@jshookmcp/jshook 0.3.2 → 0.3.4

package/dist/handlers-KY0g31ny.mjs

@@ -0,0 +1,9 @@
+import{$t as e,Jt as t,Qt as n,Xt as r,Yt as i,Zt as a,en as o,nn as s,qt as c,tn as l}from"./constants-nvsLpSri.mjs";import{t as u}from"./DetailedDataManager-Dgh402Gp.mjs";import{n as d}from"./response-R8ghbZSb.mjs";import{c as f,l as p,s as m,u as h}from"./parse-args-B6dwWc9k.mjs";import{r as g}from"./ResponseBuilder-BLicSCjn.mjs";import{dirname as _}from"node:path";import{mkdir as v,readFile as y,writeFile as b}from"node:fs/promises";import{isIP as x}from"node:net";function S(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function ee(e,t){if(!S(e))throw Error(`fields[${t}] must be an object`);let n=e.name,r=e.offset,i=e.length,a=e.type;if(typeof n!=`string`||n.trim().length===0)throw Error(`fields[${t}].name must be a non-empty string`);if(typeof r!=`number`||!Number.isInteger(r)||r<0)throw Error(`fields[${t}].offset must be a non-negative integer`);if(typeof i!=`number`||!Number.isInteger(i)||i<=0)throw Error(`fields[${t}].length must be a positive integer`);if(a!==`int`&&a!==`string`&&a!==`bytes`&&a!==`bool`&&a!==`float`)throw Error(`fields[${t}].type is invalid`);return{name:n,offset:r,length:i,type:a}}function C(e,t){if(!S(e))throw Error(`fields[${t}] must be an object`);let n=e.name,r=e.offset,i=e.length,a=e.type,o=e.description;if(typeof n!=`string`||n.trim().length===0)throw Error(`fields[${t}].name must be a non-empty string`);if(typeof r!=`number`||!Number.isInteger(r)||r<0)throw Error(`fields[${t}].offset must be a non-negative integer`);if(typeof i!=`number`||!Number.isInteger(i)||i<=0)throw Error(`fields[${t}].length must be a positive integer`);if(a!==`uint8`&&a!==`uint16`&&a!==`uint32`&&a!==`int64`&&a!==`float`&&a!==`string`&&a!==`bytes`)throw Error(`fields[${t}].type is invalid`);return{name:n,offset:r,length:i,type:a,...typeof o==`string`?{description:o}:{}}}function w(e,t){let n=t.fields;if(!Array.isArray(n))throw Error(`spec.fields must be an array`);let r=typeof t.fieldDelimiter==`string`&&t.fieldDelimiter.length>0?t.fieldDelimiter:void 0,i=t.byteOrder,a=i===`le`||i===`be`?i:void 0;return{name:e,...r?{fieldDelimiter:r}:{},...a?{byteOrder:a}:{},fields:n.map((e,t)=>ee(e,t))}}function te(e){if(!S(e))return;let t=e.type;if(t!==`aes`&&t!==`xor`&&t!==`rc4`&&t!==`custom`)return;let n=typeof e.key==`string`?e.key:void 0,r=typeof e.iv==`string`?e.iv:void 0,i=typeof e.notes==`string`?e.notes:void 0;return{type:t,...n?{key:n}:{},...r?{iv:r}:{},...i?{notes:i}:{}}}function ne(e,t){if(!S(e))throw Error(`messages[${t}] must be an object`);let n=e.direction,r=e.timestamp,i=e.fields,a=e.raw;if(n!==`req`&&n!==`res`)throw Error(`messages[${t}].direction must be "req" or "res"`);if(typeof r!=`number`||!Number.isFinite(r))throw Error(`messages[${t}].timestamp must be a number`);if(!S(i))throw Error(`messages[${t}].fields must be an object`);if(typeof a!=`string`)throw Error(`messages[${t}].raw must be a string`);return{direction:n,timestamp:r,fields:i,raw:a}}const re=[`utf8`,`ascii`],T=[`utf8`,`ascii`,`hex`,`base64`],ie=[`u8`,`u16`,`u32`,`i8`,`i16`,`i32`,`string`,`bytes`],ae=[`set_byte`,`flip_bit`,`overwrite_bytes`,`append_bytes`,`truncate`,`increment_integer`];function oe(e,t=`big`){return e===`little`?`little`:t}function E(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0)throw Error(`${t} must be a non-negative integer`);return e}function D(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<=0)throw Error(`${t} must be a positive integer`);return e}function O(e,t){if(typeof e!=`number`||!Number.isInteger(e))throw Error(`${t} must be an integer`);return e}function k(e,t){let n=O(e,t);if(n<0||n>255)throw Error(`${t} must be between 0 and 255`);return n}function se(e,t){return e===void 0?void 0:D(e,t)}function A(e,t,n,r){if(e===void 0)return n;if(typeof e!=`string`||!t.includes(e))throw Error(`${r} is invalid`);return e}function ce(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);return e}function j(e,t){let n=e.replace(/^0x/i,``).replace(/\s+/g,``);if(n.length===0)return n;if(n.length%2!=0||/[^0-9a-f]/i.test(n))throw Error(`${t} must be a valid even-length hex string`);return n.toLowerCase()}function le(e,t,n){switch(t){case`utf8`:case`ascii`:return Buffer.from(e,t);case`hex`:return Buffer.from(j(e,n),`hex`);case`base64`:return Buffer.from(e,`base64`)}}function ue(e,t){let n=e*8;return t?{min:-(2**(n-1)),max:2**(n-1)-1}:{min:0,max:2**n-1}}function de(e){switch(e){case`u8`:return{width:1,signed:!1};case`u16`:return{width:2,signed:!1};case`u32`:return{width:4,signed:!1};case`i8`:return{width:1,signed:!0};case`i16`:return{width:2,signed:!0};case`i32`:return{width:4,signed:!0};default:return null}}function fe(e,t,n,r,i){if(r)switch(n){case 1:e.writeInt8(t,0);return;case 2:i===`little`?e.writeInt16LE(t,0):e.writeInt16BE(t,0);return;case 4:i===`little`?e.writeInt32LE(t,0):e.writeInt32BE(t,0);return}switch(n){case 1:e.writeUInt8(t,0);return;case 2:i===`little`?e.writeUInt16LE(t,0):e.writeUInt16BE(t,0);return;case 4:i===`little`?e.writeUInt32LE(t,0):e.writeUInt32BE(t,0);return}}function pe(e,t,n,r,i){if(r)switch(n){case 1:return e.readInt8(t);case 2:return i===`little`?e.readInt16LE(t):e.readInt16BE(t);case 4:return i===`little`?e.readInt32LE(t):e.readInt32BE(t)}switch(n){case 1:return e.readUInt8(t);case 2:return i===`little`?e.readUInt16LE(t):e.readUInt16BE(t);case 4:return i===`little`?e.readUInt32LE(t):e.readUInt32BE(t)}}function me(e,t,n){return t===void 0||e.length===t?e:e.length>t?e.subarray(0,t):Buffer.concat([e,Buffer.alloc(t-e.length,n)])}function he(e,t){if(!S(e))throw Error(`fields[${t}] must be an object`);let n=e.name,r=e.type,i=e.value;if(typeof n!=`string`||n.trim().length===0)throw Error(`fields[${t}].name must be a non-empty string`);if(typeof r!=`string`||!ie.includes(r))throw Error(`fields[${t}].type is invalid`);let a=r,o=de(a);if(o){let s=O(i,`fields[${t}].value`),c=ue(o.width,o.signed);if(s<c.min||s>c.max)throw Error(`fields[${t}].value is out of range for ${r} (${c.min}..${c.max})`);if(e.length!==void 0||e.padByte!==void 0||e.encoding!==void 0)throw Error(`fields[${t}] does not support length, padByte, or encoding`);return{name:n,type:a,value:s}}let s=ce(i,`fields[${t}].value`),c=se(e.length,`fields[${t}].length`),l=e.padByte===void 0?0:k(e.padByte,`fields[${t}].padByte`);return r===`string`?{name:n,type:`string`,value:s,encoding:A(e.encoding,re,`utf8`,`fields[${t}].encoding`),...c===void 0?{}:{length:c},padByte:l}:{name:n,type:`bytes`,value:s,encoding:A(e.encoding,T,`hex`,`fields[${t}].encoding`),...c===void 0?{}:{length:c},padByte:l}}function ge(e,t){switch(e.type){case`u8`:case`u16`:case`u32`:case`i8`:case`i16`:case`i32`:{let n=de(e.type);if(!n)throw Error(`Unsupported numeric field type: ${e.type}`);let r=Buffer.alloc(n.width);return fe(r,e.value,n.width,n.signed,t),r}case`string`:return me(Buffer.from(e.value,e.encoding),e.length,e.padByte);case`bytes`:return me(le(e.value,e.encoding,`field ${e.name}`),e.length,e.padByte)}}function _e(e,t){let n=[],r=[],i=0;for(let a of e){let e=ge(a,t);n.push(e),r.push({name:a.name,offset:i,length:e.length,hex:e.toString(`hex`)}),i+=e.length}return{payload:Buffer.concat(n),segments:r}}function ve(e,t){if(!S(e))throw Error(`mutations[${t}] must be an object`);let n=e.strategy;if(typeof n!=`string`||!ae.includes(n))throw Error(`mutations[${t}].strategy is invalid`);switch(n){case`set_byte`:return{strategy:`set_byte`,offset:E(e.offset,`mutations[${t}].offset`),value:k(e.value,`mutations[${t}].value`)};case`flip_bit`:return{strategy:`flip_bit`,offset:E(e.offset,`mutations[${t}].offset`),bit:(()=>{let n=O(e.bit,`mutations[${t}].bit`);if(n<0||n>7)throw Error(`mutations[${t}].bit must be between 0 and 7`);return n})()};case`overwrite_bytes`:return{strategy:`overwrite_bytes`,offset:E(e.offset,`mutations[${t}].offset`),data:le(ce(e.data,`mutations[${t}].data`),A(e.encoding,T,`hex`,`mutations[${t}].encoding`),`mutations[${t}].data`)};case`append_bytes`:return{strategy:`append_bytes`,data:le(ce(e.data,`mutations[${t}].data`),A(e.encoding,T,`hex`,`mutations[${t}].encoding`),`mutations[${t}].data`)};case`truncate`:return{strategy:`truncate`,length:E(e.length,`mutations[${t}].length`)};case`increment_integer`:{let n=e.width;if(n!==1&&n!==2&&n!==4)throw Error(`mutations[${t}].width must be 1, 2, or 4`);return{strategy:`increment_integer`,offset:E(e.offset,`mutations[${t}].offset`),width:n,delta:O(e.delta,`mutations[${t}].delta`),endian:oe(e.endian),signed:e.signed===!0}}}}function ye(e,t,n){let r=Buffer.from(e);switch(t.strategy){case`set_byte`:if(t.offset>=r.length)throw Error(`mutations[${n}] offset is outside the payload`);return r[t.offset]=t.value,{payload:r,summary:{index:n,strategy:t.strategy,detail:`set payload[${t.offset}] to ${t.value}`}};case`flip_bit`:if(t.offset>=r.length)throw Error(`mutations[${n}] offset is outside the payload`);{let e=r[t.offset];r[t.offset]=e^1<<t.bit}return{payload:r,summary:{index:n,strategy:t.strategy,detail:`flipped bit ${t.bit} at offset ${t.offset}`}};case`overwrite_bytes`:if(t.offset+t.data.length>r.length)throw Error(`mutations[${n}] overwrite exceeds payload length`);return t.data.copy(r,t.offset),{payload:r,summary:{index:n,strategy:t.strategy,detail:`overwrote ${t.data.length} bytes at offset ${t.offset}`}};case`append_bytes`:return{payload:Buffer.concat([r,t.data]),summary:{index:n,strategy:t.strategy,detail:`appended ${t.data.length} bytes`}};case`truncate`:if(t.length>r.length)throw Error(`mutations[${n}] length exceeds payload size`);return{payload:r.subarray(0,t.length),summary:{index:n,strategy:t.strategy,detail:`truncated payload to ${t.length} bytes`}};case`increment_integer`:{if(t.offset+t.width>r.length)throw Error(`mutations[${n}] integer range exceeds payload length`);let e=pe(r,t.offset,t.width,t.signed,t.endian)+t.delta,i=ue(t.width,t.signed);if(e<i.min||e>i.max)throw Error(`mutations[${n}] integer overflow (${i.min}..${i.max})`);return fe(r.subarray(t.offset,t.offset+t.width),e,t.width,t.signed,t.endian),{payload:r,summary:{index:n,strategy:t.strategy,detail:`incremented ${t.signed?`signed`:`unsigned`} ${t.width}-byte integer at offset ${t.offset} by ${t.delta}`}}}}}const be=Object.freeze({arp:2054,ipv4:2048,ipv6:34525,vlan:33024}),xe=Object.freeze({icmp:1,igmp:2,tcp:6,udp:17,gre:47,esp:50,ah:51,icmpv6:58,ospf:89}),Se=Object.freeze({loopback:0,ethernet:1,raw:101});function Ce(e,t,n,r){if(typeof e==`number`){if(!Number.isInteger(e)||e<0||e>r)throw Error(`${t} must be an integer between 0 and ${r}`);return e}if(typeof e!=`string`||e.trim().length===0)throw Error(`${t} must be a non-empty string or integer`);let i=e.trim().toLowerCase(),a=n[i];if(a!==void 0)return a;if(/^\d+$/.test(i)){let e=Number.parseInt(i,10);if(e>r)throw Error(`${t} must be less than or equal to ${r}`);return e}let o=j(i,t),s=Number.parseInt(o,16);if(s>r)throw Error(`${t} must be less than or equal to ${r}`);return s}function M(e,t){if(typeof e!=`string`||e.trim().length===0)throw Error(`${t} must be a non-empty MAC address string`);let n=e.trim().toLowerCase().replace(/^0x/,``).replace(/[:\-.\s]/g,``);if(!/^[0-9a-f]{12}$/i.test(n))throw Error(`${t} must be a valid 6-byte MAC address`);let r=n.match(/.{2}/g)?.join(`:`);if(!r)throw Error(`${t} must be a valid 6-byte MAC address`);return{canonical:r,bytes:Buffer.from(n,`hex`)}}function N(e,t){if(typeof e!=`string`||x(e.trim())!==4)throw Error(`${t} must be a valid IPv4 address`);let n=e.trim().split(`.`).map(e=>Number.parseInt(e,10));return Buffer.from(n)}function we(e,t){return e.length===0?[]:e.split(`:`).flatMap(e=>{if(e.length===0)return[];if(e.includes(`.`)){let n=N(e,t);return[n.readUInt16BE(0).toString(16),n.readUInt16BE(2).toString(16)]}if(!/^[0-9a-f]{1,4}$/i.test(e))throw Error(`${t} contains an invalid IPv6 group`);return[e]})}function Te(e,t){if(typeof e!=`string`)throw Error(`${t} must be a valid IPv6 address`);let n=e.trim().toLowerCase().split(`%`)[0]??``;if(x(n)!==6)throw Error(`${t} must be a valid IPv6 address`);let r=n.split(`::`);if(r.length>2)throw Error(`${t} must be a valid IPv6 address`);let i=we(r[0]??``,t),a=we(r[1]??``,t),o=r.length===2?[...i,...Array.from({length:8-i.length-a.length},()=>`0`),...a]:i;if(o.length!==8)throw Error(`${t} must expand to exactly 8 IPv6 groups`);let s=Buffer.alloc(16);for(let[e,t]of o.entries())s.writeUInt16BE(Number.parseInt(t,16),e*2);return s}function P(e,t,n){return t===`ipv4`?N(e,n):Te(e,n)}function Ee(e,t){return Ce(e,t,be,65535)}function De(e,t){return Ce(e,t,xe,255)}function Oe(e,t){return Ce(e,t,Se,4294967295)}function ke(e){return e===`little`?`little`:`big`}function Ae(e){return e===`big`?`big`:`little`}function je(e){return e===`nano`?`nano`:`micro`}function F(e,t){if(typeof e!=`string`)throw Error(`${t} must be a hex string`);return Buffer.from(j(e,t),`hex`)}function I(e){let t=0;for(let n=0;n<e.length;n+=2){let r=e[n]??0,i=e[n+1]??0;for(t+=r<<8|i;t>65535;)t=(t&65535)+(t>>>16)}return~t&65535}function Me(e,t,n,r){let i=Buffer.alloc(14);return e.bytes.copy(i,0),t.bytes.copy(i,6),i.writeUInt16BE(n,12),Buffer.concat([i,r])}function Ne(e){if(e.hardwareSize!==e.senderMac.bytes.length||e.hardwareSize!==e.targetMac.bytes.length)throw Error(`hardwareSize must match the provided MAC address lengths`);if(e.protocolSize!==e.senderIp.length||e.protocolSize!==e.targetIp.length)throw Error(`protocolSize must match the provided IP address lengths`);let t=Buffer.alloc(8+e.hardwareSize*2+e.protocolSize*2),n=0;return t.writeUInt16BE(e.hardwareType,n),n+=2,t.writeUInt16BE(e.protocolType,n),n+=2,t.writeUInt8(e.hardwareSize,n++),t.writeUInt8(e.protocolSize,n++),t.writeUInt16BE(e.operation===`reply`?2:1,n),n+=2,e.senderMac.bytes.copy(t,n),n+=e.hardwareSize,e.senderIp.copy(t,n),n+=e.protocolSize,e.targetMac.bytes.copy(t,n),n+=e.hardwareSize,e.targetIp.copy(t,n),t}function Pe(e){let t=Buffer.alloc(20);t[0]=69,t[1]=(e.dscp&63)<<2|e.ecn&3,t.writeUInt16BE(t.length+e.payload.length,2),t.writeUInt16BE(e.identification,4);let n=!!e.dontFragment<<1|!!e.moreFragments;t.writeUInt16BE((n&7)<<13|e.fragmentOffset&8191,6),t[8]=e.ttl,t[9]=e.protocol,t.writeUInt16BE(0,10),e.sourceIp.copy(t,12),e.destinationIp.copy(t,16);let r=I(t);return t.writeUInt16BE(r,10),{packet:Buffer.concat([t,e.payload]),checksum:r}}function Fe(e){let t=Buffer.alloc(40),n=6<<28|(((e.dscp&63)<<2|e.ecn&3)&255)<<20|e.flowLabel&1048575;return t.writeUInt32BE(n>>>0,0),t.writeUInt16BE(e.payload.length,4),t.writeUInt8(e.protocol,6),t.writeUInt8(e.hopLimit,7),e.sourceIp.copy(t,8),e.destinationIp.copy(t,24),Buffer.concat([t,e.payload])}function Ie(e){let t=Buffer.alloc(8+e.payload.length);t[0]=e.operation===`reply`?0:8,t[1]=0,t.writeUInt16BE(0,2),t.writeUInt16BE(e.identifier,4),t.writeUInt16BE(e.sequenceNumber,6),e.payload.copy(t,8);let n=I(t);return t.writeUInt16BE(n,2),{packet:t,checksum:n}}function L(e,t,n,r){r===`little`?e.writeUInt32LE(n,t):e.writeUInt32BE(n,t)}function Le(e,t,n,r){r===`little`?e.writeUInt16LE(n,t):e.writeUInt16BE(n,t)}function R(e,t,n){return n===`little`?e.readUInt32LE(t):e.readUInt32BE(t)}function Re(e,t,n){return n===`little`?e.readUInt16LE(t):e.readUInt16BE(t)}function ze(e,t){let n=e===`little`?t===`nano`?`4d3cb2a1`:`d4c3b2a1`:t===`nano`?`a1b23c4d`:`a1b2c3d4`;return Buffer.from(n,`hex`)}function Be(e){if(e.length<24)throw Error(`PCAP file is too small to contain a global header`);let t=e.subarray(0,4).toString(`hex`),n,r;switch(t){case`d4c3b2a1`:n=`little`,r=`micro`;break;case`4d3cb2a1`:n=`little`,r=`nano`;break;case`a1b2c3d4`:n=`big`,r=`micro`;break;case`a1b23c4d`:n=`big`,r=`nano`;break;default:throw Error(`Unsupported capture format: only classic PCAP files are supported`)}return{endianness:n,timestampPrecision:r,versionMajor:Re(e,4,n),versionMinor:Re(e,6,n),snapLength:R(e,16,n),linkType:R(e,20,n)}}function Ve(e,t){if(!S(e))throw Error(`packets[${t}] must be an object`);let n=F(e.dataHex,`packets[${t}].dataHex`),r=e.timestampSeconds===void 0?0:E(e.timestampSeconds,`packets[${t}].timestampSeconds`),i=e.timestampFraction===void 0?0:E(e.timestampFraction,`packets[${t}].timestampFraction`),a=e.originalLength===void 0?n.length:D(e.originalLength,`packets[${t}].originalLength`);if(a<n.length)throw Error(`packets[${t}].originalLength must be >= included packet length`);return{data:n,timestampSeconds:r,timestampFraction:i,originalLength:a}}function He(e){let t=Buffer.alloc(24);ze(e.endianness,e.timestampPrecision).copy(t,0),Le(t,4,2,e.endianness),Le(t,6,4,e.endianness),L(t,8,0,e.endianness),L(t,12,0,e.endianness),L(t,16,e.snapLength,e.endianness),L(t,20,e.linkType,e.endianness);let n=e.packets.map(t=>{let n=Buffer.alloc(16);return L(n,0,t.timestampSeconds,e.endianness),L(n,4,t.timestampFraction,e.endianness),L(n,8,t.data.length,e.endianness),L(n,12,t.originalLength,e.endianness),Buffer.concat([n,t.data])});return Buffer.concat([t,...n])}function Ue(e,t,n){let r=Be(e),i=[],a=24;for(;a<e.length&&!(t!==void 0&&i.length>=t);){if(a+16>e.length)throw Error(`PCAP file ends with an incomplete packet header`);let t=R(e,a,r.endianness),o=R(e,a+4,r.endianness),s=R(e,a+8,r.endianness),c=R(e,a+12,r.endianness);if(a+=16,a+s>e.length)throw Error(`PCAP file ends with an incomplete packet payload`);let l=e.subarray(a,a+s);a+=s;let u=n===void 0?l.length:n,d=Math.min(u,l.length);i.push({index:i.length,timestampSeconds:t,timestampFraction:o,includedLength:s,originalLength:c,dataHex:l.subarray(0,d).toString(`hex`),truncated:d<l.length})}return{header:r,packets:i}}const z={SECTION_HEADER:168627466,INTERFACE_DESCRIPTION:1,PACKET_OBSOLETE:2,SIMPLE_PACKET:3,NAME_RESOLUTION:4,INTERFACE_STATISTICS:5,ENHANCED_PACKET:6},We=439041101,Ge={[z.SECTION_HEADER]:`SectionHeader`,[z.INTERFACE_DESCRIPTION]:`InterfaceDescription`,[z.PACKET_OBSOLETE]:`PacketObsolete`,[z.SIMPLE_PACKET]:`SimplePacket`,[z.NAME_RESOLUTION]:`NameResolution`,[z.INTERFACE_STATISTICS]:`InterfaceStatistics`,[z.ENHANCED_PACKET]:`EnhancedPacket`};function B(e){return e+3&-4}function Ke(e){return Ge[e]??`Unknown(0x${e.toString(16).padStart(8,`0`)})`}function V(e,t,n){return n===`little`?e.readUInt16LE(t):e.readUInt16BE(t)}function H(e,t,n){return n===`little`?e.readUInt32LE(t):e.readUInt32BE(t)}function U(e,t,n,r,i){let a=[],o=t;for(;o+4<=n;){let s=V(e,o,r),c=V(e,o+2,r);if(o+=4,s===0)break;if(o+c>n){i.push(`option code ${s} declares ${c} bytes but exceeds body bounds`);break}let l=e.subarray(o,o+c),u={code:s,name:qe(s),valueHex:l.toString(`hex`)};(s===1||s===2)&&(u.text=l.toString(`utf8`)),a.push(u),o=t+B(o+c-t)}return a}function qe(e){switch(e){case 1:return`opt_comment`;case 2:return`if_name`;case 9:return`if_tsresol`;default:return`opt_${e}`}}function Je(e,t,n){if(t+8>e.length)return null;let r=H(e,t,n),i=H(e,t+4,n);return i<12||t+i>e.length||H(e,t+i-4,n)!==i?null:{type:r,totalLength:i,bodyStart:t+8,bodyEnd:t+i-4}}function Ye(e){if(e.length<8||e.readUInt32BE(0)!==z.SECTION_HEADER)return null;let t=e.readUInt32BE(8),n=e.readUInt32LE(8);return t===439041101?`big`:n===439041101?