@jshookmcp/jshook 0.2.9 → 0.3.0

package/dist/{manifest-CAhOuvSl.mjs → manifest-D7YZM_2e.mjs}

@@ -1,11 +1,12 @@
-import { n as toolLookup } from "./registry-D-6e18lB.mjs";
-import { t as bindByDepKey } from "./bind-helpers-xFfRF-qm.mjs";
-import { t as tool } from "./tool-builder-DCbIC5Eo.mjs";
+import { n as toolLookup } from "./registry-Bl8ZQW61.mjs";
+import { n as defineMethodRegistrations } from "./bind-helpers-ClV34xdn.mjs";
+import { t as tool } from "./tool-builder-BHJp32mV.mjs";
 //#region src/server/domains/binary-instrument/definitions.ts
 const binaryInstrumentTools = [
-	tool("frida_attach", (t) => t.desc("Attach Frida to a local process, PID, or binary path and create a binary inst...").string("target", "Process name, PID, or binary path to attach to").required("target")),
+	tool("binary_instrument_capabilities", (t) => t.desc("Report binary instrumentation backend availability.").query()),
+	tool("frida_attach", (t) => t.desc("Attach Frida to a local target and open a session.").string("target", "Process name, PID, or binary path to attach to").required("target")),
 	tool("frida_enumerate_modules", (t) => t.desc("Enumerate modules for an attached Frida session.").string("sessionId", "Session id returned by frida_attach").required("sessionId").query()),
-	tool("ghidra_analyze", (t) => t.desc("Run binary metadata analysis with Ghidra headless when available, with struct...").number("timeout", "Optional timeout in milliseconds for headless analysis").required("binaryPath")),
+	tool("ghidra_analyze", (t) => t.desc("Analyze a binary and return metadata.").string("binaryPath", "Path to the binary file").number("timeout", "Optional timeout in milliseconds for headless analysis").required("binaryPath")),
 	tool("generate_hooks", (t) => t.desc("Generate a Frida interceptor script for a list of symbols.").array("symbols", { type: "string" }, "Symbol names to hook").object("options", {
 		includeArgs: {
 			type: "boolean",
@@ -16,16 +17,16 @@ const binaryInstrumentTools = [
 			description: "Emit return-address logging on function entry"
 		}
 	}, "Optional Frida hook generation flags").required("symbols")),
-	tool("unidbg_emulate", (t) => t.desc("Attempt to emulate a native function with unidbg, or return structured mock o...").string("functionName", "Function name to emulate").array("args", { type: "string" }, "Optional string arguments forwarded to emulation").required("binaryPath", "functionName")),
+	tool("unidbg_emulate", (t) => t.desc("Emulate a native function with Unidbg when available.").string("binaryPath", "Path to the binary file").string("functionName", "Function name to emulate").array("args", { type: "string" }, "Optional string arguments forwarded to emulation").required("binaryPath", "functionName")),
 	tool("frida_run_script", (t) => t.desc("Execute a Frida JavaScript snippet inside an attached Frida session.").string("sessionId", "Session id returned by frida_attach").string("script", "Frida JavaScript to execute").required("sessionId", "script")),
 	tool("frida_detach", (t) => t.desc("Detach from a Frida session and clean up resources.").string("sessionId", "Session id returned by frida_attach").required("sessionId")),
 	tool("frida_list_sessions", (t) => t.desc("List all active Frida sessions.").query()),
