diff --git a/README.md b/README.md index a9c6ea9be..612bf56ba 100644 --- a/README.md +++ b/README.md @@ -358,7 +358,7 @@ REA is already useful for native application, browser, and Electron investigatio - Reconstruct bounded static package, entrypoint, Webpack/Rspack module, import, worker, endpoint, storage, source-map, BrowserWindow, preload, contextBridge, IPC, utility-process, and native-add-on structure from an approved local directory or ASAR through `analyze_javascript_application` or `rea analyze-javascript-application`. The AST-only [application service](docs/javascript-artifact-reconstruction.md) never executes bootstrap code, pairs only unique exact literal IPC channels, and reports dynamic or ambiguous channels as unresolved. - Reconcile that static graph with existing passive web or Electron Evidence through `reconcile_javascript_runtime` or `rea reconcile-javascript-runtime`. Exact captured bytes outrank caller-declared file/URL mappings; target, frame, script, worker, cache, and asset ambiguity stays explicit, source-map authority stays separate, and a module resident in an observed bundle is never reported as executed. See [JavaScript static/runtime reconciliation](docs/javascript-runtime-reconciliation.md). - Trace a literal route, string, API, IPC channel, module, or native export through authenticated application Evidence with explicit traversal bounds, then hand exact native artifact digests and requested exports to retained Ghidra or Hopper Evidence without automatic provider switching. Compare application versions using unique-only digest, source-map, structural, and semantic tiers; duplicate, incomplete, and truncated matches stay unknown. See [cross-layer JavaScript application workflows](docs/javascript-application-workflows.md). -- Classify PE/CLI managed artifacts with `inspect_managed_artifact` / `rea inspect-managed-artifact`, inspect bounded metadata members, signatures, method-body CIL hashes, exception regions, call edges, and field-access anchors with `inspect_managed_members` / `rea inspect-managed-members`, inventory declared ModuleRef/ImplMap/PInvoke and non-IL method boundary indicators with `inspect_managed_native_boundaries` / `rea inspect-managed-native-boundaries`, then compare two authenticated member observations with `compare_managed_members` / `rea compare-managed-members`. `verify_managed_native_boundaries` / `rea verify-managed-native-boundaries` checks managed P/Invoke declarations against authenticated native export or function Evidence while keeping verified, inferred, contradicted, and unresolved states distinct. The comparison remaps build-local tokens using unique CIL/signature and structural method-shape tiers, never names alone. `project_managed_application_graph` / `rea project-managed-application-graph` projects authenticated managed artifact/member/native-boundary Evidence into the existing application graph for cross-layer feature tracing. `import_managed_reconstruction` / `rea import-managed-reconstruction` admits user-supplied decompiler C#/IL/pseudocode as analyst inference only after exact artifact SHA-256, MVID, signature, and normalized IL commitments match. Separately, `plan_managed_runtime_correlation` / `rea plan-managed-runtime-correlation` can admit a default-disabled, permission-gated runtime-correlation plan locked to the same build evidence. These paths never load the assembly, resolve CLR dependencies, execute target code, run a decompiler, or translate managed tokens into native addresses; native-body bridge mapping and an actual runtime executor remain future managed-code contracts. +- Classify PE/CLI managed artifacts with `inspect_managed_artifact` / `rea inspect-managed-artifact`, inspect bounded metadata members, signatures, raw CIL hashes, limited decoded-instruction-tuple v1 hashes, separately reported exception regions, call edges, and field-access anchors with `inspect_managed_members` / `rea inspect-managed-members`, inventory declared ModuleRef/ImplMap/PInvoke and non-IL method boundary indicators with `inspect_managed_native_boundaries` / `rea inspect-managed-native-boundaries`, then compare two authenticated member observations with `compare_managed_members` / `rea compare-managed-members`. `verify_managed_native_boundaries` / `rea verify-managed-native-boundaries` checks managed P/Invoke declarations against authenticated native export or function Evidence while keeping verified, inferred, contradicted, and unresolved states distinct. The comparison treats build-local tokens as build-local and uses unique decoded-CIL/signature and structural method-shape tiers, never names alone; the v1 tuple hash does not itself resolve tokens or fully commit control flow. `project_managed_application_graph` / `rea project-managed-application-graph` projects authenticated managed artifact/member/native-boundary Evidence into the existing application graph for cross-layer feature tracing. `import_managed_reconstruction` / `rea import-managed-reconstruction` admits user-supplied decompiler C#/IL/pseudocode as analyst inference only after exact artifact SHA-256, MVID, signature, and the shipped v1 decoded-IL commitment match. Separately, `plan_managed_runtime_correlation` / `rea plan-managed-runtime-correlation` can admit a default-disabled, permission-gated runtime-correlation plan locked to the same build evidence. These paths never load the assembly, resolve CLR dependencies, execute target code, run a decompiler, or translate managed tokens into native addresses; full normalized-CIL v2 semantics, native-body bridge mapping, and an actual runtime executor remain future managed-code contracts. - Configure `REA_ILSPY_CMD_PATH=/absolute/path/to/ilspycmd` only when you want doctor and `verify:managed` to inspect a bring-your-own ILSpy command as a real reconstruction oracle. REA does not install ILSpy and does not treat diff --git a/docs/adr/0003-managed-code-evidence-and-provider-boundary.md b/docs/adr/0003-managed-code-evidence-and-provider-boundary.md index fac0a7172..5b6af3cf2 100644 --- a/docs/adr/0003-managed-code-evidence-and-provider-boundary.md +++ b/docs/adr/0003-managed-code-evidence-and-provider-boundary.md @@ -4,9 +4,10 @@ - Date: 2026-07-16 - Implementation status: Read-only PE/CLI triage and exact identity are shipped through `inspect_managed_artifact` / `rea inspect-managed-artifact`. Bounded - metadata, signatures, method bodies, normalized CIL, exception regions, call - edges, and field-access anchors are shipped through `inspect_managed_members` - / `rea inspect-managed-members`. Static member comparison and build-local + metadata, signatures, method bodies, raw CIL hashes, limited + decoded-instruction-tuple v1 hashes, exception regions, call edges, and + field-access anchors are shipped through `inspect_managed_members`; `rea +inspect-managed-members` provides CLI parity. Static member comparison and build-local token remapping are shipped through `compare_managed_members` / `rea compare-managed-members`. Declaration-only managed/native boundary inventory for ModuleRef, ImplMap/PInvoke, ReadyToRun indicators, and non-IL @@ -216,22 +217,50 @@ Method observations add: declaring type + normalized CLI signature build-local metadata token RVA/file extent when present -exact method-body SHA-256 -normalized-CIL schema version + SHA-256 when CIL is valid -max stack + locals signature + exception-region commitment +raw CIL byte length + SHA-256 when the body is admitted +member-result schema version + decoded-instruction-tuple SHA-256 when CIL is valid +separate max-stack, locals-token, and exception-region observations ``` -The exact body hash commits header bytes, CIL bytes, and admitted extra -sections. Normalized CIL decodes instructions, converts branch operands to -instruction coordinates, and resolves metadata operands to canonical -signatures or literal identities under a versioned algorithm. It preserves -opcode, prefix, constant, local/argument, generic, and exception semantics. It -does not erase differences merely to make two builds match. +The shipped `il_sha256` commits only the raw CIL byte stream identified by the +method header's `il_size`. It does not commit the method header, local-signature +blob, alignment padding, or extra sections such as exception clauses. Those +facts remain separate observations and the enclosing artifact SHA-256 binds +them to the exact file. A digest over the complete method body is not shipped. + +The caller-visible field remains named `normalized_il_sha256`, but its shipped +v1 meaning is deliberately narrower than a canonical semantic CIL identity. +For a completely decoded method, REA serializes the instruction-order array of +`[opcode, operand_kind, operand]` tuples with JavaScript `JSON.stringify`, +encodes that text as UTF-8, and reports its lowercase SHA-256. The member +result's `schema_version: 1` scopes this convention; there is no independent +normalized-CIL algorithm-version field in v1. + +Operands retain the current decoder projection: metadata and user-string +operands are build-local lowercase hexadecimal tokens, scalar branch operands +are decimal target CIL byte offsets, and `switch` retains only its decimal case +count. Constants and variable indexes are decimal strings; an operand-free +instruction uses kind `none` and value `null`. Opcode names preserve distinct +short forms and prefix instructions, but instruction offsets, branch target +instruction identity, switch targets, resolved token identities, method +headers, locals, and exception regions are not part of this digest. A partial +or malformed decode has no `normalized_il_sha256`. + +Consequently v1 is a deterministic decoded-tuple fingerprint, not proof of +semantic equivalence. In particular, methods with the same opcodes and switch +case counts can share it despite different switch targets, and token movement +can change it without a semantic change. Cross-build comparison may use it as +one unique-only structural tier while retaining artifact/MVID commitments and +ambiguity; it must not describe the digest itself as token-remapped canonical +CIL. Canonical operand resolution, complete control-flow operands, +exception/local commitments, and an explicit algorithm version require a new +normalized-CIL schema. Metadata tokens are reported because they are precise coordinates inside one module. Cross-version identity never consists of a token alone. A structural -match cites both build commitments, both local tokens, the normalized inputs, -the matching algorithm version, and all competing candidates. +match cites both build commitments, both local tokens, the v1 tuple inputs, the +member-result schema version, and all competing candidates. V1 cannot cite a +separate matching-algorithm version because none is exposed. ### 5. Separate five evidence layers @@ -356,8 +385,9 @@ requires its own threat model and admission decision. coverage; it never returns a partial list labeled complete. - Managed addresses distinguish file offsets, RVAs, native virtual addresses, metadata tokens, and CIL offsets. They are not interchangeable. -- Cache compatibility is exact on artifact/component commitment, parser - profile, normalized-CIL schema, and producer version. +- Cache compatibility is exact on artifact/component commitment, member-result + schema, parser profile, and producer version. For shipped v1, + `normalized_il_sha256` has no independent algorithm-version field. - Provider-neutral workflows may compose canonical managed findings with the one native binding, but every source operation retains its actual producer. @@ -400,7 +430,9 @@ or development-only oracles. ## Rollout gates 1. Add read-only triage and identity with malformed-input bounds. Shipped. -2. Add metadata, signatures, method bodies, normalized CIL, and exact Evidence. Shipped. +2. Add metadata, signatures, method bodies, deterministic decoded-CIL tuple + fingerprints, and exact artifact Evidence. Shipped with the v1 limitations + above; full normalized-CIL semantics remain planned. 3. Add obfuscation-resistant slices and cross-build match states. Shipped. 4. Compose explicit managed/native boundaries with Hopper/Ghidra. Declaration inventory and native export/function Evidence matching shipped; native-body diff --git a/docs/api/types/domain_managedArtifact.ManagedArtifactInspection.html b/docs/api/types/domain_managedArtifact.ManagedArtifactInspection.html index 41fceb912..363682bd1 100644 --- a/docs/api/types/domain_managedArtifact.ManagedArtifactInspection.html +++ b/docs/api/types/domain_managedArtifact.ManagedArtifactInspection.html @@ -13,7 +13,7 @@

Type Alias ManagedArtifactInspection

ManagedArtifactInspection: z.infer<typeof managedArtifactInspectionSchema>
+
  • Defined in src/domain/managedArtifact.ts:496
    • diff --git a/docs/api/types/domain_managedArtifact.ManagedMemberInspection.html b/docs/api/types/domain_managedArtifact.ManagedMemberInspection.html index b2c46c6a8..b0d7b4205 100644 --- a/docs/api/types/domain_managedArtifact.ManagedMemberInspection.html +++ b/docs/api/types/domain_managedArtifact.ManagedMemberInspection.html @@ -13,7 +13,7 @@

    Type Alias ManagedMemberInspection

    ManagedMemberInspection: z.infer<typeof managedMemberInspectionSchema>
    +
  • Defined in src/domain/managedArtifact.ts:499
    • diff --git a/docs/api/types/domain_managedArtifact.ManagedNativeBoundaryInspection.html b/docs/api/types/domain_managedArtifact.ManagedNativeBoundaryInspection.html index 9a5c498c7..7a73abf31 100644 --- a/docs/api/types/domain_managedArtifact.ManagedNativeBoundaryInspection.html +++ b/docs/api/types/domain_managedArtifact.ManagedNativeBoundaryInspection.html @@ -13,7 +13,7 @@

    Type Alias ManagedNativeBoundaryInspection

    ManagedNativeBoundaryInspection: z.infer<
        typeof managedNativeBoundaryInspectionSchema,
    >
    +
  • Defined in src/domain/managedArtifact.ts:502
    • diff --git a/docs/api/types/domain_managedArtifact.ManagedParseIssue.html b/docs/api/types/domain_managedArtifact.ManagedParseIssue.html index 348a0635a..a917f7f25 100644 --- a/docs/api/types/domain_managedArtifact.ManagedParseIssue.html +++ b/docs/api/types/domain_managedArtifact.ManagedParseIssue.html @@ -13,7 +13,7 @@

    Type Alias ManagedParseIssue

    ManagedParseIssue: z.infer<typeof managedParseIssueSchema>
    +
  • Defined in src/domain/managedArtifact.ts:505
    • diff --git a/docs/api/variables/contracts_managedToolContracts.MANAGED_TOOL_CONTRACTS.html b/docs/api/variables/contracts_managedToolContracts.MANAGED_TOOL_CONTRACTS.html index 713a609e7..15eb2b2a7 100644 --- a/docs/api/variables/contracts_managedToolContracts.MANAGED_TOOL_CONTRACTS.html +++ b/docs/api/variables/contracts_managedToolContracts.MANAGED_TOOL_CONTRACTS.html @@ -11,7 +11,7 @@
  • contracts/managedToolContracts
  • MANAGED_TOOL_CONTRACTS

    • Variable MANAGED_TOOL_CONTRACTSConst

    -
    MANAGED_TOOL_CONTRACTS: readonly [
        {
            annotations: DerivedToolAnnotations;
            description: "Classify the active PE/CLI artifact and inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns bounded pages and explicit partial or malformed coverage.";
            effects: ToolEffects;
            examples: readonly [
                { input: {}; title: "Example inspect managed artifact request" },
            ];
            inputSchema: ZodObject<
                {
                    attribute_limit: ZodDefault<ZodNumber>;
                    attribute_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    reference_limit: ZodDefault<ZodNumber>;
                    reference_offset: ZodDefault<ZodNumber>;
                    resource_limit: ZodDefault<ZodNumber>;
                    resource_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_artifact";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect bounded PE/CLI metadata members, signatures, method body IL hashes, exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { edge_limit: 100; method_limit: 25 };
                    title: "Example inspect managed members request";
                },
            ];
            inputSchema: ZodObject<
                {
                    edge_limit: ZodDefault<ZodNumber>;
                    edge_offset: ZodDefault<ZodNumber>;
                    field_limit: ZodDefault<ZodNumber>;
                    field_offset: ZodDefault<ZodNumber>;
                    instruction_anchor_limit: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_method_body_bytes: ZodDefault<ZodNumber>;
                    max_method_instructions: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    member_ref_limit: ZodDefault<ZodNumber>;
                    member_ref_offset: ZodDefault<ZodNumber>;
                    method_limit: ZodDefault<ZodNumber>;
                    method_offset: ZodDefault<ZodNumber>;
                    type_limit: ZodDefault<ZodNumber>;
                    type_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect PE/CLI ModuleRef, ImplMap/PInvoke declarations, CLI native-header indicators, and non-IL method implementation flags without loading or executing target code. Results are managed declarations and degraded native-boundary observations, not verified native exports or addresses.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { implementation_limit: 50; import_limit: 50 };
                    title: "Example inspect managed/native boundary request";
                },
            ];
            inputSchema: ZodObject<
                {
                    implementation_limit: ZodDefault<ZodNumber>;
                    implementation_offset: ZodDefault<ZodNumber>;
                    import_limit: ZodDefault<ZodNumber>;
                    import_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    module_ref_limit: ZodDefault<ZodNumber>;
                    module_ref_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
    ] = ...
    +
    MANAGED_TOOL_CONTRACTS: readonly [
        {
            annotations: DerivedToolAnnotations;
            description: "Classify the active PE/CLI artifact and inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns bounded pages and explicit partial or malformed coverage.";
            effects: ToolEffects;
            examples: readonly [
                { input: {}; title: "Example inspect managed artifact request" },
            ];
            inputSchema: ZodObject<
                {
                    attribute_limit: ZodDefault<ZodNumber>;
                    attribute_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    reference_limit: ZodDefault<ZodNumber>;
                    reference_offset: ZodDefault<ZodNumber>;
                    resource_limit: ZodDefault<ZodNumber>;
                    resource_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_artifact";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect bounded PE/CLI metadata members, signatures, raw CIL hashes, limited member-result-v1 decoded-instruction-tuple hashes, separately reported exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID; the v1 tuple hash does not resolve them or fully commit control flow.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { edge_limit: 100; method_limit: 25 };
                    title: "Example inspect managed members request";
                },
            ];
            inputSchema: ZodObject<
                {
                    edge_limit: ZodDefault<ZodNumber>;
                    edge_offset: ZodDefault<ZodNumber>;
                    field_limit: ZodDefault<ZodNumber>;
                    field_offset: ZodDefault<ZodNumber>;
                    instruction_anchor_limit: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_method_body_bytes: ZodDefault<ZodNumber>;
                    max_method_instructions: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    member_ref_limit: ZodDefault<ZodNumber>;
                    member_ref_offset: ZodDefault<ZodNumber>;
                    method_limit: ZodDefault<ZodNumber>;
                    method_offset: ZodDefault<ZodNumber>;
                    type_limit: ZodDefault<ZodNumber>;
                    type_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect PE/CLI ModuleRef, ImplMap/PInvoke declarations, CLI native-header indicators, and non-IL method implementation flags without loading or executing target code. Results are managed declarations and degraded native-boundary observations, not verified native exports or addresses.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { implementation_limit: 50; import_limit: 50 };
                    title: "Example inspect managed/native boundary request";
                },
            ];
            inputSchema: ZodObject<
                {
                    implementation_limit: ZodDefault<ZodNumber>;
                    implementation_offset: ZodDefault<ZodNumber>;
                    import_limit: ZodDefault<ZodNumber>;
                    import_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    module_ref_limit: ZodDefault<ZodNumber>;
                    module_ref_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
    ] = ...

    Read-only managed artifact contracts.

    -
    MANAGED_WORKFLOW_TOOL_CONTRACTS: readonly [
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two authenticated inspect_managed_members Evidence records using unique-only CIL/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens are remapped as build-local coordinates bound to each artifact SHA-256 and MVID.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        left_evidence_id: string;
                        limits: {
                            max_candidates: number;
                            max_field_matches: number;
                            max_method_matches: number;
                        };
                        right_evidence_id: string;
                    };
                    title: "Compare two managed member observations";
                },
            ];
            inputSchema: ZodObject<
                {
                    left_evidence_id: ZodString;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates: ZodDefault<ZodNumber>;
                                max_field_matches: ZodDefault<ZodNumber>;
                                max_method_matches: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    right_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "compare_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_candidates_per_import: number;
                            max_native_observations: number;
                        };
                        managed_boundaries_evidence_id: string;
                        native_observation_evidence_ids: string[];
                    };
                    title: "Verify a managed P/Invoke declaration against native Evidence";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates_per_import: ZodDefault<ZodNumber>;
                                max_native_observations: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_boundaries_evidence_id: ZodString;
                    native_observation_evidence_ids: ZodArray<ZodString>;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "verify_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and normalized IL hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        decompiler: {
                            executable_sha256: null;
                            family: string;
                            name: string;
                            options: string[];
                            version: string;
                        };
                        methods: {
                            normalized_il_sha256: string;
                            reconstruction: {
                                end_line: number;
                                kind: string;
                                language: string;
                                source_path: string;
                                start_line: number;
                                text: string;
                            };
                            signature_sha256: string;
                            token: string;
                        }[];
                        notes: string[];
                        static_members_evidence_id: string;
                    };
                    title: "Import a decompiler reconstruction for one managed method";
                },
            ];
            inputSchema: ZodObject<
                {
                    decompiler: ZodObject<
                        {
                            executable_sha256: ZodNullable<ZodString>;
                            family: ZodEnum<
                                {
                                    dnlib: "dnlib";
                                    dnspy: "dnspy";
                                    ilspy: "ilspy";
                                    "mono-cecil": "mono-cecil";
                                    other: "other";
                                },
                            >;
                            name: ZodString;
                            options: ZodDefault<ZodArray<ZodString>>;
                            version: ZodNullable<ZodString>;
                        },
                        $strict,
                    >;
                    methods: ZodArray<
                        ZodObject<
                            {
                                normalized_il_sha256: ZodNullable<ZodString>;
                                reconstruction: ZodObject<
                                    {
                                        end_line: ZodOptional<ZodNullable<(...)>>;
                                        kind: ZodEnum<
                                            {
                                                "decompiled-csharp": ...;
                                                "decompiled-il": ...;
                                                "semantic-pseudocode": ...;
                                            },
                                        >;
                                        language: ZodEnum<{ csharp: ...; il: ...; pseudocode: ... }>;
                                        source_path: ZodOptional<ZodNullable<(...)>>;
                                        start_line: ZodOptional<ZodNullable<(...)>>;
                                        text: ZodString;
                                        text_sha256: ZodOptional<ZodString>;
                                    },
                                    $strict,
                                >;
                                signature_sha256: ZodString;
                                token: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    notes: ZodDefault<ZodArray<ZodString>>;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "import_managed_reconstruction";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and normalized IL shape, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        bounds: {
                            allow_network: boolean;
                            allow_ui: boolean;
                            max_output_bytes: number;
                            max_threads: number;
                            timeout_ms: number;
                        };
                        host: { architecture: string; clr_family: string; os: string };
                        method: {
                            normalized_il_sha256: string;
                            signature_sha256: string;
                            token: string;
                        };
                        requested_effect: string;
                        static_members_evidence_id: string;
                    };
                    title: "Plan an exact-build managed runtime correlation";
                },
            ];
            inputSchema: ZodObject<
                {
                    bounds: ZodDefault<
                        ZodObject<
                            {
                                allow_network: ZodDefault<ZodLiteral<false>>;
                                allow_ui: ZodDefault<ZodLiteral<false>>;
                                max_output_bytes: ZodDefault<ZodNumber>;
                                max_threads: ZodDefault<ZodNumber>;
                                timeout_ms: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    host: ZodObject<
                        {
                            architecture: ZodEnum<
                                { arm: "arm"; arm64: "arm64"; x86: "x86"; x86_64: "x86_64" },
                            >;
                            clr_family: ZodEnum<
                                {
                                    dotnet: "dotnet";
                                    "dotnet-framework": "dotnet-framework";
                                    mono: "mono";
                                    unknown: "unknown";
                                },
                            >;
                            os: ZodEnum<{ linux: "linux"; macos: "macos"; windows: "windows" }>;
                        },
                        $strict,
                    >;
                    method: ZodObject<
                        {
                            normalized_il_sha256: ZodNullable<ZodString>;
                            signature_sha256: ZodString;
                            token: ZodString;
                        },
                        $strict,
                    >;
                    requested_effect: ZodEnum<
                        {
                            attach: "attach";
                            debugger: "debugger";
                            instrumentation: "instrumentation";
                            load: "load";
                            reflection: "reflection";
                        },
                    >;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "plan_managed_runtime_correlation";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_fields: number;
                            max_methods: number;
                            max_native_implementations: number;
                            max_pinvoke_imports: number;
                            max_types: number;
                        };
                        managed_members_evidence_id: string;
                    };
                    title: "Project static managed observations into an application graph";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_fields: ZodDefault<ZodNumber>;
                                max_methods: ZodDefault<ZodNumber>;
                                max_native_implementations: ZodDefault<ZodNumber>;
                                max_pinvoke_imports: ZodDefault<ZodNumber>;
                                max_types: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_artifact_evidence_id: ZodOptional<ZodString>;
                    managed_members_evidence_id: ZodOptional<ZodString>;
                    managed_native_boundaries_evidence_id: ZodOptional<ZodString>;
                },
                $strict,
            >;
            kind: "application";
            name: "project_managed_application_graph";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
    ] = ...
    +
    MANAGED_WORKFLOW_TOOL_CONTRACTS: readonly [
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL-v1/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the v1 tuple digest does not itself remap them.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        left_evidence_id: string;
                        limits: {
                            max_candidates: number;
                            max_field_matches: number;
                            max_method_matches: number;
                        };
                        right_evidence_id: string;
                    };
                    title: "Compare two managed member observations";
                },
            ];
            inputSchema: ZodObject<
                {
                    left_evidence_id: ZodString;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates: ZodDefault<ZodNumber>;
                                max_field_matches: ZodDefault<ZodNumber>;
                                max_method_matches: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    right_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "compare_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_candidates_per_import: number;
                            max_native_observations: number;
                        };
                        managed_boundaries_evidence_id: string;
                        native_observation_evidence_ids: string[];
                    };
                    title: "Verify a managed P/Invoke declaration against native Evidence";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates_per_import: ZodDefault<ZodNumber>;
                                max_native_observations: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_boundaries_evidence_id: ZodString;
                    native_observation_evidence_ids: ZodArray<ZodString>;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "verify_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited member-result-v1 decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        decompiler: {
                            executable_sha256: null;
                            family: string;
                            name: string;
                            options: string[];
                            version: string;
                        };
                        methods: {
                            normalized_il_sha256: string;
                            reconstruction: {
                                end_line: number;
                                kind: string;
                                language: string;
                                source_path: string;
                                start_line: number;
                                text: string;
                            };
                            signature_sha256: string;
                            token: string;
                        }[];
                        notes: string[];
                        static_members_evidence_id: string;
                    };
                    title: "Import a decompiler reconstruction for one managed method";
                },
            ];
            inputSchema: ZodObject<
                {
                    decompiler: ZodObject<
                        {
                            executable_sha256: ZodNullable<ZodString>;
                            family: ZodEnum<
                                {
                                    dnlib: "dnlib";
                                    dnspy: "dnspy";
                                    ilspy: "ilspy";
                                    "mono-cecil": "mono-cecil";
                                    other: "other";
                                },
                            >;
                            name: ZodString;
                            options: ZodDefault<ZodArray<ZodString>>;
                            version: ZodNullable<ZodString>;
                        },
                        $strict,
                    >;
                    methods: ZodArray<
                        ZodObject<
                            {
                                normalized_il_sha256: ZodNullable<ZodString>;
                                reconstruction: ZodObject<
                                    {
                                        end_line: ZodOptional<ZodNullable<(...)>>;
                                        kind: ZodEnum<
                                            {
                                                "decompiled-csharp": ...;
                                                "decompiled-il": ...;
                                                "semantic-pseudocode": ...;
                                            },
                                        >;
                                        language: ZodEnum<{ csharp: ...; il: ...; pseudocode: ... }>;
                                        source_path: ZodOptional<ZodNullable<(...)>>;
                                        start_line: ZodOptional<ZodNullable<(...)>>;
                                        text: ZodString;
                                        text_sha256: ZodOptional<ZodString>;
                                    },
                                    $strict,
                                >;
                                signature_sha256: ZodString;
                                token: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    notes: ZodDefault<ZodArray<ZodString>>;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "import_managed_reconstruction";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and limited member-result-v1 decoded-IL tuple hash, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        bounds: {
                            allow_network: boolean;
                            allow_ui: boolean;
                            max_output_bytes: number;
                            max_threads: number;
                            timeout_ms: number;
                        };
                        host: { architecture: string; clr_family: string; os: string };
                        method: {
                            normalized_il_sha256: string;
                            signature_sha256: string;
                            token: string;
                        };
                        requested_effect: string;
                        static_members_evidence_id: string;
                    };
                    title: "Plan an exact-build managed runtime correlation";
                },
            ];
            inputSchema: ZodObject<
                {
                    bounds: ZodDefault<
                        ZodObject<
                            {
                                allow_network: ZodDefault<ZodLiteral<false>>;
                                allow_ui: ZodDefault<ZodLiteral<false>>;
                                max_output_bytes: ZodDefault<ZodNumber>;
                                max_threads: ZodDefault<ZodNumber>;
                                timeout_ms: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    host: ZodObject<
                        {
                            architecture: ZodEnum<
                                { arm: "arm"; arm64: "arm64"; x86: "x86"; x86_64: "x86_64" },
                            >;
                            clr_family: ZodEnum<
                                {
                                    dotnet: "dotnet";
                                    "dotnet-framework": "dotnet-framework";
                                    mono: "mono";
                                    unknown: "unknown";
                                },
                            >;
                            os: ZodEnum<{ linux: "linux"; macos: "macos"; windows: "windows" }>;
                        },
                        $strict,
                    >;
                    method: ZodObject<
                        {
                            normalized_il_sha256: ZodNullable<ZodString>;
                            signature_sha256: ZodString;
                            token: ZodString;
                        },
                        $strict,
                    >;
                    requested_effect: ZodEnum<
                        {
                            attach: "attach";
                            debugger: "debugger";
                            instrumentation: "instrumentation";
                            load: "load";
                            reflection: "reflection";
                        },
                    >;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "plan_managed_runtime_correlation";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_fields: number;
                            max_methods: number;
                            max_native_implementations: number;
                            max_pinvoke_imports: number;
                            max_types: number;
                        };
                        managed_members_evidence_id: string;
                    };
                    title: "Project static managed observations into an application graph";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_fields: ZodDefault<ZodNumber>;
                                max_methods: ZodDefault<ZodNumber>;
                                max_native_implementations: ZodDefault<ZodNumber>;
                                max_pinvoke_imports: ZodDefault<ZodNumber>;
                                max_types: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_artifact_evidence_id: ZodOptional<ZodString>;
                    managed_members_evidence_id: ZodOptional<ZodString>;
                    managed_native_boundaries_evidence_id: ZodOptional<ZodString>;
                },
                $strict,
            >;
            kind: "application";
            name: "project_managed_application_graph";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
    ] = ...

    Provider-neutral managed-code workflow contracts.