`little`:null}function Xe(e,t={}){let n=[],r=Ye(e);if(r===null){if(e.length<8)throw Error(`Not a PCAPNG file: buffer too short for a Section Header Block`);let t=e.readUInt32BE(0);throw t===z.SECTION_HEADER?Error(`Not a PCAPNG file: Section Header Block present but Byte-Order Magic is malformed`):Error(`Not a PCAPNG file: first block type is 0x${t.toString(16)} (expected Section Header Block 0x${z.SECTION_HEADER.toString(16)})`)}let i={endianness:r,sections:[],interfaces:[],packets:[],nameResolutionRecords:[],interfaceStatistics:[],unknownBlocks:[],blockCount:0,warnings:n},a=0,o=0,s=0,c=r;for(;a+8<=e.length;){let r=Je(e,a,c);if(r===null){n.push(`truncated or malformed block at offset ${a}`);break}switch(i.blockCount++,r.type){case z.SECTION_HEADER:c=Ze(e,r,c,i,n);break;case z.INTERFACE_DESCRIPTION:Qe(e,r,c,i,s),s++;break;case z.ENHANCED_PACKET:$e(e,r,c,i,o,t),o++;break;case z.SIMPLE_PACKET:et(e,r,c,i,o,t),o++;break;case z.NAME_RESOLUTION:nt(e,r,c,i,n);break;case z.INTERFACE_STATISTICS:at(e,r,c,i);break;default:{let t=e.subarray(r.bodyStart,r.bodyEnd);i.unknownBlocks.push({blockIndex:i.blockCount-1,type:r.type,typeName:Ke(r.type),totalLength:r.totalLength,bodyHex:t.toString(`hex`)}),r.type===z.PACKET_OBSOLETE&&n.push(`obsolete Packet Block (type 0x02) encountered; use Enhanced Packet Block`)}}if(t.maxPackets!==void 0&&i.packets.length>=t.maxPackets)break;a+=r.totalLength}return t.interfaceFilter!==void 0&&(i.packets=i.packets.filter(e=>e.kind===`simple`||e.interfaceId===t.interfaceFilter)),i}function Ze(e,t,n,r,i){let a=H(e,t.bodyStart,n),o=n;if(a===439041101)o=n;else{o=e.readUInt32BE(t.bodyStart)===439041101?`big`:`little`;let n=We.toString(16);i.push(`Section Header Block byte-order magic mismatch (expected 0x${n}, got 0x${a.toString(16)})`)}let s=V(e,t.bodyStart+4,o),c=V(e,t.bodyStart+6,o),l=H(e,t.bodyStart+8,o),u=H(e,t.bodyStart+12,o),d=l===4294967295&&u===4294967295,f=d?`unspecified`:(l>>>0).toString(16).padStart(8,`0`)+(u>>>0).toString(16).padStart(8,`0`),p=U(e,t.bodyStart+16,t.bodyEnd,o,i);return r.sections.push({byteOrderMagic:a,endianness:o,majorVersion:s,minorVersion:c,sectionLengthHex:f,sectionLengthUnspecified:d,options:p}),o}function Qe(e,t,n,r,i){let a=V(e,t.bodyStart,n),o=H(e,t.bodyStart+4,n),s=U(e,t.bodyStart+8,t.bodyEnd,n,r.warnings),c={index:i,linkType:a,snapLen:o,options:s};for(let e of s)if(e.code===2&&e.text)c.name=e.text;else if(e.code===9&&e.valueHex.length>=2){let t=Number.parseInt(e.valueHex.slice(0,2),16);c.tsresolBase2=(t&128)!=0,c.tsresol=t&127}r.interfaces.push(c)}function $e(e,t,n,r,i,a){let o=H(e,t.bodyStart,n),s=H(e,t.bodyStart+4,n),c=H(e,t.bodyStart+8,n),l=H(e,t.bodyStart+12,n),u=H(e,t.bodyStart+16,n),d=t.bodyStart+20;if(d+B(l)>t.bodyEnd){r.warnings.push(`Enhanced Packet Block ${i} declares ${l} captured bytes exceeding body`);return}let f=e.subarray(d,d+l),p=a.maxBytesPerPacket??f.length,m=Math.min(p,f.length),h=m<f.length,g=tt(f.subarray(0,m),i,a);r.packets.push({index:i,blockIndex:r.blockCount-1,kind:`enhanced`,interfaceId:o,timestampHigh:s,timestampLow:c,timestampHex:ot(s,c),capturedLength:l,originalLength:u,...g,truncated:h})}function et(e,t,n,r,i,a){let o=H(e,t.bodyStart,n),s=t.bodyStart+4,c=t.bodyEnd-s,l=Math.min(o,c),u=e.subarray(s,s+l),d=a.maxBytesPerPacket??u.length,f=Math.min(d,u.length),p=f<u.length,m=tt(u.subarray(0,f),i,a);r.packets.push({index:i,blockIndex:r.blockCount-1,kind:`simple`,interfaceId:null,timestampHigh:null,timestampLow:null,timestampHex:null,capturedLength:l,originalLength:o,...m,truncated:p})}function tt(e,t,n){let r=e.toString(`hex`),i=n.offloadThreshold??65536;return r.length>i&&n.offloadPacket?{dataRef:n.offloadPacket(r,t)}:{dataHex:r}}function nt(e,t,n,r,i){let a=t.bodyStart;for(;a+4<=t.bodyEnd;){let o=V(e,a,n),s=V(e,a+2,n);if(a+=4,o===0)break;if(a+s>t.bodyEnd){i.push(`Name Resolution record exceeds block bounds`);break}let{address:c,name:l,typeName:u}=rt(o,e.subarray(a,a+s));r.nameResolutionRecords.push({type:o,typeName:u,address:c,name:l}),a=t.bodyStart+B(a+s-t.bodyStart)}}function rt(e,t){return e===1&&t.length>=5?{address:[t[0],t[1],t[2],t[3]].map(e=>String(e)).join(`.`),name:it(t.subarray(4).toString(`utf8`)),typeName:`IPv4`}:e===2&&t.length>=17?{address:Array.from(t.subarray(0,16)).map((e,n)=>n%2==1?`${t[n-1].toString(16).padStart(2,`0`)}${e.toString(16).padStart(2,`0`)}`:``).filter(Boolean).join(`:`),name:it(t.subarray(16).toString(`utf8`)),typeName:`IPv6`}:{address:t.toString(`hex`),name:``,typeName:`type_${e}`}}function it(e){let t=e.indexOf(`\0`);return t>=0?e.slice(0,t):e}function at(e,t,n,r){let i=H(e,t.bodyStart,n),a=H(e,t.bodyStart+4,n),o=H(e,t.bodyStart+8,n),s=U(e,t.bodyStart+12,t.bodyEnd,n,r.warnings);r.interfaceStatistics.push({index:r.interfaceStatistics.length,blockIndex:r.blockCount-1,interfaceId:i,timestampHigh:a,timestampLow:o,timestampHex:ot(a,o),options:s})}function ot(e,t){return(e>>>0).toString(16).padStart(8,`0`)+(t>>>0).toString(16).padStart(8,`0`)}function W(e,t,n,r){r===`little`?e.writeUInt16LE(n,t):e.writeUInt16BE(n,t)}function G(e,t,n,r){r===`little`?e.writeUInt32LE(n,t):e.writeUInt32BE(n,t)}function st(e){let t=[];for(let n of e){let e=Buffer.alloc(4);e.writeUInt16LE(n.code,0),e.writeUInt16LE(n.value.length,2);let r=B(n.value.length),i=Buffer.alloc(r);n.value.copy(i),t.push(e,i)}let n=Buffer.alloc(4);return t.push(n),Buffer.concat(t)}function ct(e,t,n){let r=Buffer.alloc(16);return G(r,0,We,e),W(r,4,t,e),W(r,6,n,e),G(r,8,4294967295,e),G(r,12,4294967295,e),K(z.SECTION_HEADER,r,e)}function lt(e,t){let n=[];e.name&&n.push({code:2,value:Buffer.from(e.name,`utf8`)});let r=st(n),i=Buffer.alloc(8+r.length);return W(i,0,e.linkType,t),W(i,2,0,t),G(i,4,e.snapLen??262144,t),r.copy(i,8),K(z.INTERFACE_DESCRIPTION,i,t)}function ut(e,t){let n=Buffer.from(e.dataHex.replace(/\s+/g,``),`hex`),r=B(n.length),i=Buffer.alloc(20+r);return G(i,0,e.interfaceId??0,t),G(i,4,e.timestampHigh??0,t),G(i,8,e.timestampLow??0,t),G(i,12,n.length,t),G(i,16,e.originalLength??n.length,t),n.copy(i,20),K(z.ENHANCED_PACKET,i,t)}function K(e,t,n){let r=8+t.length+4,i=Buffer.alloc(8);G(i,0,e,n),G(i,4,r,n);let a=Buffer.alloc(4);return G(a,0,r,n),Buffer.concat([i,t,a])}function dt(e){if(e.interfaces.length===0)throw Error(`at least one interface is required`);let t=e.endianness===`big`?`big`:`little`,n=[ct(t,e.majorVersion??1,e.minorVersion??0)];for(let r of e.interfaces)n.push(lt(r,t));for(let r of e.packets)n.push(ut(r,t));return Buffer.concat(n)}const ft={1:`A`,2:`NS`,5:`CNAME`,6:`SOA`,12:`PTR`,15:`MX`,16:`TXT`,28:`AAAA`,33:`SRV`,41:`OPT`,46:`RRSIG`,48:`DNSKEY`,257:`CAA`},pt={1:`IN`,3:`CH`,4:`HS`,254:`NONE`,255:`ANY`},mt={0:`QUERY`,1:`IQUERY`,2:`STATUS`,4:`NOTIFY`,5:`UPDATE`},ht={0:`NOERROR`,1:`FORMERR`,2:`SERVFAIL`,3:`NXDOMAIN`,4:`NOTIMP`,5:`REFUSED`,6:`YXDOMAIN`};function gt(e,t){return e[t]??`TYPE${t}`}function _t(e){return pt[e]??`CLASS${e}`}function vt(e,t={}){let n={buffer:e,warnings:[],maxPointerDepth:t.maxPointerDepth??10},r=t.maxRecordsPerSection??256;if(e.length<12)throw Error(`DNS payload too short: header requires 12 bytes`);let i=e.readUInt16BE(0),a=e.readUInt16BE(2),o=e.readUInt16BE(4),s=e.readUInt16BE(6),c=e.readUInt16BE(8),l=e.readUInt16BE(10),u={id:i,flags:a,qr:+((a>>>15&1)==1),opcode:a>>>11&15,opcodeMnemonic:mt[a>>>11&15]??`UNKNOWN`,authoritativeAnswer:(a>>>10&1)==1,truncation:(a>>>9&1)==1,recursionDesired:(a>>>8&1)==1,recursionAvailable:(a>>>7&1)==1,z:a>>>6&1,authenticData:(a>>>5&1)==1,checkingDisabled:(a>>>4&1)==1,rcode:a&15,rcodeMnemonic:ht[a&15]??`UNKNOWN`},d=12,f=[],p=[],m=[],h=[];try{d=yt(n,d,Math.min(o,r),f),d=q(n,d,Math.min(s,r),p),d=q(n,d,Math.min(c,r),m),d=q(n,d,Math.min(l,r),h)}catch(e){n.warnings.push(e instanceof Error?e.message:`parse error at offset ${d}`)}return{byteLength:e.length,header:u,questionCount:o,answerCount:s,authorityCount:c,additionalCount:l,questions:f,answers:p,authorities:m,additionals:h,warnings:n.warnings}}function yt(e,t,n,r){let i=t;for(let t=0;t<n;t++){let{name:n,nextOffset:a}=J(e,i);if(i=a,i+4>e.buffer.length)throw Error(`question ${t} truncated before QTYPE/QCLASS`);let o=e.buffer.readUInt16BE(i),s=e.buffer.readUInt16BE(i+2);i+=4,r.push({name:n,qtype:o,qtypeMnemonic:gt(ft,o),qclass:s,qclassMnemonic:_t(s)})}return i}function q(e,t,n,r){let i=t;for(let t=0;t<n;t++){let{name:n,nextOffset:a}=J(e,i);if(i=a,i+10>e.buffer.length)throw Error(`resource record ${t} truncated before TYPE/CLASS/TTL/RDLENGTH`);let o=e.buffer.readUInt16BE(i),s=e.buffer.readUInt16BE(i+2),c=e.buffer.readUInt32BE(i+4),l=e.buffer.readUInt16BE(i+8);if(i+=10,i+l>e.buffer.length)throw Error(`resource record ${t} RDATA exceeds payload (rdlength=${l})`);let u=e.buffer.subarray(i,i+l);i+=l;let d={name:n,type:o,typeMnemonic:o===41?`OPT`:gt(ft,o),class:s,classMnemonic:_t(s),ttl:c,rdlength:l,rdataHex:u.toString(`hex`)},f=bt(e,o,i-l,l,s,c);f&&(d.decoded=f),r.push(d)}return i}function J(e,t){let n=[],r=t,i=0,a=null;for(;r<e.buffer.length;){let t=e.buffer[r];if(t===0){r+=1,a===null&&(a=r);break}if((t&192)==192){if(r+2>e.buffer.length)throw Error(`compression pointer truncated`);let t=e.buffer.readUInt16BE(r)&16383;if(a===null&&(a=r+2),r=t,i+=1,i>e.maxPointerDepth){e.warnings.push(`compression pointer depth exceeded ${e.maxPointerDepth}`),n.push(`<truncated>`);break}continue}if(t&192)throw Error(`invalid label length byte 0x${t.toString(16)}`);if(r+=1,r+t>e.buffer.length)throw Error(`label of length ${t} exceeds buffer`);n.push(e.buffer.subarray(r,r+t).toString(`ascii`)),r+=t}return a===null&&(a=r),{name:n.length===0?`.`:n.join(`.`),nextOffset:a}}function bt(e,t,n,r,i,a){let o=e.buffer;switch(t){case 1:return r>=4?{address:`${o[n]}.${o[n+1]}.${o[n+2]}.${o[n+3]}`}:null;case 28:if(r>=16){let e=[];for(let t=0;t<16;t+=2)e.push((o[n+t]<<8|o[n+t+1]).toString(16).replace(/^0+/u,``)||`0`);return{address:e.join(`:`)}}return null;case 5:case 2:case 12:{let{name:t}=J(e,n);return{target:t}}case 15:{if(r<3)return null;let t=o.readUInt16BE(n),{name:i}=J(e,n+2);return{preference:t,exchange:i}}case 16:{let e=[],t=n,i=n+r;for(;t<i;){let n=o[t];if(t+=1,t+n>i)break;e.push(o.subarray(t,t+n).toString(`utf8`)),t+=n}return{entries:e}}case 33:{if(r<7)return null;let t=o.readUInt16BE(n),i=o.readUInt16BE(n+2),a=o.readUInt16BE(n+4),{name:s}=J(e,n+6);return{priority:t,weight:i,port:a,target:s}}case 41:{let e=a>>>24&255,t=a>>>16&255,n=a&65535;return{udpPayloadSize:i,extendedRcode:e,version:t,flags:n,dnssecOk:(n>>>15&1)==1}}default:return null}}const xt=Buffer.from(`\r
+`),St=Buffer.from(`\r
+\r
+`),Ct=Buffer.from(`
+`);function wt(e){let t=[],n=Et(e,St),r;if(n!==-1)r=n+2;else{let n=Et(e,Ct);if(n===-1)throw Error(`HTTP payload missing a complete start line`);r=n,t.push(`malformed message: start line not terminated by CRLF`)}let i=e.subarray(0,r).toString(`utf8`),a=e.subarray(n===-1?r+1:n+4),o=i.split(/\r\n/u),s=o.shift()?.trim()??``,c=[];for(let e of o){if(e.length===0)continue;let n=e.indexOf(`:`);if(n===-1){t.push(`malformed header line: "${e}"`);continue}let r=e.slice(0,n).trim(),i=e.slice(n+1).trim();if(r.length===0){t.push(`empty header name in line: "${e}"`);continue}c.push({name:r,value:i})}let l={};for(let e of c)l[e.name.toLowerCase()]=e.value;let u=/^HTTP\/\d/u.test(s)?`response`:`request`,d={kind:u,byteLength:e.length,startLine:s,headers:c,headersByKey:l,bodyHex:a.toString(`hex`),decodedBodyHex:null,chunkCount:null,malformedChunks:[],warnings:t},f=l[`transfer-encoding`];f&&(d.transferEncoding=f);let p=l[`content-length`];if(p!==void 0){let e=Number.parseInt(p,10);Number.isFinite(e)&&e>=0&&(d.contentLength=e)}if(l[`content-type`]&&(d.contentType=l[`content-type`]),l[`content-encoding`]&&(d.contentEncoding=l[`content-encoding`]),l.host&&(d.host=l.host),u===`request`){let e=s.split(/\s+/u);if(e.length<3)t.push(`malformed request line: expected "METHOD SP target SP HTTP-version"`);else{d.method=e[0],d.requestTarget=e.slice(1,-1).join(` `);let t=e[e.length-1];/^HTTP\/\d+(\.\d+)?$/iu.test(t)?d.httpVersion=t.slice(5):d.httpVersion=t}}else{let e=s.split(/\s+/u);if(e.length<2)t.push(`malformed status line: expected "HTTP-version SP status-code [reason]"`);else{let t=e[0];/^HTTP\/\d+(\.\d+)?$/iu.test(t)?d.httpVersion=t.slice(5):d.httpVersion=t;let n=Number.parseInt(e[1],10);Number.isFinite(n)&&(d.statusCode=n),d.reasonPhrase=e.slice(2).join(` `)}}if(f&&/chunked/iu.test(f)){let e=Tt(a,d.malformedChunks,t);d.decodedBodyHex=e.body.toString(`hex`),d.chunkCount=e.chunkCount}return d}function Tt(e,t,n){let r=[],i=0,a=0;for(;i<e.length;){let o=Et(e,xt,i);if(o===-1){t.push(`no CRLF after chunk size at offset ${i}`);break}let s=e.subarray(i,o).toString(`ascii`).split(`;`)[0].trim();if(s.length===0){t.push(`empty chunk size token at offset ${i}`);break}let c=Number.parseInt(s,16);if(!Number.isFinite(c)||c<0){t.push(`invalid chunk size "${s}" at offset ${i}`);break}if(i=o+2,c===0)break;if(i+c>e.length){t.push(`chunk body of size ${c} exceeds remaining body at offset ${i}`);break}if(r.push(e.subarray(i,i+c)),i+=c,i+2<=e.length)i+=2;else{n.push(`chunked body missing trailing CRLF after chunk`);break}a++}return{body:Buffer.concat(r),chunkCount:a}}function Et(e,t,n=0){if(t.length===0)return n;for(let r=n;r<=e.length-t.length;r++){let n=!0;for(let i=0;i<t.length;i++)if(e[r+i]!==t[i]){n=!1;break}if(n)return r}return-1}const Dt=[Buffer.from([44]),Buffer.from([124]),Buffer.from([58]),Buffer.from([59]),Buffer.from([9]),Buffer.from([0]),Buffer.from([13,10])];function Ot(e){return e.replace(/^0x/i,``).replace(/\s+/g,``).toLowerCase()}function kt(e){let t=Ot(e);return t.length===0||t.length%2!=0?!1:/^[0-9a-f]+$/i.test(t)}function At(e){return kt(e)?Buffer.from(Ot(e),`hex`):null}function jt(e){return e>=32&&e<=126}function Mt(e){if(e.length===0)return 0;let t=0;for(let n of e.values())jt(n)&&(t+=1);return t/e.length}function Nt(e){return e.length===0?0:e.reduce((e,t)=>e+Mt(t),0)/e.length}function Pt(e,t){if(t.length===0)return[e];let n=[],r=0,i=e.indexOf(t,r);for(;i>=0;)n.push(e.subarray(r,i)),r=i+t.length,i=e.indexOf(t,r);return n.push(e.subarray(r)),n}function Ft(e){return Mt(e)===1?e.toString(`utf8`):e.toString(`hex`)}function It(e){let t=[];for(let n of e){let e=At(n);e&&t.push(e)}return t}function Lt(e,t){if(e.length===0)return null;if(e.length===1)return e.readUInt8(0);if(e.length===2)return t===`le`?e.readUInt16LE(0):e.readUInt16BE(0);if(e.length===4)return t===`le`?e.readUInt32LE(0):e.readUInt32BE(0);if(e.length===8){let n=Number(t===`le`?e.readBigUInt64LE(0):e.readBigUInt64BE(0));return Number.isFinite(n)?n:null}let n=0,r=t===`le`?[...e.values()].toReversed():[...e.values()];for(let e of r)n=n*256+e;return Number.isFinite(n)?n:null}function Rt(e,t){if(e.length===4){let n=t===`le`?e.readFloatLE(0):e.readFloatBE(0);return Number.isFinite(n)?n:null}if(e.length===8){let n=t===`le`?e.readDoubleLE(0):e.readDoubleBE(0);return Number.isFinite(n)?n:null}return null}function zt(e,t){if(t.length===0)return 0;let n=0,r=0,i=e.indexOf(t,r);for(;i>=0;)n+=1,r=i+t.length,i=e.indexOf(t,r);return n}function Bt(e){return e.length===0?`bytes`:e.every(e=>e.length===1)&&e.every(e=>e[0]===0||e[0]===1)?`bool`:Nt(e)>=.7?`string`:e.every(e=>e.length===4)&&Vt(e)?`float`:e.every(e=>e.length<=4)?`int`:`bytes`}function Vt(e){let t=[];for(let n of e){let e=Rt(n,`be`);if(e===null)return!1;t.push(e)}return t.some(e=>Math.abs(e)>.001&&Math.abs(e)<1e6)}function Ht(e,t){let n=0,r=0;for(let i of e){let e=i[t];e!==void 0&&(n+=1,jt(e)&&(r+=1))}return n>0&&r/n>=.8}function Ut(e,t){let n=0;for(let r of e){let e=r[t];if(e!==void 0&&(n+=1,e!==0&&e!==1))return!1}return n>0}function Wt(e,t){if(t.length===0)return[];let n=e.map(e=>Pt(e,t)),r=n[0];if(!r||r.length<2)return[];let i=r.length;if(!n.every(e=>e.length===i))return[];let a=[],o=0;for(let e=0;e<i;e+=1){let i=r[e];if(!i)continue;let s=n.map(t=>t[e]).filter(e=>Buffer.isBuffer(e));a.push({name:`field_${e+1}`,offset:o,length:i.length,type:Bt(s)}),o+=i.length+t.length}return a}function Gt(e){let t=Math.min(...e.map(e=>e.length)),n=[],r=0;for(;r<t&&n.length<24;){if(Ht(e,r)){let i=r+1;for(;i<t&&Ht(e,i);)i+=1;n.push({name:`field_${n.length+1}`,offset:r,length:i-r,type:`string`}),r=i;continue}if(Ut(e,r)){n.push({name:`field_${n.length+1}`,offset:r,length:1,type:`bool`}),r+=1;continue}let i=t-r;if(i>=4&&Vt(e.map(e=>e.subarray(r,r+4)))){n.push({name:`field_${n.length+1}`,offset:r,length:4,type:`float`}),r+=4;continue}let a=i>=4?4:Math.min(i,2),o=e.map(e=>e.subarray(r,r+a));n.push({name:`field_${n.length+1}`,offset:r,length:a,type:Bt(o)}),r+=a}return n}function Kt(e){for(let t of Dt){let n=e.map(e=>zt(e,t)),r=n[0];if(typeof r==`number`&&r>=2&&n.every(e=>e===r))return Ft(t)}}function qt(e){let t=Math.min(...e.map(e=>e.length));if(t<2)return`be`;let n=0,r=0,i=Math.min(t-1,8);for(let t=0;t<i;t+=2){let i=0,a=0;for(let n of e){let e=n.readUInt16LE(t),r=n.readUInt16BE(t);e<4096&&(i+=1),r<4096&&(a+=1)}i>a?n+=1:a>i&&(r+=1)}return n>r?`le`:`be`}function Jt(e,t){if(e.length===0||t.length<2)return e;let n=Math.min(...t.map(e=>e.length)),r=0;for(let e=0;e<n;e+=1){let n=t[0][e];if(t.every(t=>t[e]===n))r=e+1;else break}if(r===0)return e;let i=!1;return e.map(e=>!i&&e.offset===0&&r>=2?(i=!0,{...e,name:`magic`}):i&&e.type===`int`&&e.length<=2&&e.offset<=r?{...e,name:`version`}:e)}var Yt=class{patterns=new Map;legacyPatterns=new Map;definePattern(e,t,n){let r=Array.isArray(t)?this.createLegacyPattern(e,t,n):this.createLegacyPatternFromSpec(e,t),i=this.createSpecFromLegacyPattern(r);if(this.patterns.set(e,i),this.legacyPatterns.set(e,r),Array.isArray(t))return r}detectPattern(e){let t=At(e);if(!t)return null;let n=null;for(let e of this.patterns.values()){let r=e.fields.length+ +!!e.fieldDelimiter;if(r===0)continue;let i=0;e.fieldDelimiter&&this.payloadContainsDelimiter(t,e.fieldDelimiter)&&(i+=1);for(let n of e.fields)this.matchesField(t,n,e.byteOrder??`be`)&&(i+=1);let a=Number((i/r).toFixed(2));if(a<=0)continue;let o={pattern:e,confidence:a,matches:i,total:r};(!n||o.confidence>n.confidence||o.confidence===n.confidence&&o.matches>n.matches)&&(n=o)}return n}autoDetect(e){let t=It(e);if(t.length===0)return null;let n=Kt(t),r=this.inferFields(e);return{name:`auto-detected-pattern`,fieldDelimiter:n,byteOrder:qt(t),fields:r}}inferFields(e){let t=It(e);if(t.length===0)return[];let n=Kt(t);if(n){let e=Wt(t,this.parseDelimiter(n));if(e.length>0)return Jt(e,t)}return Jt(Gt(t),t)}autoDetectPattern(e,t){let n=e.map(e=>e.toString(`hex`)),r=this.autoDetect(n),i=t?.name??r?.name??`auto_detected`;if(!r){let e=this.createLegacyPattern(i,[]);return this.patterns.set(i,this.createSpecFromLegacyPattern(e)),this.legacyPatterns.set(i,e),e}let a={...r,name:i};return this.definePattern(i,a),this.getPattern(i)??this.createLegacyPatternFromSpec(i,a)}getPattern(e){return this.legacyPatterns.get(e)}listPatterns(){return[...this.patterns.keys()]}exportProto(e){let t=this.isLegacyPattern(e)?e:this.createLegacyPatternFromSpec(e.name,e),n=[`// Protocol: ${t.name}`,`// Byte order: ${t.byteOrder}`,``];t.encryption&&(n.push(`// Encryption: ${t.encryption.type}`),t.encryption.notes&&n.push(`// Notes: ${t.encryption.notes}`),n.push(``)),n.push(`message ${this.toPascalCase(t.name)} {`);for(let e=0;e<t.fields.length;e+=1){let r=t.fields[e];if(!r)continue;let i=r.description?` // ${r.description}`:``;n.push(`  ${this.toProtoType(r.type)} ${r.name} = ${e+1};${i}`)}return n.push(`}`),n.push(``),n.join(`
