@remnux/mcp-server 0.1.54 → 0.1.56

package/dist/handlers/compare-files.d.ts

@@ -0,0 +1,10 @@
+import type { HandlerDeps } from "./types.js";
+import type { CompareFilesArgs } from "../schemas/tools.js";
+export declare function handleCompareFiles(deps: HandlerDeps, args: CompareFilesArgs): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+//# sourceMappingURL=compare-files.d.ts.map

package/dist/handlers/compare-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare-files.d.ts","sourceRoot":"","sources":["../../src/handlers/compare-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAwH5D,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB;;;;;;GA8CjF"}

package/dist/handlers/compare-files.js

@@ -0,0 +1,147 @@
+import { validateFilePath } from "../security/blocklist.js";
+import { formatResponse, formatError } from "../response.js";
+import { REMnuxError } from "../errors/remnux-error.js";
+import { toREMnuxError } from "../errors/error-mapper.js";
+import { resolveSamplePath } from "../utils/resolve-sample-path.js";
+import { checkFileExists } from "../utils/check-file-exists.js";
+import { parsePeImports } from "../parsers/imports.js";
+import { parseDiecOutput } from "../parsers/diec.js";
+import { parseCapaOutput } from "../parsers/capa.js";
+import { parseR2Sections } from "../parsers/r2.js";
+import { diffFileMeta } from "../analysis/file-diff.js";
+/** Shannon entropy of the file's bytes, via a one-shot python helper. */
+const ENTROPY_PY = "import sys,math,collections\n" +
+    "b=open(sys.argv[1],'rb').read()\n" +
+    "n=len(b) or 1\n" +
+    "c=collections.Counter(b)\n" +
+    "print(round(-sum((v/n)*math.log2(v/n) for v in c.values()),4))";
+function archFromFileType(ft) {
+    if (/PE32\+|x86-64|x86_64|64-bit/i.test(ft))
+        return "x64";
+    if (/PE32\b|Intel 80386|80386|32-bit/i.test(ft))
+        return "x86";
+    return undefined;
+}
+/** Pull the value after "Type: name" from a diec finding for a given category. */
+function diecValue(diecRaw, category) {
+    const parsed = parseDiecOutput(diecRaw);
+    const f = parsed.findings.find((x) => x.category === category);
+    if (!f)
+        return undefined;
+    const idx = f.description.indexOf(": ");
+    return idx >= 0 ? f.description.slice(idx + 2) : f.description;
+}
+async function num(connector, cmd) {
+    try {
+        const r = await connector.execute(cmd, { timeout: 30000 });
+        const n = parseFloat((r.stdout || "").trim().split(/\s+/)[0]);
+        return Number.isFinite(n) ? n : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function gatherFileMeta(connector, filePath, fileArg, runCapa) {
+    let fileType = "";
+    let sha256 = "";
+    try {
+        fileType = (await connector.execute(["file", filePath], { timeout: 30000 })).stdout?.trim() ?? "";
+    }
+    catch { /* best effort */ }
+    try {
+        sha256 = ((await connector.execute(["sha256sum", filePath], { timeout: 30000 })).stdout || "").trim().split(/\s+/)[0] || "";
+    }
+    catch { /* best effort */ }
+    const size_bytes = (await num(connector, ["stat", "-c", "%s", filePath])) ?? 0;
+    const entropy = await (async () => {
+        try {
+            const r = await connector.execute(["python3", "-c", ENTROPY_PY, filePath], { timeout: 30000 });
+            const n = parseFloat((r.stdout || "").trim());
+            return Number.isFinite(n) ? n : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    let compiler;
+    let packer;
+    try {
+        const diec = (await connector.execute(["diec", "-j", filePath], { timeout: 60000 })).stdout || "";
+        compiler = diecValue(diec, "compiler");
+        packer = diecValue(diec, "packer") ?? diecValue(diec, "protector");
+    }
+    catch { /* best effort */ }
+    let imports = [];
+    try {
+        const imp = parsePeImports((await connector.execute(["readpe", "-i", "-f", "json", filePath], { timeout: 60000 })).stdout || "");
+        imports = imp.dlls.flatMap((d) => d.functions);
+    }
+    catch { /* non-PE or failure */ }
+    let sections = [];
+    try {
+        const sec = parseR2Sections((await connector.execute(["r2", "-2", "-q", "-N", "-e", "scr.color=0", "-c", "iSj", filePath], { timeout: 30000 })).stdout || "");
+        sections = sec.map((s) => s.name).filter((n) => n.length > 0);
+    }
+    catch { /* best effort */ }
+    let capabilities = [];
+    if (runCapa) {
+        try {
+            const capa = parseCapaOutput((await connector.execute(["capa", "-j", filePath], { timeout: 300000 })).stdout || "");
+            capabilities = capa.findings.map((f) => f.description);
+        }
+        catch { /* best effort */ }
+    }
+    return {
+        file: fileArg,
+        file_type: fileType,
+        sha256,
+        size_bytes,
+        arch: archFromFileType(fileType),
+        entropy,
+        compiler,
+        packer,
+        imports,
+        import_count: imports.length,
+        capabilities,
+        capa_run: runCapa,
+        sections,
+    };
+}
+export async function handleCompareFiles(deps, args) {
+    const startTime = Date.now();
+    try {
+        const { connector, config } = deps;
+        const depth = args.depth ?? "standard";
+        for (const f of [args.file_a, args.file_b]) {
+            if (!config.noSandbox) {
+                const v = validateFilePath(f, config.samplesDir);
+                if (!v.safe) {
+                    return formatError("compare_files", new REMnuxError(v.error || "Invalid file path", "INVALID_PATH", "validation", "Use a relative path within the samples directory"), startTime);
+                }
+            }
+        }
+        const pa = resolveSamplePath(args.file_a, config.samplesDir, config.mode);
+        const pb = resolveSamplePath(args.file_b, config.samplesDir, config.mode);
+        const ea = await checkFileExists(connector, pa.filePath);
+        if (ea)
+            return formatError("compare_files", ea, startTime);
+        const eb = await checkFileExists(connector, pb.filePath);
+        if (eb)
+            return formatError("compare_files", eb, startTime);
+        const runCapa = depth === "standard";
+        const metaA = await gatherFileMeta(connector, pa.filePath, args.file_a, runCapa);
+        const metaB = await gatherFileMeta(connector, pb.filePath, args.file_b, runCapa);
+        const diff = diffFileMeta(metaA, metaB);
+        return formatResponse("compare_files", {
+            depth,
+            basis: "Structured diff of two files' static properties (size, entropy, architecture, compiler, packer, imports, capabilities, sections). Reuses readpe/diec/capa/radare2; capability diff requires depth='standard'.",
+            file_a: { ...diff.file_a, file_type: metaA.file_type, size_bytes: metaA.size_bytes, import_count: metaA.import_count },
+            file_b: { ...diff.file_b, file_type: metaB.file_type, size_bytes: metaB.size_bytes, import_count: metaB.import_count },
+            diff,
+        }, startTime);
+    }
+    catch (error) {
+        return formatError("compare_files", toREMnuxError(error, deps.config.mode), startTime);
+    }
+}
+//# sourceMappingURL=compare-files.js.map