-	tool("frida_generate_script", (t) => t.desc("Generate a Frida interceptor script from templates (trace, intercept, replace, log).").string("target", "Target binary or module name").string("template", "Hook template type: trace, intercept, replace, log").string("functionName", "Function name to generate hook for").required("target", "template")),
-	tool("get_available_plugins", (t) => t.desc("List all available binary analysis plugins (frida, ghidra, ida, jadx).").query()),
+	tool("frida_generate_script", (t) => t.desc("Generate a Frida hook script from a template.").string("target", "Target binary or module name").string("template", "Hook template type: trace, intercept, replace, log").string("functionName", "Function name to generate hook for").required("target", "template")),
+	tool("get_available_plugins", (t) => t.desc("List installed binary analysis plugins.").query()),
 	tool("ghidra_decompile", (t) => t.desc("Decompile a specific function using Ghidra headless analysis.").string("binaryPath", "Path to the binary file").string("functionName", "Function name to decompile").required("binaryPath", "functionName")),
 	tool("ida_decompile", (t) => t.desc("Decompile a function using IDA Pro via plugin bridge.").string("binaryPath", "Path to the binary file").string("functionName", "Function name to decompile").required("binaryPath", "functionName")),
 	tool("jadx_decompile", (t) => t.desc("Decompile an APK class or method using JADX via plugin bridge.").string("apkPath", "Path to the APK file").string("className", "Fully qualified class name").string("methodName", "Method name to decompile").required("apkPath", "className")),
-	tool("unidbg_launch", (t) => t.desc("Launch an ARM/ARM64 .so library in the Unidbg emulator. First call ~3-5s warmup.").string("soPath", "Path to the .so library file").string("arch", "Architecture: arm or arm64").required("soPath")),
+	tool("unidbg_launch", (t) => t.desc("Launch a shared library in Unidbg.").string("soPath", "Path to the .so library file").string("arch", "Architecture: arm or arm64").required("soPath")),
 	tool("unidbg_call", (t) => t.desc("Call a JNI function in a running Unidbg emulator session.").string("sessionId", "Session id from unidbg_launch").string("functionName", "JNI function name to call").required("sessionId", "functionName")),
 	tool("unidbg_trace", (t) => t.desc("Get an execution trace from an Unidbg session (full/basic/instruction modes).").string("sessionId", "Session id from unidbg_launch").required("sessionId")),
 	tool("export_hook_script", (t) => t.desc("Export generated hook templates as a complete, runnable Frida script.").string("hookTemplates", "JSON array of hook template objects")),
@@ -36,122 +37,111 @@ const binaryInstrumentTools = [
 //#region src/server/domains/binary-instrument/manifest.ts
 const DOMAIN = "binary-instrument";
 const DEP_KEY = "binaryInstrumentHandlers";
-const toolByName = toolLookup(binaryInstrumentTools);
-const bind = (invoke) => bindByDepKey(DEP_KEY, invoke);
-async function ensure(ctx) {
-	const { BinaryInstrumentHandlers } = await import("./handlers-Cgyg6c0U.mjs");
-	const { GhidraAnalyzer, HookGenerator } = await import("./binary-instrument-CXfpx6fT.mjs").then((n) => n.t);
-	let handlers = ctx.getDomainInstance(DEP_KEY);
-	if (!handlers) {
-		handlers = new BinaryInstrumentHandlers(ctx, new GhidraAnalyzer(), new HookGenerator());
-		ctx.setDomainInstance(DEP_KEY, handlers);
-	}
-	return handlers;
-}
-const manifest = {
-	kind: "domain-manifest",
-	version: 1,