+`)}exportKsy(e){let t=this.isLegacyPattern(e)?e:this.createLegacyPatternFromSpec(e.name,e),n=t.byteOrder===`big`?`be`:`le`,r=[`meta:`,`  id: ${this.sanitizeKsyId(t.name)}`,`  endian: ${n}`,`seq:`];for(let e of t.fields){if(!e)continue;r.push(`  - id: ${e.name}`);let t=this.toKsyType(e.type);t&&r.push(`    type: ${t}`),e.description&&r.push(`    doc: ${e.description}`)}return r.join(`
+`)}exportJsonSchema(e){let t=this.isLegacyPattern(e)?e:this.createLegacyPatternFromSpec(e.name,e),n={};for(let e of t.fields){if(!e)continue;let t={type:this.toJsonType(e.type)};e.description&&(t.description=e.description),n[e.name]=t}return JSON.stringify({$schema:`http://json-schema.org/draft-07/schema#`,title:t.name,type:`object`,properties:n},null,2)}sanitizeKsyId(e){return e.replace(/[^a-zA-Z0-9_]/g,`_`).toLowerCase()||`message`}toKsyType(e){switch(e){case`uint8`:return`u1`;case`uint16`:return`u2`;case`uint32`:return`u4`;case`int64`:return`s8`;case`float`:return`f4`;case`string`:return`str`;case`bytes`:return null;default:return null}}toJsonType(e){switch(e){case`uint8`:case`uint16`:case`uint32`:case`int64`:return`integer`;case`float`:return`number`;case`string`:case`bytes`:return`string`;default:return`string`}}payloadContainsDelimiter(e,t){let n=this.parseDelimiter(t);return n.length===0?!1:e.includes(n)}matchesField(e,t,n){if(t.offset<0||t.length<=0||e.length<t.offset+t.length)return!1;let r=e.subarray(t.offset,t.offset+t.length);switch(t.type){case`bytes`:return r.length===t.length;case`bool`:return r.length===1&&(r[0]===0||r[0]===1);case`string`:return Mt(r)>=.6;case`int`:return Lt(r,n)!==null;case`float`:return Rt(r,n)!==null;default:return!1}}createLegacyPattern(e,t,n){return{name:e,fields:t.map(e=>({name:e.name,offset:e.offset,length:e.length,type:e.type,...e.description?{description:e.description}:{}})).toSorted((e,t)=>e.offset-t.offset),byteOrder:n?.byteOrder??`big`,...n?.encryption?{encryption:n.encryption}:{}}}createLegacyPatternFromSpec(e,t){return{name:e,fieldDelimiter:t.fieldDelimiter,byteOrder:t.byteOrder===`le`?`little`:`big`,fields:t.fields.map(e=>({name:e.name,offset:e.offset,length:e.length,type:this.toLegacyFieldType(e),...e.description?{description:e.description}:{}}))}}createSpecFromLegacyPattern(e){return{name:e.name,fieldDelimiter:e.fieldDelimiter,byteOrder:e.byteOrder===`little`?`le`:`be`,fields:e.fields.map(e=>({name:e.name,offset:e.offset,length:e.length,type:this.toSpecFieldType(e.type),...e.description?{description:e.description}:{}}))}}isLegacyPattern(e){return e.byteOrder===`big`||e.byteOrder===`little`}toLegacyFieldType(e){return e.type===`float`?`float`:e.type===`string`?`string`:e.type===`bytes`?`bytes`:e.length===1?`uint8`:e.length===2?`uint16`:e.length===4?`uint32`:`int64`}toSpecFieldType(e){return e===`float`?`float`:e===`string`?`string`:e===`bytes`?`bytes`:`int`}parseDelimiter(e){if(kt(e)){let t=At(e);if(t)return t}return Buffer.from(e,`utf8`)}toProtoType(e){return{uint8:`uint32`,uint16:`uint32`,uint32:`uint32`,int64:`int64`,float:`float`,string:`string`,bytes:`bytes`}[e]}toPascalCase(e){return e.replace(/[^a-zA-Z0-9_]/g,`_`).split(`_`).filter(Boolean).map(e=>e.charAt(0).toUpperCase()+e.slice(1)).join(``)||`Message`}};function Xt(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function Y(e){return e.trim().toLowerCase()}function Zt(e){if(e.length===0)return 0;let t=new Map;for(let n of e)t.set(n,(t.get(n)??0)+1);let n=0;for(let r of t.values()){let t=r/e.length;t>0&&(n-=t*Math.log2(t))}return n}function Qt(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);r>=32&&r<=126&&(t+=1)}return t/e.length}var $t=class{infer(e){if(e.length===0)return{states:[],transitions:[],initial:``,initialState:``,finalStates:[]};let t=new Map,n=new Map,r=``;for(let i=0;i<e.length;i+=1){let a=e[i];if(!a)continue;let o=this.buildSignature(a),s=t.get(o);if(s?s.type=this.mergeStateTypes(s.type,this.inferStateType(a,i===e.length-1)):(s={id:`state_${t.size+1}`,name:this.buildStateName(a,t.size+1),type:this.inferStateType(a,i===e.length-1)},t.set(o,s)),r&&a.timestamp!==void 0){let t=e[0];t&&t.timestamp!==void 0&&(s.timeout=a.timestamp-t.timestamp)}if(r){let e=this.buildEventName(a),t=this.buildCondition(a.fields),i=this.buildAction(a),o=`${r}:${s.id}:${e}`;n.has(o)||n.set(o,{from:r,to:s.id,event:e,confidence:this.computeTransitionConfidence(a),...t?{condition:t}:{},...i?{action:i}:{}})}r=s.id}let i=e[0],a=i?t.get(this.buildSignature(i))?.id??``:``;return{states:[...t.values()],transitions:[...n.values()],initial:a,initialState:a,finalStates:this.collectTerminalStates([...t.values()])}}visualize(e){if(e.states.length===0)return["```mermaid",`stateDiagram-v2`,`  [*] --> empty`,"```"].join(`
+`);let t=["```mermaid",`stateDiagram-v2`],n=e.initialState??e.initial;n&&t.push(`  [*] --> ${n}`);for(let n of e.states){let e=n.type??`normal`,r=e===`normal`?n.name:`${n.name} (${e})`;t.push(`  state "${r}" as ${n.id}`)}for(let n of e.transitions){let e=[n.event??n.trigger??`transition`];typeof n.confidence==`number`&&e.push(`(${n.confidence.toFixed(2)})`),n.condition&&e.push(`[${n.condition}]`),n.action&&e.push(`/ ${n.action}`),t.push(`  ${n.from} --> ${n.to} : ${e.join(` `)}`)}let r=new Set(e.finalStates??[]);for(let n of e.states){let e=n.type??`normal`;(e===`accept`||e===`reject`||r.has(n.id))&&t.push(`  ${n.id} --> [*]`)}return t.push("```"),t.join(`
+`)}inferStateMachine(e){let t=e.map(e=>({direction:e.direction===`out`?`req`:`res`,timestamp:e.timestamp??0,fields:{},raw:e.payload.length>0?e.payload.toString(`utf8`):e.payload.toString(`hex`),rawBuffer:e.payload}));return this.infer(t)}generateMermaid(e){return this.visualize(e)}simplify(e){if(e.states.length<2)return{...e,initialState:e.initialState??e.initial,finalStates:e.finalStates??this.collectTerminalStates(e.states)};let t=new Map,n=new Map;for(let r of e.states){let e=this.getPayloadPrefix(r);if(!e)continue;let i=[...n.entries()].find(([t])=>t===e);i?t.set(r.id,i[0]):(n.set(e,r.id),t.set(r.id,e))}let r=new Map,i=new Map;for(let[e,t]of n)i.set(e,t);for(let t of e.states){let e=this.getPayloadPrefix(t);if(!e)continue;let n=i.get(e);n&&n!==t.id&&r.set(t.id,n)}if(r.size===0)return{...e,initialState:e.initialState??e.initial,finalStates:e.finalStates??this.collectTerminalStates(e.states)};let a=e.states.filter(e=>!r.has(e.id)),o=e.transitions.map(e=>({...e,from:r.get(e.from)??e.from,to:r.get(e.to)??e.to})).filter(e=>e.from!==e.to),s=e.initialState??e.initial??``,c=r.get(s)??s;return{states:a,transitions:o,initial:c,initialState:c,finalStates:e.finalStates.map(e=>r.get(e)??e).filter((e,t,n)=>n.indexOf(e)===t)}}getPayloadPrefix(e){let t=e.expectedPayload;return!t||t.length<8?null:t.slice(0,8).toLowerCase()}buildSignature(e){let t=Object.keys(e.fields).toSorted().join(`,`),n=Y(e.rawBuffer?e.rawBuffer.toString(`hex`):e.raw).slice(0,24);return`${e.direction}|${t}|${n}`}buildStateName(e,t){let n=e.direction===`req`?`send`:`recv`,r=this.findPrimaryFieldName(e.fields),i=e.raw;if(i.length===0)return`${n}_empty`;let a=e.rawBuffer,o=Buffer.isBuffer(a)?a.toString(`hex`):i;if(o.startsWith(`16`)||o.startsWith(`15`)||o.startsWith(`17`))return`${n}_tls_handshake`;let s=i.trimStart();if(s.startsWith(`{`)||s.startsWith(`[`))return`${n}_json_${r||`step_${t}`}`;if(Qt(i)>=.7){let e=Y(i);return e.includes(`close`)||e.includes(`fin`)||e.includes(`bye`)?`${n}_close`:e.startsWith(`get `)||e.startsWith(`post `)||e.startsWith(`http`)?`${n}_text_http`:`${n}_text_${r||`step_${t}`}`}return Buffer.isBuffer(a)&&a.length>=32&&Zt(a)>6?`${n}_encrypted`:Buffer.isBuffer(a)&&a.length<=4?`${n}_control`:`${n}_${r||`step_${t}`}`}findPrimaryFieldName(e){return Object.keys(e).toSorted()[0]||``}inferStateType(e,t){let n=Y(e.raw),r=this.findStatusValue(e.fields);return this.containsRejectSignal(n)||this.containsRejectSignal(r)?`reject`:this.containsAcceptSignal(n)||this.containsAcceptSignal(r)||t&&e.direction===`res`?`accept`:`normal`}mergeStateTypes(e,t){return e===`reject`||t===`reject`?`reject`:e===`accept`||t===`accept`?`accept`:`normal`}findStatusValue(e){for(let t of[`status`,`result`,`code`,`reason`,`message`]){let n=e[t];if(typeof n==`string`||typeof n==`number`||typeof n==`boolean`)return String(n)}return``}containsRejectSignal(e){return[`error`,`fail`,`denied`,`reject`,`timeout`,`invalid`].some(t=>Y(e).includes(t))}containsAcceptSignal(e){return[`ok`,`success`,`accept`,`ready`,`done`,`complete`].some(t=>Y(e).includes(t))}buildEventName(e){let t=this.findStatusValue(e.fields);if(t)return`${e.direction}_${Y(t).replace(/[^a-z0-9]+/g,`_`)}`;let n=this.findPrimaryFieldName(e.fields);return n?`${e.direction}_${n}`:`${e.direction}_message`}buildCondition(e){let t=this.findStatusValue(e);if(t)return`status=${t}`;let n=Object.keys(e).toSorted().slice(0,2);if(n.length===0)return;let r=[];for(let t of n){let n=e[t];(typeof n==`string`||typeof n==`number`||typeof n==`boolean`)&&r.push(`${t}=${n}`)}return r.length>0?r.join(`, `):void 0}buildAction(e){let t=this.findStatusValue(e.fields);if(this.containsRejectSignal(t)||this.containsRejectSignal(e.raw))return`reject`;if(this.containsAcceptSignal(t)||this.containsAcceptSignal(e.raw))return`complete`;let n=Y(e.raw);if(n.includes(`ack`))return`acknowledge`;if(n.includes(`retry`))return`retry`;if(Object.keys(e.fields).length>0&&Xt(e.fields))return e.direction===`req`?`send`:`receive`}collectTerminalStates(e){let t=e.filter(e=>{let t=e.type??`normal`;return t===`accept`||t===`reject`}).map(e=>e.id);for(let n of e){let e=Y(n.name);(e.includes(`close`)||e.includes(`fin`)||e.includes(`bye`))&&(t.includes(n.id)||t.push(n.id))}return t}computeTransitionConfidence(e){let t=.3;return Object.keys(e.fields).length>0&&(t+=.3),this.findStatusValue(e.fields)&&(t+=.2),e.raw.length>0&&(t+=.2),Math.min(t,1)}};const en={20:`ChangeCipherSpec`,21:`Alert`,22:`Handshake`,23:`ApplicationData`},tn={"0300":`SSL 3.0`,"0301":`TLS 1.0`,"0302":`TLS 1.1`,"0303":`TLS 1.2`,"0304":`TLS 1.3`},nn={1301:`TLS_AES_128_GCM_SHA256`,1302:`TLS_AES_256_GCM_SHA384`,1303:`TLS_CHACHA20_POLY1305_SHA256`,c02b:`TLS_ECDHE_ECDSA_AES_128_GCM_SHA256`,c02f:`TLS_ECDHE_RSA_AES_128_GCM_SHA256`,c02c:`TLS_ECDHE_ECDSA_AES_256_GCM_SHA384`,c030:`TLS_ECDHE_RSA_AES_256_GCM_SHA384`,cca9:`TLS_ECDHE_ECDSA_CHACHA20_POLY1305`,cca8:`TLS_ECDHE_RSA_CHACHA20_POLY1305`,"009c":`TLS_RSA_AES_128_GCM_SHA256`,"009d":`TLS_RSA_AES_256_GCM_SHA384`,"002f":`TLS_RSA_AES_128_CBC_SHA`,"0035":`TLS_RSA_AES_256_CBC_SHA`,c013:`TLS_ECDHE_RSA_AES_128_CBC_SHA`,c014:`TLS_ECDHE_RSA_AES_256_CBC_SHA`,"00ff":`TLS_EMPTY_RENEGOTIATION_INFO_SCSV`,5600:`TLS_FALLBACK_SCSV`},rn={0:`NOERROR`,1:`FORMERR`,2:`SERVFAIL`,3:`NXDOMAIN`,4:`NOTIMP`,5:`REFUSED`},an={0:`QUERY`,1:`IQUERY`,2:`STATUS`,3:`UNASSIGNED`,4:`NOTIFY`,5:`UPDATE`},on={474554:`GET`,"504f5354":`POST`,505554:`PUT`,"44454c45":`DELETE`,48454144:`HEAD`,50415443:`PATCH`,"4f505449":`OPTIONS`,"434f4e4e":`CONNECT`},sn={"0000":`server_name`,"000a":`supported_groups`,"000b":`ec_point_formats`,"000d":`signature_algorithms`,"0010":`application_layer_protocol_negotiation`,"0015":`padding`,"0017":`extended_master_secret`,"001b":`compress_certificate`,"0023":`session_ticket`,"0029":`pre_shared_key`,"002b":`supported_versions`,"002d":`psk_key_exchange_modes`,"0033":`key_share`,"0039":`quic_transport_parameters`,4469:`next_protocol_negotiation`,fe0d:`encrypted_client_hello`,ff01:`renegotiation_info`},cn={0:`continuation`,1:`text`,2:`binary`,8:`close`,9:`ping`,10:`pong`};function X(e,t){return Number.parseInt(e.substring(t*2,t*2+2),16)}function Z(e,t){return Number.parseInt(e.substring(t*2,t*2+4),16)}function Q(e,t,n){return e.substring(t*2,(t+n)*2)}function ln(e){return e.length>=24&&/^0{24}$/i.test(e.slice(0,24))}function un(e){if(e.length<44)return null;let t=X(e,0);if(t!==22)return null;let n=Q(e,1,2),r=Z(e,3);if(e.length/2<5+r||X(e,5)!==1)return null;let i={recordType:en[t]??`0x${t.toString(16)}`,recordVersion:tn[n]??n,recordLength:r,handshakeType:`ClientHello`},a=9;if(a+2>e.length/2)return i;let o=Q(e,a,2);if(i.clientVersion=tn[o]??o,a+=34,a>=e.length/2)return i;let s=X(e,a);if(a+=1+s,a+2>e.length/2)return i;let c=Z(e,a);a+=2;let l=[];for(let t=0;t<c/2&&a+2<=e.length/2;t++){let t=Q(e,a,2).toLowerCase();l.push({hex:t,name:nn[t]??`Unknown(0x${t})`}),a+=2}if(i.cipherSuites=l,i.cipherSuiteCount=l.length,a>=e.length/2)return i;let u=X(e,a);if(a+=1+u,a+2>e.length/2)return i;let d=Z(e,a);a+=2;let f=a+d,p=[];for(;a+4<=f&&a+4<=e.length/2;){let t=Q(e,a,2).toLowerCase(),n=Z(e,a+2),r=Q(e,a+4,n),i={type:t,length:n,name:sn[t]},o=dn(t,r);o&&(i.details=o),p.push(i),a+=4+n}return i.extensions=p,i.extensionCount=p.length,i}function dn(e,t){try{if(e===`0000`){if(t.length<10||Z(t,0)===0)return null;let e=X(t,2),n=Z(t,3);return{kind:`server_name`,nameType:e,hostname:fn(t.substring(10,10+n*2))}}if(e===`0010`){if(t.length<4)return null;let e=Z(t,0),n=[],r=2;for(;r+1<=2+e&&r<t.length/2;){let e=X(t,r);n.push(fn(t.substring((r+1)*2,(r+1+e)*2))),r+=1+e}return{kind:`alpn`,protocols:n}}if(e===`002b`){if(t.length<2)return null;let e=X(t,0),n=[];for(let r=0;r<e/2&&1+r*2+2<=t.length/2;r++){let e=Q(t,1+r*2,2);n.push(tn[e]??e)}return{kind:`supported_versions`,versions:n}}if(e===`000d`){if(t.length<4)return null;let e=Z(t,0),n=[];for(let r=0;r<e/2&&2+r*2+2<=t.length/2;r++)n.push(Q(t,2+r*2,2));return{kind:`signature_algorithms`,schemeCount:n.length,schemes:n}}if(e===`0033`){if(t.length<4)return null;let e=Z(t,0),n=[],r=2;for(;r+4<=2+e&&r+4<=t.length/2;){let e=Q(t,r,2),i=Z(t,r+2);n.push({group:e,keyLength:i}),r+=4+i}return{kind:`key_share`,shares:n}}}catch{return null}return null}function fn(e){let t=``;for(let n=0;n+2<=e.length;n+=2){let r=Number.parseInt(e.substring(n,n+2),16);r>=32&&r<=126&&(t+=String.fromCharCode(r))}return t}function pn(e){if(e.length<24)return null;let t=Z(e,0),n=X(e,2),r=X(e,3),i=n>>7&1,a=n>>3&15,o=n>>2&1,s=n>>1&1,c=n&1,l=r>>7&1,u=r>>4&7,d=r&15;return{transactionId:`0x${t.toString(16).padStart(4,`0`)}`,flags:{qr:i===1?`Response`:`Query`,opcode:an[a]??a,authoritativeAnswer:!!o,truncation:!!s,recursionDesired:!!c,recursionAvailable:!!l,reserved:u,responseCode:rn[d]??d},questionCount:Z(e,4),answerCount:Z(e,6),authorityCount:Z(e,8),additionalCount:Z(e,10)}}function mn(e){if(e.length<24||ln(e))return!1;let t=X(e,2),n=X(e,3),r=t>>7&1,i=t>>3&15,a=n&15,o=Z(e,4),s=Z(e,6);return!(i>2||o+s===0||r===0&&a!==0||r===1&&a>5)}const hn={states:[],transitions:[],initial:``,initialState:``,finalStates:[]};var gn=class{engine;inferrer;eventBus;detailedDataManager=u.getInstance();constructor(e,t,n){this.engine=e,this.inferrer=t,this.eventBus=n}emitEvent(e,t){this.eventBus?.emit(e,{...t,timestamp:new Date().toISOString()})}getEngine(){return this.engine||=new Yt,this.engine}getInferrer(){return this.inferrer||=new $t,this.inferrer}errorMessage(e){return e instanceof Error?e.message:String(e)}},_n=class extends gn{async handleDefinePattern(e){try{let t=typeof e.name==`string`&&e.name.trim().length>0?e.name:`unnamed_pattern`,n=m(e,`spec`);if(n){let e=w(t,n);return this.getEngine().definePattern(t,e),{patternId:t,pattern:this.getEngine().getPattern(t)??{name:t,fields:[],byteOrder:`big`},success:!0}}let r=(Array.isArray(e.fields)?e.fields:[]).map((e,t)=>C(e,t)),i=e.byteOrder===`little`||e.byteOrder===`big`?e.byteOrder:void 0,a=te(e.encryption);return{patternId:t,pattern:this.getEngine().definePattern(t,r,{...i?{byteOrder:i}:{},...a?{encryption:a}:{}}),success:!0}}catch(e){return{patternId:`error`,pattern:{name:`error`,fields:[],byteOrder:`big`},success:!1,error:this.errorMessage(e)}}}async handleAutoDetect(e){try{let t=(()=>{let t=p(e,`hexPayloads`);return t.length>0?t:p(e,`payloads`)})(),n=this.getEngine().autoDetect(t),r=typeof e.name==`string`&&e.name.trim().length>0?e.name:void 0;if(!n)return{patterns:[this.getEngine().autoDetectPattern([],r?{name:r}:{})],success:!0};let i={...n,name:r??n.name};this.getEngine().definePattern(i.name,i);let a=this.getEngine().getPattern(i.name)??{name:i.name,fields:[],byteOrder:`big`};return this.emitEvent(`protocol:pattern_detected`,{patternName:i.name,confidence:0}),{patterns:[a],success:!0}}catch(e){return{patterns:[],success:!1,error:this.errorMessage(e)}}}async handleInferFields(e){try{let t=p(e,`hexPayloads`);return{success:!0,fields:this.getEngine().inferFields(t)}}catch(e){return{fields:[],success:!1,error:this.errorMessage(e)}}}async handleExportSchema(e){try{let t=h(e,`patternId`),n=f(e,`format`,`proto`)||`proto`,r=this.getEngine().getPattern(t);if(!r)return{schema:`// Error: pattern '${t}' not found`,format:n};let i=this.getEngine(),a;return a=n===`ksy`?i.exportKsy(r):n===`json-schema`?i.exportJsonSchema(r):i.exportProto(r),{schema:a,format:n}}catch(e){return{schema:`// Error: ${this.errorMessage(e)}`,format:`proto`}}}async handleInferStateMachine(e){try{let t=e.messages;if(!Array.isArray(t))throw Error(`messages must be an array`);let n=t.some(e=>S(e)&&(e.direction===`in`||e.direction===`out`)),r;if(n){let e=t.map((e,t)=>{if(!S(e))throw Error(`messages[${t}] must be an object`);let n=e.direction,r=typeof e.payloadHex==`string`?e.payloadHex:``,i=typeof e.timestamp==`number`?e.timestamp:void 0,a=Buffer.from(r.replace(/\s+/g,``),`hex`);if(n!==`in`&&n!==`out`)throw Error(`messages[${t}].direction must be "in" or "out"`);return{direction:n,payload:a,...i===void 0?{}:{timestamp:i}}});r=this.getInferrer().inferStateMachine(e)}else{let e=t.map((e,t)=>ne(e,t));r=this.getInferrer().infer(e)}return e.simplify===!0&&(r=this.getInferrer().simplify(r)),{stateMachine:r,mermaid:this.getInferrer().generateMermaid(r),success:!0}}catch(e){return{stateMachine:{...hn},success:!1,error:this.errorMessage(e)}}}async handleVisualizeState(e){try{let t=e.stateMachine;if(!S(t))return{mermaidDiagram:this.getInferrer().generateMermaid(hn)};let n=Array.isArray(t.states)?t.states:[],r=Array.isArray(t.transitions)?t.transitions:[],i=typeof t.initialState==`string`?t.initialState:``,a=Array.isArray(t.finalStates)?t.finalStates.filter(e=>typeof e==`string`):[];return{mermaidDiagram:this.getInferrer().generateMermaid({states:n.filter(e=>S(e)),transitions:r.filter(e=>S(e)),initial:i,initialState:i,finalStates:a})}}catch(e){return{mermaidDiagram:`stateDiagram-v2\n  note right of empty: ${this.errorMessage(e)}`}}}},vn=class extends _n{async handlePayloadTemplateBuild(e){try{let t=e.fields;if(!Array.isArray(t))throw Error(`fields must be an array`);let{payload:n,segments:r}=_e(t.map((e,t)=>he(e,t)),oe(e.endian));return this.emitEvent(`protocol:payload_built`,{byteLength:n.length,fieldCount:r.length}),{hexPayload:n.toString(`hex`),byteLength:n.length,fields:r,success:!0}}catch(e){return{hexPayload:``,byteLength:0,fields:[],success:!1,error:this.errorMessage(e)}}}async handlePayloadMutate(e){let t=``;try{if(typeof e.hexPayload!