rea-agents 6.5.0 → 6.7.0

package/dist/server/registerInvestigationTools.js

@@ -8,20 +8,23 @@ import { comparisonClosure, evidenceClosure, functionEvidenceIds, isIncomplete,
 import { runDerivedOperation } from "./runDerivedOperation.js";
 import { CALL_PATH_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, RECONSTRUCTION_PROVIDER, STATIC_RUNTIME_PROVIDER, } from "../application/InvestigationProviders.js";
 import { applicationValidatedInputSchema, toolRegistrationOptions, } from "./toolRegistrationOptions.js";
+import { withAdmittedAnalysis } from "./analysisAdmission.js";
+import { runAdmittedToolOperation } from "./admittedToolOperation.js";
 import { verifyReconstruction } from "../domain/reconstructionVerification.js";
 /** Register Evidence-composed differential investigation workflows. */
 export const registerInvestigationTools = (server, session) => {
-    registerChangedBehavior(server, session, toolContract("find_changed_behavior"));
-    registerCallPath(server, session, toolContract("build_call_path"));
-    registerStaticRuntime(server, session, toolContract("correlate_static_and_runtime"));
-    registerReconstruction(server, session, toolContract("verify_reconstruction"));
+    const admission = withAdmittedAnalysis({ kind: "session", session });
+    registerChangedBehavior(server, session, admission, toolContract("find_changed_behavior"));
+    registerCallPath(server, session, admission, toolContract("build_call_path"));
+    registerStaticRuntime(server, session, admission, toolContract("correlate_static_and_runtime"));
+    registerReconstruction(server, session, admission, toolContract("verify_reconstruction"));
 };
-const registerChangedBehavior = (server, session, contract) => {
+const registerChangedBehavior = (server, session, admission, contract) => {
     const registration = toolRegistrationOptions(contract);
     server.registerTool(contract.name, {
         ...registration,
         inputSchema: applicationValidatedInputSchema(registration.inputSchema),
-    }, async (input, context) => {
+    }, async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         const computed = await runDerivedOperation(context, contract.name, () => findChangedBehavior(input));
         if (!computed.ok)
             return server.delivery.toCallToolResult(computed, contract);
@@ -55,10 +58,10 @@ const registerChangedBehavior = (server, session, contract) => {
             ],
         });
         return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
-    });
+    }));
 };
-const registerCallPath = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+const registerCallPath = (server, session, admission, contract) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         const closure = evidenceClosure(session, functionEvidenceIds(input.functions));
         if (!closure.ok)
             return server.delivery.toCallToolResult(closure, contract);
@@ -93,10 +96,10 @@ const registerCallPath = (server, session, contract) => {
             ],
         });
         return server.delivery.toEvidenceToolResult(evidence, contract, recorded);
-    });
+    }));
 };
-const registerStaticRuntime = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+const registerStaticRuntime = (server, session, admission, contract) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         const closure = evidenceClosure(session, comparisonClosure([
             ...input.static_comparisons,
             ...input.runtime_comparisons,
@@ -132,10 +135,10 @@ const registerStaticRuntime = (server, session, contract) => {
                 },
             ],
         }));
-    });
+    }));
 };
-const registerReconstruction = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+const registerReconstruction = (server, session, admission, contract) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => runAdmittedToolOperation(server, admission, contract.name, context.mcpReq.signal, async () => {
         const owned = session.exportEvidenceBundle();
         const computed = await runDerivedOperation(context, contract.name, () => verifyReconstruction(input.specification, owned));
         if (!computed.ok)
@@ -163,10 +166,7 @@ const registerReconstruction = (server, session, contract) => {
             domain: "reconstruction-verification",
             requiredAuthority: null,
             requiredConfidence: "derived",
-            probes: result.recommended_probes.map(({ operation, rationale }) => ({
-                operation,
-                rationale,
-            })),
+            probes: result.recommended_probes.map(({ operation, rationale }) => ({ operation, rationale })),
         }));
-    });
+    }));
 };