package/dist/handlers/compare-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare-files.js","sourceRoot":"","sources":["../../src/handlers/compare-files.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAiB,MAAM,0BAA0B,CAAC;AAEvE,yEAAyE;AACzE,MAAM,UAAU,GACd,+BAA+B;IAC/B,mCAAmC;IACnC,iBAAiB;IACjB,4BAA4B;IAC5B,gEAAgE,CAAC;AAEnE,SAAS,gBAAgB,CAAC,EAAU;IAClC,IAAI,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,OAAe,EAAE,QAAgB;IAClD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,SAAoB,EAAE,GAAa;IACpD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,SAAoB,EACpB,QAAgB,EAChB,OAAe,EACf,OAAgB;IAEhB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9H,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,QAA4B,CAAC;IACjC,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAClG,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvC,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjI,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAEnC,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CACzB,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CACjI,CAAC;QACF,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACpH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,QAAQ;QACnB,MAAM;QACN,UAAU;QACV,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QAChC,OAAO;QACP,QAAQ;QACR,MAAM;QACN,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,YAAY;QACZ,QAAQ,EAAE,OAAO;QACjB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAiB,EAAE,IAAsB;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;QAEvC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACZ,OAAO,WAAW,CAChB,eAAe,EACf,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,kDAAkD,CAAC,EACjI,SAAS,CACV,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,EAAE;YAAE,OAAO,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,EAAE;YAAE,OAAO,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,KAAK,KAAK,UAAU,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEjF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAExC,OAAO,cAAc,CACnB,eAAe,EACf;YACE,KAAK;YACL,KAAK,EAAE,+MAA+M;YACtN,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;YACtH,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;YACtH,IAAI;SACL,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/handlers/extract-iocs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-iocs.d.ts","sourceRoot":"","sources":["../../src/handlers/extract-iocs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAK3D,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,eAAe;;;;;;GAsBtB"}
+{"version":3,"file":"extract-iocs.d.ts","sourceRoot":"","sources":["../../src/handlers/extract-iocs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAK3D,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,eAAe;;;;;;GA6BtB"}

package/dist/handlers/extract-iocs.js

@@ -14,6 +14,12 @@ export async function handleExtractIOCs(_deps, args) {
         if (args.include_noise) {
             data.noise = result.noise;
         }
+        // Point the next hop at malware-specific OSINT enrichment for the IOCs just extracted.
+        if (result.iocs.length > 0) {
+            data.next_step =
+                "To enrich these IOCs with external OSINT, call get_osint_guidance for malware-specific triage " +
+                    "tradecraft (hash-first, disclosure-aware) and a curated catalog of lookup services.";
+        }
         return formatResponse("extract_iocs", data, startTime);
     }
     catch (error) {