=`string`)throw Error(`hexPayload must be a string`);t=j(e.hexPayload,`hexPayload`);let n=e.mutations;if(!Array.isArray(n))throw Error(`mutations must be an array`);let r=Buffer.from(t,`hex`),i=[];for(let[e,t]of n.entries()){let n=ve(t,e),a=ye(r,n,e);r=a.payload,i.push(a.summary)}return this.emitEvent(`protocol:payload_mutated`,{byteLength:r.length,mutationCount:i.length}),{originalHex:t,mutatedHex:r.toString(`hex`),byteLength:r.length,appliedMutations:i,success:!0}}catch(e){return{originalHex:t,mutatedHex:``,byteLength:0,appliedMutations:[],success:!1,error:this.errorMessage(e)}}}},yn=class extends vn{formatIpv4(e){return Array.from(e.values()).join(`.`)}async handleEthernetFrameBuild(e){try{let t=M(e.destinationMac,`destinationMac`),n=M(e.sourceMac,`sourceMac`),r=Ee(e.etherType,`etherType`),i=Me(t,n,r,F(e.payloadHex,`payloadHex`));return this.emitEvent(`protocol:ethernet_frame_built`,{byteLength:i.length,etherType:`0x${r.toString(16).padStart(4,`0`)}`}),{destinationMac:t.canonical,sourceMac:n.canonical,etherType:r,etherTypeHex:`0x${r.toString(16).padStart(4,`0`)}`,byteLength:i.length,headerHex:i.subarray(0,14).toString(`hex`),frameHex:i.toString(`hex`),success:!0}}catch(e){return{destinationMac:``,sourceMac:``,etherType:0,etherTypeHex:`0x0000`,byteLength:0,headerHex:``,frameHex:``,success:!1,error:this.errorMessage(e)}}}async handleArpBuild(e){try{let t=e.operation===`reply`?`reply`:`request`,n=M(e.senderMac,`senderMac`),r=M(e.targetMac??`00:00:00:00:00:00`,`targetMac`),i=N(e.senderIp,`senderIp`),a=N(e.targetIp,`targetIp`),o=Ne({operation:t,hardwareType:e.hardwareType===void 0?1:E(e.hardwareType,`hardwareType`),protocolType:Ee(e.protocolType??`ipv4`,`protocolType`),hardwareSize:e.hardwareSize===void 0?6:D(e.hardwareSize,`hardwareSize`),protocolSize:e.protocolSize===void 0?4:D(e.protocolSize,`protocolSize`),senderMac:n,senderIp:i,targetMac:r,targetIp:a});return this.emitEvent(`protocol:arp_built`,{operation:t,byteLength:o.length}),{operation:t,byteLength:o.length,payloadHex:o.toString(`hex`),senderMac:n.canonical,senderIp:this.formatIpv4(i),targetMac:r.canonical,targetIp:this.formatIpv4(a),success:!0}}catch(e){return{operation:null,byteLength:0,payloadHex:``,senderMac:``,senderIp:``,targetMac:``,targetIp:``,success:!1,error:this.errorMessage(e)}}}},bn=class extends yn{async handleRawIpPacketBuild(e){try{let t=e.version===`ipv6`?`ipv6`:`ipv4`,n=F(e.payloadHex??``,`payloadHex`),r=De(e.protocol,`protocol`),i=e.dscp===void 0?0:E(e.dscp,`dscp`),a=e.ecn===void 0?0:E(e.ecn,`ecn`);if(i>63)throw Error(`dscp must be between 0 and 63`);if(a>3)throw Error(`ecn must be between 0 and 3`);if(t===`ipv4`){let o=e.ttl===void 0?64:k(e.ttl,`ttl`),s=e.identification===void 0?0:E(e.identification,`identification`),c=e.fragmentOffset===void 0?0:E(e.fragmentOffset,`fragmentOffset`);if(s>65535)throw Error(`identification must be between 0 and 65535`);if(c>8191)throw Error(`fragmentOffset must be between 0 and 8191`);let{packet:l,checksum:u}=Pe({sourceIp:P(e.sourceIp,`ipv4`,`sourceIp`),destinationIp:P(e.destinationIp,`ipv4`,`destinationIp`),protocol:r,payload:n,ttl:o,identification:s,dontFragment:e.dontFragment===!0,moreFragments:e.moreFragments===!0,fragmentOffset:c,dscp:i,ecn:a});return this.emitEvent(`protocol:ip_packet_built`,{version:t,protocol:r,byteLength:l.length}),{version:t,protocol:r,byteLength:l.length,headerLength:20,packetHex:l.toString(`hex`),headerHex:l.subarray(0,20).toString(`hex`),payloadHex:n.toString(`hex`),checksumHex:u.toString(16).padStart(4,`0`),success:!0}}let o=e.hopLimit===void 0?e.ttl===void 0?64:k(e.ttl,`ttl`):k(e.hopLimit,`hopLimit`),s=e.flowLabel===void 0?0:E(e.flowLabel,`flowLabel`);if(s>1048575)throw Error(`flowLabel must be between 0 and 1048575`);let c=Fe({sourceIp:P(e.sourceIp,`ipv6`,`sourceIp`),destinationIp:P(e.destinationIp,`ipv6`,`destinationIp`),protocol:r,payload:n,hopLimit:o,dscp:i,ecn:a,flowLabel:s});return this.emitEvent(`protocol:ip_packet_built`,{version:t,protocol:r,byteLength:c.length}),{version:t,protocol:r,byteLength:c.length,headerLength:40,packetHex:c.toString(`hex`),headerHex:c.subarray(0,40).toString(`hex`),payloadHex:n.toString(`hex`),checksumHex:null,success:!0}}catch(e){return{version:null,protocol:null,byteLength:0,headerLength:0,packetHex:``,headerHex:``,payloadHex:``,checksumHex:null,success:!1,error:this.errorMessage(e)}}}async handleIcmpEchoBuild(e){try{let t=e.operation===`reply`?`reply`:`request`,n=e.identifier===void 0?0:E(e.identifier,`identifier`),r=e.sequenceNumber===void 0?0:E(e.sequenceNumber,`sequenceNumber`);if(n>65535)throw Error(`identifier must be between 0 and 65535`);if(r>65535)throw Error(`sequenceNumber must be between 0 and 65535`);let i=F(e.payloadHex??``,`payloadHex`),{packet:a,checksum:o}=Ie({operation:t,identifier:n,sequenceNumber:r,payload:i}),s=o.toString(16).padStart(4,`0`);return this.emitEvent(`protocol:icmp_echo_built`,{operation:t,byteLength:a.length,checksumHex:s}),{operation:t,identifier:n,sequenceNumber:r,checksum:o,checksumHex:s,byteLength:a.length,packetHex:a.toString(`hex`),payloadHex:i.toString(`hex`),success:!0}}catch(e){return{operation:null,identifier:null,sequenceNumber:null,checksum:null,checksumHex:``,byteLength:0,packetHex:``,payloadHex:``,success:!1,error:this.errorMessage(e)}}}},xn=class extends bn{async handleChecksumApply(e){try{let t=F(e.hexPayload,`hexPayload`),n=e.startOffset===void 0?0:E(e.startOffset,`startOffset`),r=e.endOffset===void 0?t.length:E(e.endOffset,`endOffset`);if(n>r||r>t.length)throw Error(`checksum range must stay within the payload`);let i=e.zeroOffset===void 0?void 0:E(e.zeroOffset,`zeroOffset`),a=e.zeroLength===void 0?2:D(e.zeroLength,`zeroLength`),o=e.writeOffset===void 0?i:E(e.writeOffset,`writeOffset`),s=ke(e.endian),c=Buffer.from(t);if(i!==void 0){if(i+a>c.length)throw Error(`zeroOffset and zeroLength must stay within the payload`);c.fill(0,i,i+a)}let l=I(c.subarray(n,r));if(o!==void 0){if(o+2>c.length)throw Error(`writeOffset must leave room for a 16-bit checksum field`);s===`little`?c.writeUInt16LE(l,o):c.writeUInt16BE(l,o)}let u=l.toString(16).padStart(4,`0`);return this.emitEvent(`protocol:checksum_applied`,{checksumHex:u,byteLength:c.length}),{checksumHex:u,checksum:l,mutatedHex:c.toString(`hex`),byteLength:c.length,rangeStart:n,rangeEnd:r,success:!0}}catch(e){return{checksumHex:``,checksum:0,mutatedHex:``,byteLength:0,rangeStart:0,rangeEnd:0,success:!1,error:this.errorMessage(e)}}}},Sn=class extends xn{},Cn=class extends Sn{async handlePcapWrite(e){try{let t=this.parseRequiredPath(e);if(!Array.isArray(e.packets))throw Error(`packets must be an array`);let n=e.packets.map((e,t)=>Ve(e,t)),r=Ae(e.endianness),i=je(e.timestampPrecision),a=e.snapLength===void 0?65535:D(e.snapLength,`snapLength`),o=Oe(e.linkType??`ethernet`,`linkType`),s=He({packets:n,endianness:r,timestampPrecision:i,snapLength:a,linkType:o});return await b(t,s),this.emitEvent(`protocol:pcap_written`,{path:t,packetCount:n.length,byteLength:s.length}),{path:t,packetCount:n.length,byteLength:s.length,endianness:r,timestampPrecision:i,linkType:o,success:!0}}catch(t){return{path:typeof e.path==`string`?e.path:``,packetCount:0,byteLength:0,endianness:null,timestampPrecision:null,linkType:null,success:!1,error:this.errorMessage(t)}}}async handlePcapRead(e){try{let t=this.parseRequiredPath(e),n=e.maxPackets===void 0?void 0:D(e.maxPackets,`maxPackets`),r=e.maxBytesPerPacket===void 0?void 0:D(e.maxBytesPerPacket,`maxBytesPerPacket`),i=await y(t);if(i.length>=4&&i.readUInt32BE(0)===168627466){let e=Xe(i,{maxPackets:n,maxBytesPerPacket:r,offloadPacket:(e,t)=>this.detailedDataManager.store({packetIndex:t,hex:e})});return this.emitEvent(`protocol:pcap_read`,{path:t,packetCount:e.packets.length}),{path:t,format:`pcapng`,header:null,packets:e.packets,endianness:e.endianness,blockCount:e.blockCount,warnings:e.warnings,success:!0}}let{header:a,packets:o}=Ue(i,n,r);return this.emitEvent(`protocol:pcap_read`,{path:t,packetCount:o.length}),{path:t,format:`pcap`,header:a,packets:o,success:!0}}catch(t){return{path:typeof e.path==`string`?e.path:``,format:`pcap`,header:null,packets:[],success:!1,error:this.errorMessage(t)}}}parseRequiredPath(e){if(typeof e.path!=`string`||e.path.trim().length===0)throw Error(`path must be a non-empty string`);return e.path}},wn=class extends Cn{},Tn=class extends wn{async handleProtoFingerprint(u){let f=p(u,`hexPayloads`),m=u.includeKnownProtocols!==!1,h=u.includeFieldHints!==!1;return f.length===0?d({success:!1,error:`hexPayloads is required`}):d({success:!0,fingerprints:f.map((u,d)=>{let f=u.replace(/\s/g,``),p=[],g=f.length/2,_=g>=5?Z(f,3):-1,v=Number.isFinite(_)&&_>=0&&g>=5+_,y=v&&_>=l&&X(f,0)===22&&X(f,5)===1,b=mn(f),x=Object.keys(on).some(e=>f.toUpperCase().startsWith(e)),S=f.toUpperCase().startsWith(`5353482D`),ee=f.length>=4&&(()=>{let e=X(f,0),t=X(f,1),n=e&15;if(n===0)return!1;let r=n<=10&&!(n>=3&&n<=7),i=(t>>7&1)==1,a=f.length/2,o=t&127,s=2;if(o===126){if(a<4)return!1;o=Z(f,2),s=4}else if(o===127){if(a<10)return!1;let e=Z(f,2)<<16|Z(f,4),t=Z(f,6)<<16|Z(f,8);o=e>0?4294967295:t,s=10}return r&&a>=s+(i?4:0)+o})(),C=null;if(y)p.push({protocol:`TLS ClientHello`,layer:`L6-TLS`,confidence:o}),h&&(C=un(f));else if(x)p.push({protocol:`HTTP/1.x`,layer:`L7-HTTP`,confidence:t}),h&&(C={method:Object.entries(on).find(([e])=>f.toUpperCase().startsWith(e))?.[1]??`UNKNOWN`,httpVersion:f.indexOf(`2048545450`)>0?`1.x`:`unknown`});else if(S)p.push({protocol:`SSH`,layer:`L7-SSH`,confidence:n}),h&&f.length>=20&&(C={banner:Buffer.from(f.substring(0,Math.min(f.length,80)),`hex`).toString(`ascii`)});else if(ee){if(p.push({protocol:`WebSocket`,layer:`L7-WS`,confidence:s}),h&&f.length>=4){let e=X(f,0),t=X(f,1),n=e&15,r=t>>7&1,i=t&127,a=2;if(i===126)i=f.length>=4?Z(f,2):0,a=4;else if(i===127){if(f.length>=20){let e=Z(f,2)<<16|Z(f,4),t=Z(f,6)<<16|Z(f,8);i=e>0?4294967295:t}else i=0;a=10}r&&(a+=4),C={fin:e>>7&1,rsv1:e>>6&1,opcode:n,opcodeName:cn[n]??`reserved(${n})`,masked:!!r,payloadLength:i,headerSize:a}}}else if(g>=20&&!((X(f,4)<<24|X(f,5)<<16|X(f,6)<<8|X(f,7))!=554869826||Z(f,0)&49152)&&20+Z(f,2)<=g){if(p.push({protocol:`STUN`,layer:`L5-STUN`,confidence:e}),h){let e=Z(f,0),t=e>>4&1,n=e&16111;C={messageType:e,class:t?`indication/response`:`request`,method:n,messageLength:Z(f,2)}}}else if(g>=6&&X(f,0)===192&&(()=>{let e=X(f,1)<<24|X(f,2)<<16|X(f,3)<<8|X(f,4);return e===1||e===0||e===1889161412})()){let e=X(f,1)<<24|X(f,2)<<16|X(f,3)<<8|X(f,4);if(p.push({protocol:`QUIC`,layer:`L4-QUIC`,confidence:r}),h&&g>=6){let t=X(f,5);C={headerForm:`long`,version:e===1?`v1`:e===0?`version-negotiation`:`0x${e.toString(16)}`,destConnIdLen:t}}}else if(g>=3&&X(f,0)===5&&(()=>{let e=X(f,1);return e>=1&&e<=3||e>0&&e<10})()){if(p.push({protocol:`SOCKS5`,layer:`L5-SOCKS5`,confidence:a}),h){let e=X(f,1);C=e>=1&&e<=3?{command:{1:`CONNECT`,2:`BIND`,3:`UDP_ASSOCIATE`}[e]??e}:{authMethodCount:e}}}else if(b)p.push({protocol:`DNS`,layer:`L7-DNS`,confidence:.85}),h&&(C=pn(f));else if(g>=2&&(()=>{let e=X(f,0),t=e>>4;if(t<1||t>14||t!==3&&e&15)return!1;let n=0,r=0,i=0;for(let e=1;e<=4&&e<g;e++){let t=X(f,e);if(n|=(t&127)<<r,r+=7,i++,!(t&128))break}return i>0&&n>0&&1+i+n<=g})()){if(p.push({protocol:`MQTT`,layer:`L7-MQTT`,confidence:i}),h){let e=X(f,0),t=e>>4;C={packetType:{1:`CONNECT`,2:`CONNACK`,3:`PUBLISH`,4:`PUBACK`,5:`PUBREC`,6:`PUBREL`,7:`PUBCOMP`,8:`SUBSCRIBE`,9:`SUBACK`,10:`UNSUBSCRIBE`,11:`UNSUBACK`,12:`PINGREQ`,13:`PINGRESP`,14:`DISCONNECT`}[t]??t,dup:e>>3&1,qos:e>>1&3}}}else if(g>=9&&(()=>{let e=X(f,0)<<16|X(f,1)<<8|X(f,2),t=X(f,3);return t<0||t>9||t===0&&e===0||e>16384||(X(f,5)<<24|X(f,6)<<16|X(f,7)<<8|X(f,8))&2147483648?!1:9+e<=g})()){let e=X(f,3),t=X(f,5)<<24|X(f,6)<<16|X(f,7)<<8|X(f,8);p.push({protocol:`HTTP/2`,layer:`L5-HTTP2`,confidence:c}),h&&(C={frameType:{0:`DATA`,1:`HEADERS`,2:`PRIORITY`,3:`RST_STREAM`,4:`SETTINGS`,5:`PUSH_PROMISE`,6:`PING`,7:`GOAWAY`,8:`WINDOW_UPDATE`,9:`CONTINUATION`}[e]??e,frameLength:X(f,0)<<16|X(f,1)<<8|X(f,2),flags:X(f,4),streamId:t})}m&&p.length===0&&(v&&/^160301|^160302|^160303/i.test(f.substring(0,8))&&p.push({protocol:`TLS Record`,layer:`L6-TLS`,confidence:.9}),f.substring(0,8).startsWith(`50524920`)&&p.push({protocol:`HTTP/2 PRI`,layer:`L7-HTTP2`,confidence:.9}));let w=[];if(h&&!C&&f.length>=8){let e=Z(f,0);e>0&&e<f.length/2&&w.push({offset:0,hint:`possible length field (${e} bytes)`})}return{index:d,size:g,protocolMatches:p.length>0?p:[{protocol:`unknown`,layer:`unknown`,confidence:0}],...C?{parsedFields:C}:{},...w.length>0?{fieldHints:w}:{}}})})}};const En=/^[0-9a-f]*$/iu;var Dn=class extends Tn{async handlePcapngRead(e){try{let t=this.parseRequiredPath(e),n=e.maxPackets===void 0?void 0:$(e.maxPackets,`maxPackets`),r=e.maxBytesPerPacket===void 0?void 0:$(e.maxBytesPerPacket,`maxBytesPerPacket`),i=e.interfaceFilter===void 0?void 0:$(e.interfaceFilter,`interfaceFilter`),a=await y(t);if(a.length<12)throw Error(`PCAPNG file is too small to contain a Section Header Block`);let o=Xe(a,{maxPackets:n,maxBytesPerPacket:r,interfaceFilter:i,offloadPacket:(e,t)=>this.detailedDataManager.store({packetIndex:t,hex:e})});return this.emitEvent(`protocol:pcapng_read`,{path:t,blockCount:o.blockCount,packetCount:o.packets.length}),{path:t,endianness:o.endianness,blockCount:o.blockCount,sections:o.sections,interfaces:o.interfaces,packets:o.packets,nameResolutionRecords:o.nameResolutionRecords,interfaceStatistics:o.interfaceStatistics,unknownBlocks:o.unknownBlocks,warnings:o.warnings,success:!0}}catch(t){return{path:typeof e.path==`string`?e.path:``,endianness:null,blockCount:0,sections:[],interfaces:[],packets:[],nameResolutionRecords:[],interfaceStatistics:[],unknownBlocks:[],warnings:[],success:!1,error:this.errorMessage(t)}}}async handlePcapngWrite(e){try{let t=this.parseRequiredPath(e),n=e.endianness===`big`?`big`:`little`,r=e.majorVersion===void 0?1:$(e.majorVersion,`majorVersion`),i=e.minorVersion===void 0?0:$(e.minorVersion,`minorVersion`);if(!Array.isArray(e.interfaces))throw Error(`interfaces must be an array`);if(!Array.isArray(e.packets))throw Error(`packets must be an array`);let a=e.interfaces.map((e,t)=>On(e,t)),o=e.packets.map((e,t)=>kn(e,t)),s=dt({endianness:n,majorVersion:r,minorVersion:i,interfaces:a,packets:o});return await v(_(t),{recursive:!0}),await b(t,s),this.emitEvent(`protocol:pcapng_written`,{path:t,packetCount:o.length,interfaceCount:a.length,byteLength:s.length}),{path:t,packetCount:o.length,interfaceCount:a.length,byteLength:s.length,endianness:n,success:!0}}catch(t){return{path:typeof e.path==`string`?e.path:``,packetCount:0,interfaceCount:0,byteLength:0,endianness:e.endianness===`big`?`big`:`little`,success:!1,error:this.errorMessage(t)}}}};function $(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0)throw Error(`${t} must be a non-negative integer`);return e}function On(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`interfaces[${t}] must be an object`);let n=e,r=n.linkType;if(typeof r!=`number`||!Number.isInteger(r)||r<0||r>65535)throw Error(`interfaces[${t}].linkType must be an integer between 0 and 65535`);let i={linkType:r};if(n.snapLen!==void 0){let e=n.snapLen;if(typeof e!=`number`||!Number.isInteger(e)||e<0)throw Error(`interfaces[${t}].snapLen must be a non-negative integer`);i.snapLen=e}if(n.name!==void 0){if(typeof n.name!=`string`)throw Error(`interfaces[${t}].name must be a string`);i.name=n.name}return i}function kn(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`packets[${t}] must be an object`);let n=e;if(typeof n.dataHex!=`string`)throw Error(`packets[${t}].dataHex must be a hex string`);let r=n.dataHex.replace(/\s+/g,``).toLowerCase();if(r.length%2!=0||!En.test(r))throw Error(`packets[${t}].dataHex must be valid even-length hex`);let i={dataHex:r};if(n.interfaceId!==void 0){if(typeof n.interfaceId!=`number`||!Number.isInteger(n.interfaceId)||n.interfaceId<0)throw Error(`packets[${t}].interfaceId must be a non-negative integer`);i.interfaceId=n.interfaceId}return n.timestampHigh!==void 0&&(i.timestampHigh=An(n.timestampHigh,`packets[${t}].timestampHigh`)),n.timestampLow!==void 0&&(i.timestampLow=An(n.timestampLow,`packets[${t}].timestampLow`)),n.originalLength!==void 0&&(i.originalLength=$(n.originalLength,`packets[${t}].originalLength`)),i}function An(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>4294967295)throw Error(`${t} must be an integer between 0 and 4294967295`);return e}const jn=/^[0-9a-f]*$/iu;var Mn=class extends Dn{async handleProtoDissectDns(e){try{let t=Pn(e.packetHex),n=vt(t,{maxPointerDepth:e.maxPointerDepth===void 0?void 0:Nn(e.maxPointerDepth,`maxPointerDepth`)});return this.emitEvent(`protocol:dns_dissected`,{byteLength:t.length,questionCount:n.questionCount,answerCount:n.answerCount}),{byteLength:t.length,message:n,success:!0}}catch(e){return{byteLength:0,message:null,success:!1,error:this.errorMessage(e)}}}};function Nn(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0)throw Error(`${t} must be a non-negative integer`);return e}function Pn(e){if(typeof e!=`string`)throw Error(`packetHex must be a hex string`);let t=e.replace(/\s+/g,``).replace(/^0x/iu,``).toLowerCase();if(t.length%2!=0||!jn.test(t))throw Error(`packetHex must be valid even-length hex`);return Buffer.from(t,`hex`)}const Fn=/^[0-9a-f]*$/iu;var In=class extends Mn{async handleProtoDissectHttp(e){try{let t=Ln(e.packetHex),n=wt(t);return this.emitEvent(`protocol:http_dissected`,{byteLength:t.length,kind:n.kind,headerCount:n.headers.length}),{byteLength:t.length,message:n,success:!0}}catch(e){return{byteLength:0,message:null,success:!1,error:this.errorMessage(e)}}}};function Ln(e){if(typeof e!=`string`)throw Error(`packetHex must be a hex string`);let t=e.replace(/\s+/g,``).replace(/^0x/iu,``).toLowerCase();if(t.length%2!=0||!Fn.test(t))throw Error(`packetHex must be valid even-length hex`);return Buffer.from(t,`hex`)}var Rn=class extends In{handleDefinePatternTool(e){return g(()=>this.handleDefinePattern(e))}handleAutoDetectTool(e){return g(()=>this.handleAutoDetect(e))}handleInferFieldsTool(e){return g(()=>this.handleInferFields(e))}handleInferStateMachineTool(e){return g(()=>this.handleInferStateMachine(e))}handleExportSchemaTool(e){return g(()=>this.handleExportSchema(e))}handleVisualizeStateTool(e){return g(()=>this.handleVisualizeState(e))}handlePayloadTemplateBuildTool(e){return g(()=>this.handlePayloadTemplateBuild(e))}handlePayloadMutateTool(e){return g(()=>this.handlePayloadMutate(e))}handleEthernetFrameBuildTool(e){return g(()=>this.handleEthernetFrameBuild(e))}handleArpBuildTool(e){return g(()=>this.handleArpBuild(e))}handleRawIpPacketBuildTool(e){return g(()=>this.handleRawIpPacketBuild(e))}handleIcmpEchoBuildTool(e){return g(()=>this.handleIcmpEchoBuild(e))}handleChecksumApplyTool(e){return g(()=>this.handleChecksumApply(e))}handlePcapWriteTool(e){return g(()=>this.handlePcapWrite(e))}handlePcapReadTool(e){return g(()=>this.handlePcapRead(e))}handlePcapngWriteTool(e){return g(()=>this.handlePcapngWrite(e))}handlePcapngReadTool(e){return g(()=>this.handlePcapngRead(e))}handleProtoDissectDnsTool(e){return g(()=>this.handleProtoDissectDns(e))}handleProtoDissectHttpTool(e){return g(()=>this.handleProtoDissectHttp(e))}handleProtoFingerprintTool(e){return g(()=>this.handleProtoFingerprint(e))}};export{Rn as ProtocolAnalysisHandlers};