    -
    TOOL_CONTRACTS: readonly [
        ToolContract<"address_name">,
        ToolContract<"comment">,
        ToolContract<"current_address">,
        ToolContract<"current_procedure">,
        ToolContract<"current_document">,
        ToolContract<"goto_address">,
        ToolContract<"inline_comment">,
        ToolContract<"list_bookmarks">,
        ToolContract<"list_documents">,
        ToolContract<"list_names">,
        ToolContract<"list_procedures">,
        ToolContract<"list_segments">,
        ToolContract<"list_strings">,
        ToolContract<"next_address">,
        ToolContract<"prev_address">,
        ToolContract<"procedure_address">,
        ToolContract<"procedure_assembly">,
        ToolContract<"procedure_callees">,
        ToolContract<"procedure_callers">,
        ToolContract<"procedure_info">,
        ToolContract<"procedure_references">,
        ToolContract<"procedure_pseudo_code">,
        ToolContract<"resolve_containing_procedure">,
        ToolContract<"search_procedures">,
        ToolContract<"search_strings">,
        ToolContract<"set_address_name">,
        ToolContract<"set_addresses_names">,
        ToolContract<"set_bookmark">,
        ToolContract<"set_comment">,
        ToolContract<"set_current_document">,
        ToolContract<"set_inline_comment">,
        ToolContract<"unset_bookmark">,
        ToolContract<"xrefs">,
        ToolContract<"swift_classes">,
        ToolContract<"get_objc_classes">,
        ToolContract<"get_objc_protocols">,
        ToolContract<"batch_decompile">,
        ToolContract<"get_call_graph">,
        ToolContract<"analyze_swift_types">,
        ToolContract<"find_xrefs_to_name">,
        ToolContract<"binary_overview">,
        ToolContract<"analyze_function">,
        ToolContract<"trace_feature">,
        ToolContract<"inspect_macho">,
        ToolContract<"inspect_signature">,
        ToolContract<"inspect_plist">,
        ToolContract<"list_architectures">,
        ToolContract<"demangle_swift">,
        ToolContract<"inventory_artifact">,
        ToolContract<"extract_artifact">,
        {
            annotations: DerivedToolAnnotations;
            description: "Classify the active PE/CLI artifact and inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns bounded pages and explicit partial or malformed coverage.";
            effects: ToolEffects;
            examples: readonly [
                { input: {}; title: "Example inspect managed artifact request" },
            ];
            inputSchema: ZodObject<
                {
                    attribute_limit: ZodDefault<ZodNumber>;
                    attribute_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    reference_limit: ZodDefault<ZodNumber>;
                    reference_offset: ZodDefault<ZodNumber>;
                    resource_limit: ZodDefault<ZodNumber>;
                    resource_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_artifact";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect bounded PE/CLI metadata members, signatures, method body IL hashes, exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { edge_limit: 100; method_limit: 25 };
                    title: "Example inspect managed members request";
                },
            ];
            inputSchema: ZodObject<
                {
                    edge_limit: ZodDefault<ZodNumber>;
                    edge_offset: ZodDefault<ZodNumber>;
                    field_limit: ZodDefault<ZodNumber>;
                    field_offset: ZodDefault<ZodNumber>;
                    instruction_anchor_limit: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_method_body_bytes: ZodDefault<ZodNumber>;
                    max_method_instructions: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    member_ref_limit: ZodDefault<ZodNumber>;
                    member_ref_offset: ZodDefault<ZodNumber>;
                    method_limit: ZodDefault<ZodNumber>;
                    method_offset: ZodDefault<ZodNumber>;
                    type_limit: ZodDefault<ZodNumber>;
                    type_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect PE/CLI ModuleRef, ImplMap/PInvoke declarations, CLI native-header indicators, and non-IL method implementation flags without loading or executing target code. Results are managed declarations and degraded native-boundary observations, not verified native exports or addresses.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { implementation_limit: 50; import_limit: 50 };
                    title: "Example inspect managed/native boundary request";
                },
            ];
            inputSchema: ZodObject<
                {
                    implementation_limit: ZodDefault<ZodNumber>;
                    implementation_offset: ZodDefault<ZodNumber>;
                    import_limit: ZodDefault<ZodNumber>;
                    import_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    module_ref_limit: ZodDefault<ZodNumber>;
                    module_ref_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two authenticated inspect_managed_members Evidence records using unique-only CIL/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens are remapped as build-local coordinates bound to each artifact SHA-256 and MVID.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        left_evidence_id: string;
                        limits: {
                            max_candidates: number;
                            max_field_matches: number;
                            max_method_matches: number;
                        };
                        right_evidence_id: string;
                    };
                    title: "Compare two managed member observations";
                },
            ];
            inputSchema: ZodObject<
                {
                    left_evidence_id: ZodString;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates: ZodDefault<ZodNumber>;
                                max_field_matches: ZodDefault<ZodNumber>;
                                max_method_matches: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    right_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "compare_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_candidates_per_import: number;
                            max_native_observations: number;
                        };
                        managed_boundaries_evidence_id: string;
                        native_observation_evidence_ids: string[];
                    };
                    title: "Verify a managed P/Invoke declaration against native Evidence";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates_per_import: ZodDefault<ZodNumber>;
                                max_native_observations: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_boundaries_evidence_id: ZodString;
                    native_observation_evidence_ids: ZodArray<ZodString>;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "verify_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and normalized IL hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        decompiler: {
                            executable_sha256: null;
                            family: string;
                            name: string;
                            options: string[];
                            version: string;
                        };
                        methods: {
                            normalized_il_sha256: string;
                            reconstruction: {
                                end_line: number;
                                kind: string;
                                language: string;
                                source_path: string;
                                start_line: number;
                                text: string;
                            };
                            signature_sha256: string;
                            token: string;
                        }[];
                        notes: string[];
                        static_members_evidence_id: string;
                    };
                    title: "Import a decompiler reconstruction for one managed method";
                },
            ];
            inputSchema: ZodObject<
                {
                    decompiler: ZodObject<
                        {
                            executable_sha256: ZodNullable<ZodString>;
                            family: ZodEnum<
                                {
                                    dnlib: "dnlib";
                                    dnspy: "dnspy";
                                    ilspy: "ilspy";
                                    "mono-cecil": "mono-cecil";
                                    other: "other";
                                },
                            >;
                            name: ZodString;
                            options: ZodDefault<ZodArray<ZodString>>;
                            version: ZodNullable<ZodString>;
                        },
                        $strict,
                    >;
                    methods: ZodArray<
                        ZodObject<
                            {
                                normalized_il_sha256: ZodNullable<ZodString>;
                                reconstruction: ZodObject<
                                    {
                                        end_line: ZodOptional<ZodNullable<(...)>>;
                                        kind: ZodEnum<
                                            {
                                                "decompiled-csharp": ...;
                                                "decompiled-il": ...;
                                                "semantic-pseudocode": ...;
                                            },
                                        >;
                                        language: ZodEnum<{ csharp: ...; il: ...; pseudocode: ... }>;
                                        source_path: ZodOptional<ZodNullable<(...)>>;
                                        start_line: ZodOptional<ZodNullable<(...)>>;
                                        text: ZodString;
                                        text_sha256: ZodOptional<ZodString>;
                                    },
                                    $strict,
                                >;
                                signature_sha256: ZodString;
                                token: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    notes: ZodDefault<ZodArray<ZodString>>;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "import_managed_reconstruction";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and normalized IL shape, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        bounds: {
                            allow_network: boolean;
                            allow_ui: boolean;
                            max_output_bytes: number;
                            max_threads: number;
                            timeout_ms: number;
                        };
                        host: { architecture: string; clr_family: string; os: string };
                        method: {
                            normalized_il_sha256: string;
                            signature_sha256: string;
                            token: string;
                        };
                        requested_effect: string;
                        static_members_evidence_id: string;
                    };
                    title: "Plan an exact-build managed runtime correlation";
                },
            ];
            inputSchema: ZodObject<
                {
                    bounds: ZodDefault<
                        ZodObject<
                            {
                                allow_network: ZodDefault<ZodLiteral<false>>;
                                allow_ui: ZodDefault<ZodLiteral<false>>;
                                max_output_bytes: ZodDefault<ZodNumber>;
                                max_threads: ZodDefault<ZodNumber>;
                                timeout_ms: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    host: ZodObject<
                        {
                            architecture: ZodEnum<
                                { arm: "arm"; arm64: "arm64"; x86: "x86"; x86_64: "x86_64" },
                            >;
                            clr_family: ZodEnum<
                                {
                                    dotnet: "dotnet";
                                    "dotnet-framework": "dotnet-framework";
                                    mono: "mono";
                                    unknown: "unknown";
                                },
                            >;
                            os: ZodEnum<{ linux: "linux"; macos: "macos"; windows: "windows" }>;
                        },
                        $strict,
                    >;
                    method: ZodObject<
                        {
                            normalized_il_sha256: ZodNullable<ZodString>;
                            signature_sha256: ZodString;
                            token: ZodString;
                        },
                        $strict,
                    >;
                    requested_effect: ZodEnum<
                        {
                            attach: "attach";
                            debugger: "debugger";
                            instrumentation: "instrumentation";
                            load: "load";
                            reflection: "reflection";
                        },
                    >;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "plan_managed_runtime_correlation";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_fields: number;
                            max_methods: number;
                            max_native_implementations: number;
                            max_pinvoke_imports: number;
                            max_types: number;
                        };
                        managed_members_evidence_id: string;
                    };
                    title: "Project static managed observations into an application graph";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_fields: ZodDefault<ZodNumber>;
                                max_methods: ZodDefault<ZodNumber>;
                                max_native_implementations: ZodDefault<ZodNumber>;
                                max_pinvoke_imports: ZodDefault<ZodNumber>;
                                max_types: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_artifact_evidence_id: ZodOptional<ZodString>;
                    managed_members_evidence_id: ZodOptional<ZodString>;
                    managed_native_boundaries_evidence_id: ZodOptional<ZodString>;
                },
                $strict,
            >;
            kind: "application";
            name: "project_managed_application_graph";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "List bounded page targets from an approved user-owned loopback Chrome DevTools Protocol endpoint. Only targets whose current URL matches an approved exact origin are returned; URL credentials, query values, and fragments are redacted.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        limit: 100;
                        offset: 0;
                    };
                    title: "List approved browser page targets";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    limit: ZodDefault<ZodNumber>;
                    offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "list_browser_targets";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Passively inspect one approved page target through CDP without evaluating JavaScript, navigating, clicking, closing, or mutating the page. Returns bounded DOM structure, accessibility, scripts, resources, attach-window network and console metadata, workers, and redacted storage inventory as Evidence v2.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        console_text_approved: false;
                        include_accessibility_text: false;
                        include_console_text: false;
                        include_json_body_shapes: false;
                        include_script_sources: false;
                        include_storage_keys: false;
                        include_websocket_shapes: false;
                        json_body_schema_approved: false;
                        limits: {
                            max_ax_nodes: 2000;
                            max_ax_text_field_bytes: 1024;
                            max_console_events: 200;
                            max_console_text_field_bytes: 1024;
                            max_dom_nodes: 2000;
                            max_frames: 200;
                            max_json_body_bytes: 1048576;
                            max_json_shape_depth: 20;
                            max_json_shape_nodes: 5000;
                            max_network_events: 1000;
                            max_resources: 2000;
                            max_script_source_bytes: 1048576;
                            max_scripts: 200;
                            max_storage_keys: 1000;
                            max_total_ax_text_bytes: 65536;
                            max_total_console_text_bytes: 65536;
                            max_total_json_body_bytes: 4194304;
                            max_total_script_source_bytes: 4194304;
                            max_total_websocket_shape_bytes: 1048576;
                            max_websocket_events: 500;
                            max_websocket_shape_bytes: 65536;
                            max_workers: 500;
                        };
                        observation_ms: 500;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                        websocket_shape_approved: false;
                    };
                    title: "Inspect one approved browser page";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    console_text_approved: ZodDefault<ZodBoolean>;
                    include_accessibility_text: ZodDefault<ZodBoolean>;
                    include_console_text: ZodDefault<ZodBoolean>;
                    include_json_body_shapes: ZodDefault<ZodBoolean>;
                    include_script_sources: ZodDefault<ZodBoolean>;
                    include_storage_keys: ZodDefault<ZodBoolean>;
                    include_websocket_shapes: ZodDefault<ZodBoolean>;
                    json_body_schema_approved: ZodDefault<ZodBoolean>;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_ax_nodes: ZodDefault<ZodNumber>;
                                max_ax_text_field_bytes: ZodDefault<ZodNumber>;
                                max_console_events: ZodDefault<ZodNumber>;
                                max_console_text_field_bytes: ZodDefault<ZodNumber>;
                                max_dom_nodes: ZodDefault<ZodNumber>;
                                max_frames: ZodDefault<ZodNumber>;
                                max_json_body_bytes: ZodDefault<ZodNumber>;
                                max_json_shape_depth: ZodDefault<ZodNumber>;
                                max_json_shape_nodes: ZodDefault<ZodNumber>;
                                max_network_events: ZodDefault<ZodNumber>;
                                max_resources: ZodDefault<ZodNumber>;
                                max_script_source_bytes: ZodDefault<ZodNumber>;
                                max_scripts: ZodDefault<ZodNumber>;
                                max_storage_keys: ZodDefault<ZodNumber>;
                                max_total_ax_text_bytes: ZodDefault<ZodNumber>;
                                max_total_console_text_bytes: ZodDefault<ZodNumber>;
                                max_total_json_body_bytes: ZodDefault<ZodNumber>;
                                max_total_script_source_bytes: ZodDefault<ZodNumber>;
                                max_total_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_websocket_events: ZodDefault<ZodNumber>;
                                max_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_workers: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    observation_ms: ZodDefault<ZodNumber>;
                    target_id: ZodString;
                    websocket_shape_approved: ZodDefault<ZodBoolean>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "inspect_web_page";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Capture explicitly approved JavaScript source from one approved CDP page and statically derive a bounded chunk graph, route and endpoint candidates, vendor fingerprints, page-declared WebMCP metadata, and optional separately approved source-map evidence. JavaScript is parsed but never executed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        analysis_limits: {
                            max_ast_nodes: 250000;
                            max_findings: 1000;
                            max_original_sources: 2000;
                            max_source_map_bytes: 4194304;
                            max_source_map_mappings: 10000;
                            max_source_maps: 100;
                            max_total_source_map_bytes: 16777216;
                        };
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        fetch_source_maps: false;
                        include_accessibility_text: false;
                        include_script_sources: true;
                        include_storage_keys: false;
                        observation_ms: 500;
                        source_capture_approved: true;
                        source_map_fetch_approved: false;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Analyze an approved page bundle";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    analysis_limits: ZodDefault<
                        ZodObject<
                            {
                                max_ast_nodes: ZodDefault<ZodNumber>;
                                max_findings: ZodDefault<ZodNumber>;
                                max_original_sources: ZodDefault<ZodNumber>;
                                max_source_map_bytes: ZodDefault<ZodNumber>;
                                max_source_map_mappings: ZodDefault<ZodNumber>;
                                max_source_maps: ZodDefault<ZodNumber>;
                                max_total_source_map_bytes: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    console_text_approved: ZodDefault<ZodBoolean>;
                    fetch_source_maps: ZodDefault<ZodBoolean>;
                    include_accessibility_text: ZodDefault<ZodBoolean>;
                    include_console_text: ZodDefault<ZodBoolean>;
                    include_json_body_shapes: ZodDefault<ZodBoolean>;
                    include_script_sources: ZodDefault<ZodLiteral<true>>;
                    include_storage_keys: ZodDefault<ZodBoolean>;
                    include_websocket_shapes: ZodDefault<ZodBoolean>;
                    json_body_schema_approved: ZodDefault<ZodBoolean>;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_ax_nodes: ZodDefault<ZodNumber>;
                                max_ax_text_field_bytes: ZodDefault<ZodNumber>;
                                max_console_events: ZodDefault<ZodNumber>;
                                max_console_text_field_bytes: ZodDefault<ZodNumber>;
                                max_dom_nodes: ZodDefault<ZodNumber>;
                                max_frames: ZodDefault<ZodNumber>;
                                max_json_body_bytes: ZodDefault<ZodNumber>;
                                max_json_shape_depth: ZodDefault<ZodNumber>;
                                max_json_shape_nodes: ZodDefault<ZodNumber>;
                                max_network_events: ZodDefault<ZodNumber>;
                                max_resources: ZodDefault<ZodNumber>;
                                max_script_source_bytes: ZodDefault<ZodNumber>;
                                max_scripts: ZodDefault<ZodNumber>;
                                max_storage_keys: ZodDefault<ZodNumber>;
                                max_total_ax_text_bytes: ZodDefault<ZodNumber>;
                                max_total_console_text_bytes: ZodDefault<ZodNumber>;
                                max_total_json_body_bytes: ZodDefault<ZodNumber>;
                                max_total_script_source_bytes: ZodDefault<ZodNumber>;
                                max_total_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_websocket_events: ZodDefault<ZodNumber>;
                                max_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_workers: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    observation_ms: ZodDefault<ZodNumber>;
                    source_capture_approved: ZodLiteral<true>;
                    source_map_fetch_approved: ZodDefault<ZodBoolean>;
                    target_id: ZodString;
                    websocket_shape_approved: ZodDefault<ZodBoolean>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "analyze_web_bundle";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Arm a bounded CDP observation window while the user operates the page. Allows approved same-origin reload and SPA navigation, records ordered navigation, redirect, lifecycle, and failure metadata, and stops before retaining an out-of-policy destination.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        max_timeline_events: 2000;
                        observation_ms: 10000;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Observe one external user action";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    max_timeline_events: ZodDefault<ZodNumber>;
                    observation_ms: ZodDefault<ZodNumber>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "observe_web_session";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Passively inventory page-registered WebMCP tools using the experimental CDP WebMCP domain. Metadata is bounded and page-declared-untrusted; REA never registers or invokes discovered tools.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        max_schema_bytes: 262144;
                        max_schema_depth: 20;
                        max_schema_nodes: 5000;
                        max_tools: 500;
                        observation_ms: 100;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Discover current WebMCP declarations";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    max_schema_bytes: ZodDefault<ZodNumber>;
                    max_schema_depth: ZodDefault<ZodNumber>;
                    max_schema_nodes: ZodDefault<ZodNumber>;
                    max_tools: ZodDefault<ZodNumber>;
                    observation_ms: ZodDefault<ZodNumber>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "discover_webmcp_tools";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two normalized web captures across DOM, scripts, resources, network, safe metadata, and optional WebMCP inventories. Stable observed changes are distinguished from unknown absence caused by incomplete capture coverage.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        after: {
                            inspection: {
                                accessibility: {
                                    nodes: never[];
                                    text_capture: {
                                        excluded_fields: number;
                                        retained_bytes: number;
                                        status: string;
                                        truncated_fields: number;
                                    };
                                    total_nodes: number;
                                };
                                browser: {
                                    js_version: string;
                                    product: string;
                                    protocol_version: string;
                                    revision: string;
                                    user_agent: string;
                                };
                                capture_window: {
                                    ended_at: string;
                                    observation_ms: number;
                                    started_at: string;
                                };
                                completeness: {
                                    attach_limited_sections: never[];
                                    conditions: string[];
                                    dropped_events: {
                                        console_events: number;
                                        network_requests: number;
                                        scripts: number;
                                        timeline_events: number;
                                        total: number;
                                        webmcp_tools: number;
                                        websocket_connections: number;
                                        websocket_frames: number;
                                    };
                                    excluded: never[];
                                    policy_filtered_sections: never[];
                                    status: string;
                                    truncated_sections: never[];
                                    unavailable_sections: never[];
                                };
                                console: {
                                    coverage_started_at: string;
                                    events: never[];
                                    prior_activity_available: boolean;
                                };
                                dom: { nodes: never[]; total_nodes: number };
                                frames: never[];
                                limitations: never[];
                                metadata: {
                                    agent_hints: never[];
                                    dom_urls: never[];
                                    excluded_dom_urls: number;
                                    headers_allowlisted: boolean;
                                    responses: never[];
                                };
                                network: {
                                    coverage_started_at: string;
                                    prior_activity_available: boolean;
                                    requests: never[];
                                    websocket_events: never[];
                                };
                                resources: never[];
                                schema_version: number;
                                scripts: { items: never[]; total: number };
                                storage: {
                                    cache_names: never[];
                                    indexed_db_names: never[];
                                    local_storage_keys: never[];
                                    origin: string;
                                    quota_bytes: null;
                                    session_storage_keys: never[];
                                    usage_bytes: null;
                                    values_redacted: boolean;
                                };
                                target: {
                                    attached: boolean;
                                    origin: string;
                                    target_id: string;
                                    title: string;
                                    type: string;
                                    url: string;
                                };
                                workers: never[];
                            };
                        };
                        before: {
                            inspection: {
                                accessibility: {
                                    nodes: never[];
                                    text_capture: {
                                        excluded_fields: number;
                                        retained_bytes: number;
                                        status: string;
                                        truncated_fields: number;
                                    };
                                    total_nodes: number;
                                };
                                browser: {
                                    js_version: string;
                                    product: string;
                                    protocol_version: string;
                                    revision: string;
                                    user_agent: string;
                                };
                                capture_window: {
                                    ended_at: string;
                                    observation_ms: number;
                                    started_at: string;
                                };
                                completeness: {
                                    attach_limited_sections: never[];
                                    conditions: string[];
                                    dropped_events: {
                                        console_events: number;
                                        network_requests: number;
                                        scripts: number;
                                        timeline_events: number;
                                        total: number;
                                        webmcp_tools: number;
                                        websocket_connections: number;
                                        websocket_frames: number;
                                    };
                                    excluded: never[];
                                    policy_filtered_sections: never[];
                                    status: string;
                                    truncated_sections: never[];
                                    unavailable_sections: never[];
                                };
                                console: {
                                    coverage_started_at: string;
                                    events: never[];
                                    prior_activity_available: boolean;
                                };
                                dom: { nodes: never[]; total_nodes: number };
                                frames: never[];
                                limitations: never[];
                                metadata: {
                                    agent_hints: never[];
                                    dom_urls: never[];
                                    excluded_dom_urls: number;
                                    headers_allowlisted: boolean;
                                    responses: never[];
                                };
                                network: {
                                    coverage_started_at: string;
                                    prior_activity_available: boolean;
                                    requests: never[];
                                    websocket_events: never[];
                                };
                                resources: never[];
                                schema_version: number;
                                scripts: { items: never[]; total: number };
                                storage: {
                                    cache_names: never[];
                                    indexed_db_names: never[];
                                    local_storage_keys: never[];
                                    origin: string;
                                    quota_bytes: null;
                                    session_storage_keys: never[];
                                    usage_bytes: null;
                                    values_redacted: boolean;
                                };
                                target: {
                                    attached: boolean;
                                    origin: string;
                                    target_id: string;
                                    title: string;
                                    type: string;
                                    url: string;
                                };
                                workers: never[];
                            };
                        };
                        max_changes: 2000;
                    };
                    title: "Compare two normalized captures";
                },
            ];
            inputSchema: ZodObject<
                {
                    after: ZodObject<
                        {
                            inspection: ZodObject<
                                {
                                    accessibility: ZodObject<
                                        {
                                            nodes: ZodArray<(...)>;
                                            text_capture: ZodObject<(...), (...)>;
                                            total_nodes: ZodNumber;
                                        },
                                        $strip,
                                    >;
                                    browser: ZodObject<
                                        {
                                            js_version: ZodString;
                                            product: ZodString;
                                            protocol_version: ZodString;
                                            revision: ZodString;
                                            user_agent: ZodString;
                                        },
                                        $strip,
                                    >;
                                    capture_window: ZodObject<
                                        {
                                            ended_at: ZodISODateTime;
                                            observation_ms: ZodNumber;
                                            started_at: ZodISODateTime;
                                        },
                                        $strip,
                                    >;
                                    completeness: ZodObject<
                                        {
                                            attach_limited_sections: ZodArray<(...)>;
                                            conditions: ZodArray<(...)>;
                                            dropped_events: ZodObject<(...), (...)>;
                                            excluded: ZodArray<(...)>;
                                            policy_filtered_sections: ZodArray<(...)>;
                                            status: ZodEnum<(...)>;
                                            truncated_sections: ZodArray<(...)>;
                                            unavailable_sections: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    console: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            events: ZodArray<(...)>;
                                            prior_activity_available: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    dom: ZodObject<
                                        { nodes: ZodArray<(...)>; total_nodes: ZodNumber },
                                        $strip,
                                    >;
                                    frames: ZodArray<
                                        ZodObject<
                                            { frame_id: ...; origin: ...; parent_frame_id: ...; url: ... },
                                            $strip,
                                        >,
                                    >;
                                    limitations: ZodArray<ZodString>;
                                    metadata: ZodObject<
                                        {
                                            agent_hints: ZodArray<(...)>;
                                            dom_urls: ZodArray<(...)>;
                                            excluded_dom_urls: ZodNumber;
                                            headers_allowlisted: ZodLiteral<(...)>;
                                            responses: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    network: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            prior_activity_available: ZodLiteral<(...)>;
                                            requests: ZodArray<(...)>;
                                            websocket_events: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    resources: ZodArray<
                                        ZodObject<
                                            {
                                                content_size: ...;
                                                mime_type: ...;
                                                origin: ...;
                                                resource_key: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    schema_version: ZodLiteral<2>;
                                    scripts: ZodObject<
                                        { items: ZodArray<(...)>; total: ZodNumber },
                                        $strip,
                                    >;
                                    storage: ZodObject<
                                        {
                                            cache_names: ZodArray<(...)>;
                                            indexed_db_names: ZodArray<(...)>;
                                            local_storage_keys: ZodArray<(...)>;
                                            origin: ZodString;
                                            quota_bytes: ZodNullable<(...)>;
                                            session_storage_keys: ZodArray<(...)>;
                                            usage_bytes: ZodNullable<(...)>;
                                            values_redacted: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    target: ZodObject<
                                        {
                                            attached: ZodBoolean;
                                            origin: ZodString;
                                            target_id: ZodString;
                                            title: ZodString;
                                            type: ZodString;
                                            url: ZodString;
                                        },
                                        $strip,
                                    >;
                                    workers: ZodArray<
                                        ZodObject<
                                            {
                                                attached: ...;
                                                opener_target_id: ...;
                                                origin: ...;
                                                parent_frame_id: ...;
                                                target_id: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strip,
                            >;
                            webmcp: ZodDefault<
                                ZodNullable<
                                    ZodObject<
                                        {
                                            browser: ZodObject<(...), (...)>;
                                            completeness: ZodObject<(...), (...)>;
                                            limitations: ZodArray<(...)>;
                                            schema_version: ZodLiteral<(...)>;
                                            status: ZodEnum<(...)>;
                                            target: ZodObject<(...), (...)>;
                                            tools: ZodObject<(...), (...)>;
                                        },
                                        $strip,
                                    >,
                                >,
                            >;
                        },
                        $strip,
                    >;
                    before: ZodObject<
                        {
                            inspection: ZodObject<
                                {
                                    accessibility: ZodObject<
                                        {
                                            nodes: ZodArray<(...)>;
                                            text_capture: ZodObject<(...), (...)>;
                                            total_nodes: ZodNumber;
                                        },
                                        $strip,
                                    >;
                                    browser: ZodObject<
                                        {
                                            js_version: ZodString;
                                            product: ZodString;
                                            protocol_version: ZodString;
                                            revision: ZodString;
                                            user_agent: ZodString;
                                        },
                                        $strip,
                                    >;
                                    capture_window: ZodObject<
                                        {
                                            ended_at: ZodISODateTime;
                                            observation_ms: ZodNumber;
                                            started_at: ZodISODateTime;
                                        },
                                        $strip,
                                    >;
                                    completeness: ZodObject<
                                        {
                                            attach_limited_sections: ZodArray<(...)>;
                                            conditions: ZodArray<(...)>;
                                            dropped_events: ZodObject<(...), (...)>;
                                            excluded: ZodArray<(...)>;
                                            policy_filtered_sections: ZodArray<(...)>;
                                            status: ZodEnum<(...)>;
                                            truncated_sections: ZodArray<(...)>;
                                            unavailable_sections: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    console: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            events: ZodArray<(...)>;
                                            prior_activity_available: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    dom: ZodObject<
                                        { nodes: ZodArray<(...)>; total_nodes: ZodNumber },
                                        $strip,
                                    >;
                                    frames: ZodArray<
                                        ZodObject<
                                            { frame_id: ...; origin: ...; parent_frame_id: ...; url: ... },
                                            $strip,
                                        >,
                                    >;
                                    limitations: ZodArray<ZodString>;
                                    metadata: ZodObject<
                                        {
                                            agent_hints: ZodArray<(...)>;
                                            dom_urls: ZodArray<(...)>;
                                            excluded_dom_urls: ZodNumber;
                                            headers_allowlisted: ZodLiteral<(...)>;
                                            responses: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    network: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            prior_activity_available: ZodLiteral<(...)>;
                                            requests: ZodArray<(...)>;
                                            websocket_events: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    resources: ZodArray<
                                        ZodObject<
                                            {
                                                content_size: ...;
                                                mime_type: ...;
                                                origin: ...;
                                                resource_key: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    schema_version: ZodLiteral<2>;
                                    scripts: ZodObject<
                                        { items: ZodArray<(...)>; total: ZodNumber },
                                        $strip,
                                    >;
                                    storage: ZodObject<
                                        {
                                            cache_names: ZodArray<(...)>;
                                            indexed_db_names: ZodArray<(...)>;
                                            local_storage_keys: ZodArray<(...)>;
                                            origin: ZodString;
                                            quota_bytes: ZodNullable<(...)>;
                                            session_storage_keys: ZodArray<(...)>;
                                            usage_bytes: ZodNullable<(...)>;
                                            values_redacted: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    target: ZodObject<
                                        {
                                            attached: ZodBoolean;
                                            origin: ZodString;
                                            target_id: ZodString;
                                            title: ZodString;
                                            type: ZodString;
                                            url: ZodString;
                                        },
                                        $strip,
                                    >;
                                    workers: ZodArray<
                                        ZodObject<
                                            {
                                                attached: ...;
                                                opener_target_id: ...;
                                                origin: ...;
                                                parent_frame_id: ...;
                                                target_id: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strip,
                            >;
                            webmcp: ZodDefault<
                                ZodNullable<
                                    ZodObject<
                                        {
                                            browser: ZodObject<(...), (...)>;
                                            completeness: ZodObject<(...), (...)>;
                                            limitations: ZodArray<(...)>;
                                            schema_version: ZodLiteral<(...)>;
                                            status: ZodEnum<(...)>;
                                            target: ZodObject<(...), (...)>;
                                            tools: ZodObject<(...), (...)>;
                                        },
                                        $strip,
                                    >,
                                >,
                            >;
                        },
                        $strip,
                    >;
                    max_changes: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "compare_web_captures";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Capture the current visible viewport of one approved page as a bounded, content-addressed PNG artifact. Screenshot capture requires separate explicit approval and never scrolls, navigates, or evaluates page JavaScript.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        maximum_image_bytes: 4194304;
                        screenshot_approved: true;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Capture an approved viewport";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    maximum_image_bytes: ZodDefault<ZodNumber>;
                    screenshot_approved: ZodLiteral<true>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "capture_web_screenshot";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two self-verifying PNG screenshot artifacts with bounded local pixel metrics. Returns exact changed-pixel ratios and channel deltas without OCR or external services.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        after: {
                            bytes: number;
                            data_base64: string;
                            media_type: string;
                            sha256: string;
                            uri: string;
                        };
                        before: {
                            bytes: number;
                            data_base64: string;
                            media_type: string;
                            sha256: string;
                            uri: string;
                        };
                        channel_threshold: 0;
                        maximum_pixels: 16000000;
                    };
                    title: "Compare two screenshot artifacts";
                },
            ];
            inputSchema: ZodObject<
                {
                    after: ZodObject<
                        {
                            bytes: ZodNumber;
                            data_base64: ZodString;
                            media_type: ZodLiteral<"image/png">;
                            sha256: ZodString;
                            uri: ZodString;
                        },
                        $strip,
                    >;
                    before: ZodObject<
                        {
                            bytes: ZodNumber;
                            data_base64: ZodString;
                            media_type: ZodLiteral<"image/png">;
                            sha256: ZodString;
                            uri: ZodString;
                        },
                        $strip,
                    >;
                    channel_threshold: ZodDefault<ZodNumber>;
                    maximum_pixels: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "compare_web_screenshots";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "List Electron file:// page targets from an approved user-owned loopback CDP endpoint. Every path is canonicalized and must remain contained by an approved filesystem root, including after symlink resolution.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_file_roots: ["/Applications/Example.app/Contents/Resources"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9223";
                        limit: 100;
                        offset: 0;
                    };
                    title: "List approved Electron file pages";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_file_roots: ZodPipe<
                        ZodArray<ZodString>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    limit: ZodDefault<ZodNumber>;
                    offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "electron-provider";
            name: "list_electron_targets";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Passively inspect one approved Electron file page through CDP. Returns root-confined frames, DOM structure, resource paths, and scripts without evaluating renderer JavaScript or invoking Electron APIs; script contents require separate approval.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_file_roots: ["/Applications/Example.app/Contents/Resources"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9223";
                        include_script_sources: false;
                        limits: {
                            max_dom_nodes: 2000;
                            max_frames: 200;
                            max_resources: 2000;
                            max_script_source_bytes: 1048576;
                            max_scripts: 500;
                            max_total_script_source_bytes: 4194304;
                            max_workers: 500;
                        };
                        observation_ms: 100;
                        source_capture_approved: false;
                        target_id: "TARGET_ID_FROM_LIST_ELECTRON_TARGETS";
                    };
                    title: "Inspect an approved Electron page";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_file_roots: ZodPipe<
                        ZodArray<ZodString>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    include_script_sources: ZodDefault<ZodBoolean>;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_dom_nodes: ZodDefault<ZodNumber>;
                                max_frames: ZodDefault<ZodNumber>;
                                max_resources: ZodDefault<ZodNumber>;
                                max_script_source_bytes: ZodDefault<ZodNumber>;
                                max_scripts: ZodDefault<ZodNumber>;
                                max_total_script_source_bytes: ZodDefault<ZodNumber>;
                                max_workers: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    observation_ms: ZodDefault<ZodNumber>;
                    source_capture_approved: ZodDefault<ZodBoolean>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "electron-provider";
            name: "inspect_electron_page";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Statically reconstruct one approved local ASAR or extracted JavaScript application as Evidence v2 and JavaScript Application Graph v1. Maps BrowserWindow preferences, preload and contextBridge APIs, literal and dynamic IPC, handler locations, sender-validation observations, utility processes, and requested native addon bindings without executing JavaScript; source-map contents require separate approval.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved: true;