package/dist/server/registerJavaScriptRuntimeObservationTools.js

@@ -5,6 +5,7 @@ import { toolContract } from "../contracts/toolContracts.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { runAdmittedToolOperation } from "./admittedToolOperation.js";
+import { deliverEvidenceResult } from "./contractToolHandler.js";
 /** Register passive Inspector tools even when policy keeps them unavailable. */
 export const registerJavaScriptRuntimeObservationTools = (server, options) => {
     const registration = { ...options, delivery: server.delivery, server };
@@ -19,9 +20,6 @@ const runRuntimeTool = async (options, contract, request, execute) => {
         return options.delivery.toCallToolResult(err(optionalProviderUnavailable(options.loadFailure, contract.name)), contract);
     return runAdmittedToolOperation(options.server, options.withAdmittedAnalysis, contract.name, context.mcpReq.signal, async () => {
         const result = await logToolExecution(options.logger, contract.name, () => execute(input, context.mcpReq.signal));
-        if (!result.ok)
-            return options.delivery.toCallToolResult(result, contract);
-        const recorded = options.recordEvidence?.(result.value);
-        return options.delivery.toEvidenceToolResult(result.value, contract, recorded);
+        return deliverEvidenceResult(options.server, result, contract, options.recordEvidence);
     });
 };

package/dist/server/registerManagedWorkflowTools/evidence.js

@@ -1,13 +1,18 @@
 import { parseEvidence } from "../../domain/evidence.js";
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { err, ok } from "../../domain/result.js";
+/**
+ * Authenticate caller-supplied records. When `expectedOperations` is omitted,
+ * the shared workflow owns which authentic operations it can use.
+ */
 const parseExpectedEvidence = (rawEvidence, expectedOperations) => {
     try {
         const evidence = rawEvidence.map(parseEvidence);
-        for (const record of evidence)
-            if (!expectedOperations.includes(record.operation) ||
-                record.predicate_type !== "rea.analysis")
-                throw new TypeError(`Expected ${expectedOperations.join(" or ")} Evidence, received ${record.operation}`);
+        if (expectedOperations !== undefined)
+            for (const record of evidence)
+                if (!expectedOperations.includes(record.operation) ||
+                    record.predicate_type !== "rea.analysis")
+                    throw new TypeError(`Expected ${expectedOperations.join(" or ")} Evidence, received ${record.operation}`);
         return ok(evidence);
     }
     catch (cause) {
@@ -17,9 +22,11 @@ const parseExpectedEvidence = (rawEvidence, expectedOperations) => {
 export const resolveManagedEvidence = (evidence) => parseExpectedEvidence([evidence], ["inspect_managed_members"]);
 export const resolveManagedArtifactEvidence = (evidence) => parseExpectedEvidence([evidence], ["inspect_managed_artifact"]);
 export const resolveManagedBoundaryEvidence = (evidence) => parseExpectedEvidence([evidence], ["inspect_managed_native_boundaries"]);
-export const resolveNativeEvidence = (evidence) => {
-    return parseExpectedEvidence(evidence, ["inspect_macho", "analyze_function"]);
-};
+/**
+ * Authenticate native observations without an operation allowlist: the domain
+ * counts authentic operations it cannot read symbols from as unsupported.
+ */
+export const resolveNativeEvidence = (evidence) => parseExpectedEvidence(evidence);
 export const sourceEvidence = (input) => [
     input.managed_artifact,
     input.managed_members,

package/dist/server/registerProcessComparisonTool.js

@@ -96,6 +96,9 @@ export const registerProcessComparisonTool = (server, session, contract, now = D
                 right_evidence_id: rightRecord.evidence_id,
                 left_normalization: leftCapture.normalization,
                 right_normalization: rightCapture.normalization,
+                ...(input.max_capture_age_ms === undefined
+                    ? {}
+                    : { max_capture_age_ms: input.max_capture_age_ms }),
                 ...(input.trace_spec === undefined
                     ? {}
                     : { trace_spec: jsonValueSchema.parse(input.trace_spec) }),