package/dist/handlers-oGo60aVv.mjs

@@ -0,0 +1 @@
+import{t as e}from"./ToolError-g3rjWzhx.mjs";import{c as t,r as n}from"./parse-args-B6dwWc9k.mjs";import{r}from"./ResponseBuilder-BLicSCjn.mjs";import{basename as i,join as a}from"node:path";import{open as o,readdir as s,stat as c}from"node:fs/promises";import{createHash as l}from"node:crypto";import{open as u}from"yauzl";const d=Object.freeze([]),f=(e,t)=>{let n=process.env[e];if(n===void 0||n===``)return t;let r=parseInt(n,10);return Number.isFinite(r)?r:t},p=f(`APK_PACKER_MAX_APK_BYTES`,512*1024*1024),m=f(`APK_PACKER_MAX_ZIP_ENTRIES`,2e5),h=f(`APK_PACKER_MAX_REGEX_PATTERN_LENGTH`,256),g=f(`APK_PACKER_REGEX_TIMEOUT_MS`,50),_=f(`APK_SIGBLOCK_EOCD_SCAN_BYTES`,65536),v=f(`APK_SIGBLOCK_MAX_BYTES`,1024*1024),y=f(`APK_SIGBLOCK_DEX_PREFIX_HEAD_BYTES`,4),b=Object.freeze([/\([^()]*[+*][^()]*\)[+*]/,/\([^()]*\|[^()]*\)[+*][^()]*[+*]/]);function x(t,n){return new e(`VALIDATION`,t,{details:n})}function S(e){return/[\^$*+?()[\]{}|]/.test(e)}function C(e){if(!e.name||e.name.length===0)throw x(`customSignature.name must be a non-empty string`);if(e.category!==void 0&&typeof e.category!=`string`)throw x(`customSignature.category, when present, must be a string`,{name:e.name});if(!Array.isArray(e.libPatterns)||e.libPatterns.length===0)throw x(`customSignature.libPatterns must be a non-empty array`,{name:e.name});let t=[];for(let n=0;n<e.libPatterns.length;n++){let r=e.libPatterns[n];if(typeof r!=`string`||r.length===0)throw x(`customSignature.libPatterns[${n}] must be a non-empty string`,{name:e.name});if(r.length>h)throw x(`customSignature.libPatterns[${n}] exceeds APK_PACKER_MAX_REGEX_PATTERN_LENGTH (${h})`,{name:e.name,length:r.length});S(r)?(w(r,e.name),t.push(T(r,`i`,e.name))):t.push(r.toLowerCase())}return{name:e.name,libPatterns:t,...e.category?{category:e.category}:{},...e.confidence?{confidence:e.confidence}:{},...e.notes?{notes:e.notes}:{}}}function w(e,t){for(let n of b)if(n.test(e))throw x(`customSignature pattern rejected as potentially catastrophic (ReDoS heuristic match)`,{name:t,pattern:e})}function T(t,n,r){try{return new RegExp(t,n)}catch(i){throw new e(`VALIDATION`,`customSignature regex failed to compile: ${i.message}`,{details:{name:r,pattern:t,flags:n},cause:i})}}function E(e,t,n){return n===`replace`?Object.freeze([...t??[]]):!t||t.length===0?Object.freeze([...e]):Object.freeze(n===`prepend`?[...t,...e]:[...e,...t])}function D(t,n,r=g,i){let a=performance.now(),o=t.test(n),s=performance.now()-a;if(s>r)throw new e(`TIMEOUT`,`Regex match exceeded APK_PACKER_REGEX_TIMEOUT_MS (${r} ms): ${s.toFixed(2)} ms`,{details:{signatureName:i,pattern:t.source,flags:t.flags,elapsedMs:s,timeoutMs:r}});return o}const O=/^lib\/[^/]+\/(lib[^/]+\.so)$/i;var k=class{defaults;constructor(e=d){this.defaults=e}async detectFromApk(t,n={}){if(!t||t.length===0)throw new e(`VALIDATION`,`apkPath must be a non-empty string`);let r;try{r=await c(t)}catch(n){throw new e(`NOT_FOUND`,`APK not found: ${t}`,{details:{apkPath:t},cause:n})}if(!r.isFile())throw new e(`VALIDATION`,`APK path is not a regular file: ${t}`,{details:{apkPath:t}});if(r.size>p)throw new e(`VALIDATION`,`APK exceeds APK_PACKER_MAX_APK_BYTES (${p} bytes): ${r.size}`,{details:{apkPath:t,size:r.size,max:p}});let i=await M(t);return this.matchBasenames(i,n)}async detectFromDir(t,n={}){if(!t||t.length===0)throw new e(`VALIDATION`,`dirPath must be a non-empty string`);let r;try{r=await c(t)}catch(n){throw new e(`NOT_FOUND`,`Directory not found: ${t}`,{details:{dirPath:t},cause:n})}if(!r.isDirectory())throw new e(`VALIDATION`,`Path is not a directory: ${t}`,{details:{dirPath:t}});let i=await N(t);return this.matchBasenames(i,n)}matchBasenames(e,t={}){let n=E(this.defaults,t.customSignatures,t.ruleMode??`append`),r=[];for(let t of n){let n=new Set;for(let r of e)A(r,t)&&n.add(r.path);if(n.size===0)continue;let i=t.confidence??`medium`,a=n.size>=2?`high`:i;r.push({name:t.name,...t.category?{category:t.category}:{},matchedLibs:[...n].toSorted(),confidence:a})}let i=r.length;return{packers:r,confidence:j(r),layerCount:i}}};function A(e,t){for(let n of t.libPatterns)if(typeof n==`string`){if(e.basename===n)return!0}else if(D(n,e.basename,g,t.name))return!0;return!1}function j(e){if(e.length===0)return 0;let t=.5;return e.some(e=>e.confidence===`high`)&&(t+=.25),e.length>=2&&(t+=.25),Math.min(t,1)}async function M(t){return new Promise((n,r)=>{u(t,{lazyEntries:!0,autoClose:!0},(i,a)=>{if(i||!a){r(new e(`VALIDATION`,`Failed to open APK as ZIP: ${i?.message??`unknown`}`,{details:{apkPath:t},cause:i??void 0}));return}let o=[],s=0,c=a,l=n=>{if(s+=1,s>m){c.close(),r(new e(`VALIDATION`,`APK has too many ZIP entries (> ${m})`,{details:{apkPath:t}}));return}let i=n.fileName,a=O.exec(i);if(a){let e=a[1].toLowerCase();o.push({path:i.toLowerCase(),basename:e})}c.readEntry()},u=()=>{f(),n(o)},d=n=>{f(),c.close(),r(new e(`RUNTIME`,`ZIP read failed: ${n.message}`,{details:{apkPath:t},cause:n}))};function f(){c.removeListener(`entry`,l),c.removeListener(`end`,u),c.removeListener(`error`,d)}c.on(`entry`,l),c.on(`end`,u),c.on(`error`,d),c.readEntry()})})}async function N(e){let t=a(e,`lib`),n;try{n=await s(t)}catch{return[]}let r=[];for(let e of n){let n=a(t,e),o;try{if(!(await c(n)).isDirectory())continue;o=await s(n)}catch{continue}for(let t of o){if(!t.toLowerCase().endsWith(`.so`))continue;let n=`lib/${e}/${t}`.toLowerCase();r.push({path:n,basename:i(t).toLowerCase()})}}return r}const P=`APK Sig Block 42`,F=Buffer.from(P,`utf8`);var I=class{async parse(t){if(!t||typeof t!=`string`)throw new e(`VALIDATION`,`apkPath must be a non-empty string`);let n;try{n=await c(t)}catch(n){throw new e(`NOT_FOUND`,`APK not found: ${t}`,{details:{apkPath:t},cause:n})}if(!n.isFile())throw new e(`VALIDATION`,`Path is not a regular file: ${t}`,{details:{apkPath:t}});if(n.size>p)throw new e(`VALIDATION`,`APK exceeds APK_PACKER_MAX_APK_BYTES (${p} bytes): ${n.size}`,{details:{apkPath:t,size:n.size,max:p}});let r;try{return r=await o(t,`r`),await this.parseHandle(r,t,n.size)}finally{r&&await r.close()}}async parseHandle(e,t,n){let r={schemes:{},unknownBlocks:[],warnings:[],anomalies:[]},i=Math.min(_,n),a=Buffer.alloc(i);await e.read(a,0,i,n-i);let o=R(a);if(o<0)return r.anomalies.push({kind:`eocd-not-found`,evidence:`Scanned trailing ${i} bytes — no EOCD signature 0x06054b50`}),L(t,n,r,!1);let s=a.readUInt32LE(o+16);if(s>=n-i+o||s<24)return r.warnings.push(`Implausible centralDirOffset ${s} given file size ${n}`),L(t,n,r,!1);let c=Buffer.alloc(24);if(await e.read(c,0,24,s-24),!c.subarray(8).equals(F)){let i=Math.min(s,_),a=Buffer.alloc(i);await e.read(a,0,i,s-i);let o=a.indexOf(F);if(o<0)return L(t,n,r,!1);let c=i-(o+F.length);return r.anomalies.push({kind:`magic-offset`,evidence:`APK Sig Block 42 magic located ${c} bytes before expected position`}),L(t,n,r,!1)}let l;try{l=J(c,0)}catch(e){return r.warnings.push(`Signing block size field unreadable: ${e.message}`),L(t,n,r,!1)}if(l<=0||l>v)return r.warnings.push(`Signing block size ${l} outside [1, ${v}] — refusing to read`),L(t,n,r,!1);let u=s-l-8;if(u<0)return r.warnings.push(`Computed signing block start offset is negative — refusing to read`),L(t,n,r,!1);let d=l+8;if(d>v)return r.warnings.push(`Signing block total length ${d} exceeds APK_SIGBLOCK_MAX_BYTES — refusing to read`),L(t,n,r,!1);let f=Buffer.alloc(Number(d));if(await e.read(f,0,Number(d),u),z(f,r),n>=4){let t=Math.min(y,n),i=Buffer.alloc(t);await e.read(i,0,t,0),i.length>=4&&i.readUInt32BE(0)===1684371466&&r.anomalies.push({kind:`dex-prefix-anomaly`,evidence:`DEX magic (0x6465780a) at file head with a valid Signing Block — possible dex-prefix injection pattern`})}return L(t,n,r,!0,{magic:P,size:Number(d),offset:u})}};function L(e,t,n,r,i){return{apkPath:e,fileSize:t,signingBlock:r&&i?{found:!0,magic:i.magic,size:i.size,offset:i.offset}:{found:!1},schemes:n.schemes,unknownBlocks:n.unknownBlocks,warnings:n.warnings,anomalies:n.anomalies}}function R(e){if(e.length<22)return-1;for(let t=e.length-22;t>=0;t--)if(e.readUInt32LE(t)===101010256){let n=e.readUInt16LE(t+20);if(t+22+n===e.length)return t}return-1}function z(e,t){let n=e.length-24,r=8;for(;r+12<=n;){let i=J(e,r);if(i<4||r+8+i>n){t.warnings.push(`Truncated ID-value pair at offset ${r} (pairSize ${i})`);return}let a=e.readUInt32LE(r+8),o=r+12,s=r+8+i;B(a,e.subarray(o,s),t),r=s}}function B(e,t,n){switch(e){case 1896449818:{let e=V(t,!1,n);n.schemes.v2?(n.anomalies.push({kind:`duplicate-scheme`,evidence:`v2 signers block (0x7109871a) appears more than once`}),n.schemes.v2.signers.push(...e)):n.schemes.v2={signers:e};return}case 4031998144:{let e=V(t,!0,n),r=U(e);n.schemes.v3=r?{signers:e,keyRotation:r}:{signers:e};return}case 462663009:{let e=V(t,!0,n);n.schemes.v3_1={signers:e};return}case 1114793335:{let e=W(t);e&&(n.schemes.v4=e);return}case 1347109971:return;case 1111638594:n.unknownBlocks.push({id:q(e),size:t.length}),n.anomalies.push({kind:`extra-block-anomaly`,evidence:`Block ID 0x42424242 present (size=${t.length}) — non-standard residue marker`}),n.warnings.push(`Unknown block 0x42424242 detected — non-standard block ID observed in some legacy tooling. Manual review recommended.`);return;default:n.unknownBlocks.push({id:q(e),size:t.length}),n.anomalies.push({kind:`extra-block`,evidence:`Unknown block id ${q(e)} size=${t.length}`});return}}function V(e,t,n){let r=new Y(e,`signers`),i=r.readU32();if(i===0)return[];let a=r.readSlice(i,`signersBuf`),o=[],s=new Y(a,`signers-inner`);for(;s.remaining()>0;){let e=s.readU32(),r=s.readSlice(e,`signer`);try{o.push(H(r,t))}catch(e){n.warnings.push(`Skipped malformed signer: ${e.message}`)}}return o}function H(e,t){let n=new Y(e,`signer`),r=n.readU32(),i=n.readSlice(r,`signedData`),a=0,o=0;t&&(a=n.readU32(),o=n.readU32());let s=n.readU32(),c=n.readSlice(s,`signatures`),l=[],u=new Y(c,`signatures-inner`);for(;u.remaining()>0;){let e=u.readU32(),t=u.readSlice(e,`signature`);if(t.length<4)continue;let n=t.readUInt32LE(0);l.push({algorithm:K(n),algorithmId:n})}let d=new Y(i,`signedData`),f=d.readU32(),p=d.readSlice(f,`digests`),m=[],h=new Y(p,`digests-inner`);for(;h.remaining()>0;){let e=h.readU32(),t=h.readSlice(e,`digest`);if(t.length<4)continue;let n=t.readUInt32LE(0);m.push({algorithm:K(n),algorithmId:n})}let g=d.readU32(),_=d.readSlice(g,`certificates`),v=[],y=new Y(_,`certs-inner`);for(;y.remaining()>0;){let e=y.readU32(),t=y.readSlice(e,`certificate`);v.push(G(t))}let b=d.readU32(),x=d.readSlice(b,`attributes`),S=[],C=new Y(x,`attrs-inner`);for(;C.remaining()>0;){let e=C.readU32(),t=C.readSlice(e,`attribute`);if(t.length<4)continue;let n=t.readUInt32LE(0);S.push({id:q(n),size:t.length})}let w={digests:m,signatures:l,certificates:v,additionalAttributes:S};return t?{...w,minSdkVersion:a,maxSdkVersion:o}:w}function U(e){for(let t of e)for(let e of t.additionalAttributes)if(e.id===q(1000370060))return{levels:[]}}function W(e){try{let t=new Y(e,`v4`),n=t.readU32(),r=t.readU32(),i=t.readSlice(r,`v4-hash`),a=0;return t.remaining()>=8?a=J(e,t.position()):t.remaining()>=4&&(a=t.readU32()),{algorithm:K(n),rootHash:i.toString(`hex`),treeSize:a}}catch{return}}function G(e){let t=l(`sha256`).update(e).digest(`hex`),n=e.subarray(0,Math.min(32,e.length)).toString(`hex`);return{sha256Fingerprint:t,derLength:e.length,derPreview:n}}function K(e){switch(e){case 257:return`RSA_PSS_SHA256`;case 258:return`RSA_PSS_SHA512`;case 259:return`RSA_PKCS1_V1_5_SHA256`;case 260:return`RSA_PKCS1_V1_5_SHA512`;case 513:return`ECDSA_SHA256`;case 514:return`ECDSA_SHA512`;case 769:return`DSA_SHA256`;case 1057:return`VERITY_RSA_PKCS1_V1_5_SHA256`;case 1059:return`VERITY_ECDSA_SHA256`;case 1061:return`VERITY_DSA_SHA256`;default:return`UNKNOWN`}}function q(e){return`0x${(e>>>0).toString(16).padStart(8,`0`)}`}function J(t,n){let r=t.readUInt32LE(n),i=t.readUInt32LE(n+4);if(i>2097151)throw new e(`VALIDATION`,`u64 length exceeds Number.MAX_SAFE_INTEGER at offset ${n}`);return i*4294967296+r}var Y=class{buf;label;cursor=0;constructor(e,t){this.buf=e,this.label=t}position(){return this.cursor}remaining(){return this.buf.length-this.cursor}readU32(){if(this.remaining()<4)throw new e(`VALIDATION`,`Underflow reading u32 in ${this.label}`);let t=this.buf.readUInt32LE(this.cursor);return this.cursor+=4,t}readSlice(t,n){if(t<0||t>this.remaining())throw new e(`VALIDATION`,`Underflow reading slice "${n}" (need ${t}, have ${this.remaining()}) in ${this.label}`);let r=this.buf.subarray(this.cursor,this.cursor+t);return this.cursor+=t,r}};const X=new Set([`append`,`prepend`,`replace`]),Z=new Set([`high`,`medium`,`low`]);function Q(t){if(t!=null){if(!Array.isArray(t))throw new e(`VALIDATION`,`customSignatures must be an array of signature objects`);return t.map((t,n)=>{if(typeof t!=`object`||!t||Array.isArray(t))throw new e(`VALIDATION`,`customSignatures[${n}] must be an object`);let{name:r,category:i,libPatterns:a,confidence:o,notes:s}=t;if(typeof r!=`string`)throw new e(`VALIDATION`,`customSignatures[${n}].name must be a string`);if(i!==void 0&&typeof i!=`string`)throw new e(`VALIDATION`,`customSignatures[${n}].category, when present, must be a string`);if(!Array.isArray(a))throw new e(`VALIDATION`,`customSignatures[${n}].libPatterns must be a string array`);for(let t=0;t<a.length;t++)if(typeof a[t]!=`string`)throw new e(`VALIDATION`,`customSignatures[${n}].libPatterns[${t}] must be a string`);let c={name:r,libPatterns:a};if(typeof i==`string`&&(c.category=i),typeof o==`string`){if(!Z.has(o))throw new e(`VALIDATION`,`customSignatures[${n}].confidence must be one of: high, medium, low`);c.confidence=o}return typeof s==`string`&&(c.notes=s),C(c)})}}function $(e){return{name:e.name,...e.category?{category:e.category}:{},libPatterns:e.libPatterns.map(e=>typeof e==`string`?{type:`literal`,value:e}:{type:`regex`,value:e.source}),...e.category?{category:e.category}:{},...e.confidence?{confidence:e.confidence}:{},...e.notes?{notes:e.notes}:{}}}var ee=class{detector;signingBlockParser;constructor(e=new k,t=new I){this.detector=e,this.signingBlockParser=t}handleApkPackerDetect(i){return r(async()=>{let r=t(i,`apkPath`),a=t(i,`dirPath`);if(!r&&!a)throw new e(`VALIDATION`,`Either apkPath or dirPath must be provided`);if(r&&a)throw new e(`VALIDATION`,`Provide only one of apkPath or dirPath, not both`);let o=Q(i.customSignatures),s=n(i,`ruleMode`,X),c={...o===void 0?{}:{customSignatures:o},...s===void 0?{}:{ruleMode:s}},l=r?await this.detector.detectFromApk(r,c):await this.detector.detectFromDir(a,c);return{packers:l.packers,confidence:l.confidence,layerCount:l.layerCount}})}handleApkPackerListSignatures(e){return r(async()=>{let n=t(e,`category`);return{signatures:(n?d.filter(e=>(e.category??``).toLowerCase().includes(n.toLowerCase())):d).map($)}})}handleApkSigningBlockParse(n){return r(async()=>{let r=t(n,`apkPath`);if(!r)throw new e(`VALIDATION`,`apkPath must be a non-empty string`);return{report:await this.signingBlockParser.parse(r)}})}};export{ee as ApkPackerHandlers};

package/dist/handlers.impl-BTXLw6Qc.mjs

@@ -0,0 +1 @@
+import{t as e}from"./logger-BGCcd-jJ.mjs";import{jr as t,xr as n,yr as r}from"./constants-nvsLpSri.mjs";import{t as i}from"./factory-BeND77hf.mjs";import{r as a}from"./HookPatternScanner-yx4vJ9sd.mjs";import{c as o,i as s,l as c,n as l,r as u,s as d}from"./parse-args-B6dwWc9k.mjs";import{r as f}from"./ResponseBuilder-BLicSCjn.mjs";import{a as p,c as m,i as h,l as g,n as _,o as ee,r as te,s as ne,t as re}from"./IntegrityScanner-BB7sw-SA.mjs";import{readFileSync as ie}from"node:fs";const ae=/^(0x)?[0-9a-fA-F]+$/;function v(e,t){if(typeof e!=`string`||e.length===0||!ae.test(e))throw Error(`${t} must be a hex address (e.g. "0x7FF612340000"), got: ${JSON.stringify(e)}`);return e}function oe(e,t){if(!Array.isArray(e)||e.length===0)throw Error(`${t} must be a non-empty array of bytes (0-255), got: ${JSON.stringify(e)}`);for(let n=0;n<e.length;n+=1){let r=e[n];if(typeof r!=`number`||!Number.isInteger(r)||r<0||r>255)throw Error(`${t} must be an array of bytes (0-255), got invalid element at index ${n}: ${JSON.stringify(r)}`)}return e}function y(e,t,n){if(typeof e!=`string`||e.length===0)throw Error(`${n}: missing or invalid required argument "${t}" (expected non-empty string), got: ${JSON.stringify(e)}`);return e}function b(e,t,n,r,i){if(typeof e!=`number`||!Number.isFinite(e)||e<r||e>i)throw Error(`${n}: argument "${t}" must be a finite number in [${r}, ${i}], got: ${JSON.stringify(e)}`);return e}function se(e,t,n){if(typeof e!=`number`||!Number.isInteger(e)||e<=0)throw Error(`${n}: missing or invalid required argument "${t}" (expected positive integer), got: ${JSON.stringify(e)}`);return e}function x(e,t,n){let r=e.trim();switch(t){case`int8`:case`int16`:case`int32`:case`int64`:case`uint8`:case`uint16`:case`uint32`:case`uint64`:if(!/^-?\d+$/.test(r))throw Error(`${n}: value ${JSON.stringify(e)} is not a valid integer for valueType "${t}"`);break;case`float`:case`double`:if(!/^-?\d*\.?\d+([eE][+-]?\d+)?$/.test(r))throw Error(`${n}: value ${JSON.stringify(e)} is not a valid number for valueType "${t}"`);break;case`hex`:if(!/^([0-9a-fA-F]{2}\s*)+$/.test(r))throw Error(`${n}: value ${JSON.stringify(e)} is not valid hex bytes for valueType "hex" (expected space-separated byte pairs, e.g. "48 65 6C 6C 6F")`);break;case`byte`:if(!/^-?\d+$/.test(r)||Number(r)<0||Number(r)>255)throw Error(`${n}: value ${JSON.stringify(e)} is not a valid byte (0-255) for valueType "byte"`);break;case`pointer`:if(!/^(0x)?[0-9a-fA-F]+$/.test(r))throw Error(`${n}: value ${JSON.stringify(e)} is not a valid hex pointer for valueType "pointer"`);break;case`string`:break;default:break}}function S(e,t,n){if(typeof e!=`string`||e.length===0)throw Error(`${n}: missing or invalid required argument "${t}" (expected JSON string), got: ${JSON.stringify(e)}`);try{return JSON.parse(e)}catch(e){throw Error(`${n}: argument "${t}" must be valid JSON — ${e instanceof Error?e.message:String(e)}`,{cause:e})}}const C=`memory_scan_session`,w=16*1024*1024;var ce=class{sessionManager;auditTrail;constructor(e,t){this.sessionManager=e,this.auditTrail=t??null}recordAudit(t){if(this.auditTrail)try{this.auditTrail.record(t)}catch(t){e.warn(`Memory audit trail recording failed:`,t)}}async handleScanList(e){return f(async()=>{let e=this.sessionManager.listSessions();return{sessions:e,count:e.length}})}async handleScanDelete(e){return f(async()=>{let t=y(e.sessionId,`sessionId`,C),n=Date.now(),r=this.sessionManager.deleteSession(t);return this.recordAudit({operation:`scan_session_delete`,pid:null,address:null,size:null,result:r?`success`:`failure`,durationMs:Date.now()-n}),{deleted:r}})}async handleScanExport(e){return f(async()=>{let t=y(e.sessionId,`sessionId`,C),n=this.sessionManager.exportSession(t),r=typeof n==`string`?n:JSON.stringify(n);if(r.length>w)throw Error(`${C}: export for session "${t}" is ${r.length} bytes, exceeds ${w} bytes (16MB). Narrow the session with memory_next_scan before exporting.