                        format: "auto";
                        input_path: "/Applications/Example.app/Contents/Resources/app.asar";
                        source_map_read_approved: false;
                    };
                    title: "Analyze one approved local Electron application";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved: ZodLiteral<true>;
                    format: ZodDefault<
                        ZodEnum<{ asar: "asar"; auto: "auto"; directory: "directory" }>,
                    >;
                    input_path: ZodString;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_artifact_entry_bytes: ZodDefault<ZodNumber>;
                                max_ast_nodes: ZodDefault<ZodNumber>;
                                max_compression_ratio: ZodDefault<ZodNumber>;
                                max_depth: ZodDefault<ZodNumber>;
                                max_entries: ZodDefault<ZodNumber>;
                                max_findings: ZodDefault<ZodNumber>;
                                max_modules: ZodDefault<ZodNumber>;
                                max_parse_milliseconds: ZodDefault<ZodNumber>;
                                max_path_bytes: ZodDefault<ZodNumber>;
                                max_source_map_sources: ZodDefault<ZodNumber>;
                                max_text_file_bytes: ZodDefault<ZodNumber>;
                                max_text_files: ZodDefault<ZodNumber>;
                                max_total_artifact_bytes: ZodDefault<ZodNumber>;
                                max_total_text_bytes: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    source_map_read_approved: ZodDefault<ZodBoolean>;
                },
                $strict,
            >;
            kind: "electron-provider";
            name: "analyze_javascript_application";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Reconcile verified static JavaScript application graphs with existing passive web or Electron CDP Evidence. Exact captured-source digests take priority over caller-declared file/URL mappings; target, frame, script, and worker ambiguity remains explicit, and source-map authority stays separate.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        runtime_observations: (
                            | {
                                analysis_profile: {
                                    digest: string;
                                    parameters: Record<string, JSONType>;
                                    provider: { id: string; name: string; version: string };
                                    provider_profile_schema_version: number;
                                    schema_version: 1;
                                };
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | {
                                        architecture: string;
                                        id: string;
                                        isolation: (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        platform: string;
                                    }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: (
                                    | { address: ...; kind: ... }
                                    | { end: ...; kind: ...; start: ... }
                                    | { kind: ...; path: ... }
                                    | { kind: ...; offset: ... }
                                    | { end: ...; kind: ...; start: ... }
                                )[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: string | null };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: (...)
                                        | (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        digest: { sha256: ... };
                                        format:
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...);
                                        local_path: string;
                                        name: string;
                                    }
                                    | null;
                            }
                            | {
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | {
                                        architecture: string;
                                        id: string;
                                        isolation: (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        platform: string;
                                    }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: (
                                    | { address: ...; kind: ... }
                                    | { end: ...; kind: ...; start: ... }
                                    | { kind: ...; path: ... }
                                    | { kind: ...; offset: ... }
                                    | { end: ...; kind: ...; start: ... }
                                )[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: string | null };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: (...)
                                        | (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        digest: { sha256: ... };
                                        format:
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...);
                                        local_path: string;
                                        name: string;
                                    }
                                    | null;
                            }
                        )[];
                        static_layers: {
                            analysis: | {
                                analysis_profile: {
                                    digest: string;
                                    parameters: Record<(...), (...)>;
                                    provider: { id: ...; name: ...; version: ... };
                                    provider_profile_schema_version: number;
                                    schema_version: 1;
                                };
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | { architecture: ...; id: ...; isolation: ...; platform: ... }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: ((...) | (...) | (...) | (...) | (...))[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: (...) | (...) };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: ...;
                                        digest: ...;
                                        format: ...;
                                        local_path: ...;
                                        name: ...;
                                    }
                                    | null;
                            }
                            | {
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | { architecture: ...; id: ...; isolation: ...; platform: ... }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: ((...) | (...) | (...) | (...) | (...))[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: (...) | (...) };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: ...;
                                        digest: ...;
                                        format: ...;
                                        local_path: ...;
                                        name: ...;
                                    }
                                    | null;
                            };
                            role: string;
                        }[];
                    };
                    title: "Reconcile one passive Electron capture";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_reconciliation_items: ZodDefault<ZodNumber>;
                                max_runtime_entities: ZodDefault<ZodNumber>;
                                max_static_load_states: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    runtime_observations: ZodArray<
                        ZodObject<
                            {
                                analysis_profile: ZodOptional<
                                    ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >,
                                >;
                                authority: ZodEnum<
                                    {
                                        "analyst-inference": "analyst-inference";
                                        "controlled-replay": "controlled-replay";
                                        "external-service": "external-service";
                                        "historical-reference": "historical-reference";
                                        "shipped-artifact": "shipped-artifact";
                                    },
                                >;
                                confidence: ZodEnum<
                                    {
                                        derived: "derived";
                                        inferred: "inferred";
                                        observed: "observed";
                                    },
                                >;
                                environment: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodString;
                                            id: ZodString;
                                            isolation: ZodEnum<(...)>;
                                            platform: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                                evidence_id: ZodString;
                                evidence_links: ZodArray<ZodString>;
                                limitations: ZodArray<ZodString>;
                                locations: ZodArray<
                                    ZodDiscriminatedUnion<
                                        [
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                        ],
                                        "kind",
                                    >,
                                >;
                                normalized_result: ZodJSONSchema;
                                operation: ZodString;
                                parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                predicate_type: ZodString;
                                provider: ZodObject<
                                    {
                                        id: ZodString;
                                        name: ZodString;
                                        version: ZodNullable<ZodString>;
                                    },
                                    $strip,
                                >;
                                raw_result: ZodNullable<ZodJSONSchema>;
                                schema_version: ZodLiteral<2>;
                                subject: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodNullable<(...)>;
                                            digest: ZodObject<(...), (...)>;
                                            format: ZodEnum<(...)>;
                                            local_path: ZodString;
                                            name: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                    static_layers: ZodArray<
                        ZodObject<
                            {
                                analysis: ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodJSONSchema;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >;
                                role: ZodEnum<
                                    { application: "application"; assets: "assets"; cache: "cache" },
                                >;
                                runtime_mappings: ZodDefault<
                                    ZodArray<ZodDiscriminatedUnion<[(...), (...)], "kind">>,
                                >;
                            },
                            $strict,
                        >,
                    >;
                },
                $strict,
            >;
            kind: "electron-provider";
            name: "reconcile_javascript_runtime";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Trace a typed literal seed through an authenticated JavaScript Application Graph with explicit direction, depth, node, edge, and path bounds. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        application: | {
                            analysis_profile: {
                                digest: string;
                                parameters: Record<string, JSONType>;
                                provider: { id: string; name: string; version: string };
                                provider_profile_schema_version: number;
                                schema_version: 1;
                            };
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        }
                        | {
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        };
                        direction: "both";
                        seed: {
                            case_sensitive: boolean;
                            kind: "module";
                            match: "exact";
                            value: string;
                        };
                    };
                    title: "Trace one module seed through a retained application graph";
                },
            ];
            inputSchema: ZodObject<
                {
                    application: ZodObject<
                        {
                            analysis_profile: ZodOptional<
                                ZodObject<
                                    {
                                        digest: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        provider_profile_schema_version: ZodNumber;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strip,
                                >,
                            >;
                            authority: ZodEnum<
                                {
                                    "analyst-inference": "analyst-inference";
                                    "controlled-replay": "controlled-replay";
                                    "external-service": "external-service";
                                    "historical-reference": "historical-reference";
                                    "shipped-artifact": "shipped-artifact";
                                },
                            >;
                            confidence: ZodEnum<
                                { derived: "derived"; inferred: "inferred"; observed: "observed" },
                            >;
                            environment: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodString;
                                        id: ZodString;
                                        isolation: ZodEnum<
                                            {
                                                container: ...;
                                                none: ...;
                                                process: ...;
                                                "virtual-machine": ...;
                                            },
                                        >;
                                        platform: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                            evidence_id: ZodString;
                            evidence_links: ZodArray<ZodString>;
                            limitations: ZodArray<ZodString>;
                            locations: ZodArray<
                                ZodDiscriminatedUnion<
                                    [
                                        ZodObject<{ address: ...; kind: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                        ZodObject<{ kind: ...; path: ... }, $strip>,
                                        ZodObject<{ kind: ...; offset: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                    ],
                                    "kind",
                                >,
                            >;
                            normalized_result: ZodJSONSchema;
                            operation: ZodString;
                            parameters: ZodRecord<ZodString, ZodJSONSchema>;
                            predicate_type: ZodString;
                            provider: ZodObject<
                                {
                                    id: ZodString;
                                    name: ZodString;
                                    version: ZodNullable<ZodString>;
                                },
                                $strip,
                            >;
                            raw_result: ZodNullable<ZodJSONSchema>;
                            schema_version: ZodLiteral<2>;
                            subject: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodNullable<ZodEnum<(...)>>;
                                        digest: ZodObject<{ sha256: ... }, $strip>;
                                        format: ZodEnum<
                                            {
                                                "analysis-database": ...;
                                                apk: ...;
                                                asar: ...;
                                                directory: ...;
                                                dmg: ...;
                                                elf: ...;
                                                entitlements: ...;
                                                file: ...;
                                                hopper: ...;
                                                ipa: ...;
                                                javascript: ...;
                                                "javascript-bundle": ...;
                                                "mach-o": ...;
                                                "mach-o-universal": ...;
                                                pe: ...;
                                                pkg: ...;
                                                plist: ...;
                                                "source-map": ...;
                                                unknown: ...;
                                                zip: ...;
                                            },
                                        >;
                                        local_path: ZodString;
                                        name: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    direction: ZodDefault<
                        ZodEnum<
                            { both: "both"; incoming: "incoming"; outgoing: "outgoing" },
                        >,
                    >;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_depth: ZodDefault<ZodNumber>;
                                max_edges: ZodDefault<ZodNumber>;
                                max_nodes: ZodDefault<ZodNumber>;
                                max_paths: ZodDefault<ZodNumber>;
                                max_seed_matches: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    native_observations: ZodDefault<
                        ZodArray<
                            ZodObject<
                                {
                                    analysis_profile: ZodOptional<
                                        ZodObject<
                                            {
                                                digest: ...;
                                                parameters: ...;
                                                provider: ...;
                                                provider_profile_schema_version: ...;
                                                schema_version: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        >,
                    >;
                    seed: ZodObject<
                        {
                            case_sensitive: ZodDefault<ZodBoolean>;
                            kind: ZodEnum<
                                {
                                    api: "api";
                                    channel: "channel";
                                    module: "module";
                                    "native-export": "native-export";
                                    "node-id": "node-id";
                                    route: "route";
                                    string: "string";
                                },
                            >;
                            match: ZodDefault<
                                ZodNullable<ZodEnum<{ contains: "contains"; exact: "exact" }>>,
                            >;
                            value: ZodString;
                        },
                        $strict,
                    >;
                },
                $strict,
            >;
            kind: "application";
            name: "trace_application_feature";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two authenticated JavaScript Application Graph versions using unique-only exact digest, module source digest, source-map identity, structural fingerprint, and non-module semantic-key tiers. Reports added, removed, changed, ambiguous, and unknown entities plus a bounded changed_from graph without fuzzy or module-ordinal pairing.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        left: | {
                            analysis_profile: {
                                digest: string;
                                parameters: Record<string, JSONType>;
                                provider: { id: string; name: string; version: string };
                                provider_profile_schema_version: number;
                                schema_version: 1;
                            };
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        }
                        | {
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        };
                        right: | {
                            analysis_profile: {
                                digest: string;
                                parameters: Record<string, JSONType>;
                                provider: { id: string; name: string; version: string };
                                provider_profile_schema_version: number;
                                schema_version: 1;
                            };
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        }
                        | {
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        };
                    };
                    title: "Compare authenticated static and reconciled application graphs";
                },
            ];
            inputSchema: ZodObject<
                {
                    left: ZodObject<
                        {
                            analysis_profile: ZodOptional<
                                ZodObject<
                                    {
                                        digest: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        provider_profile_schema_version: ZodNumber;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strip,
                                >,
                            >;
                            authority: ZodEnum<
                                {
                                    "analyst-inference": "analyst-inference";
                                    "controlled-replay": "controlled-replay";
                                    "external-service": "external-service";
                                    "historical-reference": "historical-reference";
                                    "shipped-artifact": "shipped-artifact";
                                },
                            >;
                            confidence: ZodEnum<
                                { derived: "derived"; inferred: "inferred"; observed: "observed" },
                            >;
                            environment: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodString;
                                        id: ZodString;
                                        isolation: ZodEnum<
                                            {
                                                container: ...;
                                                none: ...;
                                                process: ...;
                                                "virtual-machine": ...;
                                            },
                                        >;
                                        platform: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                            evidence_id: ZodString;
                            evidence_links: ZodArray<ZodString>;
                            limitations: ZodArray<ZodString>;
                            locations: ZodArray<
                                ZodDiscriminatedUnion<
                                    [
                                        ZodObject<{ address: ...; kind: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                        ZodObject<{ kind: ...; path: ... }, $strip>,
                                        ZodObject<{ kind: ...; offset: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                    ],
                                    "kind",
                                >,
                            >;
                            normalized_result: ZodJSONSchema;
                            operation: ZodString;
                            parameters: ZodRecord<ZodString, ZodJSONSchema>;
                            predicate_type: ZodString;
                            provider: ZodObject<
                                {
                                    id: ZodString;
                                    name: ZodString;
                                    version: ZodNullable<ZodString>;
                                },
                                $strip,
                            >;
                            raw_result: ZodNullable<ZodJSONSchema>;
                            schema_version: ZodLiteral<2>;
                            subject: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodNullable<ZodEnum<(...)>>;
                                        digest: ZodObject<{ sha256: ... }, $strip>;
                                        format: ZodEnum<
                                            {
                                                "analysis-database": ...;
                                                apk: ...;
                                                asar: ...;
                                                directory: ...;
                                                dmg: ...;
                                                elf: ...;
                                                entitlements: ...;
                                                file: ...;
                                                hopper: ...;
                                                ipa: ...;
                                                javascript: ...;
                                                "javascript-bundle": ...;
                                                "mach-o": ...;
                                                "mach-o-universal": ...;
                                                pe: ...;
                                                pkg: ...;
                                                plist: ...;
                                                "source-map": ...;
                                                unknown: ...;
                                                zip: ...;
                                            },
                                        >;
                                        local_path: ZodString;
                                        name: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    left_native_observations: ZodDefault<
                        ZodArray<
                            ZodObject<
                                {
                                    analysis_profile: ZodOptional<
                                        ZodObject<
                                            {
                                                digest: ...;
                                                parameters: ...;
                                                provider: ...;
                                                provider_profile_schema_version: ...;
                                                schema_version: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        >,
                    >;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidate_nodes: ZodDefault<ZodNumber>;
                                max_comparison_items: ZodDefault<ZodNumber>;
                                max_graph_edges: ZodDefault<ZodNumber>;
                                max_graph_nodes: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    right: ZodObject<
                        {
                            analysis_profile: ZodOptional<
                                ZodObject<
                                    {
                                        digest: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        provider_profile_schema_version: ZodNumber;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strip,
                                >,
                            >;
                            authority: ZodEnum<
                                {
                                    "analyst-inference": "analyst-inference";
                                    "controlled-replay": "controlled-replay";
                                    "external-service": "external-service";
                                    "historical-reference": "historical-reference";
                                    "shipped-artifact": "shipped-artifact";
                                },
                            >;
                            confidence: ZodEnum<
                                { derived: "derived"; inferred: "inferred"; observed: "observed" },
                            >;
                            environment: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodString;
                                        id: ZodString;
                                        isolation: ZodEnum<
                                            {
                                                container: ...;
                                                none: ...;
                                                process: ...;
                                                "virtual-machine": ...;
                                            },
                                        >;
                                        platform: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                            evidence_id: ZodString;
                            evidence_links: ZodArray<ZodString>;
                            limitations: ZodArray<ZodString>;
                            locations: ZodArray<
                                ZodDiscriminatedUnion<
                                    [
                                        ZodObject<{ address: ...; kind: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                        ZodObject<{ kind: ...; path: ... }, $strip>,
                                        ZodObject<{ kind: ...; offset: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                    ],
                                    "kind",
                                >,
                            >;
                            normalized_result: ZodJSONSchema;
                            operation: ZodString;
                            parameters: ZodRecord<ZodString, ZodJSONSchema>;
                            predicate_type: ZodString;
                            provider: ZodObject<
                                {
                                    id: ZodString;
                                    name: ZodString;
                                    version: ZodNullable<ZodString>;
                                },
                                $strip,
                            >;
                            raw_result: ZodNullable<ZodJSONSchema>;
                            schema_version: ZodLiteral<2>;
                            subject: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodNullable<ZodEnum<(...)>>;
                                        digest: ZodObject<{ sha256: ... }, $strip>;
                                        format: ZodEnum<
                                            {
                                                "analysis-database": ...;
                                                apk: ...;
                                                asar: ...;
                                                directory: ...;
                                                dmg: ...;
                                                elf: ...;
                                                entitlements: ...;
                                                file: ...;
                                                hopper: ...;
                                                ipa: ...;
                                                javascript: ...;
                                                "javascript-bundle": ...;
                                                "mach-o": ...;
                                                "mach-o-universal": ...;
                                                pe: ...;
                                                pkg: ...;
                                                plist: ...;
                                                "source-map": ...;
                                                unknown: ...;
                                                zip: ...;
                                            },
                                        >;
                                        local_path: ZodString;
                                        name: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    right_native_observations: ZodDefault<
                        ZodArray<
                            ZodObject<
                                {
                                    analysis_profile: ZodOptional<
                                        ZodObject<
                                            {
                                                digest: ...;
                                                parameters: ...;
                                                provider: ...;
                                                provider_profile_schema_version: ...;
                                                schema_version: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        >,
                    >;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "compare_application_versions";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Plan or execute a content-bound extracted-module JavaScript replay inside the Linux Bubblewrap, seccomp, and cgroup boundary. Execution requires approved: true and the exact plan digest. Supports deterministic boundary cases and optional left/right differential comparison; observations have controlled-replay authority and do not claim real application runtime behavior.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved: false;
                        cases: [{ arguments: [""]; case_id: "empty" }];
                        determinism: {
                            clock_iso: "2000-01-01T00:00:00.000Z";
                            locale: "en-US";
                            platform: "linux";
                            random_seed: 0;
                            timezone: "UTC";
                        };
                        left: {
                            entry_alias: "parser";
                            entry_export: "default";
                            modules: [
                                {
                                    alias: "parser";
                                    dependencies: {};
                                    format: "esm";
                                    path: "/approved/parser.mjs";
                                    role: "module";
                                },
                            ];
                        };
                        limits: {
                            cpu_quota_percent: 50;
                            input_bytes: 262144;
                            memory_bytes: 134217728;
                            module_bytes: 4194304;
                            output_bytes: 524288;
                            protocol_bytes: 16777216;
                            result_depth: 16;
                            result_nodes: 10000;
                            stderr_bytes: 32768;
                            tasks: 8;
                            tmpfs_bytes: 16777216;
                            wall_time_ms: 3000;
                        };
                        mode: "plan";
                    };
                    title: "Plan one extracted ESM parser replay";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved: ZodDefault<ZodBoolean>;
                    cases: ZodDefault<
                        ZodArray<
                            ZodObject<
                                { arguments: ZodArray<ZodJSONSchema>; case_id: ZodString },
                                $strict,
                            >,
                        >,
                    >;
                    determinism: ZodDefault<
                        ZodObject<
                            {
                                clock_iso: ZodDefault<ZodISODateTime>;
                                locale: ZodDefault<ZodLiteral<"en-US">>;
                                platform: ZodDefault<ZodLiteral<"linux">>;
                                random_seed: ZodDefault<ZodNumber>;
                                timezone: ZodDefault<ZodLiteral<"UTC">>;
                            },
                            $strict,
                        >,
                    >;
                    generator: ZodOptional<
                        ZodObject<
                            {
                                count: ZodNumber;
                                preset: ZodEnum<
                                    {
                                        "clipboard-boundaries": "clipboard-boundaries";
                                        "parser-boundaries": "parser-boundaries";
                                        "sanitizer-boundaries": "sanitizer-boundaries";
                                    },
                                >;
                                seed: ZodNumber;
                            },
                            $strict,
                        >,
                    >;
                    left: ZodObject<
                        {
                            entry_alias: ZodString;
                            entry_export: ZodDefault<ZodString>;
                            modules: ZodArray<
                                ZodObject<
                                    {
                                        alias: ZodString;
                                        dependencies: ZodDefault<ZodRecord<(...), (...)>>;
                                        format: ZodEnum<{ "commonjs-factory": ...; esm: ... }>;
                                        path: ZodString;
                                        role: ZodDefault<ZodEnum<(...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                cpu_quota_percent: ZodDefault<ZodNumber>;
                                input_bytes: ZodDefault<ZodNumber>;
                                memory_bytes: ZodDefault<ZodNumber>;
                                module_bytes: ZodDefault<ZodNumber>;
                                output_bytes: ZodDefault<ZodNumber>;
                                protocol_bytes: ZodDefault<ZodNumber>;
                                result_depth: ZodDefault<ZodNumber>;
                                result_nodes: ZodDefault<ZodNumber>;
                                stderr_bytes: ZodDefault<ZodNumber>;
                                tasks: ZodDefault<ZodNumber>;
                                tmpfs_bytes: ZodDefault<ZodNumber>;
                                wall_time_ms: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    mode: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                    plan_digest: ZodOptional<ZodString>;
                    reproducer_export: ZodOptional<
                        ZodObject<
                            {
                                approved: ZodBoolean;
                                include_sources: ZodDefault<ZodBoolean>;
                                path: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    right: ZodOptional<
                        ZodObject<
                            {
                                entry_alias: ZodString;
                                entry_export: ZodDefault<ZodString>;
                                modules: ZodArray<
                                    ZodObject<
                                        {
                                            alias: ZodString;
                                            dependencies: ZodDefault<(...)>;
                                            format: ZodEnum<(...)>;
                                            path: ZodString;
                                            role: ZodDefault<(...)>;
                                        },
                                        $strict,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                },
                $strict,
            >;
            kind: "application";
            name: "run_controlled_replay";
            outputSchema: ZodObject<
                {
                    evidence: ZodNullable<
                        ZodObject<
                            {
                                analysis_profile: ZodOptional<
                                    ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >,
                                >;
                                authority: ZodEnum<
                                    {
                                        "analyst-inference": "analyst-inference";
                                        "controlled-replay": "controlled-replay";
                                        "external-service": "external-service";
                                        "historical-reference": "historical-reference";
                                        "shipped-artifact": "shipped-artifact";
                                    },
                                >;
                                confidence: ZodEnum<
                                    {
                                        derived: "derived";
                                        inferred: "inferred";
                                        observed: "observed";
                                    },
                                >;
                                environment: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodString;
                                            id: ZodString;
                                            isolation: ZodEnum<(...)>;
                                            platform: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                                evidence_id: ZodString;
                                evidence_links: ZodArray<ZodString>;
                                limitations: ZodArray<ZodString>;
                                locations: ZodArray<
                                    ZodDiscriminatedUnion<
                                        [
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                        ],
                                        "kind",
                                    >,
                                >;
                                normalized_result: ZodObject<
                                    {
                                        cleanup: ZodObject<
                                            { residual_resources: ...; state: ... },
                                            $strict,
                                        >;
                                        comparison: ZodOptional<ZodArray<(...)>>;
                                        limitations: ZodArray<ZodString>;
                                        outcomes: ZodArray<ZodObject<(...), (...)>>;
                                        plan_digest: ZodString;
                                        reproducer: ZodNullable<ZodDiscriminatedUnion<(...), (...)>>;
                                        schema_version: ZodLiteral<1>;
                                        stderr: ZodString;
                                        termination: ZodEnum<
                                            {
                                                cancelled: ...;
                                                completed: ...;
                                                crash: ...;
                                                oom: ...;
                                                protocol_error: ...;
                                                timeout: ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >;
                                operation: ZodString;
                                parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                predicate_type: ZodString;
                                provider: ZodObject<
                                    {
                                        id: ZodString;
                                        name: ZodString;
                                        version: ZodNullable<ZodString>;
                                    },
                                    $strip,
                                >;
                                raw_result: ZodNullable<ZodJSONSchema>;
                                schema_version: ZodLiteral<2>;
                                subject: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodNullable<(...)>;
                                            digest: ZodObject<(...), (...)>;
                                            format: ZodEnum<(...)>;
                                            local_path: ZodString;
                                            name: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                    phase: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                    plan: ZodNullable<
                        ZodObject<
                            {
                                cases: ZodArray<
                                    ZodObject<
                                        {
                                            arguments: ZodArray<(...)>;
                                            case_id: ZodString;
                                            sha256: ZodString;
                                        },
                                        $strict,
                                    >,
                                >;
                                determinism: ZodObject<
                                    {
                                        clock_iso: ZodDefault<ZodISODateTime>;
                                        locale: ZodDefault<ZodLiteral<(...)>>;
                                        platform: ZodDefault<ZodLiteral<(...)>>;
                                        random_seed: ZodDefault<ZodNumber>;
                                        timezone: ZodDefault<ZodLiteral<(...)>>;
                                    },
                                    $strict,
                                >;
                                effects: ZodArray<ZodString>;
                                filesystem: ZodObject<
                                    {
                                        host_writes: ZodLiteral<false>;
                                        private_tmpfs_bytes: ZodNumber;
                                    },
                                    $strict,
                                >;
                                left: ZodObject<
                                    {
                                        entry_alias: ZodString;
                                        entry_export: ZodString;
                                        modules: ZodArray<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >;
                                limits: ZodObject<
                                    {
                                        cpu_quota_percent: ZodDefault<ZodNumber>;
                                        input_bytes: ZodDefault<ZodNumber>;
                                        memory_bytes: ZodDefault<ZodNumber>;
                                        module_bytes: ZodDefault<ZodNumber>;
                                        output_bytes: ZodDefault<ZodNumber>;
                                        protocol_bytes: ZodDefault<ZodNumber>;
                                        result_depth: ZodDefault<ZodNumber>;
                                        result_nodes: ZodDefault<ZodNumber>;
                                        stderr_bytes: ZodDefault<ZodNumber>;
                                        tasks: ZodDefault<ZodNumber>;
                                        tmpfs_bytes: ZodDefault<ZodNumber>;
                                        wall_time_ms: ZodDefault<ZodNumber>;
                                    },
                                    $strict,
                                >;
                                network: ZodLiteral<"none">;
                                plan_digest: ZodString;
                                policy_sha256: ZodString;
                                policy_version: ZodLiteral<"linux-bwrap-systemd-v1">;
                                reproducer_export: ZodNullable<
                                    ZodObject<
                                        {
                                            authority: ZodLiteral<(...)>;
                                            include_sources: ZodBoolean;
                                            path: ZodString;
                                        },
                                        $strict,
                                    >,
                                >;
                                right: ZodOptional<
                                    ZodObject<
                                        {
                                            entry_alias: ZodString;
                                            entry_export: ZodString;
                                            modules: ZodArray<(...)>;
                                        },
                                        $strict,
                                    >,
                                >;
                                runtime: ZodObject<
                                    {
                                        executable: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                        read_only_files: ZodArray<ZodObject<(...), (...)>>;
                                        worker: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                    },
                                    $strict,
                                >;
                                sandbox: ZodObject<
                                    {
                                        bubblewrap: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                        seccomp_sha256: ZodString;
                                        shell: ZodObject<{ path: ...; sha256: ...; version: ... }, $strict>;
                                        systemctl: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                        systemd_run: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                    },
                                    $strict,
                                >;
                                schema_version: ZodLiteral<1>;
                            },
                            $strict,
                        >,
                    >;
                    source_evidence: ZodArray<
                        ZodObject<
                            {
                                analysis_profile: ZodOptional<
                                    ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >,
                                >;
                                authority: ZodEnum<
                                    {
                                        "analyst-inference": "analyst-inference";
                                        "controlled-replay": "controlled-replay";
                                        "external-service": "external-service";
                                        "historical-reference": "historical-reference";
                                        "shipped-artifact": "shipped-artifact";
                                    },
                                >;
                                confidence: ZodEnum<
                                    {
                                        derived: "derived";
                                        inferred: "inferred";
                                        observed: "observed";
                                    },
                                >;
                                environment: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodString;
                                            id: ZodString;
                                            isolation: ZodEnum<(...)>;
                                            platform: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                                evidence_id: ZodString;
                                evidence_links: ZodArray<ZodString>;
                                limitations: ZodArray<ZodString>;
                                locations: ZodArray<
                                    ZodDiscriminatedUnion<
                                        [
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                        ],
                                        "kind",
                                    >,
                                >;
                                normalized_result: ZodObject<
                                    {
                                        cleanup: ZodObject<
                                            { residual_resources: ...; state: ... },
                                            $strict,
                                        >;
                                        comparison: ZodOptional<ZodArray<(...)>>;
                                        limitations: ZodArray<ZodString>;
                                        outcomes: ZodArray<ZodObject<(...), (...)>>;
                                        plan_digest: ZodString;
                                        reproducer: ZodNullable<ZodDiscriminatedUnion<(...), (...)>>;
                                        schema_version: ZodLiteral<1>;
                                        stderr: ZodString;
                                        termination: ZodEnum<
                                            {
                                                cancelled: ...;
                                                completed: ...;
                                                crash: ...;
                                                oom: ...;
                                                protocol_error: ...;
                                                timeout: ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >;
                                operation: ZodString;
                                parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                predicate_type: ZodString;
                                provider: ZodObject<
                                    {
                                        id: ZodString;
                                        name: ZodString;
                                        version: ZodNullable<ZodString>;
                                    },
                                    $strip,
                                >;
                                raw_result: ZodNullable<ZodJSONSchema>;
                                schema_version: ZodLiteral<2>;
                                subject: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodNullable<(...)>;
                                            digest: ZodObject<(...), (...)>;
                                            format: ZodEnum<(...)>;
                                            local_path: ZodString;
                                            name: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Prepare a hash-bound Node/JavaScript characterization plan and deterministic reversible export transformation without executing target code. The exact source, selected byte range, runtime closure, sandbox profile, cases, and limits are committed for separate execution approval.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: Record<string, JSONType>;
                    title: "Prepare one exact bundled callable characterization";
                },
            ];
            inputSchema: ZodObject<
                {
                    expected_effect: ZodEnum<
                        { "observation-only": "observation-only"; pure: "pure" },
                    >;
                    instrumentation: ZodObject<
                        {
                            artifact_path: ZodString;
                            artifact_sha256: ZodString;
                            selection: ZodObject<
                                {
                                    byte_end: ZodNumber;
                                    byte_start: ZodNumber;
                                    export_name: ZodString;