package/dist/handlers/extract-iocs.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-iocs.js","sourceRoot":"","sources":["../../src/handlers/extract-iocs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAkB,EAClB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB;SAC5C,CAAC,CAAC;QAEH,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,CAAC;QAED,OAAO,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"extract-iocs.js","sourceRoot":"","sources":["../../src/handlers/extract-iocs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAkB,EAClB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB;SAC5C,CAAC,CAAC;QAEH,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,CAAC;QAED,uFAAuF;QACvF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS;gBACZ,gGAAgG;oBAChG,qFAAqF,CAAC;QAC1F,CAAC;QAED,OAAO,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/handlers/get-tool-help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-tool-help.d.ts","sourceRoot":"","sources":["../../src/handlers/get-tool-help.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS3D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GAmFtB"}
+{"version":3,"file":"get-tool-help.d.ts","sourceRoot":"","sources":["../../src/handlers/get-tool-help.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS3D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GAmGtB"}

package/dist/handlers/get-tool-help.js

@@ -24,6 +24,9 @@ export async function handleGetToolHelp(deps, args) {
             : [["--help"], ["-h"]];
         let output = "";
         let exitCode = 0;
+        // Set when a thrown Docker/OCI exec error indicates the binary is missing
+        // (Docker surfaces this instead of the shell's exit code 127).
+        let notFound = false;
         for (const helpArgs of helpInvocations) {
             try {
                 const result = await connector.execute([resolved, ...helpArgs], { timeout: 10000 });
@@ -43,10 +46,18 @@ export async function handleGetToolHelp(deps, args) {
                 if (/timeout/i.test(msg)) {
                     return formatError("get_tool_help", new REMnuxError(`Timed out running '${tool} ${helpArgs.join(" ")}'`, "COMMAND_TIMEOUT", "timeout", "The tool may require input or not support help flags"), startTime);
                 }
+                // Docker/OCI surface a missing executable as a thrown exec error rather
+                // than the shell's exit code 127. Mark it so we return NOT_FOUND below.
+                if (/executable file not found|not found in \$?PATH|OCI runtime exec failed/i.test(msg)) {
+                    notFound = true;
+                }
                 // Continue to next help invocation
             }
         }
         if (!output) {
+            if (notFound) {
+                return formatError("get_tool_help", new REMnuxError(`Tool '${tool}' not found. It may not be installed on this REMnux system.`, "NOT_FOUND", "not_found", "Use check_tools to see installed tools, or install with apt/pip"), startTime);
+            }
             return formatError("get_tool_help", new REMnuxError(`No help output from '${tool}'. The tool may not be installed or may not support --help/-h.`, "EMPTY_OUTPUT", "tool_failure", "Check that the tool is installed with check_tools, or try run_tool with a specific command"), startTime);
         }
         return formatResponse("get_tool_help", {

package/dist/handlers/get-tool-help.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-tool-help.js","sourceRoot":"","sources":["../../src/handlers/get-tool-help.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,uBAAuB,IAAI,4FAA4F,EACvH,eAAe,EACf,YAAY,EACZ,4DAA4D,CAC7D,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,mEAAmE;QACnE,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,IAAI,IAAI,CAAC;QAEtC,+EAA+E;QAC/E,oEAAoE;QACpE,MAAM,eAAe,GAAe,GAAG,EAAE,QAAQ;YAC/C,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAChB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpF,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClF,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAE3B,yEAAyE;gBACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBAC5B,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,SAAS,IAAI,6DAA6D,EAC1E,WAAW,EACX,WAAW,EACX,iEAAiE,CAClE,EAAE,SAAS,CAAC,CAAC;gBAChB,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,GAAG,QAAQ,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,sBAAsB,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACnD,iBAAiB,EACjB,SAAS,EACT,sDAAsD,CACvD,EAAE,SAAS,CAAC,CAAC;gBAChB,CAAC;gBACD,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,wBAAwB,IAAI,gEAAgE,EAC5F,cAAc,EACd,cAAc,EACd,4FAA4F,CAC7F,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,OAAO,cAAc,CAAC,eAAe,EAAE;YACrC,IAAI;YACJ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,QAAQ;SACpB,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}
+{"version":3,"file":"get-tool-help.js","sourceRoot":"","sources":["../../src/handlers/get-tool-help.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,uBAAuB,IAAI,4FAA4F,EACvH,eAAe,EACf,YAAY,EACZ,4DAA4D,CAC7D,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,mEAAmE;QACnE,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,IAAI,IAAI,CAAC;QAEtC,+EAA+E;QAC/E,oEAAoE;QACpE,MAAM,eAAe,GAAe,GAAG,EAAE,QAAQ;YAC/C,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAChB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpF,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClF,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAE3B,yEAAyE;gBACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBAC5B,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,SAAS,IAAI,6DAA6D,EAC1E,WAAW,EACX,WAAW,EACX,iEAAiE,CAClE,EAAE,SAAS,CAAC,CAAC;gBAChB,CAAC;gBAED,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,GAAG,QAAQ,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,sBAAsB,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACnD,iBAAiB,EACjB,SAAS,EACT,sDAAsD,CACvD,EAAE,SAAS,CAAC,CAAC;gBAChB,CAAC;gBACD,wEAAwE;gBACxE,wEAAwE;gBACxE,IAAI,yEAAyE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxF,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,SAAS,IAAI,6DAA6D,EAC1E,WAAW,EACX,WAAW,EACX,iEAAiE,CAClE,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YACD,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,wBAAwB,IAAI,gEAAgE,EAC5F,cAAc,EACd,cAAc,EACd,4FAA4F,CAC7F,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,OAAO,cAAc,CAAC,eAAe,EAAE;YACrC,IAAI;YACJ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,QAAQ;SACpB,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/handlers/osint.d.ts