`);return{exportedData:n}})}};async function T(e,t,n){if(t)return await m(e,t,n);let r=Number(e);if(!Number.isInteger(r)||r<=0)throw Error(`Invalid PID: ${JSON.stringify(e)} (expected a positive integer). Provide an explicit pid, or attach a browser session for auto-discovery.`);return r}const E=new Set([`byte`,`int8`,`int16`,`uint16`,`int32`,`uint32`,`int64`,`uint64`,`float`,`double`,`string`,`hex`,`pointer`]),D=new Set([`exact`,`unknown_initial`,`changed`,`unchanged`,`increased`,`decreased`,`greater_than`,`less_than`,`between`,`not_equal`]),O=`memory_first_scan`,k=`memory_next_scan`,A=`memory_group_scan`;function j(e){return e===void 0||!Number.isFinite(e)||e<=0?t:Math.min(e,t)}var le=class{scanner;eventBus;processManager;ctx;auditTrail;constructor(e,t,n,r,i){this.scanner=e,this.eventBus=t,this.processManager=n,this.ctx=r,this.auditTrail=i??null}async resolvePid(e){return await T(e,this.processManager,this.ctx)}recordAudit(t){if(this.auditTrail)try{this.auditTrail.record(t)}catch(t){e.warn(`Memory audit trail recording failed:`,t)}}async handleFirstScan(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=y(e.value,`value`,O),r=u(e,`valueType`,E);if(!r)throw Error(`${O}: missing or invalid required argument "valueType" (expected one of: ${[...E].join(`, `)}), got: ${JSON.stringify(e.valueType)}`);x(n,r,O);let i={valueType:r,alignment:s(e,`alignment`),maxResults:j(s(e,`maxResults`)),regionFilter:d(e,`regionFilter`),onProgress:e.onProgress},a=Date.now(),o=await this.scanner.firstScan(t,n,i);return this.recordAudit({operation:`first_scan`,pid:t,address:null,size:o.totalMatches??0,result:`success`,durationMs:Date.now()-a}),this.eventBus?.emit(`memory:scan_completed`,{scanType:`first`,resultCount:o.totalMatches??0,timestamp:new Date().toISOString()}),{...o,hint:o.totalMatches>0?`Found ${o.totalMatches} matches. Use memory_next_scan with sessionId "${o.sessionId}" to narrow down.`:`No matches found. Try a different value or type.`}})}async handleNextScan(e){return f(async()=>{let t=y(e.sessionId,`sessionId`,k),n=u(e,`mode`,D);if(!n)throw Error(`${k}: missing or invalid required argument "mode" (expected one of: ${[...D].join(`, `)}), got: ${JSON.stringify(e.mode)}`);let r=typeof e.value==`string`?e.value:void 0,i=typeof e.value2==`string`?e.value2:void 0;if(n===`between`&&(!r||!i))throw Error(`${k}: mode "between" requires both "value" (lower bound) and "value2" (upper bound)`);let a=await this.scanner.nextScan(t,n,r,i);return{...a,hint:a.totalMatches<=10?`Few matches remaining — inspect these addresses.`:`${a.totalMatches} matches remain. Continue narrowing with memory_next_scan.`}})}async handleUnknownScan(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=u(e,`valueType`,E);if(!n)throw Error(`memory_unknown_scan: missing or invalid required argument "valueType" (expected one of: ${[...E].join(`, `)}), got: ${JSON.stringify(e.valueType)}`);let r={valueType:n,alignment:s(e,`alignment`),maxResults:j(s(e,`maxResults`)),regionFilter:d(e,`regionFilter`),onProgress:e.onProgress},i=await this.scanner.unknownInitialScan(t,r);return{...i,hint:`Captured ${i.totalMatches} addresses. Use memory_next_scan with changed/unchanged/increased/decreased to narrow.`}})}async handlePointerScan(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=v(e.targetAddress,`targetAddress`),r=l(e,`moduleOnly`,!1);return{...await this.scanner.pointerScan(t,n,{maxResults:j(s(e,`maxResults`)),moduleOnly:r})}})}async handleGroupScan(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=e.pattern;if(!Array.isArray(n)||n.length===0)throw Error(`${A}: missing or invalid required argument "pattern" (expected non-empty array of {offset, value, type}), got: ${JSON.stringify(n)}`);if(n.length>64)throw Error(`${A}: pattern has ${n.length} entries, exceeds maximum 64. Split into multiple group scans.`);let r=[],i=new Set;for(let e=0;e<n.length;e+=1){let t=n[e];if(!t||typeof t!=`object`)throw Error(`${A}: pattern element at index ${e} must be an object, got: ${JSON.stringify(t)}`);let a=t.offset,o=t.value,s=t.type;if(typeof a!=`number`||!Number.isFinite(a))throw Error(`${A}: pattern element at index ${e} has invalid "offset" (expected number), got: ${JSON.stringify(a)}`);if(i.has(a))throw Error(`${A}: duplicate offset ${a} at pattern index ${e} — each entry must target a distinct offset`);if(i.add(a),typeof o!=`string`||o.length===0)throw Error(`${A}: pattern element at index ${e} has invalid "value" (expected non-empty string), got: ${JSON.stringify(o)}`);if(typeof s!=`string`||!E.has(s))throw Error(`${A}: pattern element at index ${e} has invalid "type" (expected one of: ${[...E].join(`, `)}), got: ${JSON.stringify(s)}`);r.push({offset:a,value:o,type:s})}let a=s(e,`alignment`),o=j(s(e,`maxResults`));return{...await this.scanner.groupScan(t,r,{alignment:a,maxResults:o})}})}async handleAobScan(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=y(e.pattern,`pattern`,`memory_aob_scan`),r=o(e,`moduleName`),i=s(e,`maxResults`,1e4),a=n.trim();if(a.length===0)throw Error(`memory_aob_scan: missing or invalid required argument "pattern" (expected non-empty AOB pattern like "48 8B ?? ??")`);let c=a.split(/\s+/);for(let e of c){if(e===`??`||e===`?`)continue;let t=e.startsWith(`0x`)||e.startsWith(`0X`)?e.slice(2):e;if(t.length!==2||!/^[0-9a-fA-F]{2}$/.test(t))throw Error(`Invalid AOB pattern: each token must be 2 hex chars (00-FF, optional "0x" prefix) or "??" for wildcard, got: "${e}"`)}if(c.length===0)throw Error(`Invalid AOB pattern: pattern must contain at least one byte or wildcard`);let l=await this.scanner.aobScan(t,a,{maxResults:i,moduleName:r});return{...l,hint:l.totalMatches>0?`Found ${l.totalMatches} matches.`:`No matches found. Try a shorter pattern or fewer wildcards.`}})}};const M=`memory_pointer_chain`,ue=65536;function N(e){return!e||typeof e!=`object`?!1:typeof e.id==`string`}var de=class{ptrEngine;processManager;ctx;auditTrail;constructor(e,t,n,r){this.ptrEngine=e,this.processManager=t,this.ctx=n,this.auditTrail=r??null}async resolvePid(e){return await T(e,this.processManager,this.ctx)}recordAudit(t){if(this.auditTrail)try{this.auditTrail.record(t)}catch(t){e.warn(`Memory audit trail recording failed:`,t)}}async handlePointerChainScan(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=v(e.targetAddress,`targetAddress`),r=s(e,`maxDepth`);if(r!==void 0&&(r<1||r>6))throw Error(`${M}: maxDepth must be 1–6, got ${r}`);let i=s(e,`maxOffset`);if(i!==void 0&&(!Number.isFinite(i)||i<=0||i>ue))throw Error(`${M}: maxOffset must be a positive number ≤ ${ue}, got ${i}`);let a=Date.now(),o=await this.ptrEngine.scan(t,n,{maxDepth:r,maxOffset:i,staticOnly:l(e,`staticOnly`,!1),modules:c(e,`modules`),maxResults:s(e,`maxResults`)});return this.recordAudit({operation:`pointer_chain_scan`,pid:t,address:n,size:o.totalFound??0,result:`success`,durationMs:Date.now()-a}),{...o,hint:o.totalFound>0?`Found ${o.totalFound} pointer chains. Static chains survive process restarts.`:`No pointer chains found. Try increasing maxDepth or maxOffset.`}})}async handlePointerChainValidate(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=S(e.chains,`chains`,M);if(!Array.isArray(n))throw Error(`${M}: argument "chains" must be a JSON array of PointerChain objects, got: ${JSON.stringify(e.chains)}`);if(!n.every(N))throw Error(`${M}: argument "chains" contains a malformed entry — each PointerChain must have a string "id" and an array "levels"`);let r=await this.ptrEngine.validateChains(t,n);return{results:r,validCount:r.filter(e=>e.isValid).length,totalChecked:n.length}})}async handlePointerChainResolve(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=S(e.chain,`chain`,M);if(!N(n))throw Error(`${M}: argument "chain" is malformed — a PointerChain must have a string "id" and an array "levels"`);let r=await this.ptrEngine.resolveChain(t,n);return{chainId:n.id,resolvedAddress:r,isResolvable:r!==null}})}async handlePointerChainExport(e){return f(async()=>{let t=S(e.chains,`chains`,M);if(!Array.isArray(t))throw Error(`${M}: argument "chains" must be a JSON array of PointerChain objects, got: ${JSON.stringify(e.chains)}`);if(!t.every(N))throw Error(`${M}: argument "chains" contains a malformed entry — each PointerChain must have a string "id" and an array "levels"`);return{exportedData:this.ptrEngine.exportChains(t),chainCount:t.length}})}};const fe=/^(0x)?[0-9a-fA-F]+$/,pe=/^0x[0-9a-fA-F]+$/,me=/^[0-9]+$/,he=/^<([^>]+)>$/;function P(e){let t=e.trim();if(t.length===0)return{address:null,error:`address formula is empty`};if(fe.test(t))return{address:t.startsWith(`0x`)?t:`0x${t}`,error:null};let n=0,r=[],i=I(t,n);if(!i)return{address:null,error:`cannot parse address base from: "${t}"`};for(r.push({kind:`base`,value:i.token}),n=i.end;n<t.length&&(n=F(t,n),!(n>=t.length));){let e=t[n];if(e!==`+`&&e!==`-`)return{address:null,error:`expected '+' or '-' at position ${n}, got "${e}"`};n=F(t,n+1);let i=I(t,n);if(!i)return{address:null,error:`expected number at position ${n}`};r.push({kind:`op`,op:e,value:i.token}),n=i.end}let a=r[0],o=R(a.value);if(typeof o==`string`)return{address:null,error:o};for(let e=1;e<r.length;e++){let t=r[e];if(t.kind!==`op`)continue;let n=R(t.value);if(typeof n==`string`)return{address:null,error:n};t.op===`+`?o+=n:o-=n}return o<0n?{address:null,error:`address formula resolves to negative value: ${t}`}:{address:`0x${o.toString(16)}`,error:null}}function F(e,t){let n=t;for(;n<e.length&&(e[n]===` `||e[n]===`	`);)n++;return n}function I(e,t){let n=F(e,t);if(n>=e.length)return null;if(e[n]===`<`){let t=n+1;for(;t<e.length&&e[t]!==`>`;)t++;return t<e.length&&t++,{token:e.slice(n,t),end:t}}let r=n;if(e[r]===`0`&&(e[r+1]===`x`||e[r+1]===`X`))for(r+=2;r<e.length&&L(e[r]);)r++;else for(;r<e.length&&ge(e[r]);)r++;if(r===n)for(;r<e.length&&L(e[r]);)r++;return r===n?null:{token:e.slice(n,r),end:r}}function L(e){return e>=`0`&&e<=`9`||e>=`a`&&e<=`f`||e>=`A`&&e<=`F`}function ge(e){return e>=`0`&&e<=`9`}function R(e){if(he.test(e)){let t=e.slice(1,-1);return`module reference "${t}" cannot be resolved without a live process. Replace "<${t}>" with the actual base address (e.g. from memory_pe_headers or memory_dump).`}return pe.test(e)?BigInt(e):/^[0-9a-fA-F]+$/.test(e)&&/[a-fA-F]/.test(e)?BigInt(`0x${e}`):me.test(e)?BigInt(e):`cannot parse numeric value: "${e}"`}const z=`memory_structure_analyze`,B=`memory_vtable_parse`,V=`memory_structure_export_c`,H=`memory_structure_compare`,U=64*1024,_e={int8_t:`int8`,uint8_t:`uint8`,int16_t:`int16`,uint16_t:`uint16`,int32_t:`int32`,uint32_t:`uint32`,int64_t:`int64`,uint64_t:`uint64`,void_ptr:`pointer`,char_ptr:`string_ptr`};function ve(e){if(typeof e!=`string`||e.length===0)return`unknown`;let t=e.toLowerCase().replace(/\s+/g,`_`).replace(/\*/g,`_ptr`);return _e[t]??t}function ye(e){if(!e||typeof e!=`object`)throw Error(`structure must be a JSON object`);let t=e,n=(Array.isArray(t.fields)?t.fields:[]).map((e,t)=>{let n=e;return{offset:typeof n.offset==`number`?n.offset:0,size:typeof n.size==`number`?n.size:1,type:ve(n.type),name:typeof n.name==`string`&&n.name.length>0?n.name:`field_${t}`,value:typeof n.value==`string`?n.value:``,confidence:typeof n.confidence==`number`?n.confidence:1,notes:typeof n.notes==`string`?n.notes:void 0}}),r=n.reduce((e,t)=>Math.max(e,t.offset+t.size),0),i=typeof t.totalSize==`number`?t.totalSize:typeof t.size==`number`?t.size:r;return{baseAddress:typeof t.baseAddress==`string`?t.baseAddress:`0x0`,totalSize:i,fields:n,vtableAddress:typeof t.vtableAddress==`string`?t.vtableAddress:void 0,className:typeof t.className==`string`?t.className:void 0,baseClasses:Array.isArray(t.baseClasses)?t.baseClasses.filter(e=>typeof e==`string`):void 0,timestamp:typeof t.timestamp==`number`?t.timestamp:Date.now()}}var be=class{structAnalyzer;processManager;ctx;auditTrail;constructor(e,t,n,r){this.structAnalyzer=e,this.processManager=t,this.ctx=n,this.auditTrail=r??null}async resolvePid(e){return await T(e,this.processManager,this.ctx)}recordAudit(t){if(this.auditTrail)try{this.auditTrail.record(t)}catch(t){e.warn(`Memory audit trail recording failed:`,t)}}async handleStructureAnalyze(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=o(e,`address`);if(!n)throw Error(`${z}: missing or invalid required argument "address" (expected hex or address formula, e.g. "0x7FF612340000 + 0x10")`);let r=P(n);if(!r.address)throw Error(`${z}: ${r.error}`);let i=r.address,a=s(e,`size`);if(a!==void 0&&(!Number.isFinite(a)||a<=0))throw Error(`${z}: argument "size" must be a positive number, got: ${JSON.stringify(e.size)}`);if(a!==void 0&&a>U)throw Error(`${z}: size ${a} exceeds maximum ${U} bytes (64KB). Analyze a smaller region or narrow the address first.`);let u=c(e,`otherInstances`),d=l(e,`parseRtti`,!0),f=Date.now(),p=await this.structAnalyzer.analyzeStructure(t,i,{size:a,otherInstances:u,parseRtti:d});return this.recordAudit({operation:`structure_analyze`,pid:t,address:i,size:p.fields?.length??0,result:`success`,durationMs:Date.now()-f}),{...p,hint:p.className?`Detected class: ${p.className}${p.baseClasses?.length?` (inherits: ${p.baseClasses.join(` → `)})`:``}`:`Inferred ${p.fields.length} fields. Use memory_structure_export_c to export as C struct.`}})}async handleVtableParse(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=o(e,`vtableAddress`);if(!n)throw Error(`${B}: missing or invalid required argument "vtableAddress"`);let r=P(n);if(!r.address)throw Error(`${B}: ${r.error}`);let i=r.address;if(BigInt(`0x${i.toLowerCase().replace(/^0x/,``)}`)%8n!=0n)throw Error(`${B}: vtableAddress ${i} is not 8-byte aligned. x64 vtables must be pointer-aligned (address divisible by 8).`);return{...await this.structAnalyzer.parseVtable(t,i)}})}async handleStructureExportC(e){return f(async()=>{let t=o(e,`structure`);if(!t)throw Error(`${V}: missing or invalid required argument "structure" (expected JSON string), got: ${JSON.stringify(e.structure)}`);let n=ye(S(t,`structure`,V)),r=typeof e.name==`string`&&e.name.length>0?e.name:void 0;return{...this.structAnalyzer.exportToCStruct(n,r)}})}async handleStructureCompare(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=o(e,`address1`);if(!n)throw Error(`${H}: missing or invalid required argument "address1"`);let r=P(n);if(!r.address)throw Error(`${H}: ${r.error}`);let i=r.address,a=o(e,`address2`);if(!a)throw Error(`${H}: missing or invalid required argument "address2"`);let c=P(a);if(!c.address)throw Error(`${H}: ${c.error}`);let l=c.address,u=s(e,`size`);if(u!==void 0&&(!Number.isFinite(u)||u<=0))throw Error(`${H}: argument "size" must be a positive number, got: ${JSON.stringify(e.size)}`);if(u!==void 0&&u>U)throw Error(`${H}: size ${u} exceeds maximum ${U} bytes (64KB). Compare a smaller region.`);let d=await this.structAnalyzer.compareInstances(t,i,l,u);return{matchingFieldCount:d.matching.length,differingFieldCount:d.differing.length,...d}})}};const W=`memory_breakpoint`,G=`memory_patch_nop`,xe=1024,K=new Set([`read`,`write`,`readwrite`,`execute`]),Se=new Set([1,2,4,8]),q=`Hardware breakpoint tools (memory_breakpoint) are only supported on Windows. This tool requires Win32 debug register APIs.`;var Ce=class{bpEngine;injector;processManager;ctx;auditTrail;constructor(e,t,n,r,i){this.bpEngine=e,this.injector=t,this.processManager=n,this.ctx=r,this.auditTrail=i??null}async resolvePid(e){return await T(e,this.processManager,this.ctx)}recordAudit(t){if(this.auditTrail)try{this.auditTrail.record(t)}catch(t){e.warn(`Memory audit trail recording failed:`,t)}}async handleBreakpointSet(e){return f(async()=>{if(!this.bpEngine)throw Error(q);if(this.bpEngine.listBreakpoints().length>=4)throw Error(`${W}: all 4 hardware debug registers (DR0-DR3) are in use. Remove an existing breakpoint (memory_breakpoint action=remove) before setting a new one.`);let t=await this.resolvePid(e.pid),n=v(e.address,`address`),r=u(e,`access`,K);if(!r)throw Error(`${W}: missing or invalid required argument "access" (expected one of: ${[...K].join(`, `)}), got: ${JSON.stringify(e.access)}`);let i=s(e,`size`,4),a=Se.has(i)?i:4;return{...await this.bpEngine.setBreakpoint(t,n,r,a),hint:`Hardware breakpoint set on DR register. Use memory_breakpoint with action='trace' to collect hits.`}})}async handleBreakpointRemove(e){return f(async()=>{if(!this.bpEngine)throw Error(q);let t=y(e.breakpointId,`breakpointId`,W);return{removed:await this.bpEngine.removeBreakpoint(t)}})}async handleBreakpointList(e){return f(async()=>{if(!this.bpEngine)throw Error(q);let e=this.bpEngine.listBreakpoints();return{breakpoints:e,count:e.length}})}async handleBreakpointTrace(e){return f(async()=>{if(!this.bpEngine)throw Error(q);if(this.bpEngine.listBreakpoints().length>=4)throw Error(`${W}: all 4 hardware debug registers (DR0-DR3) are in use. Remove an existing breakpoint before tracing.`);let t=await this.resolvePid(e.pid),n=v(e.address,`address`),r=u(e,`access`,K);if(!r)throw Error(`${W}: missing or invalid required argument "access" (expected one of: ${[...K].join(`, `)}), got: ${JSON.stringify(e.access)}`);let i=s(e,`maxHits`),a=s(e,`timeoutMs`),o=await this.bpEngine.traceAccess(t,n,r,i,a);return{hits:o,hitCount:o.length,hint:o.length>0?`${o.length} accesses captured. Check instructionAddress to find the code accessing this address.`:`No hits captured within timeout.`}})}async handlePatchBytes(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=v(e.address,`address`),r=oe(e.bytes,`bytes`),i=Date.now();try{let e=await this.injector.patchBytes(t,n,r);return this.recordAudit({operation:`patch_bytes`,pid:t,address:n,size:r.length,result:`success`,durationMs:Date.now()-i}),{...e,hint:`Patch applied. Use memory_patch_undo with patchId "${e.id}" to restore.`}}catch(e){throw this.recordAudit({operation:`patch_bytes`,pid:t,address:n,size:r.length,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-i}),e}})}async handlePatchNop(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=v(e.address,`address`),r=se(e.count,`count`,G);if(r>xe)throw Error(`${G}: count ${r} exceeds maximum ${xe} bytes. NOP-ing huge ranges risks corrupting control flow; use memory_patch_bytes for large intentional writes.`);let i=Date.now();try{let e=await this.injector.nopBytes(t,n,r);return this.recordAudit({operation:`patch_nop`,pid:t,address:n,size:r,result:`success`,durationMs:Date.now()-i}),{...e,hint:`${r} bytes NOP'd. Use memory_patch_undo to restore.`}}catch(e){throw this.recordAudit({operation:`patch_nop`,pid:t,address:n,size:r,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-i}),e}})}async handlePatchUndo(e){return f(async()=>{let t=y(e.patchId,`patchId`,`memory_patch_undo`),n=Date.now();try{let e=await this.injector.unpatch(t);return this.recordAudit({operation:`patch_undo`,pid:null,address:null,size:null,result:`success`,durationMs:Date.now()-n}),{restored:e}}catch(e){throw this.recordAudit({operation:`patch_undo`,pid:null,address:null,size:null,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-n}),e}})}async handleCodeCaves(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=s(e,`minSize`);if(n!