package/dist/server/registerSessionStatusTool.js

@@ -1,4 +1,4 @@
-import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { buildCapabilityInventory, compactToolAvailability, } from "../application/CapabilityInventory.js";
 import { toolContract } from "../contracts/toolContracts.js";
 import { jsonObjectSchema } from "../domain/jsonValue.js";
@@ -9,28 +9,32 @@ import { err } from "../domain/result.js";
 import { CURRENT_ENTRYPOINT_PATH } from "../process/CurrentEntrypointPath.js";
 /** Register the read-only provider and target status operation. */
 export const registerSessionStatusTool = (options) => {
-    const { server, session, contract, startedAt, availabilityPolicy, androidAnalysisAvailability, adbAnalysisAvailability, apktoolAnalysisAvailability, } = options;
+    const { server, session, contract, startedAt, availabilityPolicy, androidAnalysisAvailability, adbAnalysisAvailability, apktoolAnalysisAvailability, jebAnalysisAvailability, } = options;
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
         const { client, clientFeatures, protocolVersion } = mcpClientMetadata(context, server.server);
         let androidAvailability;
         let adbAvailability;
         let apktoolAvailability;
+        let jebAvailability;
+        let status;
         try {
-            const [android, adb, apktool] = await Promise.all([
+            const [android, adb, apktool, jeb] = await Promise.all([
                 androidAnalysisAvailability(context.mcpReq.signal),
                 adbAnalysisAvailability?.(context.mcpReq.signal) ?? undefined,
                 apktoolAnalysisAvailability?.(context.mcpReq.signal) ?? undefined,
+                jebAnalysisAvailability?.(context.mcpReq.signal) ?? undefined,
             ]);
             androidAvailability = android;
             adbAvailability = adb;
             apktoolAvailability = apktool;
+            jebAvailability = jeb;
+            status = await session.status({ signal: context.mcpReq.signal });
         }
         catch (cause) {
-            if (!context.mcpReq.signal.aborted)
+            if (!(cause instanceof AnalysisError))
                 throw cause;
-            return server.delivery.toCallToolResult(err(new AnalysisCancelledError("binary_session")), contract);
+            return server.delivery.toCallToolResult(err(cause), contract);
         }
-        const status = session.status();
         const statusObject = jsonObjectSchema.parse(status);
         const toolAvailability = buildCapabilityInventory(status, {
             ...availabilityPolicy(),
@@ -41,6 +45,9 @@ export const registerSessionStatusTool = (options) => {
             ...(apktoolAvailability === undefined
                 ? {}
                 : { apktoolAnalysisAvailability: apktoolAvailability }),
+            ...(jebAvailability === undefined
+                ? {}
+                : { jebAnalysisAvailability: jebAvailability }),
         }, clientFeatures);
         const serverIdentity = createServerIdentity({
             startedAt,