+const registrations = defineMethodRegistrations({
 	domain: DOMAIN,
 	depKey: DEP_KEY,
-	profiles: ["full"],
-	ensure,
-	registrations: [
+	lookup: toolLookup(binaryInstrumentTools),
+	entries: [
+		{
+			tool: "binary_instrument_capabilities",
+			method: "handleBinaryInstrumentCapabilities"
+		},
 		{
-			tool: toolByName("frida_attach"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaAttach(args))
+			tool: "frida_attach",
+			method: "handleFridaAttach"
 		},
 		{
-			tool: toolByName("frida_enumerate_modules"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaEnumerateModules(args))
+			tool: "frida_enumerate_modules",
+			method: "handleFridaEnumerateModules"
 		},
 		{
-			tool: toolByName("ghidra_analyze"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleGhidraAnalyze(args))
+			tool: "ghidra_analyze",
+			method: "handleGhidraAnalyze"
 		},
 		{
-			tool: toolByName("generate_hooks"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleGenerateHooks(args))
+			tool: "generate_hooks",
+			method: "handleGenerateHooks"
 		},
 		{
-			tool: toolByName("unidbg_emulate"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleUnidbgEmulate(args))
+			tool: "unidbg_emulate",
+			method: "handleUnidbgEmulate"
 		},
 		{
-			tool: toolByName("frida_run_script"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaRunScript(args))
+			tool: "frida_run_script",
+			method: "handleFridaRunScript"
 		},
 		{
-			tool: toolByName("frida_detach"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaDetach(args))
+			tool: "frida_detach",
+			method: "handleFridaDetach"
 		},
 		{
-			tool: toolByName("frida_list_sessions"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaListSessions(args))
+			tool: "frida_list_sessions",
+			method: "handleFridaListSessions"
 		},
 		{
-			tool: toolByName("frida_generate_script"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaGenerateScript(args))
+			tool: "frida_generate_script",
+			method: "handleFridaGenerateScript"
 		},
 		{
-			tool: toolByName("get_available_plugins"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleGetAvailablePlugins(args))
+			tool: "get_available_plugins",
+			method: "handleGetAvailablePlugins"
 		},
 		{
-			tool: toolByName("ghidra_decompile"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleGhidraDecompile(args))
+			tool: "ghidra_decompile",
+			method: "handleGhidraDecompile"
 		},
 		{
-			tool: toolByName("ida_decompile"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleIdaDecompile(args))
+			tool: "ida_decompile",
+			method: "handleIdaDecompile"
 		},
 		{
-			tool: toolByName("jadx_decompile"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleJadxDecompile(args))
+			tool: "jadx_decompile",
+			method: "handleJadxDecompile"
 		},
 		{
-			tool: toolByName("unidbg_launch"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleUnidbgLaunch(args))
+			tool: "unidbg_launch",
+			method: "handleUnidbgLaunch"
 		},
 		{
-			tool: toolByName("unidbg_call"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleUnidbgCall(args))
+			tool: "unidbg_call",
+			method: "handleUnidbgCall"
 		},
 		{
-			tool: toolByName("unidbg_trace"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleUnidbgTrace(args))
+			tool: "unidbg_trace",
+			method: "handleUnidbgTrace"
 		},
 		{
-			tool: toolByName("export_hook_script"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleExportHookScript(args))
