : `${method.declaring_type}.${method.name}`),
             properties: {
                 token: method.token,
                 declaring_type_token: method.declaring_type_token,
@@ -202,9 +206,9 @@ const fieldNode = (state, field, evidence) => createJavaScriptApplicationNode({
     identity: artifactLocalIdentity(state.artifactSha256, "managed-field-token", field.token),
     observations: [
         {
-            label: field.declaring_type === null
+            label: metadataLabel(field.declaring_type === null
                 ? field.name
-                : `${field.declaring_type}.${field.name}`,
+                : `${field.declaring_type}.${field.name}`),
             properties: {
                 token: field.token,
                 declaring_type_token: field.declaring_type_token,
@@ -270,7 +274,7 @@ const pinvokeNode = (state, pinvoke, evidence) => createJavaScriptApplicationNod
     identity: artifactLocalIdentity(state.artifactSha256, "managed-pinvoke-token", pinvoke.token),
     observations: [
         {
-            label: pinvoke.import_name,
+            label: metadataLabel(pinvoke.import_name),
             properties: {
                 token: pinvoke.token,
                 member_token: pinvoke.member_token,
@@ -291,7 +295,7 @@ const nativeImplementationNode = (state, implementation, evidence) => createJava
     identity: artifactLocalIdentity(state.artifactSha256, "managed-native-implementation-token", implementation.token),
     observations: [
         {
-            label: implementation.name,
+            label: metadataLabel(implementation.name),
             properties: {
                 token: implementation.token,
                 name: implementation.name,