@@ -0,0 +1,10 @@
+import type { HandlerDeps } from "./types.js";
+import type { GetOsintGuidanceArgs } from "../schemas/tools.js";
+export declare function handleGetOsintGuidance(_deps: HandlerDeps, args: GetOsintGuidanceArgs): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+//# sourceMappingURL=osint.d.ts.map

package/dist/handlers/osint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osint.d.ts","sourceRoot":"","sources":["../../src/handlers/osint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AA0ChE,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB;;;;;;GAsC1F"}

package/dist/handlers/osint.js

@@ -0,0 +1,72 @@
+import { formatResponse, formatError } from "../response.js";
+import { toREMnuxError } from "../errors/error-mapper.js";
+import { OSINT_GUIDANCE } from "../osint/guidance.js";
+import { loadOsintCatalog, condensedCatalog, resourcesForIocType, } from "../osint/index.js";
+const NOTES = "Server-authored, bundled, offline guidance. This tool returns GUIDANCE only — it makes no network calls and " +
+    "holds no API keys; run the lookups with your own tools. The resource catalog (data/osint-resources.json) is " +
+    "maintained by pull request and curated for free, mostly-stable services. The canonical source lists are " +
+    "zeltser.com/automated-malware-analysis, /lookup-malicious-websites, and /malicious-ip-blocklists.";
+/** Select the guidance prose for a topic. The catalog ('resources') is handled separately by ioc_type. */
+function selectGuidance(topic) {
+    switch (topic) {
+        case "tradecraft":
+            return { tradecraft: OSINT_GUIDANCE.tradecraft };
+        case "workflow":
+            return {
+                workflow_by_ioc: OSINT_GUIDANCE.workflow_by_ioc,
+                disclosure_legend: OSINT_GUIDANCE.disclosure_legend,
+            };
+        case "access":
+            return { access_guidance: OSINT_GUIDANCE.access_guidance };
+        case "resources":
+            return {};
+        case "all":
+        default:
+            return {
+                tradecraft: OSINT_GUIDANCE.tradecraft,
+                access_guidance: OSINT_GUIDANCE.access_guidance,
+                workflow_by_ioc: OSINT_GUIDANCE.workflow_by_ioc,
+                disclosure_legend: OSINT_GUIDANCE.disclosure_legend,
+            };
+    }
+}
+export async function handleGetOsintGuidance(_deps, args) {
+    const startTime = Date.now();
+    try {
+        const topic = args.topic ?? "all";
+        const iocType = args.ioc_type;
+        const data = {
+            topic,
+            version: OSINT_GUIDANCE.version,
+            // Persistent header on EVERY response — leads not verdicts, corroborate, triage not assessment.
+            header: OSINT_GUIDANCE.header,
+            scope: OSINT_GUIDANCE.scope,
+        };
+        if (iocType)
+            data.ioc_type = iocType;
+        // Guidance prose, selected by `topic`.
+        Object.assign(data, selectGuidance(topic));
+        // Resources, selected by `ioc_type` (full detail) or `topic` (condensed / full / omitted).
+        if (iocType) {
+            data.resources = resourcesForIocType(iocType);
+        }
+        else if (topic === "resources") {
+            data.resources = loadOsintCatalog().resources;
+        }
+        else if (topic === "all") {
+            data.resources = condensedCatalog();
+            data.resources_note =
+                "Condensed index. The lean flow for a real sample: call once with topic='all' for the prose plus this " +
+                    "index, then call topic='resources' with ioc_type=<hash|url|domain|ip|family|host_artifact> per indicator " +
+                    "type to get full per-entry detail (caveats, both disclosure fields, stability) without re-emitting the " +
+                    "prose. access_guidance.first_moves lists the fastest keyless move per type.";
+        }
+        // Prose-only topics with no ioc_type omit `resources` entirely (token hygiene).
+        data.notes = NOTES;
+        return formatResponse("get_osint_guidance", data, startTime);
+    }
+    catch (error) {
+        return formatError("get_osint_guidance", toREMnuxError(error), startTime);
+    }
+}
+//# sourceMappingURL=osint.js.map