                                    selected_sha256: ZodString;
                                },
                                $strict,
                            >;
                        },
                        $strict,
                    >;
                    preparation_approved: ZodLiteral<true>;
                    replay: ZodObject<
                        {
                            approved: ZodDefault<ZodBoolean>;
                            cases: ZodDefault<
                                ZodArray<
                                    ZodObject<
                                        { arguments: ZodArray<(...)>; case_id: ZodString },
                                        $strict,
                                    >,
                                >,
                            >;
                            determinism: ZodDefault<
                                ZodObject<
                                    {
                                        clock_iso: ZodDefault<ZodISODateTime>;
                                        locale: ZodDefault<ZodLiteral<(...)>>;
                                        platform: ZodDefault<ZodLiteral<(...)>>;
                                        random_seed: ZodDefault<ZodNumber>;
                                        timezone: ZodDefault<ZodLiteral<(...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                            generator: ZodOptional<
                                ZodObject<
                                    {
                                        count: ZodNumber;
                                        preset: ZodEnum<
                                            {
                                                "clipboard-boundaries": ...;
                                                "parser-boundaries": ...;
                                                "sanitizer-boundaries": ...;
                                            },
                                        >;
                                        seed: ZodNumber;
                                    },
                                    $strict,
                                >,
                            >;
                            left: ZodObject<
                                {
                                    entry_alias: ZodString;
                                    entry_export: ZodDefault<ZodString>;
                                    modules: ZodArray<
                                        ZodObject<
                                            {
                                                alias: ...;
                                                dependencies: ...;
                                                format: ...;
                                                path: ...;
                                                role: ...;
                                            },
                                            $strict,
                                        >,
                                    >;
                                },
                                $strict,
                            >;
                            limits: ZodDefault<
                                ZodObject<
                                    {
                                        cpu_quota_percent: ZodDefault<ZodNumber>;
                                        input_bytes: ZodDefault<ZodNumber>;
                                        memory_bytes: ZodDefault<ZodNumber>;
                                        module_bytes: ZodDefault<ZodNumber>;
                                        output_bytes: ZodDefault<ZodNumber>;
                                        protocol_bytes: ZodDefault<ZodNumber>;
                                        result_depth: ZodDefault<ZodNumber>;
                                        result_nodes: ZodDefault<ZodNumber>;
                                        stderr_bytes: ZodDefault<ZodNumber>;
                                        tasks: ZodDefault<ZodNumber>;
                                        tmpfs_bytes: ZodDefault<ZodNumber>;
                                        wall_time_ms: ZodDefault<ZodNumber>;
                                    },
                                    $strict,
                                >,
                            >;
                            mode: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                            plan_digest: ZodOptional<ZodString>;
                            reproducer_export: ZodOptional<
                                ZodObject<
                                    {
                                        approved: ZodBoolean;
                                        include_sources: ZodDefault<ZodBoolean>;
                                        path: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            right: ZodOptional<
                                ZodObject<
                                    {
                                        entry_alias: ZodString;
                                        entry_export: ZodDefault<ZodString>;
                                        modules: ZodArray<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    selected_alias: ZodString;
                },
                $strict,
            >;
            kind: "application";
            name: "prepare_node_characterization";
            outputSchema: ZodObject<
                {
                    phase: ZodLiteral<"preparation">;
                    plan: ZodObject<
                        {
                            allowed_boundaries: ZodArray<ZodString>;
                            artifact: ZodObject<
                                { byte_length: ZodNumber; path: ZodString; sha256: ZodString },
                                $strict,
                            >;
                            authority: ZodObject<
                                {
                                    execution_approved: ZodLiteral<false>;
                                    network: ZodEnum<{ loopback: "loopback"; none: "none" }>;
                                    preparation_approved: ZodLiteral<true>;
                                    provider_owned_process_only: ZodLiteral<true>;
                                },
                                $strict,
                            >;
                            callable: ZodObject<
                                {
                                    callable_id: ZodString;
                                    export_name: ZodString;
                                    module_id: ZodString;
                                    selector_sha256: ZodString;
                                    semantic_evidence_id: ZodNullable<ZodString>;
                                },
                                $strict,
                            >;
                            determinism: ZodObject<
                                {
                                    clock: ZodEnum<{ fixed: "fixed"; real: "real" }>;
                                    identifiers: ZodEnum<
                                        { deterministic: "deterministic"; runtime: "runtime" },
                                    >;
                                    randomness: ZodEnum<{ seeded: "seeded"; system: "system" }>;
                                    seed: ZodNumber;
                                },
                                $strict,
                            >;
                            expected_effect: ZodEnum<
                                {
                                    "bounded-effects": "bounded-effects";
                                    "observation-only": "observation-only";
                                    pure: "pure";
                                },
                            >;
                            isolated_home: ZodString;
                            limits: ZodObject<
                                {
                                    idle_timeout_ms: ZodNumber;
                                    max_bytes: ZodNumber;
                                    max_calls: ZodNumber;
                                    max_files: ZodNumber;
                                    max_handles: ZodNumber;
                                    max_processes: ZodNumber;
                                    timeout_ms: ZodNumber;
                                },
                                $strict,
                            >;
                            plan_sha256: ZodString;
                            preparation_sha256: ZodString;
                            runtime: ZodObject<
                                {
                                    executable_path: ZodString;
                                    executable_sha256: ZodString;
                                    family: ZodString;
                                    profile_sha256: ZodString;
                                    provider_id: ZodString;
                                    version: ZodString;
                                },
                                $strict,
                            >;
                            schema_version: ZodLiteral<1>;
                            working_directory: ZodString;
                        },
                        $strict,
                    >;
                    replay: ZodObject<
                        {
                            evidence: ZodNullable<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                            phase: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                            plan: ZodNullable<
                                ZodObject<
                                    {
                                        cases: ZodArray<ZodObject<(...), (...)>>;
                                        determinism: ZodObject<
                                            {
                                                clock_iso: ...;
                                                locale: ...;
                                                platform: ...;
                                                random_seed: ...;
                                                timezone: ...;
                                            },
                                            $strict,
                                        >;
                                        effects: ZodArray<ZodString>;
                                        filesystem: ZodObject<
                                            { host_writes: ...; private_tmpfs_bytes: ... },
                                            $strict,
                                        >;
                                        left: ZodObject<
                                            { entry_alias: ...; entry_export: ...; modules: ... },
                                            $strict,
                                        >;
                                        limits: ZodObject<
                                            {
                                                cpu_quota_percent: ...;
                                                input_bytes: ...;
                                                memory_bytes: ...;
                                                module_bytes: ...;
                                                output_bytes: ...;
                                                protocol_bytes: ...;
                                                result_depth: ...;
                                                result_nodes: ...;
                                                stderr_bytes: ...;
                                                tasks: ...;
                                                tmpfs_bytes: ...;
                                                wall_time_ms: ...;
                                            },
                                            $strict,
                                        >;
                                        network: ZodLiteral<"none">;
                                        plan_digest: ZodString;
                                        policy_sha256: ZodString;
                                        policy_version: ZodLiteral<"linux-bwrap-systemd-v1">;
                                        reproducer_export: ZodNullable<ZodObject<(...), (...)>>;
                                        right: ZodOptional<ZodObject<(...), (...)>>;
                                        runtime: ZodObject<
                                            { executable: ...; read_only_files: ...; worker: ... },
                                            $strict,
                                        >;
                                        sandbox: ZodObject<
                                            {
                                                bubblewrap: ...;
                                                seccomp_sha256: ...;
                                                shell: ...;
                                                systemctl: ...;
                                                systemd_run: ...;
                                            },
                                            $strict,
                                        >;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strict,
                                >,
                            >;
                            source_evidence: ZodArray<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    schema_version: ZodLiteral<1>;
                    transformation: ZodObject<
                        {
                            artifact_path: ZodString;
                            inserted_ranges: ZodArray<
                                ZodObject<
                                    {
                                        byte_end: ZodNumber;
                                        byte_start: ZodNumber;
                                        inserted_sha256: ZodString;
                                        purpose: ZodEnum<
                                            {
                                                "export-binding": ...;
                                                "factory-prefix": ...;
                                                "factory-suffix": ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >,
                            >;
                            instrumented_byte_length: ZodNumber;
                            instrumented_sha256: ZodString;
                            kind: ZodLiteral<"commonjs-factory-export-v1">;
                            original_byte_length: ZodNumber;
                            original_sha256: ZodString;
                            output_format: ZodLiteral<"commonjs-factory">;
                            schema_version: ZodLiteral<1>;
                            selected_range: ZodObject<
                                {
                                    byte_end: ZodNumber;
                                    byte_start: ZodNumber;
                                    selected_sha256: ZodString;
                                },
                                $strict,
                            >;
                            source_map: ZodLiteral<null>;
                        },
                        $strict,
                    >;
                    transformation_evidence: ZodUnion<
                        readonly [
                            ZodObject<
                                {
                                    analysis_profile: ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                            ZodObject<
                                {
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        ],
                    >;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Recompute and execute one separately approved exact Node characterization plan in the owned controlled-replay boundary. Returns transformation, replay, cleanup, and provider-neutral characterization Evidence v2; stale plans fail before execution.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved_plan_sha256: string;
                        execution_approved: true;
                        preparation: Record<string, JSONType>;
                    };
                    title: "Execute one approved exact characterization plan";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved_plan_sha256: ZodString;
                    execution_approved: ZodLiteral<true>;
                    preparation: ZodObject<
                        {
                            expected_effect: ZodEnum<
                                { "observation-only": "observation-only"; pure: "pure" },
                            >;
                            instrumentation: ZodObject<
                                {
                                    artifact_path: ZodString;
                                    artifact_sha256: ZodString;
                                    selection: ZodObject<
                                        {
                                            byte_end: ZodNumber;
                                            byte_start: ZodNumber;
                                            export_name: ZodString;
                                            selected_sha256: ZodString;
                                        },
                                        $strict,
                                    >;
                                },
                                $strict,
                            >;
                            preparation_approved: ZodLiteral<true>;
                            replay: ZodObject<
                                {
                                    approved: ZodDefault<ZodBoolean>;
                                    cases: ZodDefault<ZodArray<ZodObject<(...), (...)>>>;
                                    determinism: ZodDefault<
                                        ZodObject<
                                            {
                                                clock_iso: ...;
                                                locale: ...;
                                                platform: ...;
                                                random_seed: ...;
                                                timezone: ...;
                                            },
                                            $strict,
                                        >,
                                    >;
                                    generator: ZodOptional<
                                        ZodObject<{ count: ...; preset: ...; seed: ... }, $strict>,
                                    >;
                                    left: ZodObject<
                                        {
                                            entry_alias: ZodString;
                                            entry_export: ZodDefault<(...)>;
                                            modules: ZodArray<(...)>;
                                        },
                                        $strict,
                                    >;
                                    limits: ZodDefault<
                                        ZodObject<
                                            {
                                                cpu_quota_percent: ...;
                                                input_bytes: ...;
                                                memory_bytes: ...;
                                                module_bytes: ...;
                                                output_bytes: ...;
                                                protocol_bytes: ...;
                                                result_depth: ...;
                                                result_nodes: ...;
                                                stderr_bytes: ...;
                                                tasks: ...;
                                                tmpfs_bytes: ...;
                                                wall_time_ms: ...;
                                            },
                                            $strict,
                                        >,
                                    >;
                                    mode: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                                    plan_digest: ZodOptional<ZodString>;
                                    reproducer_export: ZodOptional<
                                        ZodObject<
                                            { approved: ...; include_sources: ...; path: ... },
                                            $strict,
                                        >,
                                    >;
                                    right: ZodOptional<
                                        ZodObject<
                                            { entry_alias: ...; entry_export: ...; modules: ... },
                                            $strict,
                                        >,
                                    >;
                                },
                                $strict,
                            >;
                            selected_alias: ZodString;
                        },
                        $strict,
                    >;
                },
                $strict,
            >;
            kind: "application";
            name: "execute_node_characterization";
            outputSchema: ZodObject<
                {
                    evidence: ZodUnion<
                        readonly [
                            ZodObject<
                                {
                                    analysis_profile: ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                            ZodObject<
                                {
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        ],
                    >;
                    phase: ZodLiteral<"execution">;
                    plan: ZodObject<
                        {
                            allowed_boundaries: ZodArray<ZodString>;
                            artifact: ZodObject<
                                { byte_length: ZodNumber; path: ZodString; sha256: ZodString },
                                $strict,
                            >;
                            authority: ZodObject<
                                {
                                    execution_approved: ZodLiteral<false>;
                                    network: ZodEnum<{ loopback: "loopback"; none: "none" }>;
                                    preparation_approved: ZodLiteral<true>;
                                    provider_owned_process_only: ZodLiteral<true>;
                                },
                                $strict,
                            >;
                            callable: ZodObject<
                                {
                                    callable_id: ZodString;
                                    export_name: ZodString;
                                    module_id: ZodString;
                                    selector_sha256: ZodString;
                                    semantic_evidence_id: ZodNullable<ZodString>;
                                },
                                $strict,
                            >;
                            determinism: ZodObject<
                                {
                                    clock: ZodEnum<{ fixed: "fixed"; real: "real" }>;
                                    identifiers: ZodEnum<
                                        { deterministic: "deterministic"; runtime: "runtime" },
                                    >;
                                    randomness: ZodEnum<{ seeded: "seeded"; system: "system" }>;
                                    seed: ZodNumber;
                                },
                                $strict,
                            >;
                            expected_effect: ZodEnum<
                                {
                                    "bounded-effects": "bounded-effects";
                                    "observation-only": "observation-only";
                                    pure: "pure";
                                },
                            >;
                            isolated_home: ZodString;
                            limits: ZodObject<
                                {
                                    idle_timeout_ms: ZodNumber;
                                    max_bytes: ZodNumber;
                                    max_calls: ZodNumber;
                                    max_files: ZodNumber;
                                    max_handles: ZodNumber;
                                    max_processes: ZodNumber;
                                    timeout_ms: ZodNumber;
                                },
                                $strict,
                            >;
                            plan_sha256: ZodString;
                            preparation_sha256: ZodString;
                            runtime: ZodObject<
                                {
                                    executable_path: ZodString;
                                    executable_sha256: ZodString;
                                    family: ZodString;
                                    profile_sha256: ZodString;
                                    provider_id: ZodString;
                                    version: ZodString;
                                },
                                $strict,
                            >;
                            schema_version: ZodLiteral<1>;
                            working_directory: ZodString;
                        },
                        $strict,
                    >;
                    replay: ZodObject<
                        {
                            evidence: ZodNullable<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                            phase: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                            plan: ZodNullable<
                                ZodObject<
                                    {
                                        cases: ZodArray<ZodObject<(...), (...)>>;
                                        determinism: ZodObject<
                                            {
                                                clock_iso: ...;
                                                locale: ...;
                                                platform: ...;
                                                random_seed: ...;
                                                timezone: ...;
                                            },
                                            $strict,
                                        >;
                                        effects: ZodArray<ZodString>;
                                        filesystem: ZodObject<
                                            { host_writes: ...; private_tmpfs_bytes: ... },
                                            $strict,
                                        >;
                                        left: ZodObject<
                                            { entry_alias: ...; entry_export: ...; modules: ... },
                                            $strict,
                                        >;
                                        limits: ZodObject<
                                            {
                                                cpu_quota_percent: ...;
                                                input_bytes: ...;
                                                memory_bytes: ...;
                                                module_bytes: ...;
                                                output_bytes: ...;
                                                protocol_bytes: ...;
                                                result_depth: ...;
                                                result_nodes: ...;
                                                stderr_bytes: ...;
                                                tasks: ...;
                                                tmpfs_bytes: ...;
                                                wall_time_ms: ...;
                                            },
                                            $strict,
                                        >;
                                        network: ZodLiteral<"none">;
                                        plan_digest: ZodString;
                                        policy_sha256: ZodString;
                                        policy_version: ZodLiteral<"linux-bwrap-systemd-v1">;
                                        reproducer_export: ZodNullable<ZodObject<(...), (...)>>;
                                        right: ZodOptional<ZodObject<(...), (...)>>;
                                        runtime: ZodObject<
                                            { executable: ...; read_only_files: ...; worker: ... },
                                            $strict,
                                        >;
                                        sandbox: ZodObject<
                                            {
                                                bubblewrap: ...;
                                                seccomp_sha256: ...;
                                                shell: ...;
                                                systemctl: ...;
                                                systemd_run: ...;
                                            },
                                            $strict,
                                        >;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strict,
                                >,
                            >;
                            source_evidence: ZodArray<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    schema_version: ZodLiteral<1>;
                    transformation: ZodObject<
                        {
                            artifact_path: ZodString;
                            inserted_ranges: ZodArray<
                                ZodObject<
                                    {
                                        byte_end: ZodNumber;
                                        byte_start: ZodNumber;
                                        inserted_sha256: ZodString;
                                        purpose: ZodEnum<
                                            {
                                                "export-binding": ...;
                                                "factory-prefix": ...;
                                                "factory-suffix": ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >,
                            >;
                            instrumented_byte_length: ZodNumber;
                            instrumented_sha256: ZodString;
                            kind: ZodLiteral<"commonjs-factory-export-v1">;
                            original_byte_length: ZodNumber;
                            original_sha256: ZodString;
                            output_format: ZodLiteral<"commonjs-factory">;
                            schema_version: ZodLiteral<1>;
                            selected_range: ZodObject<
                                {
                                    byte_end: ZodNumber;
                                    byte_start: ZodNumber;
                                    selected_sha256: ZodString;
                                },
                                $strict,
                            >;
                            source_map: ZodLiteral<null>;
                        },
                        $strict,
                    >;
                    transformation_evidence: ZodUnion<
                        readonly [
                            ZodObject<
                                {
                                    analysis_profile: ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                            ZodObject<
                                {
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        ],
                    >;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Atomically commit one canonical evidence-backed reconstruction coverage workspace revision under an approved root. CAS revisions reject lost updates; every Evidence and residual-unknown reference must resolve in the embedded canonical bundle.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved: true;
                        expected_revision: null;
                        workspace: Record<string, JSONType>;
                        workspace_path: "/approved/coverage.json";
                    };
                    title: "Commit the first canonical coverage revision";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved: ZodLiteral<true>;
                    expected_revision: ZodNullable<ZodNumber>;
                    workspace: ZodObject<
                        {
                            artifacts: ZodArray<
                                ZodObject<
                                    {
                                        artifact_id: ZodString;
                                        artifact_sha256: ZodString;
                                        environment_sha256: ZodString;
                                        evidence_ids: ZodArray<ZodString>;
                                        version: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            boundaries: ZodArray<
                                ZodObject<
                                    {
                                        allowed_dispositions: ZodArray<ZodEnum<(...)>>;
                                        allowed_unknown_ids: ZodArray<ZodString>;
                                        boundary_id: ZodString;
                                        required_claim_ids: ZodArray<ZodString>;
                                        required_package_proof_kinds: ZodArray<ZodEnum<(...)>>;
                                        required_surface_ids: ZodArray<ZodString>;
                                        title: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            claims: ZodArray<
                                ZodObject<
                                    {
                                        claim_id: ZodString;
                                        kind: ZodString;
                                        required_authority: ZodEnum<
                                            {
                                                "controlled-replay": ...;
                                                external: ...;
                                                "live-observation": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        required_dimensions: ZodArray<ZodString>;
                                        surface_ids: ZodArray<ZodString>;
                                        title: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            contradictions: ZodArray<
                                ZodObject<
                                    {
                                        claim_ids: ZodArray<ZodString>;
                                        contradiction_id: ZodString;
                                        evidence_ids: ZodArray<ZodString>;
                                        status: ZodEnum<{ active: ...; resolved: ... }>;
                                        surface_ids: ZodArray<ZodString>;
                                    },
                                    $strict,
                                >,
                            >;
                            evidence_bundle: ZodObject<
                                {
                                    artifacts: ZodArray<
                                        ZodObject<
                                            { architecture: ...; digest: ...; format: ... },
                                            $strip,
                                        >,
                                    >;
                                    bundle_version: ZodLiteral<2>;
                                    captures: ZodArray<
                                        ZodObject<{ evidence_id: ...; predicate_type: ... }, $strip>,
                                    >;
                                    environments: ZodArray<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    providers: ZodArray<
                                        ZodObject<{ id: ...; name: ...; version: ... }, $strip>,
                                    >;
                                    records: ZodArray<ZodUnion<readonly [(...), (...)]>>;
                                    scenarios: ZodArray<
                                        ZodObject<
                                            { authority: ...; evidence_id: ...; operation: ... },
                                            $strip,
                                        >,
                                    >;
                                    unknowns: ZodArray<
                                        ZodObject<
                                            {
                                                contradicting_evidence_ids: ...;
                                                domain: ...;
                                                mutation_evidence_ids: ...;
                                                previous_revision_digest: ...;
                                                question: ...;
                                                recommended_probes: ...;
                                                registry_version: ...;
                                                relationships: ...;
                                                required_authority: ...;
                                                required_confidence: ...;
                                                required_environment: ...;
                                                resolution: ...;
                                                revision: ...;
                                                revision_digest: ...;
                                                scope_digest: ...;
                                                severity: ...;
                                                status: ...;
                                                supporting_evidence_ids: ...;
                                                unknown_id: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strip,
                            >;
                            name: ZodString;
                            owners: ZodArray<
                                ZodObject<
                                    {
                                        ownership: ZodDiscriminatedUnion<[(...), (...)], "disposition">;
                                        surface_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            package_proofs: ZodArray<
                                ZodObject<
                                    {
                                        artifact_sha256s: ZodArray<ZodString>;
                                        evidence_ids: ZodArray<ZodString>;
                                        kind: ZodEnum<
                                            {
                                                "authority-independence": ...;
                                                build: ...;
                                                "clean-install": ...;
                                                "package-contents": ...;
                                                "runtime-routing": ...;
                                            },
                                        >;
                                        proof_id: ZodString;
                                        status: ZodEnum<
                                            {
                                                fail: ...;
                                                pass: ...;
                                                skipped: ...;
                                                unknown: ...;
                                                unsupported: ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >,
                            >;
                            previous_revision_sha256: ZodNullable<ZodString>;
                            residual_unknown_ids: ZodArray<ZodString>;
                            revision: ZodNumber;
                            revision_sha256: ZodString;
                            schema_version: ZodLiteral<1>;
                            surfaces: ZodArray<
                                ZodObject<
                                    {
                                        artifact_id: ZodString;
                                        authority: ZodEnum<
                                            {
                                                derived: ...;
                                                external: ...;
                                                historical: ...;
                                                inferred: ...;
                                                observed: ...;
                                            },
                                        >;
                                        dependency_surface_ids: ZodArray<ZodString>;
                                        evidence_ids: ZodArray<ZodString>;
                                        family: ZodString;
                                        location: ZodString;
                                        occurrence_id: ZodNullable<ZodString>;
                                        surface_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            verifier_contracts: ZodArray<
                                ZodObject<
                                    {
                                        authority: ZodEnum<
                                            {
                                                "controlled-replay": ...;
                                                external: ...;
                                                "live-observation": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        claim_ids: ZodArray<ZodString>;
                                        contract_sha256: ZodString;
                                        dimensions: ZodArray<ZodString>;
                                        max_age_ms: ZodNumber;
                                        minimum_repeats: ZodNumber;
                                        normalization_removes_dimensions: ZodLiteral<false>;
                                        normalization_sha256: ZodString;
                                        verifier_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            verifier_results: ZodArray<
                                ZodObject<
                                    {
                                        artifact_sha256s: ZodArray<ZodString>;
                                        contract_sha256: ZodString;
                                        covered_claim_ids: ZodArray<ZodString>;
                                        covered_dimensions: ZodArray<ZodString>;
                                        evidence_ids: ZodArray<ZodString>;
                                        normalization_sha256: ZodString;
                                        observed_at: ZodString;
                                        owner_sha256s: ZodArray<ZodString>;
                                        repeats: ZodNumber;
                                        status: ZodEnum<
                                            {
                                                fail: ...;
                                                pass: ...;
                                                skipped: ...;
                                                truncated: ...;
                                                unknown: ...;
                                                unsupported: ...;
                                            },
                                        >;
                                        verifier_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            workspace_id: ZodString;
                        },
                        $strict,
                    >;
                    workspace_path: ZodString;
                },
                $strict,
            >;
            kind: "application";
            name: "commit_reconstruction_coverage";
            outputSchema: ZodObject<
                {
                    bytes: ZodNumber;
                    evidence_records: ZodNumber;
                    revision: ZodNumber;
                    revision_sha256: ZodString;
                    workspace_id: ZodString;
                    workspace_path: ZodString;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Evaluate one named reconstruction boundary from a canonical coverage workspace. Missing ownership or inventory is partial; stale, weak, truncated, skipped, or unresolved proof is unknown; contradictions, failed proof, missing owners, and authority routing fail closed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        boundary_id: "replacement.cli";
                        workspace_path: "/approved/coverage.json";
                    };
                    title: "Evaluate one replacement boundary";
                },
            ];
            inputSchema: ZodObject<
                { boundary_id: ZodString; workspace_path: ZodString },
                $strict,
            >;
            kind: "application";
            name: "query_reconstruction_coverage";
            outputSchema: ZodObject<
                {
                    boundary_id: ZodString;
                    evidence_ids: ZodArray<ZodString>;
                    reasons: ZodArray<
                        ZodObject<
                            {
                                code: ZodEnum<
                                    {
                                        "active-contradiction": "active-contradiction";
                                        "active-unknown": "active-unknown";
                                        "authority-routing-detected": "authority-routing-detected";
                                        "authority-routing-unknown": "authority-routing-unknown";
                                        "claim-missing": "claim-missing";
                                        "dependency-surface-missing": "dependency-surface-missing";
                                        "disposition-not-allowed": "disposition-not-allowed";
                                        "owner-distribution-unknown": "owner-distribution-unknown";
                                        "owner-duplicate": "owner-duplicate";
                                        "owner-missing": "owner-missing";
                                        "owner-path-missing": "owner-path-missing";
                                        "owner-path-unknown": "owner-path-unknown";
                                        "owner-undistributed": "owner-undistributed";
                                        "package-proof-failed": "package-proof-failed";
                                        "package-proof-missing": "package-proof-missing";
                                        "package-proof-unknown": "package-proof-unknown";
                                        "surface-missing": "surface-missing";
                                        "verifier-duplicate": "verifier-duplicate";
                                        "verifier-failed": "verifier-failed";
                                        "verifier-missing": "verifier-missing";
                                        "verifier-result-incompatible": "verifier-result-incompatible";
                                        "verifier-result-missing": "verifier-result-missing";
                                        "verifier-result-stale": "verifier-result-stale";
                                        "verifier-unknown": "verifier-unknown";
                                    },
                                >;
                                detail: ZodString;
                                subject_id: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    recommended_probes: ZodArray<
                        ZodObject<
                            {
                                operation: ZodString;
                                rationale: ZodString;
                                subject_id: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    status: ZodEnum<
                        {
                            failed: "failed";
                            partial: "partial";
                            ready: "ready";
                            unknown: "unknown";
                        },
                    >;
                    summary: ZodObject<
                        {
                            reasons: ZodNumber;
                            required_claims: ZodNumber;
                            required_surfaces: ZodNumber;
                        },
                        $strict,
                    >;
                    workspace_revision_sha256: ZodString;
                },
                $strict,
            >;
            title: string;
        },
        ToolContract<"open_binary">,
        ToolContract<"close_binary">,
        ToolContract<"binary_session">,
        ToolContract<"export_evidence_bundle">,
        ToolContract<"import_evidence_bundle">,
        ToolContract<"capture_process_scenario">,
        ToolContract<"compare_process_captures">,
        ToolContract<"compare_artifacts">,
        ToolContract<"compare_functions">,
        ToolContract<"compare_bundles">,
        ToolContract<"find_changed_behavior">,
        ToolContract<"build_call_path">,
        ToolContract<"correlate_static_and_runtime">,
        ToolContract<"verify_reconstruction">,
        ToolContract<"list_unknowns">,
        ToolContract<"record_unknown">,
        ToolContract<"update_unknown">,
        ToolContract<"verify_unknown_resolution">,
    ] = ...
    +
    TOOL_CONTRACTS: readonly [
        ToolContract<"address_name">,
        ToolContract<"comment">,
        ToolContract<"current_address">,
        ToolContract<"current_procedure">,
        ToolContract<"current_document">,
        ToolContract<"goto_address">,
        ToolContract<"inline_comment">,
        ToolContract<"list_bookmarks">,
        ToolContract<"list_documents">,
        ToolContract<"list_names">,
        ToolContract<"list_procedures">,
        ToolContract<"list_segments">,
        ToolContract<"list_strings">,
        ToolContract<"next_address">,
        ToolContract<"prev_address">,
        ToolContract<"procedure_address">,
        ToolContract<"procedure_assembly">,
        ToolContract<"procedure_callees">,
        ToolContract<"procedure_callers">,
        ToolContract<"procedure_info">,
        ToolContract<"procedure_references">,
        ToolContract<"procedure_pseudo_code">,
        ToolContract<"resolve_containing_procedure">,
        ToolContract<"search_procedures">,
        ToolContract<"search_strings">,
        ToolContract<"set_address_name">,
        ToolContract<"set_addresses_names">,
        ToolContract<"set_bookmark">,
        ToolContract<"set_comment">,
        ToolContract<"set_current_document">,
        ToolContract<"set_inline_comment">,
        ToolContract<"unset_bookmark">,
        ToolContract<"xrefs">,
        ToolContract<"swift_classes">,
        ToolContract<"get_objc_classes">,
        ToolContract<"get_objc_protocols">,
        ToolContract<"batch_decompile">,
        ToolContract<"get_call_graph">,
        ToolContract<"analyze_swift_types">,
        ToolContract<"find_xrefs_to_name">,
        ToolContract<"binary_overview">,
        ToolContract<"analyze_function">,
        ToolContract<"trace_feature">,
        ToolContract<"inspect_macho">,
        ToolContract<"inspect_signature">,
        ToolContract<"inspect_plist">,
        ToolContract<"list_architectures">,
        ToolContract<"demangle_swift">,
        ToolContract<"inventory_artifact">,
        ToolContract<"extract_artifact">,
        {
            annotations: DerivedToolAnnotations;
            description: "Classify the active PE/CLI artifact and inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns bounded pages and explicit partial or malformed coverage.";
            effects: ToolEffects;
            examples: readonly [
                { input: {}; title: "Example inspect managed artifact request" },
            ];
            inputSchema: ZodObject<
                {
                    attribute_limit: ZodDefault<ZodNumber>;
                    attribute_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    reference_limit: ZodDefault<ZodNumber>;
                    reference_offset: ZodDefault<ZodNumber>;
                    resource_limit: ZodDefault<ZodNumber>;
                    resource_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_artifact";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect bounded PE/CLI metadata members, signatures, raw CIL hashes, limited member-result-v1 decoded-instruction-tuple hashes, separately reported exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID; the v1 tuple hash does not resolve them or fully commit control flow.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { edge_limit: 100; method_limit: 25 };
                    title: "Example inspect managed members request";
                },
            ];
            inputSchema: ZodObject<
                {
                    edge_limit: ZodDefault<ZodNumber>;
                    edge_offset: ZodDefault<ZodNumber>;
                    field_limit: ZodDefault<ZodNumber>;
                    field_offset: ZodDefault<ZodNumber>;
                    instruction_anchor_limit: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_method_body_bytes: ZodDefault<ZodNumber>;
                    max_method_instructions: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    member_ref_limit: ZodDefault<ZodNumber>;
                    member_ref_offset: ZodDefault<ZodNumber>;
                    method_limit: ZodDefault<ZodNumber>;
                    method_offset: ZodDefault<ZodNumber>;
                    type_limit: ZodDefault<ZodNumber>;
                    type_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Inspect PE/CLI ModuleRef, ImplMap/PInvoke declarations, CLI native-header indicators, and non-IL method implementation flags without loading or executing target code. Results are managed declarations and degraded native-boundary observations, not verified native exports or addresses.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: { implementation_limit: 50; import_limit: 50 };
                    title: "Example inspect managed/native boundary request";
                },
            ];
            inputSchema: ZodObject<
                {
                    implementation_limit: ZodDefault<ZodNumber>;
                    implementation_offset: ZodDefault<ZodNumber>;
                    import_limit: ZodDefault<ZodNumber>;
                    import_offset: ZodDefault<ZodNumber>;
                    max_file_bytes: ZodDefault<ZodNumber>;
                    max_heap_item_bytes: ZodDefault<ZodNumber>;
                    max_metadata_bytes: ZodDefault<ZodNumber>;
                    max_table_rows: ZodDefault<ZodNumber>;
                    module_ref_limit: ZodDefault<ZodNumber>;
                    module_ref_offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "managed-provider";
            name: "inspect_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL-v1/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the v1 tuple digest does not itself remap them.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        left_evidence_id: string;
                        limits: {
                            max_candidates: number;
                            max_field_matches: number;
                            max_method_matches: number;
                        };
                        right_evidence_id: string;
                    };
                    title: "Compare two managed member observations";
                },
            ];
            inputSchema: ZodObject<
                {
                    left_evidence_id: ZodString;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates: ZodDefault<ZodNumber>;
                                max_field_matches: ZodDefault<ZodNumber>;
                                max_method_matches: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    right_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "compare_managed_members";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_candidates_per_import: number;
                            max_native_observations: number;
                        };
                        managed_boundaries_evidence_id: string;
                        native_observation_evidence_ids: string[];
                    };
                    title: "Verify a managed P/Invoke declaration against native Evidence";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidates_per_import: ZodDefault<ZodNumber>;
                                max_native_observations: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_boundaries_evidence_id: ZodString;
                    native_observation_evidence_ids: ZodArray<ZodString>;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "verify_managed_native_boundaries";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited member-result-v1 decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        decompiler: {
                            executable_sha256: null;
                            family: string;
                            name: string;
                            options: string[];
                            version: string;
                        };