+			tool: "export_hook_script",
+			method: "handleExportHookScript"
 		},
 		{
-			tool: toolByName("frida_enumerate_functions"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaEnumerateFunctions(args))
+			tool: "frida_enumerate_functions",
+			method: "handleFridaEnumerateFunctions"
 		},
 		{
-			tool: toolByName("frida_find_symbols"),
-			domain: DOMAIN,
-			bind: bind((handlers, args) => handlers.handleFridaFindSymbols(args))
+			tool: "frida_find_symbols",
+			method: "handleFridaFindSymbols"
 		}
-	],
+	]
+});
+async function ensure(ctx) {
+	const { BinaryInstrumentHandlers } = await import("./handlers-CRyRWj2b.mjs");
+	const { GhidraAnalyzer, HookGenerator } = await import("./binary-instrument--V3MAhJ4.mjs").then((n) => n.t);
+	let handlers = ctx.getDomainInstance(DEP_KEY);
+	if (!handlers) {
+		handlers = new BinaryInstrumentHandlers(ctx, new GhidraAnalyzer(), new HookGenerator());
+		ctx.setDomainInstance(DEP_KEY, handlers);
+	}
+	return handlers;
+}
+const manifest = {
+	kind: "domain-manifest",
+	version: 1,
+	domain: DOMAIN,
+	depKey: DEP_KEY,
+	profiles: ["full"],
+	ensure,
+	registrations,
 	workflowRule: {
 		patterns: [/\b(frida|ghidra|ida|unidbg|jadx|binary|disassemb|decompil|dump\s?so)\b/i, /(binary|native|so|dll|elf|apk).*(analyze|hook|instrument|decompile)/i],
 		priority: 88,

package/dist/{manifest-DCyjf4n2.mjs → manifest-DE_VrAeQ.mjs}

@@ -1,7 +1,7 @@
 import { t as logger } from "./logger-Dh_xb7_2.mjs";
-import { t as createProgressDebouncer } from "./EventBus-DgPmwpeu.mjs";
-import { n as toolLookup, t as ensureBrowserCore } from "./registry-D-6e18lB.mjs";
-import { t as coreTools } from "./definitions-C1UvM5Iy.mjs";
+import { t as createProgressDebouncer } from "./EventBus-DFKvADm3.mjs";
+import { n as toolLookup, t as ensureBrowserCore } from "./registry-Bl8ZQW61.mjs";
+import { t as coreTools } from "./definitions-CDOg_b-l.mjs";
 //#region src/modules/deobfuscator/LLMDeobfuscator.ts
 /** Maximum code snippet size sent to the LLM (chars) to avoid token overflow */
 const MAX_CODE_SNIPPET = 2e3;
@@ -117,9 +117,9 @@ function bindWithProgress(invoke) {
 	return (deps) => {
 		const handler = deps[DEP_KEY];
 		return (args) => {
-			const _meta = args._meta;
+			const meta = args._meta;
 			let onProgress;
-			if (_meta?.progressToken !== void 0 && globalContext) onProgress = createProgressDebouncer(globalContext.eventBus, _meta.progressToken);
+			if (meta?.progressToken !== void 0 && globalContext) onProgress = createProgressDebouncer(globalContext.eventBus, meta.progressToken);
 			return invoke(handler, {
 				...args,
 				onProgress
@@ -129,8 +129,8 @@ function bindWithProgress(invoke) {
 }
 const b = bindWithProgress;
 async function ensure(ctx) {
-	const { Deobfuscator, AdvancedDeobfuscator, ObfuscationDetector, CodeAnalyzer, CryptoDetector, HookManager } = await import("./modules-C184v-S9.mjs").then((n) => n.t);
-	const { CoreAnalysisHandlers } = await import("./analysis-CL9uACt9.mjs");
+	const { Deobfuscator, AdvancedDeobfuscator, ObfuscationDetector, CodeAnalyzer, CryptoDetector, HookManager } = await import("./modules-tZozf0LQ.mjs").then((n) => n.t);
+	const { CoreAnalysisHandlers } = await import("./analysis-BHeJW2Nb.mjs");
 	globalContext = ctx;
 	await ensureBrowserCore(ctx);
 	if (!ctx.deobfuscator || !ctx.advancedDeobfuscator || !ctx.obfuscationDetector || !ctx.analyzer || !ctx.cryptoDetector || !ctx.hookManager || !ctx.coreAnalysisHandlers) {