package/dist/handlers/osint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osint.js","sourceRoot":"","sources":["../../src/handlers/osint.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,KAAK,GACT,8GAA8G;IAC9G,8GAA8G;IAC9G,0GAA0G;IAC1G,mGAAmG,CAAC;AAEtG,0GAA0G;AAC1G,SAAS,cAAc,CAAC,KAAa;IACnC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC;QACnD,KAAK,UAAU;YACb,OAAO;gBACL,eAAe,EAAE,cAAc,CAAC,eAAe;gBAC/C,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;aACpD,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,eAAe,EAAE,CAAC;QAC7D,KAAK,WAAW;YACd,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK,CAAC;QACX;YACE,OAAO;gBACL,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,eAAe,EAAE,cAAc,CAAC,eAAe;gBAC/C,eAAe,EAAE,cAAc,CAAC,eAAe;gBAC/C,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;aACpD,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAkB,EAAE,IAA0B;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAA+B,CAAC;QAErD,MAAM,IAAI,GAA4B;YACpC,KAAK;YACL,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,gGAAgG;YAChG,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,KAAK,EAAE,cAAc,CAAC,KAAK;SAC5B,CAAC;QACF,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAErC,uCAAuC;QACvC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAE3C,2FAA2F;QAC3F,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC;QAChD,CAAC;aAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,GAAG,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,cAAc;gBACjB,uGAAuG;oBACvG,2GAA2G;oBAC3G,yGAAyG;oBACzG,6EAA6E,CAAC;QAClF,CAAC;QACD,gFAAgF;QAEhF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,cAAc,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,oBAAoB,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/dist/handlers/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/handlers/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAyCjE,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW;;;;;;GAgB/D;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB;;;;;;GAkB5F"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/handlers/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AA0CjE,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW;;;;;;GAgB/D;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB;;;;;;GAmC5F"}

package/dist/handlers/report.js

@@ -1,6 +1,7 @@
 import { formatResponse, formatError } from "../response.js";
 import { toREMnuxError } from "../errors/error-mapper.js";
 import { REPORT_TEMPLATE, GUIDELINES_DIGEST, ATTRIBUTION, SOURCE_META, } from "../report/content.generated.js";
+import { TRIAGE_DISCIPLINE } from "../report/triage-discipline.js";
 const NOTES = "This report template and writing guidance are bundled with the server and work offline — no network required. " +
     `The canonical, continuously updated source is ${SOURCE_META.fallbackArticleUrl}. ` +
     "When online, the zeltser-website MCP server offers richer tools — malware_get_template, malware_get_guidelines, " +
@@ -47,6 +48,16 @@ export async function handleGetReportGuidance(_deps, args) {
     const startTime = Date.now();
     try {
         const topic = args.topic ?? "all";
+        // The triage-discipline checklist is server-authored operational guidance,
+        // not part of the synced report-writing digest — return it on its own.
+        if (topic === "triage_checklist") {
+            return formatResponse("get_report_guidance", {
+                topic,
+                triage_discipline: TRIAGE_DISCIPLINE,
+                notes: "Server-authored, bundled, offline operational guidance — distinct from the report-writing " +
+                    "guidelines (use any other topic, or 'all', for those).",
+            }, startTime);
+        }
         return formatResponse("get_report_guidance", {
             topic,
             guidelines: selectGuidelines(topic),

package/dist/handlers/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/handlers/report.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,WAAW,GACZ,MAAM,gCAAgC,CAAC;AAExC,MAAM,KAAK,GACT,gHAAgH;IAChH,iDAAiD,WAAW,CAAC,kBAAkB,IAAI;IACnF,kHAAkH;IAClH,uFAAuF,CAAC;AAE1F,0FAA0F;AAC1F,MAAM,UAAU,GAA6B;IAC3C,QAAQ,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,CAAC;IAC1F,UAAU,EAAE,CAAC,YAAY,CAAC;IAC1B,YAAY,EAAE,CAAC,iBAAiB,CAAC;IACjC,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,aAAa,EAAE,CAAC,cAAc,CAAC;IAC/B,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;IAChG,OAAO,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;IACnG,UAAU,EAAE,CAAC,YAAY,CAAC;IAC1B,QAAQ,EAAE,CAAC,uBAAuB,CAAC;CACpC,CAAC;AAEF,+GAA+G;AAC/G,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,GAAG,IAAI,iBAAiB;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAkB;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,cAAc,CACnB,qBAAqB,EACrB;YACE,QAAQ,EAAE,eAAe;YACzB,WAAW,EAAE,WAAW,CAAC,QAAQ;YACjC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,KAAK;SACb,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,qBAAqB,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAkB,EAAE,IAA2B;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QAClC,OAAO,cAAc,CACnB,qBAAqB,EACrB;YACE,KAAK;YACL,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,WAAW,CAAC,UAAU;YACnC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,KAAK;SACb,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,qBAAqB,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/handlers/report.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,WAAW,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,MAAM,KAAK,GACT,gHAAgH;IAChH,iDAAiD,WAAW,CAAC,kBAAkB,IAAI;IACnF,kHAAkH;IAClH,uFAAuF,CAAC;AAE1F,0FAA0F;AAC1F,MAAM,UAAU,GAA6B;IAC3C,QAAQ,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,CAAC;IAC1F,UAAU,EAAE,CAAC,YAAY,CAAC;IAC1B,YAAY,EAAE,CAAC,iBAAiB,CAAC;IACjC,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,aAAa,EAAE,CAAC,cAAc,CAAC;IAC/B,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;IAChG,OAAO,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;IACnG,UAAU,EAAE,CAAC,YAAY,CAAC;IAC1B,QAAQ,EAAE,CAAC,uBAAuB,CAAC;CACpC,CAAC;AAEF,+GAA+G;AAC/G,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,GAAG,IAAI,iBAAiB;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAkB;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,cAAc,CACnB,qBAAqB,EACrB;YACE,QAAQ,EAAE,eAAe;YACzB,WAAW,EAAE,WAAW,CAAC,QAAQ;YACjC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,KAAK;SACb,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,qBAAqB,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAkB,EAAE,IAA2B;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QAElC,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACjC,OAAO,cAAc,CACnB,qBAAqB,EACrB;gBACE,KAAK;gBACL,iBAAiB,EAAE,iBAAiB;gBACpC,KAAK,EACH,4FAA4F;oBAC5F,wDAAwD;aAC3D,EACD,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CACnB,qBAAqB,EACrB;YACE,KAAK;YACL,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,WAAW,CAAC,UAAU;YACnC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,KAAK;SACb,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,qBAAqB,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/handlers/verify-string-usage.d.ts