==void 0&&(!Number.isFinite(n)||n<=0))throw Error(`memory_code_caves: argument "minSize" must be a positive number, got: ${JSON.stringify(e.minSize)}`);let r=await this.injector.findCodeCaves(t,n);return{caves:r,count:r.length}})}};const J=`memory_write_value`,Y=`memory_freeze`,we=`memory_dump`,X=new Set([`byte`,`int8`,`int16`,`uint16`,`int32`,`uint32`,`int64`,`uint64`,`float`,`double`,`string`,`hex`,`pointer`]);var Te=class{memCtrl;processManager;ctx;auditTrail;constructor(e,t,n,r){this.memCtrl=e,this.processManager=t,this.ctx=n,this.auditTrail=r??null}async resolvePid(e){return await T(e,this.processManager,this.ctx)}recordAudit(t){if(this.auditTrail)try{this.auditTrail.record(t)}catch(t){e.warn(`Memory audit trail recording failed:`,t)}}async handleWriteValue(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=v(e.address,`address`),r=y(e.value,`value`,J),i=u(e,`valueType`,X);if(!i)throw Error(`${J}: missing or invalid required argument "valueType" (expected one of: ${[...X].join(`, `)}), got: ${JSON.stringify(e.valueType)}`);x(r,i,J);let a=Date.now();try{let e=await this.memCtrl.writeValue(t,n,r,i);return this.recordAudit({operation:`write_value`,pid:t,address:n,size:Array.isArray(e?.newValue)?e.newValue.length:null,result:`success`,durationMs:Date.now()-a}),{...e,hint:`Use memory_write_history with action='undo' to revert.`}}catch(e){throw this.recordAudit({operation:`write_value`,pid:t,address:n,size:null,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-a}),e}})}async handleFreeze(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=v(e.address,`address`),r=y(e.value,`value`,Y),i=u(e,`valueType`,X);if(!i)throw Error(`${Y}: missing or invalid required argument "valueType" (expected one of: ${[...X].join(`, `)}), got: ${JSON.stringify(e.valueType)}`);let a=s(e,`intervalMs`);if(a!==void 0&&a<10)throw Error(`${Y}: intervalMs ${a} is below minimum 10ms — faster writes destabilise the target process.`);if(this.memCtrl.listFreezes().length>=64)throw Error(`${Y}: 64 concurrent freezes already active — unfreeze one (memory_freeze action=unfreeze) before adding more.`);let o=Date.now();try{let e=await this.memCtrl.freeze(t,n,r,i,a);return this.recordAudit({operation:`freeze`,pid:t,address:n,size:null,result:`success`,durationMs:Date.now()-o}),{...e,hint:`Frozen. Use memory_freeze with action="unfreeze" and freezeId "${e.id}" to stop.`}}catch(e){throw this.recordAudit({operation:`freeze`,pid:t,address:n,size:null,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-o}),e}})}async handleUnfreeze(e){return f(async()=>{let t=y(e.freezeId,`freezeId`,`memory_freeze`),n=Date.now();try{let e=await this.memCtrl.unfreeze(t);return this.recordAudit({operation:`unfreeze`,pid:null,address:null,size:null,result:`success`,durationMs:Date.now()-n}),{unfrozen:e}}catch(e){throw this.recordAudit({operation:`unfreeze`,pid:null,address:null,size:null,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-n}),e}})}async handleDump(e){return f(async()=>{let t=await this.resolvePid(e.pid),r=v(e.address,`address`),i=s(e,`size`,256);if(!Number.isFinite(i)||i<=0)throw Error(`${we}: argument "size" must be a positive number, got: ${JSON.stringify(e.size)}`);if(i>n)throw Error(`${we}: size ${i} exceeds maximum ${n} bytes (${(n/1024/1024).toFixed(0)}MB). Read smaller regions in multiple calls.`);let a=Date.now();try{let e=await this.memCtrl.dumpMemoryHex(t,r,i);return this.recordAudit({operation:`dump`,pid:t,address:r,size:i,result:`success`,durationMs:Date.now()-a}),{dump:e}}catch(e){throw this.recordAudit({operation:`dump`,pid:t,address:r,size:i,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-a}),e}})}async handleWriteUndo(e){return f(async()=>{let t=e.pid===void 0?void 0:await this.resolvePid(e.pid),n=await this.memCtrl.undo(t);return this.recordAudit({operation:`write_undo`,pid:n?.pid??null,address:n?.address??null,size:Array.isArray(n?.newValue)?n.newValue.length:null,result:`success`,durationMs:0}),{undone:n!==null,entry:n}})}async handleWriteRedo(e){return f(async()=>{let t=e.pid===void 0?void 0:await this.resolvePid(e.pid),n=await this.memCtrl.redo(t);return this.recordAudit({operation:`write_redo`,pid:n?.pid??null,address:n?.address??null,size:Array.isArray(n?.newValue)?n.newValue.length:null,result:`success`,durationMs:0}),{redone:n!==null,entry:n}})}};async function Ee(e,t,n=1e4,r=2e3){let i=Date.now(),a={scannedRegions:0,queryFailures:0,durationMs:0,timedOut:!1,truncated:!1,maxRegions:n,timeoutMs:r},o=[],s;try{s=e.openProcess(t,!1)}catch{return a.durationMs=Date.now()-i,{guardPages:o,stats:a}}let c=0n;try{for(;c<140737488355327n;){if(Date.now()-i>=r){a.timedOut=!0,a.truncated=!0;break}if(a.scannedRegions>=n){a.truncated=!0;break}let t=e.queryRegion(s,c);if(!t)break;a.scannedRegions+=1,t.protection&8&&o.push({address:`0x${t.baseAddress.toString(16)}`,size:t.size,moduleName:null});let l=t.baseAddress+BigInt(t.size);if(l<=c||l<=t.baseAddress)break;c=l}}catch{a.queryFailures+=1}finally{e.closeProcess(s)}return a.durationMs=Date.now()-i,{guardPages:o,stats:a}}const De=`memory_speedhack`,Oe=`memory_guard_pages`,ke=`memory_integrity_check`,Ae=.01,je=new Set([`imports`,`exports`,`both`]),Me=new Set([`inline`,`iat`,`both`]);function Z(){try{return i()}catch(t){return e.debug(`memory: platform memory provider unavailable (${t instanceof Error?t.message:String(t)}); using per-handler fallbacks`),null}}var Ne=class{speedhackEngine;heapAnalyzer;peAnalyzer;antiCheatDetector;processManager;ctx;auditTrail;constructor(e,t,n,r,i,a,o){this.speedhackEngine=e,this.heapAnalyzer=t,this.peAnalyzer=n,this.antiCheatDetector=r,this.processManager=i,this.ctx=a,this.auditTrail=o??null}async resolvePid(e){return await T(e,this.processManager,this.ctx)}recordAudit(t){if(this.auditTrail)try{this.auditTrail.record(t)}catch(t){e.warn(`Memory audit trail recording failed:`,t)}}async handleSpeedhackApply(e){return f(async()=>{if(!this.speedhackEngine)throw Error(`Speedhack tools (memory_speedhack) are only supported on Windows. This tool requires Win32 timer manipulation APIs.`);let t=await this.resolvePid(e.pid),n=b(e.speed,`speed`,De,Ae,100),r=Date.now();try{let e=await this.speedhackEngine.apply(t,n);return this.recordAudit({operation:`speedhack_apply`,pid:t,address:null,size:null,result:`success`,durationMs:Date.now()-r}),{...e,hint:`Speedhack active (${n}x). Use memory_speedhack({ action: 'set' }) to adjust, or action: 'restore' to unhook.`}}catch(e){throw this.recordAudit({operation:`speedhack_apply`,pid:t,address:null,size:null,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-r}),e}})}async handleSpeedhackSet(e){return f(async()=>{if(!this.speedhackEngine)throw Error(`Speedhack tools (memory_speedhack) are only supported on Windows. This tool requires Win32 timer manipulation APIs.`);let t=await this.resolvePid(e.pid),n=b(e.speed,`speed`,De,Ae,100),r=Date.now();try{let e=await this.speedhackEngine.setSpeed(t,n);return this.recordAudit({operation:`speedhack_set`,pid:t,address:null,size:null,result:`success`,durationMs:Date.now()-r}),{updated:e,newSpeed:n}}catch(e){throw this.recordAudit({operation:`speedhack_set`,pid:t,address:null,size:null,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-r}),e}})}async handleSpeedhackRestore(e){return f(async()=>{if(!this.speedhackEngine)throw Error(`Speedhack tools (memory_speedhack) are only supported on Windows. This tool requires Win32 timer manipulation APIs.`);let t=await this.resolvePid(e.pid),n=Date.now();try{let e=await this.speedhackEngine.restore(t);return this.recordAudit({operation:`speedhack_restore`,pid:t,address:null,size:null,result:`success`,durationMs:Date.now()-n}),{restored:e,hint:e?`Speedhack removed and original time APIs restored.`:`No active speedhack for this process.`}}catch(e){throw this.recordAudit({operation:`speedhack_restore`,pid:t,address:null,size:null,result:`failure`,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-n}),e}})}async handleHeapEnumerate(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=await this.heapAnalyzer.enumerateHeaps(t);return{...n,hint:`Enumerated ${n.heaps.length} heaps. Use memory_heap_stats for statistics or memory_heap_anomalies to check for issues.`}})}async handleHeapStats(e){return f(async()=>{let t=await this.resolvePid(e.pid);return{...await this.heapAnalyzer.getStats(t)}})}async handleHeapAnomalies(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=await this.heapAnalyzer.detectAnomalies(t);return{anomalies:n,count:n.length,hint:n.length>0?`Found ${n.length} anomalies — inspect types for spray, UAF, or suspicious patterns.`:`No heap anomalies detected.`}})}async handlePEHeaders(e){return f(async()=>{let t=await this.resolvePid(e.pid);if(this.peAnalyzer){let n=v(e.moduleBase,`moduleBase`),r=await this.peAnalyzer.parseHeaders(t,n),i=[];try{i=await this.peAnalyzer.listSections(t,n)}catch{}return{...r,sections:i}}let n=o(e,`moduleName`);if(!n)throw Error(`memory_pe_headers on ${process.platform} requires 'moduleName' (a substring of the module path). Win32 PE uses in-memory 'moduleBase'; ELF/Mach-O parse the on-disk binary so they need the file path.`);let r=Z();if(!r)throw Error(`memory_pe_headers: no platform memory provider on ${process.platform}.`);let i=r.platform===`linux`,a=r.platform===`darwin`;if(!i&&!a)throw Error(`memory_pe_headers: unsupported platform ${process.platform} (need Win32 PEAnalyzer or Linux/macOS ELF/Mach-O).`);let s=r.openProcess(t,!1);try{let e=r.enumerateModules(s).find(e=>e.name.toLowerCase().includes(n.toLowerCase()));if(!e)throw Error(`memory_pe_headers: no loaded module matches '${n}'.`);let t=e.name,a=i?p(t):_(t),o=i?ee(t):h(t);if(!a)throw Error(`memory_pe_headers: '${t}' is not a recognised ${i?`ELF64`:`Mach-O 64`} binary.`);return{format:i?`elf64`:`mach-o-64`,moduleName:t.split(`/`).pop()??t,moduleBase:`0x${e.baseAddress.toString(16)}`,...a,sections:o,platformNote:`Parsed on-disk ${i?`ELF`:`Mach-O`} (Win32 PE in-memory parse not available on ${r.platform}).`}}finally{r.closeProcess(s)}})}async handlePEImportsExports(e){return f(async()=>{let t=u(e,`table`,je,`both`),n=await this.resolvePid(e.pid);if(this.peAnalyzer){let r=v(e.moduleBase,`moduleBase`),i={};return(t===`imports`||t===`both`)&&(i.imports=await this.peAnalyzer.parseImports(n,r)),(t===`exports`||t===`both`)&&(i.exports=await this.peAnalyzer.parseExports(n,r)),i}let r=o(e,`moduleName`);if(!r)throw Error(`memory_pe_imports_exports on ${process.platform} requires 'moduleName'.`);let i=Z();if(!i)throw Error(`memory_pe_imports_exports: no platform memory provider on ${process.platform}.`);let a=i.platform===`linux`,s=i.platform===`darwin`;if(!a&&!s)throw Error(`memory_pe_imports_exports: unsupported platform ${process.platform}.`);let c=i.openProcess(n,!1);try{let e=i.enumerateModules(c).find(e=>e.name.toLowerCase().includes(r.toLowerCase()));if(!e)throw Error(`memory_pe_imports_exports: no loaded module matches '${r}'.`);let n=e.name,o=a?ne(n):te(n),s={};return(t===`imports`||t===`both`)&&(s.imports=o.imports),(t===`exports`||t===`both`)&&(s.exports=o.exports),s.format=a?`elf64-dynsym`:`mach-o-nlist`,s.moduleName=n.split(`/`).pop()??n,s.platformNote=`Parsed on-disk ${a?`ELF .dynsym`:`Mach-O LC_SYMTAB`} (undefined=import, defined external=export).`,s}finally{i.closeProcess(c)}})}async handleInlineHookDetect(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=o(e,`moduleName`),r=u(e,`scanMode`,Me,`inline`);if(this.peAnalyzer){let e=r===`iat`?[]:await this.peAnalyzer.detectInlineHooks(t,n),i=r===`inline`?[]:await this.peAnalyzer.detectIATHooks(t,n),a=e.length+i.length;return{inlineHooks:e,iatHooks:i,count:a,scanMode:r,hint:a>0?`Detected ${e.length} inline + ${i.length} IAT hooks. Check hookType/jumpTarget (inline) and actualModule (IAT) for each.`:`No hooks detected (scanMode=${r}). Exports match disk and IAT entries resolve within their source modules.`}}if(r===`iat`)return{inlineHooks:[],iatHooks:[],count:0,scanMode:r,platformNote:`IAT hook detection requires PE import-table parsing (Windows-only). On ${process.platform} use scanMode='inline' with an explicit startAddress+size for a raw pattern sweep.`,hint:`IAT scan is Windows-only; switch to scanMode=inline for cross-platform raw pattern detection.`};let i=o(e,`startAddress`),c=s(e,`size`,4096);if(!i)return{inlineHooks:[],iatHooks:[],count:0,scanMode:r,platformNote:`Cross-platform inline-hook scan on ${process.platform} needs an explicit startAddress (hex) + optional size (default 4096). Without a PE export table the scanner does a raw byte-pattern sweep of the given range and reports high-confidence hook patterns (FF25/mov_jmp/mov_call/push_ret).`,hint:`Provide startAddress (hex) and optional size to scan a specific code range.`};v(i,`startAddress`);let l=i.startsWith(`0x`)?i:`0x${i}`,d=BigInt(l),f=Z();if(!f)throw Error(`memory_inline_hook_detect: no platform memory provider is available on ${process.platform}. Provide startAddress + size for a raw byte-pattern scan.`);let p=f.openProcess(t,!1);try{let e=f.readMemory(p,d,c),t=a(new Uint8Array(e.data),d).map(e=>({address:e.address,moduleName:n??`raw-scan@0x${d.toString(16)}`,functionName:`<offset+0x${e.offset.toString(16)}>`,originalBytes:[],currentBytes:e.matchedBytes,hookType:e.hookType,jumpTarget:e.jumpTarget}));return{inlineHooks:t,iatHooks:[],count:t.length,scanMode:r,platformNote:`Raw byte-pattern scan on ${f.platform} (${c} bytes from 0x${d.toString(16)}). Reports high-confidence patterns only (FF25/mov_jmp/mov_call/push_ret); jmp_rel32/call_rel32 are common in legitimate code and are suppressed without disk comparison. Provide confidence via the raw bytes if you need the full set.`,hint:t.length>0?`Found ${t.length} high-confidence hook pattern(s). Each is rare in clean compiler output — investigate jumpTarget.`:`No high-confidence hook patterns in the scanned range. (Legitimate jmp/call instructions are not reported without disk comparison.)`}}finally{f.closeProcess(p)}})}async handleAntiCheatDetect(e){return f(async()=>{let t=await this.resolvePid(e.pid);if(this.antiCheatDetector){let e=await this.antiCheatDetector.detect(t);return{detections:e,count:e.length,limitations:[`Import-only API detection: anti-debug resolved at runtime via GetModuleHandle+GetProcAddress or manual syscalls is not surfaced by the import scan (the RDTSC instruction pass mitigates this partially).`,`Kernel-mode anti-cheat drivers are NOT enumerated — this scanner is user-mode only and cannot inspect driver callbacks.`,`Direct PEB.BeingDebugged / PEB.NtGlobalFlag reads without calling the corresponding API are not detected.`],hint:e.length>0?`Found ${e.length} anti-debug mechanisms. Each includes a bypassSuggestion. See "limitations" for detection boundaries.`:`No anti-debug mechanisms detected in imports or timing instructions. See "limitations" for what this scanner cannot catch.`}}return{detections:[],count:0,platformNote:`Anti-cheat import scanning is Windows-only (current platform: ${process.platform}). The import-table analysis requires PE parsing of loaded modules; use memory_region_enumerate and memory_integrity_check for cross-platform code inspection.`,limitations:[`Anti-cheat detection on non-Windows platforms is limited to memory-integrity checks (memory_integrity_check) and guard-page scanning (memory_guard_pages) — both work on Linux and macOS.`,`Import-table analysis (kernel32/ntdll API enumeration) is Windows-only.`,`Kernel driver enumeration and ETW provider inspection are out of scope for a user-mode tool.`],hint:`On this platform use memory_integrity_check to compare code sections against disk, and memory_guard_pages to detect anti-tamper guards. Import-table scans require Windows.`}})}async handleGuardPages(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=s(e,`maxRegions`,1e4);if(!Number.isFinite(n)||n<=0)throw Error(`${Oe}: argument "maxRegions" must be a positive number, got: ${JSON.stringify(e.maxRegions)}`);if(this.antiCheatDetector){let{guardPages:e,stats:r}=await this.antiCheatDetector.scanGuardPages(t),i=e.length>n,a=i?e.slice(0,n):e;return{guardPages:a,count:a.length,scan:r,truncated:i||r.truncated,hint:i||r.truncated?`Scan stopped after ${i?n:r.scannedRegions} regions${i?` (maxRegions limit)`:``} in ${r.durationMs}ms to avoid hanging. Results may be partial.`:e.length>0?`Found ${e.length} guard page regions — these may indicate anti-tampering.`:`No guard pages found.`}}let r=Z();if(!r)throw Error(`${Oe}: no platform memory provider is available on ${process.platform}. This tool requires a native memory backend.`);let{guardPages:i,stats:a}=await Ee(r,t,n,2e3);return{guardPages:i,count:i.length,scan:a,truncated:a.truncated,platformNote:`Platform: ${r.platform}. Guard-page detection uses VirtualQueryEx / /proc/pid/maps / mach_vm_region (vendor-specific PAGE_GUARD flags are Windows-only).`,hint:i.length>0?`Found ${i.length} guard-page regions.`:`No guard pages found (platform: ${r.platform}). System-level guard pages on non-Windows platforms are rare — most anti-tampering uses mprotect or mach_vm_protect directly.`}})}async handleIntegrityCheck(e){return f(async()=>{let t=await this.resolvePid(e.pid),n=s(e,`maxSections`,100);if(!Number.isFinite(n)||n<=0)throw Error(`${ke}: argument "maxSections" must be a positive number, got: ${JSON.stringify(e.maxSections)}`);let r=o(e,`moduleName`);if(this.antiCheatDetector){let{sections:e,stats:i}=await this.antiCheatDetector.scanIntegrity(t,r),a=e.length>n,o=a?e.slice(0,n):e,s=o.filter(e=>e.isModified);return{sections:o,totalChecked:o.length,modifiedCount:s.length,scan:i,truncated:a||i.truncated,hint:a||i.truncated?`Checked ${i.scannedSections} executable section(s)${a?` (maxSections limit: ${n})`:``} across ${i.scannedModules} module(s) before hitting safety limits. Results may be partial.`:s.length>0?`${s.length} section(s) modified — code may have been patched or hooked.`:`All checked sections match disk — no runtime modifications detected.`}}let i=Z();if(!i)throw Error(`${ke}: no platform memory provider is available on ${process.platform}.`);let{sections:a,stats:c}=await re(i,t,r),l=a.length>n,u=l?a.slice(0,n):a,d=u.filter(e=>e.isModified);return{sections:u,totalChecked:u.length,modifiedCount:d.length,scan:c,truncated:l||c.truncated,platformNote:`Platform: ${i.platform}. Integrity comparison uses on-disk ELF (Linux) or Mach-O (macOS) section headers vs in-memory bytes read via PlatformMemoryAPI.`,hint:d.length>0?`${d.length} section(s) modified — code may have been patched or hooked.`:a.length>0?`All checked sections match disk — no runtime modifications detected.`:`No loadable sections found to compare (platform: ${i.platform}). Use memory_region_enumerate to inspect loaded code segments.