                        methods: {
                            normalized_il_sha256: string;
                            reconstruction: {
                                end_line: number;
                                kind: string;
                                language: string;
                                source_path: string;
                                start_line: number;
                                text: string;
                            };
                            signature_sha256: string;
                            token: string;
                        }[];
                        notes: string[];
                        static_members_evidence_id: string;
                    };
                    title: "Import a decompiler reconstruction for one managed method";
                },
            ];
            inputSchema: ZodObject<
                {
                    decompiler: ZodObject<
                        {
                            executable_sha256: ZodNullable<ZodString>;
                            family: ZodEnum<
                                {
                                    dnlib: "dnlib";
                                    dnspy: "dnspy";
                                    ilspy: "ilspy";
                                    "mono-cecil": "mono-cecil";
                                    other: "other";
                                },
                            >;
                            name: ZodString;
                            options: ZodDefault<ZodArray<ZodString>>;
                            version: ZodNullable<ZodString>;
                        },
                        $strict,
                    >;
                    methods: ZodArray<
                        ZodObject<
                            {
                                normalized_il_sha256: ZodNullable<ZodString>;
                                reconstruction: ZodObject<
                                    {
                                        end_line: ZodOptional<ZodNullable<(...)>>;
                                        kind: ZodEnum<
                                            {
                                                "decompiled-csharp": ...;
                                                "decompiled-il": ...;
                                                "semantic-pseudocode": ...;
                                            },
                                        >;
                                        language: ZodEnum<{ csharp: ...; il: ...; pseudocode: ... }>;
                                        source_path: ZodOptional<ZodNullable<(...)>>;
                                        start_line: ZodOptional<ZodNullable<(...)>>;
                                        text: ZodString;
                                        text_sha256: ZodOptional<ZodString>;
                                    },
                                    $strict,
                                >;
                                signature_sha256: ZodString;
                                token: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    notes: ZodDefault<ZodArray<ZodString>>;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "import_managed_reconstruction";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and limited member-result-v1 decoded-IL tuple hash, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        bounds: {
                            allow_network: boolean;
                            allow_ui: boolean;
                            max_output_bytes: number;
                            max_threads: number;
                            timeout_ms: number;
                        };
                        host: { architecture: string; clr_family: string; os: string };
                        method: {
                            normalized_il_sha256: string;
                            signature_sha256: string;
                            token: string;
                        };
                        requested_effect: string;
                        static_members_evidence_id: string;
                    };
                    title: "Plan an exact-build managed runtime correlation";
                },
            ];
            inputSchema: ZodObject<
                {
                    bounds: ZodDefault<
                        ZodObject<
                            {
                                allow_network: ZodDefault<ZodLiteral<false>>;
                                allow_ui: ZodDefault<ZodLiteral<false>>;
                                max_output_bytes: ZodDefault<ZodNumber>;
                                max_threads: ZodDefault<ZodNumber>;
                                timeout_ms: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    host: ZodObject<
                        {
                            architecture: ZodEnum<
                                { arm: "arm"; arm64: "arm64"; x86: "x86"; x86_64: "x86_64" },
                            >;
                            clr_family: ZodEnum<
                                {
                                    dotnet: "dotnet";
                                    "dotnet-framework": "dotnet-framework";
                                    mono: "mono";
                                    unknown: "unknown";
                                },
                            >;
                            os: ZodEnum<{ linux: "linux"; macos: "macos"; windows: "windows" }>;
                        },
                        $strict,
                    >;
                    method: ZodObject<
                        {
                            normalized_il_sha256: ZodNullable<ZodString>;
                            signature_sha256: ZodString;
                            token: ZodString;
                        },
                        $strict,
                    >;
                    requested_effect: ZodEnum<
                        {
                            attach: "attach";
                            debugger: "debugger";
                            instrumentation: "instrumentation";
                            load: "load";
                            reflection: "reflection";
                        },
                    >;
                    static_members_evidence_id: ZodString;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "plan_managed_runtime_correlation";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        limits: {
                            max_fields: number;
                            max_methods: number;
                            max_native_implementations: number;
                            max_pinvoke_imports: number;
                            max_types: number;
                        };
                        managed_members_evidence_id: string;
                    };
                    title: "Project static managed observations into an application graph";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_fields: ZodDefault<ZodNumber>;
                                max_methods: ZodDefault<ZodNumber>;
                                max_native_implementations: ZodDefault<ZodNumber>;
                                max_pinvoke_imports: ZodDefault<ZodNumber>;
                                max_types: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    managed_artifact_evidence_id: ZodOptional<ZodString>;
                    managed_members_evidence_id: ZodOptional<ZodString>;
                    managed_native_boundaries_evidence_id: ZodOptional<ZodString>;
                },
                $strict,
            >;
            kind: "application";
            name: "project_managed_application_graph";
            outputSchema: ZodObject<$ZodLooseShape, $strip>;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "List bounded page targets from an approved user-owned loopback Chrome DevTools Protocol endpoint. Only targets whose current URL matches an approved exact origin are returned; URL credentials, query values, and fragments are redacted.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        limit: 100;
                        offset: 0;
                    };
                    title: "List approved browser page targets";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    limit: ZodDefault<ZodNumber>;
                    offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "list_browser_targets";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Passively inspect one approved page target through CDP without evaluating JavaScript, navigating, clicking, closing, or mutating the page. Returns bounded DOM structure, accessibility, scripts, resources, attach-window network and console metadata, workers, and redacted storage inventory as Evidence v2.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        console_text_approved: false;
                        include_accessibility_text: false;
                        include_console_text: false;
                        include_json_body_shapes: false;
                        include_script_sources: false;
                        include_storage_keys: false;
                        include_websocket_shapes: false;
                        json_body_schema_approved: false;
                        limits: {
                            max_ax_nodes: 2000;
                            max_ax_text_field_bytes: 1024;
                            max_console_events: 200;
                            max_console_text_field_bytes: 1024;
                            max_dom_nodes: 2000;
                            max_frames: 200;
                            max_json_body_bytes: 1048576;
                            max_json_shape_depth: 20;
                            max_json_shape_nodes: 5000;
                            max_network_events: 1000;
                            max_resources: 2000;
                            max_script_source_bytes: 1048576;
                            max_scripts: 200;
                            max_storage_keys: 1000;
                            max_total_ax_text_bytes: 65536;
                            max_total_console_text_bytes: 65536;
                            max_total_json_body_bytes: 4194304;
                            max_total_script_source_bytes: 4194304;
                            max_total_websocket_shape_bytes: 1048576;
                            max_websocket_events: 500;
                            max_websocket_shape_bytes: 65536;
                            max_workers: 500;
                        };
                        observation_ms: 500;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                        websocket_shape_approved: false;
                    };
                    title: "Inspect one approved browser page";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    console_text_approved: ZodDefault<ZodBoolean>;
                    include_accessibility_text: ZodDefault<ZodBoolean>;
                    include_console_text: ZodDefault<ZodBoolean>;
                    include_json_body_shapes: ZodDefault<ZodBoolean>;
                    include_script_sources: ZodDefault<ZodBoolean>;
                    include_storage_keys: ZodDefault<ZodBoolean>;
                    include_websocket_shapes: ZodDefault<ZodBoolean>;
                    json_body_schema_approved: ZodDefault<ZodBoolean>;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_ax_nodes: ZodDefault<ZodNumber>;
                                max_ax_text_field_bytes: ZodDefault<ZodNumber>;
                                max_console_events: ZodDefault<ZodNumber>;
                                max_console_text_field_bytes: ZodDefault<ZodNumber>;
                                max_dom_nodes: ZodDefault<ZodNumber>;
                                max_frames: ZodDefault<ZodNumber>;
                                max_json_body_bytes: ZodDefault<ZodNumber>;
                                max_json_shape_depth: ZodDefault<ZodNumber>;
                                max_json_shape_nodes: ZodDefault<ZodNumber>;
                                max_network_events: ZodDefault<ZodNumber>;
                                max_resources: ZodDefault<ZodNumber>;
                                max_script_source_bytes: ZodDefault<ZodNumber>;
                                max_scripts: ZodDefault<ZodNumber>;
                                max_storage_keys: ZodDefault<ZodNumber>;
                                max_total_ax_text_bytes: ZodDefault<ZodNumber>;
                                max_total_console_text_bytes: ZodDefault<ZodNumber>;
                                max_total_json_body_bytes: ZodDefault<ZodNumber>;
                                max_total_script_source_bytes: ZodDefault<ZodNumber>;
                                max_total_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_websocket_events: ZodDefault<ZodNumber>;
                                max_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_workers: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    observation_ms: ZodDefault<ZodNumber>;
                    target_id: ZodString;
                    websocket_shape_approved: ZodDefault<ZodBoolean>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "inspect_web_page";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Capture explicitly approved JavaScript source from one approved CDP page and statically derive a bounded chunk graph, route and endpoint candidates, vendor fingerprints, page-declared WebMCP metadata, and optional separately approved source-map evidence. JavaScript is parsed but never executed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        analysis_limits: {
                            max_ast_nodes: 250000;
                            max_findings: 1000;
                            max_original_sources: 2000;
                            max_source_map_bytes: 4194304;
                            max_source_map_mappings: 10000;
                            max_source_maps: 100;
                            max_total_source_map_bytes: 16777216;
                        };
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        fetch_source_maps: false;
                        include_accessibility_text: false;
                        include_script_sources: true;
                        include_storage_keys: false;
                        observation_ms: 500;
                        source_capture_approved: true;
                        source_map_fetch_approved: false;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Analyze an approved page bundle";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    analysis_limits: ZodDefault<
                        ZodObject<
                            {
                                max_ast_nodes: ZodDefault<ZodNumber>;
                                max_findings: ZodDefault<ZodNumber>;
                                max_original_sources: ZodDefault<ZodNumber>;
                                max_source_map_bytes: ZodDefault<ZodNumber>;
                                max_source_map_mappings: ZodDefault<ZodNumber>;
                                max_source_maps: ZodDefault<ZodNumber>;
                                max_total_source_map_bytes: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    console_text_approved: ZodDefault<ZodBoolean>;
                    fetch_source_maps: ZodDefault<ZodBoolean>;
                    include_accessibility_text: ZodDefault<ZodBoolean>;
                    include_console_text: ZodDefault<ZodBoolean>;
                    include_json_body_shapes: ZodDefault<ZodBoolean>;
                    include_script_sources: ZodDefault<ZodLiteral<true>>;
                    include_storage_keys: ZodDefault<ZodBoolean>;
                    include_websocket_shapes: ZodDefault<ZodBoolean>;
                    json_body_schema_approved: ZodDefault<ZodBoolean>;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_ax_nodes: ZodDefault<ZodNumber>;
                                max_ax_text_field_bytes: ZodDefault<ZodNumber>;
                                max_console_events: ZodDefault<ZodNumber>;
                                max_console_text_field_bytes: ZodDefault<ZodNumber>;
                                max_dom_nodes: ZodDefault<ZodNumber>;
                                max_frames: ZodDefault<ZodNumber>;
                                max_json_body_bytes: ZodDefault<ZodNumber>;
                                max_json_shape_depth: ZodDefault<ZodNumber>;
                                max_json_shape_nodes: ZodDefault<ZodNumber>;
                                max_network_events: ZodDefault<ZodNumber>;
                                max_resources: ZodDefault<ZodNumber>;
                                max_script_source_bytes: ZodDefault<ZodNumber>;
                                max_scripts: ZodDefault<ZodNumber>;
                                max_storage_keys: ZodDefault<ZodNumber>;
                                max_total_ax_text_bytes: ZodDefault<ZodNumber>;
                                max_total_console_text_bytes: ZodDefault<ZodNumber>;
                                max_total_json_body_bytes: ZodDefault<ZodNumber>;
                                max_total_script_source_bytes: ZodDefault<ZodNumber>;
                                max_total_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_websocket_events: ZodDefault<ZodNumber>;
                                max_websocket_shape_bytes: ZodDefault<ZodNumber>;
                                max_workers: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    observation_ms: ZodDefault<ZodNumber>;
                    source_capture_approved: ZodLiteral<true>;
                    source_map_fetch_approved: ZodDefault<ZodBoolean>;
                    target_id: ZodString;
                    websocket_shape_approved: ZodDefault<ZodBoolean>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "analyze_web_bundle";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Arm a bounded CDP observation window while the user operates the page. Allows approved same-origin reload and SPA navigation, records ordered navigation, redirect, lifecycle, and failure metadata, and stops before retaining an out-of-policy destination.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        max_timeline_events: 2000;
                        observation_ms: 10000;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Observe one external user action";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    max_timeline_events: ZodDefault<ZodNumber>;
                    observation_ms: ZodDefault<ZodNumber>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "observe_web_session";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Passively inventory page-registered WebMCP tools using the experimental CDP WebMCP domain. Metadata is bounded and page-declared-untrusted; REA never registers or invokes discovered tools.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        max_schema_bytes: 262144;
                        max_schema_depth: 20;
                        max_schema_nodes: 5000;
                        max_tools: 500;
                        observation_ms: 100;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Discover current WebMCP declarations";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    max_schema_bytes: ZodDefault<ZodNumber>;
                    max_schema_depth: ZodDefault<ZodNumber>;
                    max_schema_nodes: ZodDefault<ZodNumber>;
                    max_tools: ZodDefault<ZodNumber>;
                    observation_ms: ZodDefault<ZodNumber>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "discover_webmcp_tools";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two normalized web captures across DOM, scripts, resources, network, safe metadata, and optional WebMCP inventories. Stable observed changes are distinguished from unknown absence caused by incomplete capture coverage.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        after: {
                            inspection: {
                                accessibility: {
                                    nodes: never[];
                                    text_capture: {
                                        excluded_fields: number;
                                        retained_bytes: number;
                                        status: string;
                                        truncated_fields: number;
                                    };
                                    total_nodes: number;
                                };
                                browser: {
                                    js_version: string;
                                    product: string;
                                    protocol_version: string;
                                    revision: string;
                                    user_agent: string;
                                };
                                capture_window: {
                                    ended_at: string;
                                    observation_ms: number;
                                    started_at: string;
                                };
                                completeness: {
                                    attach_limited_sections: never[];
                                    conditions: string[];
                                    dropped_events: {
                                        console_events: number;
                                        network_requests: number;
                                        scripts: number;
                                        timeline_events: number;
                                        total: number;
                                        webmcp_tools: number;
                                        websocket_connections: number;
                                        websocket_frames: number;
                                    };
                                    excluded: never[];
                                    policy_filtered_sections: never[];
                                    status: string;
                                    truncated_sections: never[];
                                    unavailable_sections: never[];
                                };
                                console: {
                                    coverage_started_at: string;
                                    events: never[];
                                    prior_activity_available: boolean;
                                };
                                dom: { nodes: never[]; total_nodes: number };
                                frames: never[];
                                limitations: never[];
                                metadata: {
                                    agent_hints: never[];
                                    dom_urls: never[];
                                    excluded_dom_urls: number;
                                    headers_allowlisted: boolean;
                                    responses: never[];
                                };
                                network: {
                                    coverage_started_at: string;
                                    prior_activity_available: boolean;
                                    requests: never[];
                                    websocket_events: never[];
                                };
                                resources: never[];
                                schema_version: number;
                                scripts: { items: never[]; total: number };
                                storage: {
                                    cache_names: never[];
                                    indexed_db_names: never[];
                                    local_storage_keys: never[];
                                    origin: string;
                                    quota_bytes: null;
                                    session_storage_keys: never[];
                                    usage_bytes: null;
                                    values_redacted: boolean;
                                };
                                target: {
                                    attached: boolean;
                                    origin: string;
                                    target_id: string;
                                    title: string;
                                    type: string;
                                    url: string;
                                };
                                workers: never[];
                            };
                        };
                        before: {
                            inspection: {
                                accessibility: {
                                    nodes: never[];
                                    text_capture: {
                                        excluded_fields: number;
                                        retained_bytes: number;
                                        status: string;
                                        truncated_fields: number;
                                    };
                                    total_nodes: number;
                                };
                                browser: {
                                    js_version: string;
                                    product: string;
                                    protocol_version: string;
                                    revision: string;
                                    user_agent: string;
                                };
                                capture_window: {
                                    ended_at: string;
                                    observation_ms: number;
                                    started_at: string;
                                };
                                completeness: {
                                    attach_limited_sections: never[];
                                    conditions: string[];
                                    dropped_events: {
                                        console_events: number;
                                        network_requests: number;
                                        scripts: number;
                                        timeline_events: number;
                                        total: number;
                                        webmcp_tools: number;
                                        websocket_connections: number;
                                        websocket_frames: number;
                                    };
                                    excluded: never[];
                                    policy_filtered_sections: never[];
                                    status: string;
                                    truncated_sections: never[];
                                    unavailable_sections: never[];
                                };
                                console: {
                                    coverage_started_at: string;
                                    events: never[];
                                    prior_activity_available: boolean;
                                };
                                dom: { nodes: never[]; total_nodes: number };
                                frames: never[];
                                limitations: never[];
                                metadata: {
                                    agent_hints: never[];
                                    dom_urls: never[];
                                    excluded_dom_urls: number;
                                    headers_allowlisted: boolean;
                                    responses: never[];
                                };
                                network: {
                                    coverage_started_at: string;
                                    prior_activity_available: boolean;
                                    requests: never[];
                                    websocket_events: never[];
                                };
                                resources: never[];
                                schema_version: number;
                                scripts: { items: never[]; total: number };
                                storage: {
                                    cache_names: never[];
                                    indexed_db_names: never[];
                                    local_storage_keys: never[];
                                    origin: string;
                                    quota_bytes: null;
                                    session_storage_keys: never[];
                                    usage_bytes: null;
                                    values_redacted: boolean;
                                };
                                target: {
                                    attached: boolean;
                                    origin: string;
                                    target_id: string;
                                    title: string;
                                    type: string;
                                    url: string;
                                };
                                workers: never[];
                            };
                        };
                        max_changes: 2000;
                    };
                    title: "Compare two normalized captures";
                },
            ];
            inputSchema: ZodObject<
                {
                    after: ZodObject<
                        {
                            inspection: ZodObject<
                                {
                                    accessibility: ZodObject<
                                        {
                                            nodes: ZodArray<(...)>;
                                            text_capture: ZodObject<(...), (...)>;
                                            total_nodes: ZodNumber;
                                        },
                                        $strip,
                                    >;
                                    browser: ZodObject<
                                        {
                                            js_version: ZodString;
                                            product: ZodString;
                                            protocol_version: ZodString;
                                            revision: ZodString;
                                            user_agent: ZodString;
                                        },
                                        $strip,
                                    >;
                                    capture_window: ZodObject<
                                        {
                                            ended_at: ZodISODateTime;
                                            observation_ms: ZodNumber;
                                            started_at: ZodISODateTime;
                                        },
                                        $strip,
                                    >;
                                    completeness: ZodObject<
                                        {
                                            attach_limited_sections: ZodArray<(...)>;
                                            conditions: ZodArray<(...)>;
                                            dropped_events: ZodObject<(...), (...)>;
                                            excluded: ZodArray<(...)>;
                                            policy_filtered_sections: ZodArray<(...)>;
                                            status: ZodEnum<(...)>;
                                            truncated_sections: ZodArray<(...)>;
                                            unavailable_sections: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    console: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            events: ZodArray<(...)>;
                                            prior_activity_available: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    dom: ZodObject<
                                        { nodes: ZodArray<(...)>; total_nodes: ZodNumber },
                                        $strip,
                                    >;
                                    frames: ZodArray<
                                        ZodObject<
                                            { frame_id: ...; origin: ...; parent_frame_id: ...; url: ... },
                                            $strip,
                                        >,
                                    >;
                                    limitations: ZodArray<ZodString>;
                                    metadata: ZodObject<
                                        {
                                            agent_hints: ZodArray<(...)>;
                                            dom_urls: ZodArray<(...)>;
                                            excluded_dom_urls: ZodNumber;
                                            headers_allowlisted: ZodLiteral<(...)>;
                                            responses: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    network: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            prior_activity_available: ZodLiteral<(...)>;
                                            requests: ZodArray<(...)>;
                                            websocket_events: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    resources: ZodArray<
                                        ZodObject<
                                            {
                                                content_size: ...;
                                                mime_type: ...;
                                                origin: ...;
                                                resource_key: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    schema_version: ZodLiteral<2>;
                                    scripts: ZodObject<
                                        { items: ZodArray<(...)>; total: ZodNumber },
                                        $strip,
                                    >;
                                    storage: ZodObject<
                                        {
                                            cache_names: ZodArray<(...)>;
                                            indexed_db_names: ZodArray<(...)>;
                                            local_storage_keys: ZodArray<(...)>;
                                            origin: ZodString;
                                            quota_bytes: ZodNullable<(...)>;
                                            session_storage_keys: ZodArray<(...)>;
                                            usage_bytes: ZodNullable<(...)>;
                                            values_redacted: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    target: ZodObject<
                                        {
                                            attached: ZodBoolean;
                                            origin: ZodString;
                                            target_id: ZodString;
                                            title: ZodString;
                                            type: ZodString;
                                            url: ZodString;
                                        },
                                        $strip,
                                    >;
                                    workers: ZodArray<
                                        ZodObject<
                                            {
                                                attached: ...;
                                                opener_target_id: ...;
                                                origin: ...;
                                                parent_frame_id: ...;
                                                target_id: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strip,
                            >;
                            webmcp: ZodDefault<
                                ZodNullable<
                                    ZodObject<
                                        {
                                            browser: ZodObject<(...), (...)>;
                                            completeness: ZodObject<(...), (...)>;
                                            limitations: ZodArray<(...)>;
                                            schema_version: ZodLiteral<(...)>;
                                            status: ZodEnum<(...)>;
                                            target: ZodObject<(...), (...)>;
                                            tools: ZodObject<(...), (...)>;
                                        },
                                        $strip,
                                    >,
                                >,
                            >;
                        },
                        $strip,
                    >;
                    before: ZodObject<
                        {
                            inspection: ZodObject<
                                {
                                    accessibility: ZodObject<
                                        {
                                            nodes: ZodArray<(...)>;
                                            text_capture: ZodObject<(...), (...)>;
                                            total_nodes: ZodNumber;
                                        },
                                        $strip,
                                    >;
                                    browser: ZodObject<
                                        {
                                            js_version: ZodString;
                                            product: ZodString;
                                            protocol_version: ZodString;
                                            revision: ZodString;
                                            user_agent: ZodString;
                                        },
                                        $strip,
                                    >;
                                    capture_window: ZodObject<
                                        {
                                            ended_at: ZodISODateTime;
                                            observation_ms: ZodNumber;
                                            started_at: ZodISODateTime;
                                        },
                                        $strip,
                                    >;
                                    completeness: ZodObject<
                                        {
                                            attach_limited_sections: ZodArray<(...)>;
                                            conditions: ZodArray<(...)>;
                                            dropped_events: ZodObject<(...), (...)>;
                                            excluded: ZodArray<(...)>;
                                            policy_filtered_sections: ZodArray<(...)>;
                                            status: ZodEnum<(...)>;
                                            truncated_sections: ZodArray<(...)>;
                                            unavailable_sections: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    console: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            events: ZodArray<(...)>;
                                            prior_activity_available: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    dom: ZodObject<
                                        { nodes: ZodArray<(...)>; total_nodes: ZodNumber },
                                        $strip,
                                    >;
                                    frames: ZodArray<
                                        ZodObject<
                                            { frame_id: ...; origin: ...; parent_frame_id: ...; url: ... },
                                            $strip,
                                        >,
                                    >;
                                    limitations: ZodArray<ZodString>;
                                    metadata: ZodObject<
                                        {
                                            agent_hints: ZodArray<(...)>;
                                            dom_urls: ZodArray<(...)>;
                                            excluded_dom_urls: ZodNumber;
                                            headers_allowlisted: ZodLiteral<(...)>;
                                            responses: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    network: ZodObject<
                                        {
                                            coverage_started_at: ZodISODateTime;
                                            prior_activity_available: ZodLiteral<(...)>;
                                            requests: ZodArray<(...)>;
                                            websocket_events: ZodArray<(...)>;
                                        },
                                        $strip,
                                    >;
                                    resources: ZodArray<
                                        ZodObject<
                                            {
                                                content_size: ...;
                                                mime_type: ...;
                                                origin: ...;
                                                resource_key: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    schema_version: ZodLiteral<2>;
                                    scripts: ZodObject<
                                        { items: ZodArray<(...)>; total: ZodNumber },
                                        $strip,
                                    >;
                                    storage: ZodObject<
                                        {
                                            cache_names: ZodArray<(...)>;
                                            indexed_db_names: ZodArray<(...)>;
                                            local_storage_keys: ZodArray<(...)>;
                                            origin: ZodString;
                                            quota_bytes: ZodNullable<(...)>;
                                            session_storage_keys: ZodArray<(...)>;
                                            usage_bytes: ZodNullable<(...)>;
                                            values_redacted: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    target: ZodObject<
                                        {
                                            attached: ZodBoolean;
                                            origin: ZodString;
                                            target_id: ZodString;
                                            title: ZodString;
                                            type: ZodString;
                                            url: ZodString;
                                        },
                                        $strip,
                                    >;
                                    workers: ZodArray<
                                        ZodObject<
                                            {
                                                attached: ...;
                                                opener_target_id: ...;
                                                origin: ...;
                                                parent_frame_id: ...;
                                                target_id: ...;
                                                type: ...;
                                                url: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strip,
                            >;
                            webmcp: ZodDefault<
                                ZodNullable<
                                    ZodObject<
                                        {
                                            browser: ZodObject<(...), (...)>;
                                            completeness: ZodObject<(...), (...)>;
                                            limitations: ZodArray<(...)>;
                                            schema_version: ZodLiteral<(...)>;
                                            status: ZodEnum<(...)>;
                                            target: ZodObject<(...), (...)>;
                                            tools: ZodObject<(...), (...)>;
                                        },
                                        $strip,
                                    >,
                                >,
                            >;
                        },
                        $strip,
                    >;
                    max_changes: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "compare_web_captures";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Capture the current visible viewport of one approved page as a bounded, content-addressed PNG artifact. Screenshot capture requires separate explicit approval and never scrolls, navigates, or evaluates page JavaScript.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_origins: ["https://app.example.test"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9222";
                        maximum_image_bytes: 4194304;
                        screenshot_approved: true;
                        target_id: "TARGET_ID_FROM_LIST_BROWSER_TARGETS";
                    };
                    title: "Capture an approved viewport";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_origins: ZodPipe<
                        ZodArray<ZodPipe<ZodString, ZodTransform<string, string>>>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    maximum_image_bytes: ZodDefault<ZodNumber>;
                    screenshot_approved: ZodLiteral<true>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "capture_web_screenshot";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two self-verifying PNG screenshot artifacts with bounded local pixel metrics. Returns exact changed-pixel ratios and channel deltas without OCR or external services.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        after: {
                            bytes: number;
                            data_base64: string;
                            media_type: string;
                            sha256: string;
                            uri: string;
                        };
                        before: {
                            bytes: number;
                            data_base64: string;
                            media_type: string;
                            sha256: string;
                            uri: string;
                        };
                        channel_threshold: 0;
                        maximum_pixels: 16000000;
                    };
                    title: "Compare two screenshot artifacts";
                },
            ];
            inputSchema: ZodObject<
                {
                    after: ZodObject<
                        {
                            bytes: ZodNumber;
                            data_base64: ZodString;
                            media_type: ZodLiteral<"image/png">;
                            sha256: ZodString;
                            uri: ZodString;
                        },
                        $strip,
                    >;
                    before: ZodObject<
                        {
                            bytes: ZodNumber;
                            data_base64: ZodString;
                            media_type: ZodLiteral<"image/png">;
                            sha256: ZodString;
                            uri: ZodString;
                        },
                        $strip,
                    >;
                    channel_threshold: ZodDefault<ZodNumber>;
                    maximum_pixels: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "browser-provider";
            name: "compare_web_screenshots";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "List Electron file:// page targets from an approved user-owned loopback CDP endpoint. Every path is canonicalized and must remain contained by an approved filesystem root, including after symlink resolution.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_file_roots: ["/Applications/Example.app/Contents/Resources"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9223";
                        limit: 100;
                        offset: 0;
                    };
                    title: "List approved Electron file pages";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_file_roots: ZodPipe<
                        ZodArray<ZodString>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    limit: ZodDefault<ZodNumber>;
                    offset: ZodDefault<ZodNumber>;
                },
                $strip,
            >;
            kind: "electron-provider";
            name: "list_electron_targets";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Passively inspect one approved Electron file page through CDP. Returns root-confined frames, DOM structure, resource paths, and scripts without evaluating renderer JavaScript or invoking Electron APIs; script contents require separate approval.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        allowed_file_roots: ["/Applications/Example.app/Contents/Resources"];
                        approved: true;
                        cdp_endpoint: "http://127.0.0.1:9223";
                        include_script_sources: false;
                        limits: {
                            max_dom_nodes: 2000;
                            max_frames: 200;
                            max_resources: 2000;
                            max_script_source_bytes: 1048576;
                            max_scripts: 500;
                            max_total_script_source_bytes: 4194304;
                            max_workers: 500;
                        };
                        observation_ms: 100;
                        source_capture_approved: false;
                        target_id: "TARGET_ID_FROM_LIST_ELECTRON_TARGETS";
                    };
                    title: "Inspect an approved Electron page";
                },
            ];
            inputSchema: ZodObject<
                {
                    allowed_file_roots: ZodPipe<
                        ZodArray<ZodString>,
                        ZodTransform<string[], string[]>,
                    >;
                    approved: ZodLiteral<true>;
                    cdp_endpoint: ZodPipe<ZodString, ZodTransform<string, string>>;
                    include_script_sources: ZodDefault<ZodBoolean>;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_dom_nodes: ZodDefault<ZodNumber>;
                                max_frames: ZodDefault<ZodNumber>;
                                max_resources: ZodDefault<ZodNumber>;
                                max_script_source_bytes: ZodDefault<ZodNumber>;
                                max_scripts: ZodDefault<ZodNumber>;
                                max_total_script_source_bytes: ZodDefault<ZodNumber>;
                                max_workers: ZodDefault<ZodNumber>;
                            },
                            $strip,
                        >,
                    >;
                    observation_ms: ZodDefault<ZodNumber>;
                    source_capture_approved: ZodDefault<ZodBoolean>;
                    target_id: ZodString;
                },
                $strip,
            >;
            kind: "electron-provider";
            name: "inspect_electron_page";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Statically reconstruct one approved local ASAR or extracted JavaScript application as Evidence v2 and JavaScript Application Graph v1. Maps BrowserWindow preferences, preload and contextBridge APIs, literal and dynamic IPC, handler locations, sender-validation observations, utility processes, and requested native addon bindings without executing JavaScript; source-map contents require separate approval.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved: true;
                        format: "auto";
                        input_path: "/Applications/Example.app/Contents/Resources/app.asar";
                        source_map_read_approved: false;
                    };
                    title: "Analyze one approved local Electron application";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved: ZodLiteral<true>;
                    format: ZodDefault<
                        ZodEnum<{ asar: "asar"; auto: "auto"; directory: "directory" }>,
                    >;
                    input_path: ZodString;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_artifact_entry_bytes: ZodDefault<ZodNumber>;
                                max_ast_nodes: ZodDefault<ZodNumber>;
                                max_compression_ratio: ZodDefault<ZodNumber>;
                                max_depth: ZodDefault<ZodNumber>;
                                max_entries: ZodDefault<ZodNumber>;
                                max_findings: ZodDefault<ZodNumber>;
                                max_modules: ZodDefault<ZodNumber>;
                                max_parse_milliseconds: ZodDefault<ZodNumber>;
                                max_path_bytes: ZodDefault<ZodNumber>;
                                max_source_map_sources: ZodDefault<ZodNumber>;
                                max_text_file_bytes: ZodDefault<ZodNumber>;
                                max_text_files: ZodDefault<ZodNumber>;
                                max_total_artifact_bytes: ZodDefault<ZodNumber>;
                                max_total_text_bytes: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    source_map_read_approved: ZodDefault<ZodBoolean>;
                },
                $strict,
            >;
            kind: "electron-provider";
            name: "analyze_javascript_application";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Reconcile verified static JavaScript application graphs with existing passive web or Electron CDP Evidence. Exact captured-source digests take priority over caller-declared file/URL mappings; target, frame, script, and worker ambiguity remains explicit, and source-map authority stays separate.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        runtime_observations: (
                            | {
                                analysis_profile: {
                                    digest: string;
                                    parameters: Record<string, JSONType>;
                                    provider: { id: string; name: string; version: string };
                                    provider_profile_schema_version: number;
                                    schema_version: 1;
                                };
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | {
                                        architecture: string;
                                        id: string;
                                        isolation: (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        platform: string;
                                    }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: (
                                    | { address: ...; kind: ... }
                                    | { end: ...; kind: ...; start: ... }
                                    | { kind: ...; path: ... }
                                    | { kind: ...; offset: ... }
                                    | { end: ...; kind: ...; start: ... }
                                )[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: string | null };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: (...)
                                        | (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        digest: { sha256: ... };
                                        format:
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...);
                                        local_path: string;
                                        name: string;
                                    }
                                    | null;
                            }
                            | {
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | {
                                        architecture: string;
                                        id: string;
                                        isolation: (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        platform: string;
                                    }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: (
                                    | { address: ...; kind: ... }
                                    | { end: ...; kind: ...; start: ... }
                                    | { kind: ...; path: ... }
                                    | { kind: ...; offset: ... }
                                    | { end: ...; kind: ...; start: ... }
                                )[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: string | null };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: (...)
                                        | (...)
                                        | (...)
                                        | (...)
                                        | (...);
                                        digest: { sha256: ... };
                                        format:
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...)
                                            | (...);
                                        local_path: string;
                                        name: string;
                                    }
                                    | null;
                            }
                        )[];