@@ -287,6 +287,26 @@ const manifest = {
 					})
 				}] };
 			})
+		},
+		{
+			tool: t("js_deobfuscate_jsvmp"),
+			domain: DOMAIN,
+			bind: b((h, a) => h.handleJsDeobfuscateJsvmp(a))
+		},
+		{
+			tool: t("js_deobfuscate_pipeline"),
+			domain: DOMAIN,
+			bind: b((h, a) => h.handleJsDeobfuscatePipeline(a))
+		},
+		{
+			tool: t("js_analyze_vm"),
+			domain: DOMAIN,
+			bind: b((h, a) => h.handleJsAnalyzeVm(a))
+		},
+		{
+			tool: t("js_solve_constraints"),
+			domain: DOMAIN,
+			bind: b((h, a) => h.handleJsSolveConstraints(a))
 		}
 	]
 };

package/dist/manifest-DGsXSCpT.mjs

@@ -0,0 +1,39 @@
+import { n as toolLookup } from "./registry-Bl8ZQW61.mjs";
+import { n as defineMethodRegistrations } from "./bind-helpers-ClV34xdn.mjs";
+import { t as antidebugTools } from "./definitions-DUE5gmdn.mjs";
+//#region src/server/domains/antidebug/manifest.ts
+const DOMAIN = "antidebug";
+const DEP_KEY = "antidebugHandlers";
+const registrations = defineMethodRegistrations({
+	domain: DOMAIN,
+	depKey: DEP_KEY,
+	lookup: toolLookup(antidebugTools),
+	entries: [{
+		tool: "antidebug_bypass",
+		method: "handleAntidebugBypass"
+	}, {
+		tool: "antidebug_detect_protections",
+		method: "handleAntiDebugDetectProtections"
+	}]
+});
+async function ensure(ctx) {
+	const { CodeCollector } = await import("./modules-tZozf0LQ.mjs").then((n) => n.t);
+	const { AntiDebugToolHandlers } = await import("./antidebug-BRKeyt27.mjs");
+	if (!ctx.collector) {
+		ctx.collector = new CodeCollector(ctx.config.puppeteer);
+		ctx.registerCaches();
+	}
+	if (!ctx.antidebugHandlers) ctx.antidebugHandlers = new AntiDebugToolHandlers(ctx.collector);
+	return ctx.antidebugHandlers;
+}
+const manifest = {
+	kind: "domain-manifest",
+	version: 1,
+	domain: DOMAIN,
+	depKey: DEP_KEY,
+	profiles: ["full"],
+	ensure,
+	registrations
+};
+//#endregion
+export { manifest as default };

package/dist/{manifest-BB2J8IMJ.mjs → manifest-DJ2vfEuW.mjs}

@@ -1,6 +1,6 @@
-import { n as toolLookup } from "./registry-D-6e18lB.mjs";
-import { t as bindByDepKey } from "./bind-helpers-xFfRF-qm.mjs";
-import { t as tool } from "./tool-builder-DCbIC5Eo.mjs";
+import { n as toolLookup } from "./registry-Bl8ZQW61.mjs";
+import { n as defineMethodRegistrations } from "./bind-helpers-ClV34xdn.mjs";
+import { t as tool } from "./tool-builder-BHJp32mV.mjs";
 //#region src/server/domains/syscall-hook/definitions.ts
 const BACKEND_OPTIONS = [
 	"etw",
@@ -12,7 +12,7 @@ const SYSCALL_EVENT_SCHEMA = {
 	properties: {
 		timestamp: {
 			type: "number",
-			description: "Unix timestamp in milliseconds"
+			description: "Relative elapsed time in milliseconds since bpftrace start"
 		},
 		pid: {
 			type: "number",
@@ -44,7 +44,7 @@ const SYSCALL_EVENT_SCHEMA = {
 	]
 };
 const syscallHookToolDefinitions = [
-	tool("syscall_start_monitor", (t) => t.desc("Start syscall monitoring using ETW, strace, or dtrace.").enum("backend", BACKEND_OPTIONS, "Syscall capture backend").number("pid", "Optional PID to scope monitoring to a single process").required("backend")),
+	tool("syscall_start_monitor", (t) => t.desc("Start syscall monitoring using ETW, strace, or dtrace.").enum("backend", BACKEND_OPTIONS, "Syscall capture backend").number("pid", "Optional PID to scope monitoring to a single process").boolean("simulate", "Use synthetic events instead of a real system tracer", { default: false }).required("backend")),