package/dist/domain/managed/managedArtifact.js

@@ -70,6 +70,11 @@ const customAttributeSchema = z.object({
 const managedSignatureSchema = z.object({
     raw_length: z.number().int().min(0),
     raw_sha256: digestSchema,
+    // Evidence recorded before this field existed reads back as null.
+    resolved_sha256: digestSchema
+        .nullable()
+        .default(null)
+        .describe("SHA-256 of the raw signature with each TypeDef or TypeRef operand replaced by that type's namespace-qualified name; equals raw_sha256 when the signature names no types. Unlike raw_sha256 it does not depend on build-local metadata rows. Null when the signature could not be decoded or names a type REA could not resolve, such as a TypeSpec."),
     kind: z.enum(["method", "field", "unknown"]),
     parse_status: z.enum(["decoded", "partial", "unsupported", "malformed"]),
     calling_convention: z.string().nullable(),
@@ -86,8 +91,16 @@ const managedTypeSchema = z.object({
     namespace: z.string(),
     name: z.string(),
     full_name: z.string(),
+    name_sha256: digestSchema
+        .nullable()
+        .default(null)
+        .describe("Framed nominal namespace/name/enclosing-name digest, independent of build-local rows. Null for historical Evidence or unresolved nesting; defining assemblies and CLR runtime identity are not established."),
     flags: z.number().int().min(0).max(0xffff_ffff),
     extends_token: tokenSchema.nullable(),
+    enclosing_type_token: tokenSchema
+        .nullable()
+        .default(null)
+        .describe("Observed enclosing TypeDef from NestedClass; null when no enclosing entry was available, which alone does not establish top-level identity."),
     field_list: z.object({
         first_row: z.number().int().min(1).nullable(),
         last_row: z.number().int().min(0).nullable(),
@@ -99,6 +112,17 @@ const managedTypeSchema = z.object({
         count: z.number().int().min(0),
     }),
 });
+/** One ExportedType row: a type this assembly exports from another module or forwards. */
+const managedExportedTypeSchema = z.object({
+    token: tokenSchema,
+    row_offset: offsetSchema,
+    namespace: z.string(),
+    name: z.string(),
+    flags: z.number().int().min(0).max(0xffff_ffff),
+    forwarder: z.boolean(),
+    type_def_id: z.number().int().min(0).max(0xffff_ffff),
+    implementation_token: tokenSchema.nullable(),
+});
 const managedFieldSchema = z.object({
     token: tokenSchema,
     row_offset: offsetSchema,
@@ -171,13 +195,25 @@ const managedMethodSchema = z.object({
     signature: managedSignatureSchema,
     body: managedMethodBodySchema,
 });
+// Declaring types are namespace-qualified like TypeDef `full_name`, nested
+// types keep bare names, and a generic instantiation names its generic type.
+// Evidence recorded before declaring types were named reads them as null.
+const declaringTypeNameSchema = z.string().nullable().default(null);
 const managedMemberReferenceSchema = z.object({
     token: tokenSchema,
     row_offset: offsetSchema,
     parent_token: tokenSchema.nullable(),
+    parent_name: declaringTypeNameSchema.describe("Name of a TypeDef, TypeRef, or generic-instantiation TypeSpec parent; null for other parents or when unknown"),
     name: z.string(),
     signature: managedSignatureSchema,
 });
+const managedUserStringSchema = z.object({
+    token: tokenSchema,
+    offset: offsetSchema.describe("File offset of the #US item"),
+    value: z
+        .string()
+        .describe("Decoded UTF-16 code units, excluding the terminal flag byte; unpaired surrogates are kept"),
+});
 const managedModuleReferenceSchema = z.object({
     token: tokenSchema,
     row_offset: offsetSchema,
@@ -245,7 +281,11 @@ const managedCallEdgeSchema = z.object({
     opcode: z.string(),
     target_token: tokenSchema,
     target_kind: z.enum(["method-def", "member-ref", "method-spec", "unknown"]),
-    target_name: z.string().nullable(),
+    target_name: z
+        .string()
+        .nullable()
+        .describe("Method name; a method-spec target reports its generic method"),
+    target_declaring_type: declaringTypeNameSchema.describe("Declaring type of the called method; null when unknown"),
 });
 const managedFieldAccessSchema = z.object({
     method_token: tokenSchema,
@@ -253,6 +293,7 @@ const managedFieldAccessSchema = z.object({
     opcode: z.string(),
     field_token: tokenSchema,
     field_name: z.string().nullable(),
+    field_declaring_type: declaringTypeNameSchema.describe("Declaring type of the accessed field; null when unknown"),
 });
 const managedParseIssueSchema = z.object({
     code: z.enum([
@@ -366,6 +407,11 @@ export const managedArtifactInspectionSchema = z.object({
 });
 /** Provider-neutral, execution-free metadata/signature/IL member inspection. */
 export const managedMemberInspectionSchema = z.object({
+    signature_resolution: z
+        .literal("type-names-v1")
+        .nullable()
+        .default(null)
+        .describe("Signature type-name resolution was examined, including unresolved operands; null means historical Evidence without this attestation."),
     artifact: z.object({
         path: z.string().min(1),
         sha256: digestSchema,
@@ -384,11 +430,41 @@ export const managedMemberInspectionSchema = z.object({
         requires_mvid: cliMetadataGuidSchema.nullable(),
     }),
     types: z.array(managedTypeSchema),
+    // Member Evidence recorded before NestedClass rows were read omits this
+    // field; null is historical uncertainty. False means a current NestedClass
+    // row was unreadable or invalid, not that no nested types exist.
+    nesting_read: z
+        .boolean()
+        .nullable()
+        .default(null)
+        .describe("Whether all NestedClass rows were read and valid. Null for historical Evidence; false means current nesting is incomplete. Individual name digests can remain unresolved for missing, cyclic or over-deep enclosing chains."),
+    // Member Evidence recorded before ExportedType rows were read omits this
+    // field; null means the table was not examined, not that it was empty.
+    exported_types: z.array(managedExportedTypeSchema).nullable().default(null),
     fields: z.array(managedFieldSchema),
     methods: z.array(managedMethodSchema),
     member_refs: z.array(managedMemberReferenceSchema),
     call_edges: z.array(managedCallEdgeSchema),
     field_accesses: z.array(managedFieldAccessSchema),
+    // Distinct #US literals loaded by ldstr in the inspected method bodies, in
+    // token order, with their own coverage: #US issues never enter the member
+    // coverage. null means they were not examined, not that there were none.
+    user_strings: z
+        .object({
+        state: z.enum(["complete", "partial"]),
+        literals: z.array(managedUserStringSchema),
+        issues: z.array(managedParseIssueSchema),
+    })
+        .nullable()
+        .default(null),
+    /** Caller-selected declaring types; null when every type was inspected. */
+    selection: z
+        .object({
+        type_names: z.array(z.string().min(1)).min(1),
+        unmatched_type_names: z.array(z.string().min(1)),
+    })
+        .nullable()
+        .default(null),
     coverage: z.object({
         state: z.enum(["complete", "partial", "unavailable"]),
         issues: z.array(managedParseIssueSchema),

package/dist/domain/managed/managedInspectionEvidence.js

@@ -19,11 +19,10 @@ export const parseManagedInspectionEvidence = (rawEvidence, operation, schema) =
     const scope = result.identity_scope;
     if (scope !== undefined && scope.requires_artifact_sha256 !== artifactSha256)
         throw new TypeError(`Managed Evidence ${operation} (${evidence.evidence_id}) token scope SHA-256 ${scope.requires_artifact_sha256} does not match normalized artifact SHA-256 ${artifactSha256}`);
-    if (scope?.requires_mvid !== undefined &&
-        scope.requires_mvid !== null &&
-        result.module?.mvid !== undefined &&
-        result.module.mvid !== null &&
-        scope.requires_mvid.toLowerCase() !== result.module.mvid.toLowerCase())
-        throw new TypeError(`Managed Evidence ${operation} (${evidence.evidence_id}) token scope MVID ${scope.requires_mvid} does not match module MVID ${result.module.mvid}`);
+    const moduleMvid = result.module?.mvid ?? null;
+    const scopedMvid = scope?.requires_mvid;
+    if (scopedMvid !== undefined &&
+        scopedMvid?.toLowerCase() !== moduleMvid?.toLowerCase())
+        throw new TypeError(`Managed Evidence ${operation} (${evidence.evidence_id}) token scope MVID ${String(scopedMvid)} does not match module MVID ${String(moduleMvid)}`);
     return { evidence, result };
 };