package/dist/server/registerSessionTools.js

@@ -16,7 +16,7 @@ import { registerFunctionComparisonTool } from "./registerFunctionComparisonTool
 import { registerInvestigationTools } from "./registerInvestigationTools.js";
 import { registerProcessComparisonTool } from "./registerProcessComparisonTool.js";
 import { registerEvidenceTools, registerUnknownTools, } from "./registerSessionRecordTools.js";
-import { registerSessionStatusTool } from "./registerSessionStatusTool.js";
+import { registerSessionStatusTool, } from "./registerSessionStatusTool.js";
 import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
@@ -66,33 +66,16 @@ const registerProcessTools = ({ server, session, logger, captureContract, resour
     }));
 };
 const registerLifecycleTools = (registration, artifactResources) => {
-    const { server, session, statusContract, startedAt, availabilityPolicy, androidAnalysisAvailability, adbAnalysisAvailability, apktoolAnalysisAvailability, } = registration;
     registerOpenLifecycleTool(registration, artifactResources);
     registerCloseLifecycleTool(registration);
     registerSessionStatusTool({
-        server,
-        session,
-        contract: statusContract,
-        startedAt,
-        availabilityPolicy,
-        androidAnalysisAvailability,
-        ...(adbAnalysisAvailability === undefined
-            ? {}
-            : { adbAnalysisAvailability }),
-        ...(apktoolAnalysisAvailability === undefined
-            ? {}
-            : { apktoolAnalysisAvailability }),
+        ...registration,
+        contract: registration.statusContract,
     });
 };
 const registerOpenLifecycleTool = ({ server, session, logger, openContract }, artifactResources) => {
     server.registerTool(openContract.name, toolRegistrationOptions(openContract), async (input, context) => {
-        let snapshot;
-        if (input.snapshot_path !== undefined) {
-            const loaded = await readAnalysisSnapshot(input.snapshot_path, context.mcpReq.signal, artifactResources);
-            if (!loaded.ok)
-                return server.delivery.toCallToolResult(loaded, openContract);
-            snapshot = loaded.value;
-        }
+        const snapshotPath = input.snapshot_path;
         const opened = await logToolExecution(logger, openContract.name, () => session.open(input.path, {
             signal: context.mcpReq.signal,
             ...(input.format === undefined ? {} : { formatHint: input.format }),
@@ -105,7 +88,13 @@ const registerOpenLifecycleTool = ({ server, session, logger, openContract }, ar
             ...(input.provider_id === undefined
                 ? {}
                 : { providerId: input.provider_id }),
-            ...(snapshot === undefined ? {} : { snapshot }),
+            ...(snapshotPath === undefined
+                ? {}
+                : {
+                    // Read inside the open's turn: calls issued after it must not
+                    // overtake a file read that precedes its place in the order.
+                    loadSnapshot: () => readAnalysisSnapshot(snapshotPath, context.mcpReq.signal, artifactResources),
+                }),
         }));
         return opened.ok
             ? server.delivery.toCallToolResult({
@@ -145,6 +134,7 @@ export const registerSessionTools = (server, session, logger, options) => {
     const snapshotContract = toolContract("get_evidence_bundle");
     const processResources = new ProcessCaptureResourceScope();
     registerLifecycleTools({
+        ...options,
         server,
         session,
         logger,
@@ -154,12 +144,6 @@ export const registerSessionTools = (server, session, logger, options) => {
         startedAt: options.startedAt ?? new Date().toISOString(),
         availabilityPolicy: sessionAvailabilityPolicy(options.availabilityPolicy, {}),
         androidAnalysisAvailability: options.androidAnalysisAvailability ?? missingAndroidAvailability,
-        ...(options.adbAnalysisAvailability === undefined
-            ? {}
-            : { adbAnalysisAvailability: options.adbAnalysisAvailability }),
-        ...(options.apktoolAnalysisAvailability === undefined
-            ? {}
-            : { apktoolAnalysisAvailability: options.apktoolAnalysisAvailability }),
         closeProcessResources: async () => {
             try {
                 await processResources.retryCleanup();
@@ -169,7 +153,10 @@ export const registerSessionTools = (server, session, logger, options) => {
                 return err(new ProcessCaptureError("process capture cleanup remains incomplete", {
                     cause,
                     reason: "cleanup_incomplete",
-                    cleanupResources: ["process_capture_resources"],
+                    cleanup: {
+                        reason: "process capture cleanup remains incomplete",
+                        resources: ["process_capture_resources"],
+                    },
                     executionFailure: cause instanceof Error
                         ? cause.message || cause.name
                         : String(cause),

package/dist/server/runDerivedOperation.js

@@ -51,5 +51,7 @@ export const runDerivedOperation = async (context, operation, compute) => {
         message: `Completed ${operation}`,
         terminal: true,
     });
+    if (context.mcpReq.signal.aborted)
+        return err(new AnalysisCancelledError(operation));
     return ok(value);
 };