@@ -0,0 +1,10 @@
+import type { HandlerDeps } from "./types.js";
+import type { VerifyStringUsageArgs } from "../schemas/tools.js";
+export declare function handleVerifyStringUsage(deps: HandlerDeps, args: VerifyStringUsageArgs): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+//# sourceMappingURL=verify-string-usage.d.ts.map

package/dist/handlers/verify-string-usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-string-usage.d.ts","sourceRoot":"","sources":["../../src/handlers/verify-string-usage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AA+BjE,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB;;;;;;GA8L3F"}

package/dist/handlers/verify-string-usage.js

@@ -0,0 +1,173 @@
+import { validateFilePath } from "../security/blocklist.js";
+import { formatResponse, formatError } from "../response.js";
+import { REMnuxError } from "../errors/remnux-error.js";
+import { toREMnuxError } from "../errors/error-mapper.js";
+import { resolveSamplePath } from "../utils/resolve-sample-path.js";
+import { checkFileExists } from "../utils/check-file-exists.js";
+import { looksObscured } from "./check-behavior-prerequisites.js";
+import { parseR2Strings, parseR2Sections, parseR2Functions, parseR2Xrefs, splitMarkedR2Output, R2_MARKERS, } from "../parsers/r2.js";
+import { selectMatches, classifyMatch } from "../analysis/string-usage.js";
+const BASIS = "Static string enumeration (radare2 izj) plus code cross-reference analysis (aa; aar; axt). 'referenced_from_code' " +
+    "means an instruction references the string; 'no_code_xrefs_detected' is a complete-analysis null result and is " +
+    "NOT proof the string is unused; 'unknown' means analysis was incomplete/unreliable (packed, timed out, version " +
+    "drift) and is never a negative. This is a static check — confirm runtime behavior dynamically.";
+/** Base, non-interactive, hermetic r2 invocation flags. */
+const R2_FLAGS = ["-2", "-q", "-N", "-e", "scr.color=0", "-e", "log.quiet=true"];
+/** Total distinct string addresses fed to the (expensive) xref pass. */
+const VADDR_CAP = 40;
+export async function handleVerifyStringUsage(deps, args) {
+    const startTime = Date.now();
+    try {
+        const { connector, config } = deps;
+        if (!args.query) {
+            return formatError("verify_string_usage", new REMnuxError("A non-empty 'query' string is required.", "INVALID_ARGUMENT", "validation", "Pass the string to look for."), startTime);
+        }
+        if (!config.noSandbox) {
+            const validation = validateFilePath(args.file, config.samplesDir);
+            if (!validation.safe) {
+                return formatError("verify_string_usage", new REMnuxError(validation.error || "Invalid file path", "INVALID_PATH", "validation", "Use a relative path within the samples directory"), startTime);
+            }
+        }
+        const { filePath } = resolveSamplePath(args.file, config.samplesDir, config.mode);
+        const fileError = await checkFileExists(connector, filePath);
+        if (fileError)
+            return formatError("verify_string_usage", fileError, startTime);
+        let fileType = "";
+        try {
+            const r = await connector.execute(["file", filePath], { timeout: 30000 });
+            fileType = r.stdout?.trim() ?? "";
+        }
+        catch (error) {
+            const mapped = toREMnuxError(error, config.mode);
+            if (mapped.code === "CONNECTION_FAILED")
+                return formatError("verify_string_usage", mapped, startTime);
+        }
+        // When the `file` probe failed or returned nothing, do NOT assert this is a
+        // non-code file: that would fall through to a confident "not an executable, no
+        // code references" — a false negative on what may be a real executable. Treat an
+        // unknown type as code-capable so the r2 xref pass runs and the
+        // schemaKnown/analysisComplete gating downgrades to UNKNOWN if analysis is degraded.
+        const fileTypeKnown = fileType.trim() !== "";
+        const isCodeFile = fileTypeKnown
+            ? /\bPE32\+?\b|\bELF\b|Mach-O|MS Windows|executable/i.test(fileType)
+            : true;
+        // Pass 1 — enumerate strings (cheap, no analysis). Try izj (mapped sections),
+        // fall back to izzj (whole file). r2 absence is detected here.
+        let r2Available = true;
+        let strings = parseR2Strings("");
+        try {
+            const r = await connector.execute([...["r2"], ...R2_FLAGS, "-c", "izj", filePath], { timeout: 30000 });
+            if (r.exitCode === 127 || /not found|No such file/i.test(r.stderr || "")) {
+                r2Available = false;
+            }
+            else {
+                strings = parseR2Strings(r.stdout || "");
+                if (strings.length === 0) {
+                    const rz = await connector.execute([...["r2"], ...R2_FLAGS, "-c", "izzj", filePath], { timeout: 30000 });
+                    strings = parseR2Strings(rz.stdout || "");
+                }
+            }
+        }
+        catch {
+            r2Available = false;
+        }
+        if (!r2Available) {
+            return formatResponse("verify_string_usage", {
+                file: args.file, query: args.query, file_type: fileType, engine: "radare2", engine_available: false, basis: BASIS,
+                match_count: 0, matches: [],