                        static_layers: {
                            analysis: | {
                                analysis_profile: {
                                    digest: string;
                                    parameters: Record<(...), (...)>;
                                    provider: { id: ...; name: ...; version: ... };
                                    provider_profile_schema_version: number;
                                    schema_version: 1;
                                };
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | { architecture: ...; id: ...; isolation: ...; platform: ... }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: ((...) | (...) | (...) | (...) | (...))[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: (...) | (...) };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: ...;
                                        digest: ...;
                                        format: ...;
                                        local_path: ...;
                                        name: ...;
                                    }
                                    | null;
                            }
                            | {
                                authority: | "shipped-artifact"
                                | "controlled-replay"
                                | "historical-reference"
                                | "external-service"
                                | "analyst-inference";
                                confidence: "observed"
                                | "derived"
                                | "inferred";
                                environment:
                                    | { architecture: ...; id: ...; isolation: ...; platform: ... }
                                    | null;
                                evidence_id: string;
                                evidence_links: string[];
                                limitations: string[];
                                locations: ((...) | (...) | (...) | (...) | (...))[];
                                normalized_result: JSONType;
                                operation: string;
                                parameters: Record<string, JSONType>;
                                predicate_type: string;
                                provider: { id: string; name: string; version: (...) | (...) };
                                raw_result: JSONType;
                                schema_version: 2;
                                subject:
                                    | {
                                        architecture: ...;
                                        digest: ...;
                                        format: ...;
                                        local_path: ...;
                                        name: ...;
                                    }
                                    | null;
                            };
                            role: string;
                        }[];
                    };
                    title: "Reconcile one passive Electron capture";
                },
            ];
            inputSchema: ZodObject<
                {
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_reconciliation_items: ZodDefault<ZodNumber>;
                                max_runtime_entities: ZodDefault<ZodNumber>;
                                max_static_load_states: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    runtime_observations: ZodArray<
                        ZodObject<
                            {
                                analysis_profile: ZodOptional<
                                    ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >,
                                >;
                                authority: ZodEnum<
                                    {
                                        "analyst-inference": "analyst-inference";
                                        "controlled-replay": "controlled-replay";
                                        "external-service": "external-service";
                                        "historical-reference": "historical-reference";
                                        "shipped-artifact": "shipped-artifact";
                                    },
                                >;
                                confidence: ZodEnum<
                                    {
                                        derived: "derived";
                                        inferred: "inferred";
                                        observed: "observed";
                                    },
                                >;
                                environment: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodString;
                                            id: ZodString;
                                            isolation: ZodEnum<(...)>;
                                            platform: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                                evidence_id: ZodString;
                                evidence_links: ZodArray<ZodString>;
                                limitations: ZodArray<ZodString>;
                                locations: ZodArray<
                                    ZodDiscriminatedUnion<
                                        [
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                        ],
                                        "kind",
                                    >,
                                >;
                                normalized_result: ZodJSONSchema;
                                operation: ZodString;
                                parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                predicate_type: ZodString;
                                provider: ZodObject<
                                    {
                                        id: ZodString;
                                        name: ZodString;
                                        version: ZodNullable<ZodString>;
                                    },
                                    $strip,
                                >;
                                raw_result: ZodNullable<ZodJSONSchema>;
                                schema_version: ZodLiteral<2>;
                                subject: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodNullable<(...)>;
                                            digest: ZodObject<(...), (...)>;
                                            format: ZodEnum<(...)>;
                                            local_path: ZodString;
                                            name: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                    static_layers: ZodArray<
                        ZodObject<
                            {
                                analysis: ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodJSONSchema;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >;
                                role: ZodEnum<
                                    { application: "application"; assets: "assets"; cache: "cache" },
                                >;
                                runtime_mappings: ZodDefault<
                                    ZodArray<ZodDiscriminatedUnion<[(...), (...)], "kind">>,
                                >;
                            },
                            $strict,
                        >,
                    >;
                },
                $strict,
            >;
            kind: "electron-provider";
            name: "reconcile_javascript_runtime";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Trace a typed literal seed through an authenticated JavaScript Application Graph with explicit direction, depth, node, edge, and path bounds. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        application: | {
                            analysis_profile: {
                                digest: string;
                                parameters: Record<string, JSONType>;
                                provider: { id: string; name: string; version: string };
                                provider_profile_schema_version: number;
                                schema_version: 1;
                            };
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        }
                        | {
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        };
                        direction: "both";
                        seed: {
                            case_sensitive: boolean;
                            kind: "module";
                            match: "exact";
                            value: string;
                        };
                    };
                    title: "Trace one module seed through a retained application graph";
                },
            ];
            inputSchema: ZodObject<
                {
                    application: ZodObject<
                        {
                            analysis_profile: ZodOptional<
                                ZodObject<
                                    {
                                        digest: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        provider_profile_schema_version: ZodNumber;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strip,
                                >,
                            >;
                            authority: ZodEnum<
                                {
                                    "analyst-inference": "analyst-inference";
                                    "controlled-replay": "controlled-replay";
                                    "external-service": "external-service";
                                    "historical-reference": "historical-reference";
                                    "shipped-artifact": "shipped-artifact";
                                },
                            >;
                            confidence: ZodEnum<
                                { derived: "derived"; inferred: "inferred"; observed: "observed" },
                            >;
                            environment: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodString;
                                        id: ZodString;
                                        isolation: ZodEnum<
                                            {
                                                container: ...;
                                                none: ...;
                                                process: ...;
                                                "virtual-machine": ...;
                                            },
                                        >;
                                        platform: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                            evidence_id: ZodString;
                            evidence_links: ZodArray<ZodString>;
                            limitations: ZodArray<ZodString>;
                            locations: ZodArray<
                                ZodDiscriminatedUnion<
                                    [
                                        ZodObject<{ address: ...; kind: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                        ZodObject<{ kind: ...; path: ... }, $strip>,
                                        ZodObject<{ kind: ...; offset: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                    ],
                                    "kind",
                                >,
                            >;
                            normalized_result: ZodJSONSchema;
                            operation: ZodString;
                            parameters: ZodRecord<ZodString, ZodJSONSchema>;
                            predicate_type: ZodString;
                            provider: ZodObject<
                                {
                                    id: ZodString;
                                    name: ZodString;
                                    version: ZodNullable<ZodString>;
                                },
                                $strip,
                            >;
                            raw_result: ZodNullable<ZodJSONSchema>;
                            schema_version: ZodLiteral<2>;
                            subject: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodNullable<ZodEnum<(...)>>;
                                        digest: ZodObject<{ sha256: ... }, $strip>;
                                        format: ZodEnum<
                                            {
                                                "analysis-database": ...;
                                                apk: ...;
                                                asar: ...;
                                                directory: ...;
                                                dmg: ...;
                                                elf: ...;
                                                entitlements: ...;
                                                file: ...;
                                                hopper: ...;
                                                ipa: ...;
                                                javascript: ...;
                                                "javascript-bundle": ...;
                                                "mach-o": ...;
                                                "mach-o-universal": ...;
                                                pe: ...;
                                                pkg: ...;
                                                plist: ...;
                                                "source-map": ...;
                                                unknown: ...;
                                                zip: ...;
                                            },
                                        >;
                                        local_path: ZodString;
                                        name: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    direction: ZodDefault<
                        ZodEnum<
                            { both: "both"; incoming: "incoming"; outgoing: "outgoing" },
                        >,
                    >;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_depth: ZodDefault<ZodNumber>;
                                max_edges: ZodDefault<ZodNumber>;
                                max_nodes: ZodDefault<ZodNumber>;
                                max_paths: ZodDefault<ZodNumber>;
                                max_seed_matches: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    native_observations: ZodDefault<
                        ZodArray<
                            ZodObject<
                                {
                                    analysis_profile: ZodOptional<
                                        ZodObject<
                                            {
                                                digest: ...;
                                                parameters: ...;
                                                provider: ...;
                                                provider_profile_schema_version: ...;
                                                schema_version: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        >,
                    >;
                    seed: ZodObject<
                        {
                            case_sensitive: ZodDefault<ZodBoolean>;
                            kind: ZodEnum<
                                {
                                    api: "api";
                                    channel: "channel";
                                    module: "module";
                                    "native-export": "native-export";
                                    "node-id": "node-id";
                                    route: "route";
                                    string: "string";
                                },
                            >;
                            match: ZodDefault<
                                ZodNullable<ZodEnum<{ contains: "contains"; exact: "exact" }>>,
                            >;
                            value: ZodString;
                        },
                        $strict,
                    >;
                },
                $strict,
            >;
            kind: "application";
            name: "trace_application_feature";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Compare two authenticated JavaScript Application Graph versions using unique-only exact digest, module source digest, source-map identity, structural fingerprint, and non-module semantic-key tiers. Reports added, removed, changed, ambiguous, and unknown entities plus a bounded changed_from graph without fuzzy or module-ordinal pairing.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        left: | {
                            analysis_profile: {
                                digest: string;
                                parameters: Record<string, JSONType>;
                                provider: { id: string; name: string; version: string };
                                provider_profile_schema_version: number;
                                schema_version: 1;
                            };
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        }
                        | {
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        };
                        right: | {
                            analysis_profile: {
                                digest: string;
                                parameters: Record<string, JSONType>;
                                provider: { id: string; name: string; version: string };
                                provider_profile_schema_version: number;
                                schema_version: 1;
                            };
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        }
                        | {
                            authority: | "shipped-artifact"
                            | "controlled-replay"
                            | "historical-reference"
                            | "external-service"
                            | "analyst-inference";
                            confidence: "observed"
                            | "derived"
                            | "inferred";
                            environment:
                                | {
                                    architecture: string;
                                    id: string;
                                    isolation: "process"
                                    | "none"
                                    | "container"
                                    | "virtual-machine";
                                    platform: string;
                                }
                                | null;
                            evidence_id: string;
                            evidence_links: string[];
                            limitations: string[];
                            locations: (
                                | { address: string; kind: "address" }
                                | { end: string; kind: "address-range"; start: string }
                                | { kind: "artifact-path"; path: string }
                                | { kind: "file-offset"; offset: number }
                                | { end: number; kind: "file-offset-range"; start: number }
                            )[];
                            normalized_result: JSONType;
                            operation: string;
                            parameters: Record<string, JSONType>;
                            predicate_type: string;
                            provider: { id: string; name: string; version: string | null };
                            raw_result: JSONType;
                            schema_version: 2;
                            subject:
                                | {
                                    architecture: "x86"
                                    | "x86_64"
                                    | "arm"
                                    | "arm64"
                                    | null;
                                    digest: { sha256: string };
                                    format:
                                        | "unknown"
                                        | "file"
                                        | "directory"
                                        | "javascript"
                                        | "source-map"
                                        | "plist"
                                        | "entitlements"
                                        | "dmg"
                                        | "zip"
                                        | "pkg"
                                        | "asar"
                                        | "javascript-bundle"
                                        | "mach-o-universal"
                                        | "mach-o"
                                        | "elf"
                                        | "pe"
                                        | "hopper"
                                        | "analysis-database"
                                        | "ipa"
                                        | "apk";
                                    local_path: string;
                                    name: string;
                                }
                                | null;
                        };
                    };
                    title: "Compare authenticated static and reconciled application graphs";
                },
            ];
            inputSchema: ZodObject<
                {
                    left: ZodObject<
                        {
                            analysis_profile: ZodOptional<
                                ZodObject<
                                    {
                                        digest: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        provider_profile_schema_version: ZodNumber;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strip,
                                >,
                            >;
                            authority: ZodEnum<
                                {
                                    "analyst-inference": "analyst-inference";
                                    "controlled-replay": "controlled-replay";
                                    "external-service": "external-service";
                                    "historical-reference": "historical-reference";
                                    "shipped-artifact": "shipped-artifact";
                                },
                            >;
                            confidence: ZodEnum<
                                { derived: "derived"; inferred: "inferred"; observed: "observed" },
                            >;
                            environment: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodString;
                                        id: ZodString;
                                        isolation: ZodEnum<
                                            {
                                                container: ...;
                                                none: ...;
                                                process: ...;
                                                "virtual-machine": ...;
                                            },
                                        >;
                                        platform: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                            evidence_id: ZodString;
                            evidence_links: ZodArray<ZodString>;
                            limitations: ZodArray<ZodString>;
                            locations: ZodArray<
                                ZodDiscriminatedUnion<
                                    [
                                        ZodObject<{ address: ...; kind: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                        ZodObject<{ kind: ...; path: ... }, $strip>,
                                        ZodObject<{ kind: ...; offset: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                    ],
                                    "kind",
                                >,
                            >;
                            normalized_result: ZodJSONSchema;
                            operation: ZodString;
                            parameters: ZodRecord<ZodString, ZodJSONSchema>;
                            predicate_type: ZodString;
                            provider: ZodObject<
                                {
                                    id: ZodString;
                                    name: ZodString;
                                    version: ZodNullable<ZodString>;
                                },
                                $strip,
                            >;
                            raw_result: ZodNullable<ZodJSONSchema>;
                            schema_version: ZodLiteral<2>;
                            subject: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodNullable<ZodEnum<(...)>>;
                                        digest: ZodObject<{ sha256: ... }, $strip>;
                                        format: ZodEnum<
                                            {
                                                "analysis-database": ...;
                                                apk: ...;
                                                asar: ...;
                                                directory: ...;
                                                dmg: ...;
                                                elf: ...;
                                                entitlements: ...;
                                                file: ...;
                                                hopper: ...;
                                                ipa: ...;
                                                javascript: ...;
                                                "javascript-bundle": ...;
                                                "mach-o": ...;
                                                "mach-o-universal": ...;
                                                pe: ...;
                                                pkg: ...;
                                                plist: ...;
                                                "source-map": ...;
                                                unknown: ...;
                                                zip: ...;
                                            },
                                        >;
                                        local_path: ZodString;
                                        name: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    left_native_observations: ZodDefault<
                        ZodArray<
                            ZodObject<
                                {
                                    analysis_profile: ZodOptional<
                                        ZodObject<
                                            {
                                                digest: ...;
                                                parameters: ...;
                                                provider: ...;
                                                provider_profile_schema_version: ...;
                                                schema_version: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        >,
                    >;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                max_candidate_nodes: ZodDefault<ZodNumber>;
                                max_comparison_items: ZodDefault<ZodNumber>;
                                max_graph_edges: ZodDefault<ZodNumber>;
                                max_graph_nodes: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    right: ZodObject<
                        {
                            analysis_profile: ZodOptional<
                                ZodObject<
                                    {
                                        digest: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        provider_profile_schema_version: ZodNumber;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strip,
                                >,
                            >;
                            authority: ZodEnum<
                                {
                                    "analyst-inference": "analyst-inference";
                                    "controlled-replay": "controlled-replay";
                                    "external-service": "external-service";
                                    "historical-reference": "historical-reference";
                                    "shipped-artifact": "shipped-artifact";
                                },
                            >;
                            confidence: ZodEnum<
                                { derived: "derived"; inferred: "inferred"; observed: "observed" },
                            >;
                            environment: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodString;
                                        id: ZodString;
                                        isolation: ZodEnum<
                                            {
                                                container: ...;
                                                none: ...;
                                                process: ...;
                                                "virtual-machine": ...;
                                            },
                                        >;
                                        platform: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                            evidence_id: ZodString;
                            evidence_links: ZodArray<ZodString>;
                            limitations: ZodArray<ZodString>;
                            locations: ZodArray<
                                ZodDiscriminatedUnion<
                                    [
                                        ZodObject<{ address: ...; kind: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                        ZodObject<{ kind: ...; path: ... }, $strip>,
                                        ZodObject<{ kind: ...; offset: ... }, $strip>,
                                        ZodObject<{ end: ...; kind: ...; start: ... }, $strip>,
                                    ],
                                    "kind",
                                >,
                            >;
                            normalized_result: ZodJSONSchema;
                            operation: ZodString;
                            parameters: ZodRecord<ZodString, ZodJSONSchema>;
                            predicate_type: ZodString;
                            provider: ZodObject<
                                {
                                    id: ZodString;
                                    name: ZodString;
                                    version: ZodNullable<ZodString>;
                                },
                                $strip,
                            >;
                            raw_result: ZodNullable<ZodJSONSchema>;
                            schema_version: ZodLiteral<2>;
                            subject: ZodNullable<
                                ZodObject<
                                    {
                                        architecture: ZodNullable<ZodEnum<(...)>>;
                                        digest: ZodObject<{ sha256: ... }, $strip>;
                                        format: ZodEnum<
                                            {
                                                "analysis-database": ...;
                                                apk: ...;
                                                asar: ...;
                                                directory: ...;
                                                dmg: ...;
                                                elf: ...;
                                                entitlements: ...;
                                                file: ...;
                                                hopper: ...;
                                                ipa: ...;
                                                javascript: ...;
                                                "javascript-bundle": ...;
                                                "mach-o": ...;
                                                "mach-o-universal": ...;
                                                pe: ...;
                                                pkg: ...;
                                                plist: ...;
                                                "source-map": ...;
                                                unknown: ...;
                                                zip: ...;
                                            },
                                        >;
                                        local_path: ZodString;
                                        name: ZodString;
                                    },
                                    $strip,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    right_native_observations: ZodDefault<
                        ZodArray<
                            ZodObject<
                                {
                                    analysis_profile: ZodOptional<
                                        ZodObject<
                                            {
                                                digest: ...;
                                                parameters: ...;
                                                provider: ...;
                                                provider_profile_schema_version: ...;
                                                schema_version: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        >,
                    >;
                    unknown_registry_approved: ZodOptional<ZodLiteral<true>>;
                },
                $strict,
            >;
            kind: "application";
            name: "compare_application_versions";
            outputSchema: ZodObject<
                {
                    evidence_id: ZodString;
                    evidence_uri: ZodString;
                    result: ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Plan or execute a content-bound extracted-module JavaScript replay inside the Linux Bubblewrap, seccomp, and cgroup boundary. Execution requires approved: true and the exact plan digest. Supports deterministic boundary cases and optional left/right differential comparison; observations have controlled-replay authority and do not claim real application runtime behavior.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved: false;
                        cases: [{ arguments: [""]; case_id: "empty" }];
                        determinism: {
                            clock_iso: "2000-01-01T00:00:00.000Z";
                            locale: "en-US";
                            platform: "linux";
                            random_seed: 0;
                            timezone: "UTC";
                        };
                        left: {
                            entry_alias: "parser";
                            entry_export: "default";
                            modules: [
                                {
                                    alias: "parser";
                                    dependencies: {};
                                    format: "esm";
                                    path: "/approved/parser.mjs";
                                    role: "module";
                                },
                            ];
                        };
                        limits: {
                            cpu_quota_percent: 50;
                            input_bytes: 262144;
                            memory_bytes: 134217728;
                            module_bytes: 4194304;
                            output_bytes: 524288;
                            protocol_bytes: 16777216;
                            result_depth: 16;
                            result_nodes: 10000;
                            stderr_bytes: 32768;
                            tasks: 8;
                            tmpfs_bytes: 16777216;
                            wall_time_ms: 3000;
                        };
                        mode: "plan";
                    };
                    title: "Plan one extracted ESM parser replay";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved: ZodDefault<ZodBoolean>;
                    cases: ZodDefault<
                        ZodArray<
                            ZodObject<
                                { arguments: ZodArray<ZodJSONSchema>; case_id: ZodString },
                                $strict,
                            >,
                        >,
                    >;
                    determinism: ZodDefault<
                        ZodObject<
                            {
                                clock_iso: ZodDefault<ZodISODateTime>;
                                locale: ZodDefault<ZodLiteral<"en-US">>;
                                platform: ZodDefault<ZodLiteral<"linux">>;
                                random_seed: ZodDefault<ZodNumber>;
                                timezone: ZodDefault<ZodLiteral<"UTC">>;
                            },
                            $strict,
                        >,
                    >;
                    generator: ZodOptional<
                        ZodObject<
                            {
                                count: ZodNumber;
                                preset: ZodEnum<
                                    {
                                        "clipboard-boundaries": "clipboard-boundaries";
                                        "parser-boundaries": "parser-boundaries";
                                        "sanitizer-boundaries": "sanitizer-boundaries";
                                    },
                                >;
                                seed: ZodNumber;
                            },
                            $strict,
                        >,
                    >;
                    left: ZodObject<
                        {
                            entry_alias: ZodString;
                            entry_export: ZodDefault<ZodString>;
                            modules: ZodArray<
                                ZodObject<
                                    {
                                        alias: ZodString;
                                        dependencies: ZodDefault<ZodRecord<(...), (...)>>;
                                        format: ZodEnum<{ "commonjs-factory": ...; esm: ... }>;
                                        path: ZodString;
                                        role: ZodDefault<ZodEnum<(...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    limits: ZodDefault<
                        ZodObject<
                            {
                                cpu_quota_percent: ZodDefault<ZodNumber>;
                                input_bytes: ZodDefault<ZodNumber>;
                                memory_bytes: ZodDefault<ZodNumber>;
                                module_bytes: ZodDefault<ZodNumber>;
                                output_bytes: ZodDefault<ZodNumber>;
                                protocol_bytes: ZodDefault<ZodNumber>;
                                result_depth: ZodDefault<ZodNumber>;
                                result_nodes: ZodDefault<ZodNumber>;
                                stderr_bytes: ZodDefault<ZodNumber>;
                                tasks: ZodDefault<ZodNumber>;
                                tmpfs_bytes: ZodDefault<ZodNumber>;
                                wall_time_ms: ZodDefault<ZodNumber>;
                            },
                            $strict,
                        >,
                    >;
                    mode: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                    plan_digest: ZodOptional<ZodString>;
                    reproducer_export: ZodOptional<
                        ZodObject<
                            {
                                approved: ZodBoolean;
                                include_sources: ZodDefault<ZodBoolean>;
                                path: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    right: ZodOptional<
                        ZodObject<
                            {
                                entry_alias: ZodString;
                                entry_export: ZodDefault<ZodString>;
                                modules: ZodArray<
                                    ZodObject<
                                        {
                                            alias: ZodString;
                                            dependencies: ZodDefault<(...)>;
                                            format: ZodEnum<(...)>;
                                            path: ZodString;
                                            role: ZodDefault<(...)>;
                                        },
                                        $strict,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                },
                $strict,
            >;
            kind: "application";
            name: "run_controlled_replay";
            outputSchema: ZodObject<
                {
                    evidence: ZodNullable<
                        ZodObject<
                            {
                                analysis_profile: ZodOptional<
                                    ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >,
                                >;
                                authority: ZodEnum<
                                    {
                                        "analyst-inference": "analyst-inference";
                                        "controlled-replay": "controlled-replay";
                                        "external-service": "external-service";
                                        "historical-reference": "historical-reference";
                                        "shipped-artifact": "shipped-artifact";
                                    },
                                >;
                                confidence: ZodEnum<
                                    {
                                        derived: "derived";
                                        inferred: "inferred";
                                        observed: "observed";
                                    },
                                >;
                                environment: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodString;
                                            id: ZodString;
                                            isolation: ZodEnum<(...)>;
                                            platform: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                                evidence_id: ZodString;
                                evidence_links: ZodArray<ZodString>;
                                limitations: ZodArray<ZodString>;
                                locations: ZodArray<
                                    ZodDiscriminatedUnion<
                                        [
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                        ],
                                        "kind",
                                    >,
                                >;
                                normalized_result: ZodObject<
                                    {
                                        cleanup: ZodObject<
                                            { residual_resources: ...; state: ... },
                                            $strict,
                                        >;
                                        comparison: ZodOptional<ZodArray<(...)>>;
                                        limitations: ZodArray<ZodString>;
                                        outcomes: ZodArray<ZodObject<(...), (...)>>;
                                        plan_digest: ZodString;
                                        reproducer: ZodNullable<ZodDiscriminatedUnion<(...), (...)>>;
                                        schema_version: ZodLiteral<1>;
                                        stderr: ZodString;
                                        termination: ZodEnum<
                                            {
                                                cancelled: ...;
                                                completed: ...;
                                                crash: ...;
                                                oom: ...;
                                                protocol_error: ...;
                                                timeout: ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >;
                                operation: ZodString;
                                parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                predicate_type: ZodString;
                                provider: ZodObject<
                                    {
                                        id: ZodString;
                                        name: ZodString;
                                        version: ZodNullable<ZodString>;
                                    },
                                    $strip,
                                >;
                                raw_result: ZodNullable<ZodJSONSchema>;
                                schema_version: ZodLiteral<2>;
                                subject: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodNullable<(...)>;
                                            digest: ZodObject<(...), (...)>;
                                            format: ZodEnum<(...)>;
                                            local_path: ZodString;
                                            name: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                    phase: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                    plan: ZodNullable<
                        ZodObject<
                            {
                                cases: ZodArray<
                                    ZodObject<
                                        {
                                            arguments: ZodArray<(...)>;
                                            case_id: ZodString;
                                            sha256: ZodString;
                                        },
                                        $strict,
                                    >,
                                >;
                                determinism: ZodObject<
                                    {
                                        clock_iso: ZodDefault<ZodISODateTime>;
                                        locale: ZodDefault<ZodLiteral<(...)>>;
                                        platform: ZodDefault<ZodLiteral<(...)>>;
                                        random_seed: ZodDefault<ZodNumber>;
                                        timezone: ZodDefault<ZodLiteral<(...)>>;
                                    },
                                    $strict,
                                >;
                                effects: ZodArray<ZodString>;
                                filesystem: ZodObject<
                                    {
                                        host_writes: ZodLiteral<false>;
                                        private_tmpfs_bytes: ZodNumber;
                                    },
                                    $strict,
                                >;
                                left: ZodObject<
                                    {
                                        entry_alias: ZodString;
                                        entry_export: ZodString;
                                        modules: ZodArray<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >;
                                limits: ZodObject<
                                    {
                                        cpu_quota_percent: ZodDefault<ZodNumber>;
                                        input_bytes: ZodDefault<ZodNumber>;
                                        memory_bytes: ZodDefault<ZodNumber>;
                                        module_bytes: ZodDefault<ZodNumber>;
                                        output_bytes: ZodDefault<ZodNumber>;
                                        protocol_bytes: ZodDefault<ZodNumber>;
                                        result_depth: ZodDefault<ZodNumber>;
                                        result_nodes: ZodDefault<ZodNumber>;
                                        stderr_bytes: ZodDefault<ZodNumber>;
                                        tasks: ZodDefault<ZodNumber>;
                                        tmpfs_bytes: ZodDefault<ZodNumber>;
                                        wall_time_ms: ZodDefault<ZodNumber>;
                                    },
                                    $strict,
                                >;
                                network: ZodLiteral<"none">;
                                plan_digest: ZodString;
                                policy_sha256: ZodString;
                                policy_version: ZodLiteral<"linux-bwrap-systemd-v1">;
                                reproducer_export: ZodNullable<
                                    ZodObject<
                                        {
                                            authority: ZodLiteral<(...)>;
                                            include_sources: ZodBoolean;
                                            path: ZodString;
                                        },
                                        $strict,
                                    >,
                                >;
                                right: ZodOptional<
                                    ZodObject<
                                        {
                                            entry_alias: ZodString;
                                            entry_export: ZodString;
                                            modules: ZodArray<(...)>;
                                        },
                                        $strict,
                                    >,
                                >;
                                runtime: ZodObject<
                                    {
                                        executable: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                        read_only_files: ZodArray<ZodObject<(...), (...)>>;
                                        worker: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                    },
                                    $strict,
                                >;
                                sandbox: ZodObject<
                                    {
                                        bubblewrap: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                        seccomp_sha256: ZodString;
                                        shell: ZodObject<{ path: ...; sha256: ...; version: ... }, $strict>;
                                        systemctl: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                        systemd_run: ZodObject<
                                            { path: ...; sha256: ...; version: ... },
                                            $strict,
                                        >;
                                    },
                                    $strict,
                                >;
                                schema_version: ZodLiteral<1>;
                            },
                            $strict,
                        >,
                    >;
                    source_evidence: ZodArray<
                        ZodObject<
                            {
                                analysis_profile: ZodOptional<
                                    ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >,
                                >;
                                authority: ZodEnum<
                                    {
                                        "analyst-inference": "analyst-inference";
                                        "controlled-replay": "controlled-replay";
                                        "external-service": "external-service";
                                        "historical-reference": "historical-reference";
                                        "shipped-artifact": "shipped-artifact";
                                    },
                                >;
                                confidence: ZodEnum<
                                    {
                                        derived: "derived";
                                        inferred: "inferred";
                                        observed: "observed";
                                    },
                                >;
                                environment: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodString;
                                            id: ZodString;
                                            isolation: ZodEnum<(...)>;
                                            platform: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                                evidence_id: ZodString;
                                evidence_links: ZodArray<ZodString>;
                                limitations: ZodArray<ZodString>;
                                locations: ZodArray<
                                    ZodDiscriminatedUnion<
                                        [
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                            ZodObject<(...), (...)>,
                                        ],
                                        "kind",
                                    >,
                                >;
                                normalized_result: ZodObject<
                                    {
                                        cleanup: ZodObject<
                                            { residual_resources: ...; state: ... },
                                            $strict,
                                        >;
                                        comparison: ZodOptional<ZodArray<(...)>>;
                                        limitations: ZodArray<ZodString>;
                                        outcomes: ZodArray<ZodObject<(...), (...)>>;
                                        plan_digest: ZodString;
                                        reproducer: ZodNullable<ZodDiscriminatedUnion<(...), (...)>>;
                                        schema_version: ZodLiteral<1>;
                                        stderr: ZodString;
                                        termination: ZodEnum<
                                            {
                                                cancelled: ...;
                                                completed: ...;
                                                crash: ...;
                                                oom: ...;
                                                protocol_error: ...;
                                                timeout: ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >;
                                operation: ZodString;
                                parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                predicate_type: ZodString;
                                provider: ZodObject<
                                    {
                                        id: ZodString;
                                        name: ZodString;
                                        version: ZodNullable<ZodString>;
                                    },
                                    $strip,
                                >;
                                raw_result: ZodNullable<ZodJSONSchema>;
                                schema_version: ZodLiteral<2>;
                                subject: ZodNullable<
                                    ZodObject<
                                        {
                                            architecture: ZodNullable<(...)>;
                                            digest: ZodObject<(...), (...)>;
                                            format: ZodEnum<(...)>;
                                            local_path: ZodString;
                                            name: ZodString;
                                        },
                                        $strip,
                                    >,
                                >;
                            },
                            $strict,
                        >,
                    >;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Prepare a hash-bound Node/JavaScript characterization plan and deterministic reversible export transformation without executing target code. The exact source, selected byte range, runtime closure, sandbox profile, cases, and limits are committed for separate execution approval.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: Record<string, JSONType>;
                    title: "Prepare one exact bundled callable characterization";
                },
            ];
            inputSchema: ZodObject<
                {
                    expected_effect: ZodEnum<
                        { "observation-only": "observation-only"; pure: "pure" },
                    >;