package/dist/signals/SigrokRecordingProvider.js

@@ -1,3 +1,4 @@
+import { artifactFileCancellationCause } from "../artifacts/ArtifactFileOperation.js";
 import { signalDecodersSchema, } from "../domain/signals/signalDecoders.js";
 import { DecoderDiscoveryBudgetError, parseDecoderDiscovery, } from "./parseDecoderDiscovery.js";
 import { BOUNDED_PRODUCER_LIMITS as LIMITS, prlimitArgumentVector, readLinuxResourceLimits, } from "../process/LinuxResourceLimits.js";
@@ -64,7 +65,9 @@ export class SigrokRecordingProvider {
         let result;
         try {
             if (options?.signal?.aborted)
-                throw new AnalysisCancelledError(operation);
+                throw new AnalysisCancelledError(operation, {
+                    cause: options.signal.reason,
+                });
             await this.#resources.release();
             if (this.platform !== "linux")
                 throw new Error("Signal decoding requires Linux with util-linux prlimit and REA_SIGROK_COMMAND so expanded recordings are processed under an enforced address-space limit.");
@@ -248,16 +251,20 @@ export class SigrokRecordingProvider {
             confidence: "observed",
             locations: execution.locations,
             limitations: execution.limitations,
-        }), operation);
+        }), operation, options?.signal);
     }
     #failure(cause, phase, path, workspacePath, effectiveLimits, observedOutput, operation = OPERATION) {
         if (cause instanceof AnalysisError)
             return cause;
         if (cause instanceof ArtifactReaderFailure && cause.cleanup !== undefined)
-            return this.#resources.cleanupFailure(cause.cleanup, cause, observedOutput, operation);
-        if ((cause instanceof Error && cause.name === "AbortError") ||
-            (cause instanceof ArtifactReaderFailure && cause.reason === "cancelled"))
-            return new AnalysisCancelledError(operation, { cause });
+            return this.#resources.cleanupFailure(cause, (primary) => this.#failure(primary, phase, path, workspacePath, effectiveLimits, observedOutput, operation), observedOutput, operation);
+        if (cause instanceof ArtifactReaderFailure && cause.reason === "cancelled")
+            return new AnalysisCancelledError(operation, {
+                cause: artifactFileCancellationCause(cause),
+                ...(observedOutput === undefined
+                    ? {}
+                    : { capturedOutput: observedOutput }),
+            });
         if (cause instanceof DecoderDiscoveryBudgetError)
             return new AnalysisResourceConstraintError(operation, "memory", cause.message, { line_budget: 65536 }, {
                 cause,

package/dist/sqlite/SqliteDatabaseFailures.js

@@ -1,4 +1,5 @@
 import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { ArtifactFileCleanupFailure, bindArtifactFileCleanup, artifactFileCancellationCause, } from "../artifacts/ArtifactFileOperation.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { AnalysisError, } from "../domain/analysisErrorBase.js";
 import { AnalysisAccessDeniedError, AnalysisArtifactChangedError, AnalysisCapabilityUnavailableError, AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, AnalysisResourceConstraintError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
@@ -27,17 +28,24 @@ export const sqliteDatabaseFailure = (cause, path, phase, signal) => {
     if (cause instanceof AnalysisError)
         return cause;
     if (cause instanceof ArtifactReaderFailure) {
-        if (cause.cleanup !== undefined)
-            return new ProviderCleanupError(SQLITE_PROVIDER_IDENTITY.id, cause.cleanup.resources, {
+        if (cause.cleanup !== undefined) {
+            const physicalRead = cause instanceof ArtifactFileCleanupFailure
+                ? cause.fileCleanupFailure.outcome
+                : undefined;
+            const previous = physicalRead?.kind === "failed"
+                ? sqliteDatabaseFailure(physicalRead.cause, path, phase)
+                : signal?.aborted
+                    ? new AnalysisCancelledError(operation, { cause: signal.reason })
+                    : physicalRead?.kind === "completed" || cause.cause === undefined
+                        ? undefined
+                        : sqliteDatabaseFailure(cause.cause, path, phase);
+            const error = new ProviderCleanupError(SQLITE_PROVIDER_IDENTITY.id, cause.cleanup.resources, {
                 reason: cause.cleanup.reason,
-                previous_error: cause.cause === undefined
-                    ? null
-                    : projectAnalysisError(signal?.aborted
-                        ? new AnalysisCancelledError(operation, {
-                            cause: cause.cause,
-                        })
-                        : sqliteDatabaseFailure(cause.cause, path, phase)),
+                previous_error: previous === undefined ? null : projectAnalysisError(previous),
             }, { operation, cause });
+            bindArtifactFileCleanup(cause, error);
+            return error;
+        }
         if (cause.reason === "io" && cause.cause !== undefined)
             return sqliteDatabaseFailure(cause.cause, path, phase, signal);
         if (cause.reason === "integrity")
@@ -45,11 +53,13 @@ export const sqliteDatabaseFailure = (cause, path, phase, signal) => {
                 cause,
             });
         if (cause.reason === "cancelled")
-            return new AnalysisCancelledError(operation, { cause });
+            return new AnalysisCancelledError(operation, {
+                cause: artifactFileCancellationCause(cause),
+            });
         return new AnalysisInputError(operation, { cause }, [
             {
                 path: ["path"],
-                reason: cause.reason === "limit" ? "out_of_range" : "invalid_format",
+                reason: "invalid_format",
                 message: cause.message,
             },
         ]);
@@ -75,7 +85,10 @@ export const sqliteDatabaseFailure = (cause, path, phase, signal) => {
                 retryable: true,
                 userMessage: "The selected SQLite database is held open by another process without read sharing. Close that application or inspect a copy, then retry.",
             });
-        if (cause.code === "ENOENT" || cause.code === "ENOTDIR")
+        if (cause.code === "ENOENT" ||
+            cause.code === "ENOTDIR" ||
+            cause.code === "ELOOP" ||
+            cause.code === "ENAMETOOLONG")
             return new AnalysisInputError(operation, { cause }, [
                 {
                     path: ["path"],