+                note: "radare2 is unavailable on this system; string cross-reference analysis could not run. Status is UNKNOWN — not a 'no xref' result.",
+            }, startTime);
+        }
+        const maxMatches = args.max_matches ?? 50;
+        const { groups, truncated } = selectMatches(strings, args.query, maxMatches);
+        if (groups.length === 0) {
+            return formatResponse("verify_string_usage", {
+                file: args.file, query: args.query, file_type: fileType, is_code_file: isCodeFile, engine: "radare2", basis: BASIS,
+                match_count: 0, matches: [],
+                note: "The query was not found among this file's strings (radare2 izj/izzj). It is not embedded as a contiguous string — it could still be built at runtime or stored encoded/obfuscated.",
+            }, startTime);
+        }
+        // Non-code file: nothing can reference the string in code.
+        if (!isCodeFile) {
+            const ctx = { isCodeFile: false, fileType, schemaKnown: false, analysisComplete: false, obscured: false };
+            const matches = groups.map((g) => classifyMatch(g, [], [], ctx));
+            return formatResponse("verify_string_usage", { file: args.file, query: args.query, file_type: fileType, is_code_file: false, engine: "radare2", basis: BASIS, match_count: groups.length, matches_truncated: truncated, matches }, startTime);
+        }
+        // Detect packing (reused from check_behavior_prerequisites) — a gate for the invariant.
+        let obscured = false;
+        try {
+            const d = await connector.execute(["diec", "-j", filePath], { timeout: 60000 });
+            obscured = looksObscured(d.stdout || "");
+        }
+        catch {
+            /* best effort */
+        }
+        // Select the groups we can afford to xref (bounded), keeping every classified
+        // group fully covered so a non-queried vaddr is never read as a negative.
+        const queried = new Set();
+        const groupsToClassify = [];
+        for (const g of groups) {
+            const vs = g.vaddrs.map((v) => v.vaddr);
+            if (queried.size + vs.length > VADDR_CAP && groupsToClassify.length > 0)
+                break;
+            vs.forEach((v) => queried.add(v));
+            groupsToClassify.push(g);
+        }
+        const matchesTruncated = truncated || groupsToClassify.length < groups.length;
+        // Pass 2 — one analyzed session: version, sections, functions, per-vaddr xrefs.
+        const deep = args.depth === "deep";
+        const analysisCmd = deep ? "aaa" : "aa; aar";
+        const parts = ["?V", analysisCmd, `?e ${R2_MARKERS.sections}`, "iSj", `?e ${R2_MARKERS.functions}`, "aflj"];
+        for (const v of queried) {
+            const h = "0x" + v.toString(16);
+            parts.push(`?e ${R2_MARKERS.xref} ${h}`, `axtj @ ${h}`);
+        }
+        const soft = deep ? 60 : 20;
+        let split;
+        try {
+            const r = await connector.execute([...["r2"], ...R2_FLAGS, "-e", `anal.timeout=${soft}`, "-c", parts.join("; "), filePath], { timeout: deep ? 120000 : 45000 });
+            split = splitMarkedR2Output(r.stdout || "");
+        }
+        catch {
+            /* timeout / kill → unknown below */
+        }
+        if (!split) {
+            const ctx = { isCodeFile: true, fileType, schemaKnown: false, analysisComplete: false, obscured };
+            const matches = groupsToClassify.map((g) => classifyMatch(g, [], [], ctx));
+            return formatResponse("verify_string_usage", { file: args.file, query: args.query, file_type: fileType, is_code_file: true, engine: "radare2", packer_detected: obscured, analysis_complete: false, timed_out: true, basis: BASIS, match_count: groupsToClassify.length, matches_truncated: matchesTruncated, matches }, startTime);
+        }
+        const sections = parseR2Sections(split.sectionsJson);
+        const functions = parseR2Functions(split.functionsJson);
+        const ctx = {
+            isCodeFile: true,
+            fileType,
+            schemaKnown: !!split.version,
+            analysisComplete: !split.truncated && functions.length > 0,
+            obscured,
+        };
+        const matches = groupsToClassify.map((g) => {
+            const xrefs = [];
+            let rawAnomaly = false;
+            for (const v of g.vaddrs) {
+                const raw = split.xrefsByVaddr.get("0x" + v.vaddr.toString(16));
+                if (raw === undefined)
+                    continue;
+                const parsed = parseR2Xrefs(raw);
+                const t = raw.trim();
+                if (parsed.length === 0 && t !== "" && t !== "[]")
+                    rawAnomaly = true;
+                xrefs.push(...parsed);
+            }
+            return classifyMatch(g, xrefs, sections, ctx, rawAnomaly);
+        });
+        return formatResponse("verify_string_usage", {
+            file: args.file, query: args.query, file_type: fileType, is_code_file: true, engine: "radare2",
+            r2_version: split.version, packer_detected: obscured, analysis_complete: ctx.analysisComplete,
+            basis: BASIS, match_count: groupsToClassify.length, matches_truncated: matchesTruncated, matches,
+        }, startTime);
+    }
+    catch (error) {
+        return formatError("verify_string_usage", toREMnuxError(error, deps.config.mode), startTime);
+    }
+}
+//# sourceMappingURL=verify-string-usage.js.map