`}})}};const Q=`memory_find_accesses`,Pe=new Set([`write`,`readwrite`]),Fe=new Set([1,2,4,8]);var Ie=class{bpEngine;memoryReader;disassembler;processManager;ctx;constructor(e,t,n,r,i){this.bpEngine=e,this.memoryReader=t,this.disassembler=n,this.processManager=r,this.ctx=i}async resolvePid(e){return await T(e,this.processManager,this.ctx)}async handleFindAccesses(t){return f(async()=>{if(!this.bpEngine)throw Error(`memory_find_accesses is only supported on Windows. Hardware breakpoint registers (DR0-DR3) require Win32 debug APIs.`);let n=v(t.address,`address`),r=u(t,`mode`,Pe);if(!r)throw Error(`${Q}: missing or invalid required argument "mode" (expected one of: ${[...Pe].join(`, `)}), got: ${JSON.stringify(t.mode)}`);let i=s(t,`size`,4);if(!Fe.has(i))throw Error(`${Q}: argument "size" must be one of 1, 2, 4, 8, got: ${JSON.stringify(i)}`);let a=s(t,`maxHits`,20);if(typeof a!=`number`||!Number.isInteger(a)||a<1)throw Error(`${Q}: argument "maxHits" must be a positive integer, got: ${JSON.stringify(t.maxHits)}`);let o=s(t,`timeoutMs`,15e3);if(typeof o!=`number`||!Number.isInteger(o)||o<100)throw Error(`${Q}: argument "timeoutMs" must be a positive integer >= 100, got: ${JSON.stringify(t.timeoutMs)}`);let c=l(t,`disassemble`,!0),d=await this.resolvePid(t.pid),f=await this.bpEngine.setBreakpoint(d,n,r,i),p=[],m=Date.now()+o,h=`timeout`,g=0;try{for(;p.length<a&&Date.now()<m;){let t=Math.max(50,m-Date.now()),o=await this.bpEngine.waitForHit(Math.min(t,500));if(!o){h=`timeout`;break}if(o.breakpointId!==f.id)continue;await this.bpEngine.removeBreakpoint(f.id),f=await this.bpEngine.setBreakpoint(d,n,r,i);let{instructionBytes:s,byteCount:l,readFailed:u}=await this.readInstructionBytes(d,o.instructionAddress);u&&g++;let _={hitCount:p.length+1,instructionAddress:o.instructionAddress,instructionBytes:s,accessType:o.accessType,threadId:o.threadId,timestamp:o.timestamp};if(c&&this.disassembler&&s&&l>0)try{let e=this.hexToByteArray(s);_.instructionMnemonic=await this.disassembler(e,o.instructionAddress)}catch(t){e.debug(`${Q}: disassembly failed at ${o.instructionAddress}:`,t),_.instructionMnemonic=`(disassembly failed)`}if(p.push(_),p.length>=a){h=`maxHits`;break}}}finally{await this.bpEngine.removeBreakpoint(f.id)}let _=p.length>0?`${p.length} accesses captured (stopped by: ${h}). Check instructionAddress for each hit to find the code accessing address ${n}.`+(g>0?` ${g} hit(s) had unreadable instruction bytes (shown as instructionBytes=null).`:``):`No accesses to ${n} captured within ${o}ms timeout. Increase timeoutMs or check that the address is being accessed.`;return{address:n,mode:r,size:i,hits:p,hitCount:p.length,stoppedBy:h,hint:_}})}async readInstructionBytes(t,n){if(!this.memoryReader)return{instructionBytes:null,byteCount:0,readFailed:!0};try{let e=await this.memoryReader(t,n,16);if(!e.success||!e.data)return{instructionBytes:null,byteCount:0,readFailed:!0};let r=e.data.trim();if(!r)return{instructionBytes:null,byteCount:0,readFailed:!0};let i=r.split(/\s+/).filter(e=>e.length>0).length;return i<16?{instructionBytes:null,byteCount:i,readFailed:!0}:{instructionBytes:r,byteCount:i,readFailed:!1}}catch(t){return e.debug(`${Q}: instruction byte read failed at ${n}:`,t),{instructionBytes:null,byteCount:0,readFailed:!0}}}hexToByteArray(e){return e.split(/\s+/).filter(e=>e.length>0).map(e=>parseInt(e,16))}};const $=`memory_region_enumerate`,Le=new Set([`r`,`w`,`x`,`rw`,`rx`,`wx`,`rwx`]);function Re(e){let t=e&1?`r`:``,n=e&2?`w`:``,r=e&4?`x`:``;return t+n+r||`---`}function ze(e){let t=0;return e.includes(`r`)&&(t|=1),e.includes(`w`)&&(t|=2),e.includes(`x`)&&(t|=4),t}function Be(e,t){let n=new Map,r=new Map;try{let i=e.enumerateModules(t);for(let e of i){let t=e.name.toLowerCase();n.set(t,{baseAddress:e.baseAddress,size:e.size,displayName:e.name}),r.set(`0x${e.baseAddress.toString(16)}`,e.name)}}catch{}return{byName:n,byAddress:r}}function Ve(e,t){for(let[,n]of t)if(e>=n.baseAddress&&e<n.baseAddress+BigInt(n.size))return n.displayName;return null}var He=class{getApi(){try{return i()}catch{return null}}async handleRegionEnumerate(e){return f(async()=>{let t=e.pid,n=Number(t);if(!Number.isInteger(n)||n<=0)throw Error(`Invalid PID: ${JSON.stringify(t)} (expected a positive integer). Provide an explicit pid.`);let i=n,a=o(e,`moduleName`),c=u(e,`protection`,Le),l=s(e,`maxRegions`,r);if(!Number.isFinite(l)||l<=0)throw Error(`${$}: argument "maxRegions" must be a positive number, got: ${JSON.stringify(e.maxRegions)}`);let d=this.getApi();if(!d)throw Error(`${$}: no platform memory provider is available on ${process.platform}. This tool requires a native memory backend.`);let f=c?ze(c):null,p=d.openProcess(i,!1);try{let e=Be(d,p),t=[],n=a?new Map([...e.byName].filter(([e])=>e.includes(a.toLowerCase()))):e.byName,r=0n,i=!1;for(;r<140737488289792n&&t.length<l;){let i=d.queryRegion(p,r);if(!i)break;let o=i.size,s=!0;if(f!==null&&(s=(i.protection&f)===f,i.protection&~f&7&&(s=!1)),s&&a){let e=!1;for(let[,t]of n)if(i.baseAddress>=t.baseAddress&&i.baseAddress<t.baseAddress+BigInt(t.size)){e=!0;break}s=e}if(s){let n=Ve(i.baseAddress,e.byName);t.push({base:`0x${i.baseAddress.toString(16)}`,size:o,protection:Re(i.protection),state:i.state,type:i.type,moduleName:n})}r=i.baseAddress+BigInt(i.size)}return i=t.length>=l,{regions:t,totalRegions:t.length,truncated:i,platform:d.platform,hint:t.length===0?`No regions matched the filter. Try broader criteria.`:i?`Returned ${t.length} regions (capped at ${l}). Narrow with moduleName or protection to see more specific results.`:`Found ${t.length} regions. Use moduleName to filter by module.`}}finally{d.closeProcess(p)}})}};const Ue={0:`UnusedStream`,1:`ReservedStream0`,2:`ReservedStream1`,3:`ThreadListStream`,4:`ModuleListStream`,5:`MemoryListStream`,6:`ExceptionStream`,7:`SystemInfoStream`,8:`ThreadExListStream`,9:`Memory64ListStream`,10:`CommentStreamA`,11:`CommentStreamW`,12:`HandleDataStream`,13:`FunctionTableStream`,14:`UnloadedModuleListStream`,15:`MiscInfoStream`,16:`MemoryInfoListStream`,17:`ThreadInfoListStream`,18:`HandleOperationListStream`,19:`TokenStream`,20:`JavaScriptDataStream`,21:`SystemMemoryInfoStream`,22:`ProcessVmCountersStream`},We={0:`x86`,5:`ARM32`,9:`x64`,12:`ARM64`,65535:`Unknown`};var Ge=class{buf;pos=0;constructor(e){this.buf=e}readU8(){return this.buf.readUInt8(this.pos++)}readU16(){let e=this.buf.readUInt16LE(this.pos);return this.pos+=2,e}readU32(){let e=this.buf.readUInt32LE(this.pos);return this.pos+=4,e}readU64(){let e=this.buf.readBigUInt64LE(this.pos);return this.pos+=8,e}readBytes(e){let t=this.buf.subarray(this.pos,this.pos+e);return this.pos+=e,t}readString(e){let t=Math.min(this.pos+e,this.buf.length),n=this.pos,r=this.buf;for(;n<t&&r[n]!==0;)n++;let i=r.subarray(this.pos,n).toString(`utf8`);return this.pos+=e,i}seek(e){this.pos=e}tell(){return this.pos}getBuf(){return this.buf}valid(e,t=1){return e>=0&&e+t<=this.buf.length}length(){return this.buf.length}readAt(e){if(!this.valid(e))throw Error(`RVA 0x${e.toString(16)} out of bounds`);return e}};function Ke(e){let t;try{t=ie(e)}catch(t){return{success:!1,filePath:e,error:`Cannot read file: ${t instanceof Error?t.message:String(t)}`,fileSize:0,streamCount:0,streams:[],modules:[],threads:[],memoryRanges:[],hasMemory64:!1}}let n=new Ge(t),r={success:!0,filePath:e,fileSize:t.length,streamCount:0,streams:[],modules:[],threads:[],memoryRanges:[],hasMemory64:!1};try{if(n.readU32()!==1347241037)return r.success=!1,r.error=`Not a valid minidump file (bad signature)`,r;n.readU16(),n.readU16();let e=n.readU32(),t=n.readU32();n.readU32(),n.readU32(),n.readU64(),r.streamCount=e,n.seek(t);let i=[];for(let t=0;t<e;t++){let e=n.readU32(),t=n.readU32(),a=n.readU32();i.push({streamType:e,locationRva:a,size:t}),r.streams.push({streamType:e,streamName:Ue[e]??`Unknown(${e})`,size:t,locationRva:a})}for(let e of i)try{qe(n,e,r)}catch{}return r}catch(e){return r.success=!1,r.error=e instanceof Error?e.message:String(e),r}}function qe(e,t,n){switch(t.streamType){case 3:Je(e,t.locationRva,n);break;case 4:Ye(e,t.locationRva,n);break;case 5:Xe(e,t.locationRva,n);break;case 6:Qe(e,t.locationRva,n);break;case 7:$e(e,t.locationRva,n);break;case 9:Ze(e,t.locationRva,n),n.hasMemory64=!0;break}}function Je(e,t,n){e.seek(t);let r=e.readU32();for(let t=0;t<r;t++){let t=e.readU32(),r=e.readU32(),i=e.readU32(),a=e.readU32();e.readU64();let o=e.readU64(),s=e.readU32();e.readU32(),e.readU32();let c=e.readU32();n.threads.push({threadId:t,suspendCount:r,priorityClass:i,priority:a,stackAddress:`0x${o.toString(16)}`,stackSize:s,contextRva:c})}}function Ye(e,t,n){e.seek(t);let r=e.readU32();for(let t=0;t<r;t++){let t=e.readU64(),r=e.readU32();e.readU32();let i=e.readU32(),a=e.readU32(),o=e.readU16(),s=e.readU16(),c=e.readU16(),l=e.readU16();e.readU32(),e.readU32(),e.readU32(),e.readU32(),e.readU64(),e.readU64();let u=`(unknown)`;if(e.valid(a)){let t=e.tell();e.seek(a),u=e.readString(256),e.seek(t)}let d=i>0?new Date(i*1e3).toISOString():`n/a`;n.modules.push({baseAddress:`0x${t.toString(16)}`,size:r,name:u,timestamp:d,checksum:0,version:`${o}.${s}.${c}.${l}`})}}function Xe(e,t,n){e.seek(t);let r=e.readU32();for(let t=0;t<r;t++){let t=e.readU64(),r=e.readU64(),i=e.readU32();n.memoryRanges.push({startAddress:`0x${t.toString(16)}`,size:Number(r),dataOffset:i})}}function Ze(e,t,n){e.seek(t);let r=e.readU64(),i=e.readU64();for(let t=0;t<Number(r)&&t<1e4;t++){let r=e.readU64(),a=e.readU64();n.memoryRanges.push({startAddress:`0x${r.toString(16)}`,size:Number(a),dataOffset:Number(i)+t*16})}}function Qe(e,t,n){e.seek(t);let r=e.readU32();e.readU32();let i=e.readU32(),a=e.readU32();e.readU64();let o=e.readU64(),s=e.readU32();e.readU32();let c=[];for(let t=0;t<s&&t<15;t++)c.push(`0x${e.readU64().toString(16)}`);n.exception={exceptionCode:`0x${i.toString(16)}`,exceptionFlags:a,exceptionAddress:`0x${o.toString(16)}`,threadId:r,numParams:s,params:c}}function $e(e,t,n){e.seek(t);let r=e.readU16(),i=e.readU16(),a=e.readU16(),o=e.readU8();e.readU8();let s=e.readU32(),c=e.readU32(),l=e.readU32(),u=e.readU32();n.systemInfo={processorArchitecture:We[r]??`Unknown(${r})`,processorLevel:i,processorRevision:a,numberOfProcessors:o,majorVersion:s,minorVersion:c,buildNumber:l,platformId:u,csdVersion:``}}function et(e,t){let n;try{n=BigInt(t.startsWith(`0x`)?t:`0x${t}`)}catch{return{address:t,found:!1}}for(let r of e.modules){let e=BigInt(r.baseAddress),i=e+BigInt(r.size);if(n>=e&&n<i)return{address:t,found:!0,module:r,offset:Number(n-e)}}for(let r of e.memoryRanges){let e=BigInt(r.startAddress),i=e+BigInt(r.size);if(n>=e&&n<i)return{address:t,found:!0,memoryRange:r,offset:Number(n-e)}}return{address:t,found:!1}}function tt(e,t){return t.map((t,n)=>({...et(e,t),queryIndex:n}))}var nt=class{async handleMemoryParseDump(e){return f(async()=>{let t=o(e,`filePath`,``)?.trim();if(!t||t.length===0)throw Error(`filePath is required (absolute or relative path to .dmp file)`);let n=l(e,`includeModules`,!0),r=l(e,`includeThreads`,!0),i=l(e,`includeMemoryRanges`,!0),a=l(e,`includeException`,!0),s=l(e,`includeSystemInfo`,!0),u=c(e,`resolveAddresses`),d=Ke(t);if(!d.success)return{success:!1,error:d.error,filePath:t};let f={success:!0,filePath:d.filePath,fileSize:d.fileSize,streamCount:d.streamCount,streams:d.streams.map(e=>({type:e.streamName,size:e.size}))};if(n&&d.modules.length>0&&(f.modules=d.modules,f.moduleCount=d.modules.length),r&&d.threads.length>0&&(f.threads=d.threads,f.threadCount=d.threads.length),i&&d.memoryRanges.length>0&&(f.memoryRanges=d.memoryRanges.slice(0,500),f.memoryRangeCount=d.memoryRanges.length,d.memoryRanges.length>500&&(f.memoryRangeTruncated=!0),f.hasMemory64=d.hasMemory64),a&&d.exception&&(f.exception=d.exception),s&&d.systemInfo&&(f.systemInfo=d.systemInfo),u&&u.length>0){let e=tt(d,u),t=e.filter(e=>e.found);f.addressResolutions=e,f.resolvedCount=t.length,f.totalQueried=e.length}return f})}},rt=class{sessions;scans;ptrChains;structures;hooks;readwrite;integrity;regions;findAccesses;minidump;auditTrail=new g;constructor(e,t,n,r,i,a,o,s,c,l,u,d,f,p){this.sessions=new ce(t,this.auditTrail),this.scans=new le(e,d,f,p,this.auditTrail),this.ptrChains=new de(n,f,p,this.auditTrail),this.structures=new be(r,f,p,this.auditTrail),this.hooks=new Ce(i,a,f,p,this.auditTrail),this.readwrite=new Te(o,f,p,this.auditTrail),this.integrity=new Ne(s,c,l,u,f,p,this.auditTrail),this.regions=new He,this.findAccesses=new Ie(i,it(o),at(),f,p),this.minidump=new nt}handleScanSessionDispatch(e){switch(String(e.action??``)){case`delete`:return this.sessions.handleScanDelete(e);case`export`:return this.sessions.handleScanExport(e);default:return this.sessions.handleScanList(e)}}handleScanList=e=>this.sessions.handleScanList(e);handleScanDelete=e=>this.sessions.handleScanDelete(e);handleScanExport=e=>this.sessions.handleScanExport(e);handleFirstScan=e=>this.scans.handleFirstScan(e);handleNextScan=e=>this.scans.handleNextScan(e);handleUnknownScan=e=>this.scans.handleUnknownScan(e);handlePointerScan=e=>this.scans.handlePointerScan(e);handleGroupScan=e=>this.scans.handleGroupScan(e);handleAobScan=e=>this.scans.handleAobScan(e);handlePointerChainDispatch(e){switch(String(e.action??``)){case`validate`:return this.ptrChains.handlePointerChainValidate(e);case`resolve`:return this.ptrChains.handlePointerChainResolve(e);case`export`:return this.ptrChains.handlePointerChainExport(e);default:return this.ptrChains.handlePointerChainScan(e)}}handlePointerChainScan=e=>this.ptrChains.handlePointerChainScan(e);handlePointerChainValidate=e=>this.ptrChains.handlePointerChainValidate(e);handlePointerChainResolve=e=>this.ptrChains.handlePointerChainResolve(e);handlePointerChainExport=e=>this.ptrChains.handlePointerChainExport(e);handleStructureAnalyze=e=>this.structures.handleStructureAnalyze(e);handleVtableParse=e=>this.structures.handleVtableParse(e);handleStructureExportC=e=>this.structures.handleStructureExportC(e);handleStructureCompare=e=>this.structures.handleStructureCompare(e);handleBreakpointDispatch(e){switch(String(e.action??``)){case`remove`:return this.hooks.handleBreakpointRemove(e);case`list`:return this.hooks.handleBreakpointList(e);case`trace`:return this.hooks.handleBreakpointTrace(e);default:return this.hooks.handleBreakpointSet(e)}}handleBreakpointSet=e=>this.hooks.handleBreakpointSet(e);handleBreakpointRemove=e=>this.hooks.handleBreakpointRemove(e);handleBreakpointList=e=>this.hooks.handleBreakpointList(e);handleBreakpointTrace=e=>this.hooks.handleBreakpointTrace(e);handlePatchBytes=e=>this.hooks.handlePatchBytes(e);handlePatchNop=e=>this.hooks.handlePatchNop(e);handlePatchUndo=e=>this.hooks.handlePatchUndo(e);handleCodeCaves=e=>this.hooks.handleCodeCaves(e);handleFreezeDispatch(e){return String(e.action??``)===`unfreeze`?this.readwrite.handleUnfreeze(e):this.readwrite.handleFreeze(e)}handleWriteHistoryDispatch(e){return String(e.action??``)===`redo`?this.readwrite.handleWriteRedo(e):this.readwrite.handleWriteUndo(e)}handleWriteValue=e=>this.readwrite.handleWriteValue(e);handleFreeze=e=>this.readwrite.handleFreeze(e);handleUnfreeze=e=>this.readwrite.handleUnfreeze(e);handleDump=e=>this.readwrite.handleDump(e);handleWriteUndo=e=>this.readwrite.handleWriteUndo(e);handleWriteRedo=e=>this.readwrite.handleWriteRedo(e);handleSpeedhackDispatch(e){let t=String(e.action??``);return t===`set`?this.integrity.handleSpeedhackSet(e):t===`restore`?this.integrity.handleSpeedhackRestore(e):this.integrity.handleSpeedhackApply(e)}handleSpeedhackApply=e=>this.integrity.handleSpeedhackApply(e);handleSpeedhackSet=e=>this.integrity.handleSpeedhackSet(e);handleSpeedhackRestore=e=>this.integrity.handleSpeedhackRestore(e);handleHeapEnumerate=e=>this.integrity.handleHeapEnumerate(e);handleHeapStats=e=>this.integrity.handleHeapStats(e);handleHeapAnomalies=e=>this.integrity.handleHeapAnomalies(e);handlePEHeaders=e=>this.integrity.handlePEHeaders(e);handlePEImportsExports=e=>this.integrity.handlePEImportsExports(e);handleInlineHookDetect=e=>this.integrity.handleInlineHookDetect(e);handleAntiCheatDetect=e=>this.integrity.handleAntiCheatDetect(e);handleGuardPages=e=>this.integrity.handleGuardPages(e);handleIntegrityCheck=e=>this.integrity.handleIntegrityCheck(e);handleRegionEnumerate=e=>this.regions.handleRegionEnumerate(e);handleFindAccesses=e=>this.findAccesses.handleFindAccesses(e);handleMemoryParseDump=e=>this.minidump.handleMemoryParseDump(e)};function it(t){return async(n,r,i)=>{try{let e=await t.dumpMemory(n,r,i);return{success:!0,data:Array.from(e).map(e=>e.toString(16).padStart(2,`0`).toUpperCase()).join(` `)}}catch(t){return e.debug(`memory_find_accesses: MemoryController.dumpMemory failed:`,t),{success:!1,error:t instanceof Error?t.message:String(t)}}}}function at(){let e=null;return async(t,n)=>{if(!e){let{Disassembler:t}=await import(`./disasm-DoxSucGp.mjs`).then(e=>e.n);e=new t}let r=Buffer.from(t),i=parseInt(n.replace(/^0x/i,``),16);if(Number.isNaN(i))throw Error(`Invalid instruction address: ${n}`);let a=await e.disassemble(r,{arch:`x64`,offset:i,count:1});if(a.length===0)throw Error(`Capstone returned no instructions for the given bytes`);let o=a[0];return o.opStr?`${o.mnemonic} ${o.opStr}`:o.mnemonic}}export{rt as MemoryScanHandlers};

package/dist/heap-sampling-BqdiU-5j.mjs

@@ -0,0 +1 @@
+import{i as e}from"./parse-args-B6dwWc9k.mjs";import{n as t,r as n}from"./cdp-session-Dy4OwMOP.mjs";async function r(r,i){let a=e(r,`durationMs`,5e3),o=Math.min(6e4,Math.max(500,Number.isFinite(a)?a:5e3)),s=Math.min(500,Math.max(1,e(r,`topN`,50))),{session:c,owned:l}=await n(t(i));if(!c)return{success:!1,error:`No CDP session available — browser must be connected via browser_launch or browser_attach`,durationMs:0,totalSampledBytes:0,sampleCount:0,sites:[],summary:`CDP session unavailable`};let u=Date.now();try{await c.send(`HeapProfiler.enable`),await c.send(`HeapProfiler.startSampling`,{samplingInterval:32768}),await new Promise(e=>setTimeout(e,o));let e=await c.send(`HeapProfiler.getSamplingProfile`);await c.send(`HeapProfiler.stopSampling`).catch(()=>void 0);let t=e?.profile?.head;if(!t)return{success:!0,durationMs:Date.now()-u,totalSampledBytes:0,sampleCount:0,sites:[],summary:`Sampling returned an empty profile (no allocations captured in window)`};let n=[],r=e=>{let t=(Array.isArray(e.children)?e.children:[]).reduce((e,t)=>e+r(t),0),i=e.selfSize??0;if(i>0){let r=e.callFrame??{};n.push({functionName:r.functionName??`(anonymous)`,scriptId:r.scriptId??`?`,url:r.url??``,lineNumber:r.lineNumber??-1,columnNumber:r.columnNumber??-1,selfSize:i,totalSize:i+t,sampleCount:e.identityGroups?.length??0})}return i+t},i=r(t);n.sort((e,t)=>t.totalSize-e.totalSize);let a=n.slice(0,s),l=n.reduce((e,t)=>e+t.sampleCount,0);return{success:!0,durationMs:Date.now()-u,totalSampledBytes:i,sampleCount:l,sites:a,summary:`${a.length} top allocation sites; ${i} bytes sampled across ${n.length} nodes`}}catch(e){return await c.send(`HeapProfiler.stopSampling`).catch(()=>void 0),{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-u,totalSampledBytes:0,sampleCount:0,sites:[],summary:`Sampling failed`}}finally{l&&await c.detach().catch(()=>void 0)}}export{r as handleHeapSampling};