                    instrumentation: ZodObject<
                        {
                            artifact_path: ZodString;
                            artifact_sha256: ZodString;
                            selection: ZodObject<
                                {
                                    byte_end: ZodNumber;
                                    byte_start: ZodNumber;
                                    export_name: ZodString;
                                    selected_sha256: ZodString;
                                },
                                $strict,
                            >;
                        },
                        $strict,
                    >;
                    preparation_approved: ZodLiteral<true>;
                    replay: ZodObject<
                        {
                            approved: ZodDefault<ZodBoolean>;
                            cases: ZodDefault<
                                ZodArray<
                                    ZodObject<
                                        { arguments: ZodArray<(...)>; case_id: ZodString },
                                        $strict,
                                    >,
                                >,
                            >;
                            determinism: ZodDefault<
                                ZodObject<
                                    {
                                        clock_iso: ZodDefault<ZodISODateTime>;
                                        locale: ZodDefault<ZodLiteral<(...)>>;
                                        platform: ZodDefault<ZodLiteral<(...)>>;
                                        random_seed: ZodDefault<ZodNumber>;
                                        timezone: ZodDefault<ZodLiteral<(...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                            generator: ZodOptional<
                                ZodObject<
                                    {
                                        count: ZodNumber;
                                        preset: ZodEnum<
                                            {
                                                "clipboard-boundaries": ...;
                                                "parser-boundaries": ...;
                                                "sanitizer-boundaries": ...;
                                            },
                                        >;
                                        seed: ZodNumber;
                                    },
                                    $strict,
                                >,
                            >;
                            left: ZodObject<
                                {
                                    entry_alias: ZodString;
                                    entry_export: ZodDefault<ZodString>;
                                    modules: ZodArray<
                                        ZodObject<
                                            {
                                                alias: ...;
                                                dependencies: ...;
                                                format: ...;
                                                path: ...;
                                                role: ...;
                                            },
                                            $strict,
                                        >,
                                    >;
                                },
                                $strict,
                            >;
                            limits: ZodDefault<
                                ZodObject<
                                    {
                                        cpu_quota_percent: ZodDefault<ZodNumber>;
                                        input_bytes: ZodDefault<ZodNumber>;
                                        memory_bytes: ZodDefault<ZodNumber>;
                                        module_bytes: ZodDefault<ZodNumber>;
                                        output_bytes: ZodDefault<ZodNumber>;
                                        protocol_bytes: ZodDefault<ZodNumber>;
                                        result_depth: ZodDefault<ZodNumber>;
                                        result_nodes: ZodDefault<ZodNumber>;
                                        stderr_bytes: ZodDefault<ZodNumber>;
                                        tasks: ZodDefault<ZodNumber>;
                                        tmpfs_bytes: ZodDefault<ZodNumber>;
                                        wall_time_ms: ZodDefault<ZodNumber>;
                                    },
                                    $strict,
                                >,
                            >;
                            mode: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                            plan_digest: ZodOptional<ZodString>;
                            reproducer_export: ZodOptional<
                                ZodObject<
                                    {
                                        approved: ZodBoolean;
                                        include_sources: ZodDefault<ZodBoolean>;
                                        path: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            right: ZodOptional<
                                ZodObject<
                                    {
                                        entry_alias: ZodString;
                                        entry_export: ZodDefault<ZodString>;
                                        modules: ZodArray<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    selected_alias: ZodString;
                },
                $strict,
            >;
            kind: "application";
            name: "prepare_node_characterization";
            outputSchema: ZodObject<
                {
                    phase: ZodLiteral<"preparation">;
                    plan: ZodObject<
                        {
                            allowed_boundaries: ZodArray<ZodString>;
                            artifact: ZodObject<
                                { byte_length: ZodNumber; path: ZodString; sha256: ZodString },
                                $strict,
                            >;
                            authority: ZodObject<
                                {
                                    execution_approved: ZodLiteral<false>;
                                    network: ZodEnum<{ loopback: "loopback"; none: "none" }>;
                                    preparation_approved: ZodLiteral<true>;
                                    provider_owned_process_only: ZodLiteral<true>;
                                },
                                $strict,
                            >;
                            callable: ZodObject<
                                {
                                    callable_id: ZodString;
                                    export_name: ZodString;
                                    module_id: ZodString;
                                    selector_sha256: ZodString;
                                    semantic_evidence_id: ZodNullable<ZodString>;
                                },
                                $strict,
                            >;
                            determinism: ZodObject<
                                {
                                    clock: ZodEnum<{ fixed: "fixed"; real: "real" }>;
                                    identifiers: ZodEnum<
                                        { deterministic: "deterministic"; runtime: "runtime" },
                                    >;
                                    randomness: ZodEnum<{ seeded: "seeded"; system: "system" }>;
                                    seed: ZodNumber;
                                },
                                $strict,
                            >;
                            expected_effect: ZodEnum<
                                {
                                    "bounded-effects": "bounded-effects";
                                    "observation-only": "observation-only";
                                    pure: "pure";
                                },
                            >;
                            isolated_home: ZodString;
                            limits: ZodObject<
                                {
                                    idle_timeout_ms: ZodNumber;
                                    max_bytes: ZodNumber;
                                    max_calls: ZodNumber;
                                    max_files: ZodNumber;
                                    max_handles: ZodNumber;
                                    max_processes: ZodNumber;
                                    timeout_ms: ZodNumber;
                                },
                                $strict,
                            >;
                            plan_sha256: ZodString;
                            preparation_sha256: ZodString;
                            runtime: ZodObject<
                                {
                                    executable_path: ZodString;
                                    executable_sha256: ZodString;
                                    family: ZodString;
                                    profile_sha256: ZodString;
                                    provider_id: ZodString;
                                    version: ZodString;
                                },
                                $strict,
                            >;
                            schema_version: ZodLiteral<1>;
                            working_directory: ZodString;
                        },
                        $strict,
                    >;
                    replay: ZodObject<
                        {
                            evidence: ZodNullable<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                            phase: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                            plan: ZodNullable<
                                ZodObject<
                                    {
                                        cases: ZodArray<ZodObject<(...), (...)>>;
                                        determinism: ZodObject<
                                            {
                                                clock_iso: ...;
                                                locale: ...;
                                                platform: ...;
                                                random_seed: ...;
                                                timezone: ...;
                                            },
                                            $strict,
                                        >;
                                        effects: ZodArray<ZodString>;
                                        filesystem: ZodObject<
                                            { host_writes: ...; private_tmpfs_bytes: ... },
                                            $strict,
                                        >;
                                        left: ZodObject<
                                            { entry_alias: ...; entry_export: ...; modules: ... },
                                            $strict,
                                        >;
                                        limits: ZodObject<
                                            {
                                                cpu_quota_percent: ...;
                                                input_bytes: ...;
                                                memory_bytes: ...;
                                                module_bytes: ...;
                                                output_bytes: ...;
                                                protocol_bytes: ...;
                                                result_depth: ...;
                                                result_nodes: ...;
                                                stderr_bytes: ...;
                                                tasks: ...;
                                                tmpfs_bytes: ...;
                                                wall_time_ms: ...;
                                            },
                                            $strict,
                                        >;
                                        network: ZodLiteral<"none">;
                                        plan_digest: ZodString;
                                        policy_sha256: ZodString;
                                        policy_version: ZodLiteral<"linux-bwrap-systemd-v1">;
                                        reproducer_export: ZodNullable<ZodObject<(...), (...)>>;
                                        right: ZodOptional<ZodObject<(...), (...)>>;
                                        runtime: ZodObject<
                                            { executable: ...; read_only_files: ...; worker: ... },
                                            $strict,
                                        >;
                                        sandbox: ZodObject<
                                            {
                                                bubblewrap: ...;
                                                seccomp_sha256: ...;
                                                shell: ...;
                                                systemctl: ...;
                                                systemd_run: ...;
                                            },
                                            $strict,
                                        >;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strict,
                                >,
                            >;
                            source_evidence: ZodArray<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    schema_version: ZodLiteral<1>;
                    transformation: ZodObject<
                        {
                            artifact_path: ZodString;
                            inserted_ranges: ZodArray<
                                ZodObject<
                                    {
                                        byte_end: ZodNumber;
                                        byte_start: ZodNumber;
                                        inserted_sha256: ZodString;
                                        purpose: ZodEnum<
                                            {
                                                "export-binding": ...;
                                                "factory-prefix": ...;
                                                "factory-suffix": ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >,
                            >;
                            instrumented_byte_length: ZodNumber;
                            instrumented_sha256: ZodString;
                            kind: ZodLiteral<"commonjs-factory-export-v1">;
                            original_byte_length: ZodNumber;
                            original_sha256: ZodString;
                            output_format: ZodLiteral<"commonjs-factory">;
                            schema_version: ZodLiteral<1>;
                            selected_range: ZodObject<
                                {
                                    byte_end: ZodNumber;
                                    byte_start: ZodNumber;
                                    selected_sha256: ZodString;
                                },
                                $strict,
                            >;
                            source_map: ZodLiteral<null>;
                        },
                        $strict,
                    >;
                    transformation_evidence: ZodUnion<
                        readonly [
                            ZodObject<
                                {
                                    analysis_profile: ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                            ZodObject<
                                {
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        ],
                    >;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Recompute and execute one separately approved exact Node characterization plan in the owned controlled-replay boundary. Returns transformation, replay, cleanup, and provider-neutral characterization Evidence v2; stale plans fail before execution.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved_plan_sha256: string;
                        execution_approved: true;
                        preparation: Record<string, JSONType>;
                    };
                    title: "Execute one approved exact characterization plan";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved_plan_sha256: ZodString;
                    execution_approved: ZodLiteral<true>;
                    preparation: ZodObject<
                        {
                            expected_effect: ZodEnum<
                                { "observation-only": "observation-only"; pure: "pure" },
                            >;
                            instrumentation: ZodObject<
                                {
                                    artifact_path: ZodString;
                                    artifact_sha256: ZodString;
                                    selection: ZodObject<
                                        {
                                            byte_end: ZodNumber;
                                            byte_start: ZodNumber;
                                            export_name: ZodString;
                                            selected_sha256: ZodString;
                                        },
                                        $strict,
                                    >;
                                },
                                $strict,
                            >;
                            preparation_approved: ZodLiteral<true>;
                            replay: ZodObject<
                                {
                                    approved: ZodDefault<ZodBoolean>;
                                    cases: ZodDefault<ZodArray<ZodObject<(...), (...)>>>;
                                    determinism: ZodDefault<
                                        ZodObject<
                                            {
                                                clock_iso: ...;
                                                locale: ...;
                                                platform: ...;
                                                random_seed: ...;
                                                timezone: ...;
                                            },
                                            $strict,
                                        >,
                                    >;
                                    generator: ZodOptional<
                                        ZodObject<{ count: ...; preset: ...; seed: ... }, $strict>,
                                    >;
                                    left: ZodObject<
                                        {
                                            entry_alias: ZodString;
                                            entry_export: ZodDefault<(...)>;
                                            modules: ZodArray<(...)>;
                                        },
                                        $strict,
                                    >;
                                    limits: ZodDefault<
                                        ZodObject<
                                            {
                                                cpu_quota_percent: ...;
                                                input_bytes: ...;
                                                memory_bytes: ...;
                                                module_bytes: ...;
                                                output_bytes: ...;
                                                protocol_bytes: ...;
                                                result_depth: ...;
                                                result_nodes: ...;
                                                stderr_bytes: ...;
                                                tasks: ...;
                                                tmpfs_bytes: ...;
                                                wall_time_ms: ...;
                                            },
                                            $strict,
                                        >,
                                    >;
                                    mode: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                                    plan_digest: ZodOptional<ZodString>;
                                    reproducer_export: ZodOptional<
                                        ZodObject<
                                            { approved: ...; include_sources: ...; path: ... },
                                            $strict,
                                        >,
                                    >;
                                    right: ZodOptional<
                                        ZodObject<
                                            { entry_alias: ...; entry_export: ...; modules: ... },
                                            $strict,
                                        >,
                                    >;
                                },
                                $strict,
                            >;
                            selected_alias: ZodString;
                        },
                        $strict,
                    >;
                },
                $strict,
            >;
            kind: "application";
            name: "execute_node_characterization";
            outputSchema: ZodObject<
                {
                    evidence: ZodUnion<
                        readonly [
                            ZodObject<
                                {
                                    analysis_profile: ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                            ZodObject<
                                {
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        ],
                    >;
                    phase: ZodLiteral<"execution">;
                    plan: ZodObject<
                        {
                            allowed_boundaries: ZodArray<ZodString>;
                            artifact: ZodObject<
                                { byte_length: ZodNumber; path: ZodString; sha256: ZodString },
                                $strict,
                            >;
                            authority: ZodObject<
                                {
                                    execution_approved: ZodLiteral<false>;
                                    network: ZodEnum<{ loopback: "loopback"; none: "none" }>;
                                    preparation_approved: ZodLiteral<true>;
                                    provider_owned_process_only: ZodLiteral<true>;
                                },
                                $strict,
                            >;
                            callable: ZodObject<
                                {
                                    callable_id: ZodString;
                                    export_name: ZodString;
                                    module_id: ZodString;
                                    selector_sha256: ZodString;
                                    semantic_evidence_id: ZodNullable<ZodString>;
                                },
                                $strict,
                            >;
                            determinism: ZodObject<
                                {
                                    clock: ZodEnum<{ fixed: "fixed"; real: "real" }>;
                                    identifiers: ZodEnum<
                                        { deterministic: "deterministic"; runtime: "runtime" },
                                    >;
                                    randomness: ZodEnum<{ seeded: "seeded"; system: "system" }>;
                                    seed: ZodNumber;
                                },
                                $strict,
                            >;
                            expected_effect: ZodEnum<
                                {
                                    "bounded-effects": "bounded-effects";
                                    "observation-only": "observation-only";
                                    pure: "pure";
                                },
                            >;
                            isolated_home: ZodString;
                            limits: ZodObject<
                                {
                                    idle_timeout_ms: ZodNumber;
                                    max_bytes: ZodNumber;
                                    max_calls: ZodNumber;
                                    max_files: ZodNumber;
                                    max_handles: ZodNumber;
                                    max_processes: ZodNumber;
                                    timeout_ms: ZodNumber;
                                },
                                $strict,
                            >;
                            plan_sha256: ZodString;
                            preparation_sha256: ZodString;
                            runtime: ZodObject<
                                {
                                    executable_path: ZodString;
                                    executable_sha256: ZodString;
                                    family: ZodString;
                                    profile_sha256: ZodString;
                                    provider_id: ZodString;
                                    version: ZodString;
                                },
                                $strict,
                            >;
                            schema_version: ZodLiteral<1>;
                            working_directory: ZodString;
                        },
                        $strict,
                    >;
                    replay: ZodObject<
                        {
                            evidence: ZodNullable<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                            phase: ZodEnum<{ execute: "execute"; plan: "plan" }>;
                            plan: ZodNullable<
                                ZodObject<
                                    {
                                        cases: ZodArray<ZodObject<(...), (...)>>;
                                        determinism: ZodObject<
                                            {
                                                clock_iso: ...;
                                                locale: ...;
                                                platform: ...;
                                                random_seed: ...;
                                                timezone: ...;
                                            },
                                            $strict,
                                        >;
                                        effects: ZodArray<ZodString>;
                                        filesystem: ZodObject<
                                            { host_writes: ...; private_tmpfs_bytes: ... },
                                            $strict,
                                        >;
                                        left: ZodObject<
                                            { entry_alias: ...; entry_export: ...; modules: ... },
                                            $strict,
                                        >;
                                        limits: ZodObject<
                                            {
                                                cpu_quota_percent: ...;
                                                input_bytes: ...;
                                                memory_bytes: ...;
                                                module_bytes: ...;
                                                output_bytes: ...;
                                                protocol_bytes: ...;
                                                result_depth: ...;
                                                result_nodes: ...;
                                                stderr_bytes: ...;
                                                tasks: ...;
                                                tmpfs_bytes: ...;
                                                wall_time_ms: ...;
                                            },
                                            $strict,
                                        >;
                                        network: ZodLiteral<"none">;
                                        plan_digest: ZodString;
                                        policy_sha256: ZodString;
                                        policy_version: ZodLiteral<"linux-bwrap-systemd-v1">;
                                        reproducer_export: ZodNullable<ZodObject<(...), (...)>>;
                                        right: ZodOptional<ZodObject<(...), (...)>>;
                                        runtime: ZodObject<
                                            { executable: ...; read_only_files: ...; worker: ... },
                                            $strict,
                                        >;
                                        sandbox: ZodObject<
                                            {
                                                bubblewrap: ...;
                                                seccomp_sha256: ...;
                                                shell: ...;
                                                systemctl: ...;
                                                systemd_run: ...;
                                            },
                                            $strict,
                                        >;
                                        schema_version: ZodLiteral<1>;
                                    },
                                    $strict,
                                >,
                            >;
                            source_evidence: ZodArray<
                                ZodObject<
                                    {
                                        analysis_profile: ZodOptional<ZodObject<(...), (...)>>;
                                        authority: ZodEnum<
                                            {
                                                "analyst-inference": ...;
                                                "controlled-replay": ...;
                                                "external-service": ...;
                                                "historical-reference": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        confidence: ZodEnum<{ derived: ...; inferred: ...; observed: ... }>;
                                        environment: ZodNullable<ZodObject<(...), (...)>>;
                                        evidence_id: ZodString;
                                        evidence_links: ZodArray<ZodString>;
                                        limitations: ZodArray<ZodString>;
                                        locations: ZodArray<ZodDiscriminatedUnion<(...), (...)>>;
                                        normalized_result: ZodObject<
                                            {
                                                cleanup: ...;
                                                comparison: ...;
                                                limitations: ...;
                                                outcomes: ...;
                                                plan_digest: ...;
                                                reproducer: ...;
                                                schema_version: ...;
                                                stderr: ...;
                                                termination: ...;
                                            },
                                            $strict,
                                        >;
                                        operation: ZodString;
                                        parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                        predicate_type: ZodString;
                                        provider: ZodObject<{ id: ...; name: ...; version: ... }, $strip>;
                                        raw_result: ZodNullable<ZodJSONSchema>;
                                        schema_version: ZodLiteral<2>;
                                        subject: ZodNullable<ZodObject<(...), (...)>>;
                                    },
                                    $strict,
                                >,
                            >;
                        },
                        $strict,
                    >;
                    schema_version: ZodLiteral<1>;
                    transformation: ZodObject<
                        {
                            artifact_path: ZodString;
                            inserted_ranges: ZodArray<
                                ZodObject<
                                    {
                                        byte_end: ZodNumber;
                                        byte_start: ZodNumber;
                                        inserted_sha256: ZodString;
                                        purpose: ZodEnum<
                                            {
                                                "export-binding": ...;
                                                "factory-prefix": ...;
                                                "factory-suffix": ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >,
                            >;
                            instrumented_byte_length: ZodNumber;
                            instrumented_sha256: ZodString;
                            kind: ZodLiteral<"commonjs-factory-export-v1">;
                            original_byte_length: ZodNumber;
                            original_sha256: ZodString;
                            output_format: ZodLiteral<"commonjs-factory">;
                            schema_version: ZodLiteral<1>;
                            selected_range: ZodObject<
                                {
                                    byte_end: ZodNumber;
                                    byte_start: ZodNumber;
                                    selected_sha256: ZodString;
                                },
                                $strict,
                            >;
                            source_map: ZodLiteral<null>;
                        },
                        $strict,
                    >;
                    transformation_evidence: ZodUnion<
                        readonly [
                            ZodObject<
                                {
                                    analysis_profile: ZodObject<
                                        {
                                            digest: ZodString;
                                            parameters: ZodRecord<(...), (...)>;
                                            provider: ZodObject<(...), (...)>;
                                            provider_profile_schema_version: ZodNumber;
                                            schema_version: ZodLiteral<(...)>;
                                        },
                                        $strip,
                                    >;
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                            ZodObject<
                                {
                                    authority: ZodEnum<
                                        {
                                            "analyst-inference": "analyst-inference";
                                            "controlled-replay": "controlled-replay";
                                            "external-service": "external-service";
                                            "historical-reference": "historical-reference";
                                            "shipped-artifact": "shipped-artifact";
                                        },
                                    >;
                                    confidence: ZodEnum<
                                        {
                                            derived: "derived";
                                            inferred: "inferred";
                                            observed: "observed";
                                        },
                                    >;
                                    environment: ZodNullable<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    evidence_id: ZodString;
                                    evidence_links: ZodArray<ZodString>;
                                    limitations: ZodArray<ZodString>;
                                    locations: ZodArray<
                                        ZodDiscriminatedUnion<
                                            [(...), (...), (...), (...), (...)],
                                            "kind",
                                        >,
                                    >;
                                    normalized_result: ZodJSONSchema;
                                    operation: ZodString;
                                    parameters: ZodRecord<ZodString, ZodJSONSchema>;
                                    predicate_type: ZodString;
                                    provider: ZodObject<
                                        { id: ZodString; name: ZodString; version: ZodNullable<(...)> },
                                        $strip,
                                    >;
                                    raw_result: ZodNullable<ZodJSONSchema>;
                                    schema_version: ZodLiteral<2>;
                                    subject: ZodNullable<
                                        ZodObject<
                                            {
                                                architecture: ...;
                                                digest: ...;
                                                format: ...;
                                                local_path: ...;
                                                name: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strict,
                            >,
                        ],
                    >;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Atomically commit one canonical evidence-backed reconstruction coverage workspace revision under an approved root. CAS revisions reject lost updates; every Evidence and residual-unknown reference must resolve in the embedded canonical bundle.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        approved: true;
                        expected_revision: null;
                        workspace: Record<string, JSONType>;
                        workspace_path: "/approved/coverage.json";
                    };
                    title: "Commit the first canonical coverage revision";
                },
            ];
            inputSchema: ZodObject<
                {
                    approved: ZodLiteral<true>;
                    expected_revision: ZodNullable<ZodNumber>;
                    workspace: ZodObject<
                        {
                            artifacts: ZodArray<
                                ZodObject<
                                    {
                                        artifact_id: ZodString;
                                        artifact_sha256: ZodString;
                                        environment_sha256: ZodString;
                                        evidence_ids: ZodArray<ZodString>;
                                        version: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            boundaries: ZodArray<
                                ZodObject<
                                    {
                                        allowed_dispositions: ZodArray<ZodEnum<(...)>>;
                                        allowed_unknown_ids: ZodArray<ZodString>;
                                        boundary_id: ZodString;
                                        required_claim_ids: ZodArray<ZodString>;
                                        required_package_proof_kinds: ZodArray<ZodEnum<(...)>>;
                                        required_surface_ids: ZodArray<ZodString>;
                                        title: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            claims: ZodArray<
                                ZodObject<
                                    {
                                        claim_id: ZodString;
                                        kind: ZodString;
                                        required_authority: ZodEnum<
                                            {
                                                "controlled-replay": ...;
                                                external: ...;
                                                "live-observation": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        required_dimensions: ZodArray<ZodString>;
                                        surface_ids: ZodArray<ZodString>;
                                        title: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            contradictions: ZodArray<
                                ZodObject<
                                    {
                                        claim_ids: ZodArray<ZodString>;
                                        contradiction_id: ZodString;
                                        evidence_ids: ZodArray<ZodString>;
                                        status: ZodEnum<{ active: ...; resolved: ... }>;
                                        surface_ids: ZodArray<ZodString>;
                                    },
                                    $strict,
                                >,
                            >;
                            evidence_bundle: ZodObject<
                                {
                                    artifacts: ZodArray<
                                        ZodObject<
                                            { architecture: ...; digest: ...; format: ... },
                                            $strip,
                                        >,
                                    >;
                                    bundle_version: ZodLiteral<2>;
                                    captures: ZodArray<
                                        ZodObject<{ evidence_id: ...; predicate_type: ... }, $strip>,
                                    >;
                                    environments: ZodArray<
                                        ZodObject<
                                            { architecture: ...; id: ...; isolation: ...; platform: ... },
                                            $strip,
                                        >,
                                    >;
                                    providers: ZodArray<
                                        ZodObject<{ id: ...; name: ...; version: ... }, $strip>,
                                    >;
                                    records: ZodArray<ZodUnion<readonly [(...), (...)]>>;
                                    scenarios: ZodArray<
                                        ZodObject<
                                            { authority: ...; evidence_id: ...; operation: ... },
                                            $strip,
                                        >,
                                    >;
                                    unknowns: ZodArray<
                                        ZodObject<
                                            {
                                                contradicting_evidence_ids: ...;
                                                domain: ...;
                                                mutation_evidence_ids: ...;
                                                previous_revision_digest: ...;
                                                question: ...;
                                                recommended_probes: ...;
                                                registry_version: ...;
                                                relationships: ...;
                                                required_authority: ...;
                                                required_confidence: ...;
                                                required_environment: ...;
                                                resolution: ...;
                                                revision: ...;
                                                revision_digest: ...;
                                                scope_digest: ...;
                                                severity: ...;
                                                status: ...;
                                                supporting_evidence_ids: ...;
                                                unknown_id: ...;
                                            },
                                            $strip,
                                        >,
                                    >;
                                },
                                $strip,
                            >;
                            name: ZodString;
                            owners: ZodArray<
                                ZodObject<
                                    {
                                        ownership: ZodDiscriminatedUnion<[(...), (...)], "disposition">;
                                        surface_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            package_proofs: ZodArray<
                                ZodObject<
                                    {
                                        artifact_sha256s: ZodArray<ZodString>;
                                        evidence_ids: ZodArray<ZodString>;
                                        kind: ZodEnum<
                                            {
                                                "authority-independence": ...;
                                                build: ...;
                                                "clean-install": ...;
                                                "package-contents": ...;
                                                "runtime-routing": ...;
                                            },
                                        >;
                                        proof_id: ZodString;
                                        status: ZodEnum<
                                            {
                                                fail: ...;
                                                pass: ...;
                                                skipped: ...;
                                                unknown: ...;
                                                unsupported: ...;
                                            },
                                        >;
                                    },
                                    $strict,
                                >,
                            >;
                            previous_revision_sha256: ZodNullable<ZodString>;
                            residual_unknown_ids: ZodArray<ZodString>;
                            revision: ZodNumber;
                            revision_sha256: ZodString;
                            schema_version: ZodLiteral<1>;
                            surfaces: ZodArray<
                                ZodObject<
                                    {
                                        artifact_id: ZodString;
                                        authority: ZodEnum<
                                            {
                                                derived: ...;
                                                external: ...;
                                                historical: ...;
                                                inferred: ...;
                                                observed: ...;
                                            },
                                        >;
                                        dependency_surface_ids: ZodArray<ZodString>;
                                        evidence_ids: ZodArray<ZodString>;
                                        family: ZodString;
                                        location: ZodString;
                                        occurrence_id: ZodNullable<ZodString>;
                                        surface_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            verifier_contracts: ZodArray<
                                ZodObject<
                                    {
                                        authority: ZodEnum<
                                            {
                                                "controlled-replay": ...;
                                                external: ...;
                                                "live-observation": ...;
                                                "shipped-artifact": ...;
                                            },
                                        >;
                                        claim_ids: ZodArray<ZodString>;
                                        contract_sha256: ZodString;
                                        dimensions: ZodArray<ZodString>;
                                        max_age_ms: ZodNumber;
                                        minimum_repeats: ZodNumber;
                                        normalization_removes_dimensions: ZodLiteral<false>;
                                        normalization_sha256: ZodString;
                                        verifier_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            verifier_results: ZodArray<
                                ZodObject<
                                    {
                                        artifact_sha256s: ZodArray<ZodString>;
                                        contract_sha256: ZodString;
                                        covered_claim_ids: ZodArray<ZodString>;
                                        covered_dimensions: ZodArray<ZodString>;
                                        evidence_ids: ZodArray<ZodString>;
                                        normalization_sha256: ZodString;
                                        observed_at: ZodString;
                                        owner_sha256s: ZodArray<ZodString>;
                                        repeats: ZodNumber;
                                        status: ZodEnum<
                                            {
                                                fail: ...;
                                                pass: ...;
                                                skipped: ...;
                                                truncated: ...;
                                                unknown: ...;
                                                unsupported: ...;
                                            },
                                        >;
                                        verifier_id: ZodString;
                                    },
                                    $strict,
                                >,
                            >;
                            workspace_id: ZodString;
                        },
                        $strict,
                    >;
                    workspace_path: ZodString;
                },
                $strict,
            >;
            kind: "application";
            name: "commit_reconstruction_coverage";
            outputSchema: ZodObject<
                {
                    bytes: ZodNumber;
                    evidence_records: ZodNumber;
                    revision: ZodNumber;
                    revision_sha256: ZodString;
                    workspace_id: ZodString;
                    workspace_path: ZodString;
                },
                $strict,
            >;
            title: string;
        },
        {
            annotations: DerivedToolAnnotations;
            description: "Evaluate one named reconstruction boundary from a canonical coverage workspace. Missing ownership or inventory is partial; stale, weak, truncated, skipped, or unresolved proof is unknown; contradictions, failed proof, missing owners, and authority routing fail closed.";
            effects: ToolEffects;
            examples: readonly [
                {
                    input: {
                        boundary_id: "replacement.cli";
                        workspace_path: "/approved/coverage.json";
                    };
                    title: "Evaluate one replacement boundary";
                },
            ];
            inputSchema: ZodObject<
                { boundary_id: ZodString; workspace_path: ZodString },
                $strict,
            >;
            kind: "application";
            name: "query_reconstruction_coverage";
            outputSchema: ZodObject<
                {
                    boundary_id: ZodString;
                    evidence_ids: ZodArray<ZodString>;
                    reasons: ZodArray<
                        ZodObject<
                            {
                                code: ZodEnum<
                                    {
                                        "active-contradiction": "active-contradiction";
                                        "active-unknown": "active-unknown";
                                        "authority-routing-detected": "authority-routing-detected";
                                        "authority-routing-unknown": "authority-routing-unknown";
                                        "claim-missing": "claim-missing";
                                        "dependency-surface-missing": "dependency-surface-missing";
                                        "disposition-not-allowed": "disposition-not-allowed";
                                        "owner-distribution-unknown": "owner-distribution-unknown";
                                        "owner-duplicate": "owner-duplicate";
                                        "owner-missing": "owner-missing";
                                        "owner-path-missing": "owner-path-missing";
                                        "owner-path-unknown": "owner-path-unknown";
                                        "owner-undistributed": "owner-undistributed";
                                        "package-proof-failed": "package-proof-failed";
                                        "package-proof-missing": "package-proof-missing";
                                        "package-proof-unknown": "package-proof-unknown";
                                        "surface-missing": "surface-missing";
                                        "verifier-duplicate": "verifier-duplicate";
                                        "verifier-failed": "verifier-failed";
                                        "verifier-missing": "verifier-missing";
                                        "verifier-result-incompatible": "verifier-result-incompatible";
                                        "verifier-result-missing": "verifier-result-missing";
                                        "verifier-result-stale": "verifier-result-stale";
                                        "verifier-unknown": "verifier-unknown";
                                    },
                                >;
                                detail: ZodString;
                                subject_id: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    recommended_probes: ZodArray<
                        ZodObject<
                            {
                                operation: ZodString;
                                rationale: ZodString;
                                subject_id: ZodString;
                            },
                            $strict,
                        >,
                    >;
                    status: ZodEnum<
                        {
                            failed: "failed";
                            partial: "partial";
                            ready: "ready";
                            unknown: "unknown";
                        },
                    >;
                    summary: ZodObject<
                        {
                            reasons: ZodNumber;
                            required_claims: ZodNumber;
                            required_surfaces: ZodNumber;
                        },
                        $strict,
                    >;
                    workspace_revision_sha256: ZodString;
                },
                $strict,
            >;
            title: string;
        },
        ToolContract<"open_binary">,
        ToolContract<"close_binary">,
        ToolContract<"binary_session">,
        ToolContract<"export_evidence_bundle">,
        ToolContract<"import_evidence_bundle">,
        ToolContract<"capture_process_scenario">,
        ToolContract<"compare_process_captures">,
        ToolContract<"compare_artifacts">,
        ToolContract<"compare_functions">,
        ToolContract<"compare_bundles">,
        ToolContract<"find_changed_behavior">,
        ToolContract<"build_call_path">,
        ToolContract<"correlate_static_and_runtime">,
        ToolContract<"verify_reconstruction">,
        ToolContract<"list_unknowns">,
        ToolContract<"record_unknown">,
        ToolContract<"update_unknown">,
        ToolContract<"verify_unknown_resolution">,
    ] = ...