 	tool("syscall_stop_monitor", (t) => t.desc("Stop syscall monitoring.").idempotent()),
 	tool("syscall_capture_events", (t) => t.desc("Capture syscall events from the active or last monitoring session.").prop("filter", {
 		type: "object",
@@ -63,61 +63,68 @@ const syscallHookToolDefinitions = [
 	}).query()),
 	tool("syscall_correlate_js", (t) => t.desc("Correlate captured syscalls with likely JavaScript functions.").array("syscallEvents", SYSCALL_EVENT_SCHEMA, "Syscall events to correlate").required("syscallEvents").query()),
 	tool("syscall_filter", (t) => t.desc("Filter captured syscall events by syscall name.").array("names", { type: "string" }, "Syscall names to keep").query()),
-	tool("syscall_get_stats", (t) => t.desc("Get syscall monitoring statistics.").query())
+	tool("syscall_get_stats", (t) => t.desc("Get syscall monitoring statistics.").query()),
+	tool("syscall_ebpf_trace", (t) => t.desc("Trace syscalls via Linux eBPF/bpftrace. Requires root or CAP_BPF.").number("pid", "Process ID to trace. 0 = trace all.", { default: 0 }).array("syscalls", { type: "string" }, "Specific syscall names to trace (empty = all)").number("durationSec", "Trace duration in seconds", {
+		default: 10,
+		minimum: 1,
+		maximum: 300
+	}).boolean("simulate", "Use synthetic events when bpftrace is unavailable", { default: false }).query())
 ];
 //#endregion
 //#region src/server/domains/syscall-hook/manifest.ts
 const DOMAIN = "syscall-hook";
 const DEP_KEY = "syscallHookHandlers";
-const lookupTool = toolLookup(syscallHookToolDefinitions);
-const bindTool = (invoke) => bindByDepKey(DEP_KEY, invoke);
-async function ensure(ctx) {
-	const { SyscallHookHandlers } = await import("./handlers-C67ktuRN.mjs");
-	const existing = ctx.getDomainInstance(DEP_KEY);
-	if (existing) return existing;
-	const handlers = new SyscallHookHandlers(void 0, void 0, ctx.eventBus);
-	ctx.setDomainInstance(DEP_KEY, handlers);
-	return handlers;
-}
-const manifest = {
-	kind: "domain-manifest",
-	version: 1,
+const registrations = defineMethodRegistrations({
 	domain: DOMAIN,
 	depKey: DEP_KEY,
-	profiles: ["full"],
-	ensure,
-	registrations: [
+	lookup: toolLookup(syscallHookToolDefinitions),
+	entries: [
 		{
-			tool: lookupTool("syscall_start_monitor"),
-			domain: DOMAIN,
-			bind: bindTool((handlers, args) => handlers.handleSyscallStartMonitor(args))
+			tool: "syscall_start_monitor",
+			method: "handleSyscallStartMonitor"
 		},
 		{
-			tool: lookupTool("syscall_stop_monitor"),
-			domain: DOMAIN,
-			bind: bindTool((handlers) => handlers.handleSyscallStopMonitor())
+			tool: "syscall_stop_monitor",
+			method: "handleSyscallStopMonitor"
 		},
 		{
-			tool: lookupTool("syscall_capture_events"),
-			domain: DOMAIN,
-			bind: bindTool((handlers, args) => handlers.handleSyscallCaptureEvents(args))
+			tool: "syscall_capture_events",
+			method: "handleSyscallCaptureEvents"
 		},
 		{
-			tool: lookupTool("syscall_correlate_js"),
-			domain: DOMAIN,
-			bind: bindTool((handlers, args) => handlers.handleSyscallCorrelateJs(args))
+			tool: "syscall_correlate_js",
+			method: "handleSyscallCorrelateJs"
 		},
 		{
-			tool: lookupTool("syscall_filter"),
-			domain: DOMAIN,
-			bind: bindTool((handlers, args) => handlers.handleSyscallFilter(args))
+			tool: "syscall_filter",
+			method: "handleSyscallFilter"
 		},
 		{