package/dist/sqlite/SqliteDatabaseInspection.js

@@ -25,10 +25,10 @@ const tableRow = z.object({
 });
 const columnRow = z.object({
     cid: natural,
-    name: z.string(),
-    type: z.string(),
+    name: z.instanceof(Uint8Array),
+    type: z.instanceof(Uint8Array),
     notnull: z.bigint(),
-    dflt_value: z.string().nullable(),
+    dflt_value: z.instanceof(Uint8Array).nullable(),
     pk: natural,
     hidden: z
         .bigint()
@@ -120,26 +120,37 @@ const cell = (value, encoding) => {
         encoding,
     };
 };
-const readColumns = (db, name, budget) => {
+const readColumns = (db, name, context) => {
+    const { budget, encoding, selectedColumns } = context;
     const columns = [];
-    // Direct PRAGMA syntax cannot be shadowed by a stored table or view.
+    // This private read-only connection has an empty temp schema. Qualifying the
+    // built-in there prevents stored main tables/views from shadowing it; the
+    // final argument selects main's metadata. Decode bytes before names become
+    // SQL identifiers. Inventory-only row subsets compare exact encoded names
+    // first, so an unrelated malformed identifier cannot alias a requested one.
+    const selection = selectedColumns === undefined
+        ? ""
+        : ` WHERE CAST(name AS BLOB) IN (${selectedColumns.map(() => "CAST(? AS BLOB)").join(", ")})`;
     for (const raw of db
-        .prepare(`PRAGMA main.table_xinfo(${quoteIdentifier(name)})`)
-        .iterate()) {
+        .prepare(`SELECT cid, CAST(name AS BLOB) AS name, CAST(type AS BLOB) AS type, "notnull", CAST(dflt_value AS BLOB) AS dflt_value, pk, hidden FROM temp.pragma_table_xinfo(?, 'main')${selection}`)
+        .iterate(name, ...(selectedColumns ?? []))) {
         const value = columnRow.parse(raw);
         const column = {
             cid: value.cid,
-            name: value.name,
-            declared_type: value.type,
+            name: decodeSchemaText(value.name, encoding, "column name"),
+            declared_type: decodeSchemaText(value.type, encoding, "column type"),
             not_null: value.notnull !== 0n,
-            default_sql: value.dflt_value,
+            default_sql: value.dflt_value === null
+                ? null
+                : decodeSchemaText(value.dflt_value, encoding, "column default"),
             primary_key_position: value.pk,
             hidden: value.hidden,
         };
         budget.retain(column);
         columns.push(column);
     }
-    return columns;
+    // Sort only retained facts, without copying untrusted text into native sorter records.
+    return columns.sort((left, right) => left.cid - right.cid);
 };
 const readSchema = (db, input, context) => {
     const { budget, limitations, encoding } = context;
@@ -251,7 +262,11 @@ const readSchema = (db, input, context) => {
             }
             else if (listed.type !== "virtual" &&
                 (scope !== "inventory" || input.table === value.name)) {
-                const columns = readColumns(db, value.name, scope === "inventory" ? new OutputBudget() : budget);
+                const columns = readColumns(db, value.name, {
+                    budget: scope === "inventory" ? new OutputBudget() : budget,
+                    encoding,
+                    selectedColumns: scope === "inventory" ? input.columns : undefined,
+                });
                 if (input.table === value.name)
                     selectedTable = { name: table.name, kind: table.kind, columns };
                 if (scope !== "inventory")