    Complete ordered public inventory used by registration and verification.

    diff --git a/docs/api/variables/domain_managedArtifact.managedMemberInspectionSchema.html b/docs/api/variables/domain_managedArtifact.managedMemberInspectionSchema.html index 12a195789..37b0d5b6b 100644 --- a/docs/api/variables/domain_managedArtifact.managedMemberInspectionSchema.html +++ b/docs/api/variables/domain_managedArtifact.managedMemberInspectionSchema.html @@ -15,7 +15,7 @@

    Provider-neutral, execution-free metadata/signature/IL member inspection.

    +
  • Defined in src/domain/managedArtifact.ts:412
    • diff --git a/docs/api/variables/domain_managedArtifact.managedNativeBoundaryInspectionSchema.html b/docs/api/variables/domain_managedArtifact.managedNativeBoundaryInspectionSchema.html index 7e865a568..7e053eebd 100644 --- a/docs/api/variables/domain_managedArtifact.managedNativeBoundaryInspectionSchema.html +++ b/docs/api/variables/domain_managedArtifact.managedNativeBoundaryInspectionSchema.html @@ -15,7 +15,7 @@

    Provider-neutral managed/native boundary observations from PE/CLI metadata.

    +
  • Defined in src/domain/managedArtifact.ts:448
    • diff --git a/docs/managed-code-analysis.md b/docs/managed-code-analysis.md index 92ba8ead2..d504a6667 100644 --- a/docs/managed-code-analysis.md +++ b/docs/managed-code-analysis.md @@ -104,8 +104,50 @@ EncBaseId because ECMA-335 metadata does not require those bit patterns. - row/heap/body locations expressed as typed file offsets, RVAs, or CIL offsets; - exact raw bytes or bounded value digest; -- method body, normalized CIL, locals, exception-region, and generic-context - commitments where applicable. +- raw CIL digest plus separately reported method-header, locals-token, and + exception-region observations where available; +- a deterministic v1 decoded-instruction-tuple digest for completely decoded + CIL, with the limitations below. + +### Shipped decoded-CIL fingerprint v1 + +`inspect_managed_members` exposes two method CIL hashes with different byte +boundaries: + +| Field | Shipped v1 input | Excluded from the digest | +| ---------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `il_sha256` | The exact `il_size` raw CIL bytes after the tiny or fat method header | Method header, locals signature blob, alignment, and extra sections including exception clauses | +| `normalized_il_sha256` | UTF-8 `JSON.stringify` output for the instruction-order array of `[opcode, operand_kind, operand]` tuples | Instruction offsets except projected scalar branch targets, switch targets, resolved metadata/string identities, method header, locals, and exception regions | + +The normalized field is available only when the entire CIL stream decodes with +status `present`. A partial, malformed, absent, or over-limit body reports +`null`. The containing member result's `schema_version: 1` scopes the tuple +format; v1 does not expose a separate algorithm-version field. + +Tuple operands use these exact projections: + +- operand-free instructions: `none` and `null`; +- metadata and user-string operands: the build-local token as lowercase + `0x`-prefixed eight-digit hexadecimal; +- scalar branches: the target CIL byte offset as a decimal string; +- `switch`: the case count as a decimal string, without target offsets; +- signed integer and variable operands: decimal strings; floating-point + operands: JavaScript's `String` representation of the decoded IEEE value. + +Opcode names retain short/long forms and prefix opcodes. This makes v1 a +reproducible decoded-tuple fingerprint, not a canonical semantic CIL identity: +it does not resolve tokens across MVIDs, does not commit full control flow or +exception semantics, and does not replace the raw CIL digest. Cross-build +comparison uses the value only as one unique-only structural tier and reports +ambiguity when that evidence is insufficient. A future normalized-CIL v2 must +have an explicit algorithm version, canonical token/literal identities, +complete branch and switch targets, and explicit locals/exception semantics. + +For example, a decoded `nop; ret` body serializes exactly as +`[["nop","none",null],["ret","none",null]]` and has v1 digest +`5e5fad7741cb44bca3a4f045546b7449990da343f612f5f34c0ca30e9eee0636`. +This vector specifies the tuple order, `null` handling, absence of whitespace, +UTF-8 encoding, and lowercase hexadecimal output. ### Epistemic commitment @@ -163,7 +205,8 @@ bounded set of observations needed to investigate a proposition: - exact strings, numeric constants, enum-like values, and serialization keys; - branch, switch, exception, loop, call, and field-flow shape; - construction and generic-instantiation sites; -- exact body and normalized-CIL commitments; +- raw CIL and decoded-tuple-v1 commitments, plus separate header, locals, and + exception observations; - callers, callees, shared fields, and competing candidates; and - limitations from reflection, dynamic dispatch, generated code, protection, native transitions, or incomplete coverage. @@ -174,12 +217,14 @@ turn that role into the method's durable identity. Cross-version matching is two-stage: -1. Exact identity requires compatible artifact/module commitments and an exact - entity/body identity. -2. Structural identity compares schema-versioned signatures, normalized CIL, - APIs, constants, and bounded graph context. It reports all candidates at the - winning score and remains ambiguous when the evidence does not distinguish - them. +1. Exact identity requires compatible artifact/module commitments and exact + raw CIL identity; v1 does not expose a standalone complete-method-body + digest. +2. Structural identity compares schema-versioned signatures, the limited v1 + decoded-CIL tuple fingerprint, constants, and bounded shape context. It + reports all candidates at the winning score and remains ambiguous when the + evidence does not distinguish them. The v1 digest does not itself remap + metadata tokens. Tokens are always remapped through observed structure. A caller cannot carry `0x06001234` into a new MVID and assume it names the same method. @@ -330,7 +375,8 @@ manifest supplies those fields. It then pages each declared MethodDef token directly by row, so selected methods do not need to appear in the first member page of a large application. `il_length` remains accepted as a legacy alias for `il_size`; optional `il_sha256` locks the exact raw CIL bytes in addition to -REA's schema-versioned normalized instruction digest. +REA's member-result-v1 decoded-instruction-tuple digest. That normalized field +has the v1 limits documented above and is not a complete semantic CIL identity. The optional `application_graph` block reuses those exact-build method commitments. For each referenced MethodDef token, the verifier builds a bounded @@ -378,7 +424,9 @@ The managed-code track advances as reviewable pull requests: 1. accepted evidence/provider boundary (this document and ADR); 2. read-only artifact triage and exact identity (shipped); -3. bounded metadata, signatures, method bodies, and normalized CIL (shipped); +3. bounded metadata, signatures, method bodies, raw CIL hashes, and the limited + decoded-instruction-tuple fingerprint v1 (shipped; normalized-CIL v2 + semantics remain planned); 4. obfuscation-resistant slices and cross-version comparison (shipped for static member observations); 5. decompiler reconstruction import (shipped as analyst inference; REA does diff --git a/docs/product-catalog.json b/docs/product-catalog.json index 7ea89d9b1..2afa2d438 100644 --- a/docs/product-catalog.json +++ b/docs/product-catalog.json @@ -566,10 +566,10 @@ "mcp_resource_templates": 8 }, "digests": { - "tools_sha256": "b9cea5c401d28e7f2bbd32a058dab8cf5c1b044a60fb5b2ec90584dcd2c781bb", + "tools_sha256": "4f19c5773a44980e176978f05626f2d82c95d49e4b86d024ce515c3ff1670bae", "prompts_sha256": "f6da3ad38a1000c11364d1710f122ac4990551f04efd8c53ffb2e819b5cf5707", "resources_sha256": "5dca0fcdad3e78d71a1b6ef7b4f0c12bdcd8e3ec11fcbdd9ccd3a68edadf5c80", - "combined_sha256": "d0e2eae4dbc245ff58042a075276a501872a5bf7405a18d1b4e0163cbdf138f9" + "combined_sha256": "b6840d7c79ffdfe8a2ef65fb66c1694f3631bacbc22a0456abbe12aca2d53969" } } } diff --git a/skills/reverse-engineer-anything/SKILL.md b/skills/reverse-engineer-anything/SKILL.md index d384bba8b..f73c34290 100644 --- a/skills/reverse-engineer-anything/SKILL.md +++ b/skills/reverse-engineer-anything/SKILL.md @@ -4,7 +4,7 @@ description: Reverse engineer native, Electron/JavaScript, and web applications metadata: version: "21" tool_count: 95 - catalog_digest: "d0e2eae4dbc245ff58042a075276a501872a5bf7405a18d1b4e0163cbdf138f9" + catalog_digest: "b6840d7c79ffdfe8a2ef65fb66c1694f3631bacbc22a0456abbe12aca2d53969" --- # REA diff --git a/src/contracts/managedToolContracts.ts b/src/contracts/managedToolContracts.ts index 35a6da1b2..7aad342f0 100644 --- a/src/contracts/managedToolContracts.ts +++ b/src/contracts/managedToolContracts.ts @@ -137,7 +137,7 @@ export const MANAGED_TOOL_CONTRACTS = [ name: "inspect_managed_members", ...toolContractMetadata("inspect_managed_members"), description: - "Inspect bounded PE/CLI metadata members, signatures, method body IL hashes, exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID.", + "Inspect bounded PE/CLI metadata members, signatures, raw CIL hashes, limited member-result-v1 decoded-instruction-tuple hashes, separately reported exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID; the v1 tuple hash does not resolve them or fully commit control flow.", kind: "managed-provider", inputSchema: managedMemberInputSchema, outputSchema: memberOutputSchema, diff --git a/src/contracts/managedWorkflowToolContracts.ts b/src/contracts/managedWorkflowToolContracts.ts index 23700920a..8ce696501 100644 --- a/src/contracts/managedWorkflowToolContracts.ts +++ b/src/contracts/managedWorkflowToolContracts.ts @@ -160,7 +160,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [ name: "compare_managed_members", ...toolContractMetadata("compare_managed_members"), description: - "Compare two authenticated inspect_managed_members Evidence records using unique-only CIL/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens are remapped as build-local coordinates bound to each artifact SHA-256 and MVID.", + "Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL-v1/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the v1 tuple digest does not itself remap them.", kind: "application", inputSchema: compareManagedMembersReferenceInputSchema, outputSchema: comparisonOutputSchema, @@ -203,7 +203,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [ name: "import_managed_reconstruction", ...toolContractMetadata("import_managed_reconstruction"), description: - "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and normalized IL hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.", + "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited member-result-v1 decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.", kind: "application", inputSchema: managedReconstructionReferenceInputSchema, outputSchema: reconstructionOutputSchema, @@ -224,7 +224,7 @@ export const MANAGED_WORKFLOW_TOOL_CONTRACTS = [ name: "plan_managed_runtime_correlation", ...toolContractMetadata("plan_managed_runtime_correlation"), description: - "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and normalized IL shape, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.", + "Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and limited member-result-v1 decoded-IL tuple hash, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.", kind: "application", inputSchema: managedRuntimeCorrelationReferenceInputSchema, outputSchema: runtimeOutputSchema, diff --git a/src/domain/managedArtifact.ts b/src/domain/managedArtifact.ts index 99363d60f..d7540173a 100644 --- a/src/domain/managedArtifact.ts +++ b/src/domain/managedArtifact.ts @@ -170,8 +170,16 @@ const managedMethodBodySchema = z.object({ init_locals: z.boolean().nullable(), local_var_sig_token: tokenSchema.nullable(), il_size: z.number().int().min(0), - il_sha256: digestSchema.nullable(), - normalized_il_sha256: digestSchema.nullable(), + il_sha256: digestSchema + .nullable() + .describe( + "SHA-256 of exactly the raw il_size CIL bytes; excludes the method header, locals signature, alignment, and extra sections", + ), + normalized_il_sha256: digestSchema + .nullable() + .describe( + "Member-result-v1 SHA-256 of UTF-8 JSON [opcode, operand_kind, operand] tuples for a complete decode; retains build-local tokens, omits switch targets, and excludes headers, locals, and exception regions", + ), instruction_count: z.number().int().min(0), decoded_instruction_count: z.number().int().min(0), truncated_instructions: z.number().int().min(0), diff --git a/tests/managedArtifactProvider.test.ts b/tests/managedArtifactProvider.test.ts index 9bb574c9e..de99d2c72 100644 --- a/tests/managedArtifactProvider.test.ts +++ b/tests/managedArtifactProvider.test.ts @@ -232,6 +232,53 @@ describe("managed PE/CLI static provider", () => { }); }); + it("keeps the documented decoded-CIL v1 golden vector stable", () => { + const il = Buffer.from([0x00, 0x2a]); + const tinyBytes = buildManagedPeFixture({ + ilBody: Buffer.from([0x0a, ...il]), + }); + const fatHeader = Buffer.alloc(12); + fatHeader.writeUInt16LE(0x3013, 0); + fatHeader.writeUInt16LE(32, 2); + fatHeader.writeUInt32LE(il.length, 4); + fatHeader.writeUInt32LE(0x1100_0001, 8); + const fatBytes = buildManagedPeFixture({ + ilBody: Buffer.concat([fatHeader, il]), + }); + const tiny = inspectManagedMembersBytes( + tinyBytes, + target(tinyBytes), + memberLimits, + ); + const fat = inspectManagedMembersBytes( + fatBytes, + target(fatBytes), + memberLimits, + ); + + expect(tiny.methods.items[0]?.body).toMatchObject({ + status: "present", + header_format: "tiny", + max_stack: 8, + init_locals: false, + local_var_sig_token: null, + il_size: 2, + il_sha256: createHash("sha256").update(il).digest("hex"), + normalized_il_sha256: + "5e5fad7741cb44bca3a4f045546b7449990da343f612f5f34c0ca30e9eee0636", + opcode_counts: { nop: 1, ret: 1 }, + exception_regions: [], + }); + expect(fat.methods.items[0]?.body).toMatchObject({ + header_format: "fat", + max_stack: 32, + init_locals: true, + local_var_sig_token: "0x11000001", + il_sha256: tiny.methods.items[0]?.body.il_sha256, + normalized_il_sha256: tiny.methods.items[0]?.body.normalized_il_sha256, + }); + }); + it("marks instruction-limited CIL as partial without assigning normalized identity", () => { const bytes = buildManagedPeFixture(); const result = inspectManagedMembersBytes(bytes, target(bytes), {