-			tool: lookupTool("syscall_get_stats"),
-			domain: DOMAIN,
-			bind: bindTool((handlers) => handlers.handleSyscallGetStats())
+			tool: "syscall_get_stats",
+			method: "handleSyscallGetStats"
+		},
+		{
+			tool: "syscall_ebpf_trace",
+			method: "handleSyscallEbpfTrace"
 		}
-	],
+	]
+});
+async function ensure(ctx) {
+	const { SyscallHookHandlers } = await import("./handlers-4jmR0nMs.mjs");
+	const existing = ctx.getDomainInstance(DEP_KEY);
+	if (existing) return existing;
+	const handlers = new SyscallHookHandlers(void 0, void 0, ctx.eventBus);
+	ctx.setDomainInstance(DEP_KEY, handlers);
+	return handlers;
+}
+const manifest = {
+	kind: "domain-manifest",
+	version: 1,
+	domain: DOMAIN,
+	depKey: DEP_KEY,
+	profiles: ["full"],
+	ensure,
+	registrations,
 	workflowRule: {
 		patterns: [/\b(syscall|etw|strace|dtrace|kernel|system\s?call)\b/i, /(syscall|kernel).*(trace|monitor|capture|filter)/i],
 		priority: 78,

package/dist/{manifest-3g71z6Bg.mjs → manifest-DPXDYhEu.mjs}

@@ -1,6 +1,6 @@
-import { n as toolLookup } from "./registry-D-6e18lB.mjs";
-import { t as bindByDepKey } from "./bind-helpers-xFfRF-qm.mjs";
-import { t as tool } from "./tool-builder-DCbIC5Eo.mjs";
+import { n as toolLookup } from "./registry-Bl8ZQW61.mjs";
+import { n as defineMethodRegistrations } from "./bind-helpers-ClV34xdn.mjs";
+import { t as tool } from "./tool-builder-BHJp32mV.mjs";
 import { resolve } from "node:path";
 //#region src/server/domains/evidence/definitions.ts
 const evidenceTools = [
@@ -16,12 +16,29 @@ const evidenceTools = [
 //#region src/server/domains/evidence/manifest.ts
 const DOMAIN = "evidence";
 const DEP_KEY = "evidenceHandlers";
-const t = toolLookup(evidenceTools);
-const b = (invoke) => bindByDepKey(DEP_KEY, invoke);
+const registrations = defineMethodRegistrations({
+	domain: DOMAIN,
+	depKey: DEP_KEY,
+	lookup: toolLookup(evidenceTools),
+	entries: [
+		{
+			tool: "evidence_query",
+			method: "handleQueryDispatch"
+		},
+		{
+			tool: "evidence_export",
+			method: "handleExportDispatch"
+		},
+		{
+			tool: "evidence_chain",
+			method: "handleChain"
+		}
+	]
+});
 async function ensure(ctx) {
-	const { ReverseEvidenceGraph } = await import("./ReverseEvidenceGraph-Dlsk94LC.mjs").then((n) => n.t);
-	const { EvidenceGraphBridge } = await import("./EvidenceGraphBridge-SFesNera.mjs");
-	const { EvidenceHandlers } = await import("./handlers-tB9Mp9ZK.mjs");
+	const { ReverseEvidenceGraph } = await import("./ReverseEvidenceGraph-C02-gXOh.mjs").then((n) => n.t);
+	const { EvidenceGraphBridge } = await import("./EvidenceGraphBridge-318Oi0Lf.mjs");
+	const { EvidenceHandlers } = await import("./handlers-Bndn6QvE.mjs");
 	let graph = ctx.getDomainInstance("evidenceGraph");
 	if (!graph) {
 		graph = new ReverseEvidenceGraph();
@@ -57,23 +74,7 @@ const manifest = {
 		tools: ["evidence_query", "evidence_export"],
 		hint: "Evidence graph: query by URL/function/scriptId → get provenance chain → export as JSON or Markdown report"
 	},
-	registrations: [
-		{
-			tool: t("evidence_query"),
-			domain: DOMAIN,
-			bind: b(async (h, a) => h.handleQueryDispatch(a))
-		},
-		{
-			tool: t("evidence_export"),
-			domain: DOMAIN,
-			bind: b(async (h, a) => h.handleExportDispatch(a))
-		},
-		{
-			tool: t("evidence_chain"),
-			domain: DOMAIN,
-			bind: b(async (h, a) => h.handleChain(a))
-		}
-	]
+	registrations
 };
 //#endregion
 export { manifest as default };