package/dist/handlers/verify-string-usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-string-usage.js","sourceRoot":"","sources":["../../src/handlers/verify-string-usage.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,UAAU,GAEX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAwB,MAAM,6BAA6B,CAAC;AAEjG,MAAM,KAAK,GACT,oHAAoH;IACpH,iHAAiH;IACjH,iHAAiH;IACjH,gGAAgG,CAAC;AAEnG,2DAA2D;AAC3D,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAEjF,wEAAwE;AACxE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAiB,EAAE,IAA2B;IAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEnC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,WAAW,CAChB,qBAAqB,EACrB,IAAI,WAAW,CAAC,yCAAyC,EAAE,kBAAkB,EAAE,YAAY,EAAE,8BAA8B,CAAC,EAC5H,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAChB,qBAAqB,EACrB,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,IAAI,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,kDAAkD,CAAC,EAC1I,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,SAAS;YAAE,OAAO,WAAW,CAAC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/E,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;gBAAE,OAAO,WAAW,CAAC,qBAAqB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACxG,CAAC;QACD,4EAA4E;QAC5E,+EAA+E;QAC/E,iFAAiF;QACjF,gEAAgE;QAChE,qFAAqF;QACrF,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,mDAAmD,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpE,CAAC,CAAC,IAAI,CAAC;QAET,8EAA8E;QAC9E,+DAA+D;QAC/D,IAAI,WAAW,GAAG,IAAI,CAAC;QACvB,IAAI,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACvG,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;gBACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;oBACzG,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,cAAc,CACnB,qBAAqB,EACrB;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;gBACjH,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;gBAC3B,IAAI,EAAE,mIAAmI;aAC1I,EACD,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC1C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE7E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,cAAc,CACnB,qBAAqB,EACrB;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;gBAClH,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;gBAC3B,IAAI,EAAE,oLAAoL;aAC3L,EACD,SAAS,CACV,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,GAAG,GAAoB,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,OAAO,cAAc,CACnB,qBAAqB,EACrB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,EACpL,SAAS,CACV,CAAC;QACJ,CAAC;QAED,wFAAwF;QACxF,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QAED,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,gBAAgB,GAAkB,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,MAAM,GAAG,SAAS,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;YAC/E,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,gBAAgB,GAAG,SAAS,IAAI,gBAAgB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE9E,gFAAgF;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5G,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,IAAI,KAAyD,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAC/B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EACxF,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CACnC,CAAC;YACF,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,GAAoB,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnH,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3E,OAAO,cAAc,CACnB,qBAAqB,EACrB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAC1Q,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,GAAG,GAAoB;YAC3B,UAAU,EAAE,IAAI;YAChB,QAAQ;YACR,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO;YAC5B,gBAAgB,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAC1D,QAAQ;SACT,CAAC;QAEF,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,KAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,IAAI,GAAG,KAAK,SAAS;oBAAE,SAAS;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACrB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI;oBAAE,UAAU,GAAG,IAAI,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,OAAO,cAAc,CACnB,qBAAqB,EACrB;YACE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;YAC9F,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;YAC7F,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,OAAO;SACjG,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,qBAAqB,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAOtF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAoC9E,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,sBAqVtD;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,iBAqCrD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAOtF,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4C9E,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,sBAwZtD;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,iBAqCrD"}