@remnux/mcp-server 0.1.73 → 0.1.74

package/dist/parsers/1768.js

@@ -0,0 +1,120 @@
+/**
+ * Parser for 1768.py, Didier Stevens' Cobalt Strike beacon configuration extractor.
+ *
+ * 1768 exits 0 whether or not it succeeds. When it cannot process a file it says so
+ * on stderr ("Error opening file ...", "Number of errors: N"), and the parser reports
+ * that as tool_reported_error. "Error: ..." lines on stdout, such as "payload size too
+ * large", are its probe results on a file without a beacon, not failures. A recovered
+ * configuration is one line per setting, led by Cobalt Strike's own setting number,
+ * followed by 1768's verdict, "Sanity check Cobalt Strike config: OK" (or NOK):
+ *
+ *   0x0001 payload type   0x0001 0x0002 0 windows-beacon_http-reverse_http
+ *   0x0008 server,get-uri 0x0003 0x0100 '<host>,/<uri>'
+ *
+ * Recognition keys on the setting numbers and the verdict, which are stable across
+ * releases. Setting names are display text, used only as labels.
+ */
+/** Setting number, display name (may be empty), type, length, then the decoded value. */
+const CONFIG_ENTRY = /^0x([0-9a-f]{4})\s+(.*?)\s*0x[0-9a-f]{4} 0x[0-9a-f]{4}(?:\s+(.*))?$/i;
+/** Any line led by a setting number, whatever the rest of its layout. */
+const SETTING_NUMBER = /^0x([0-9a-f]{4})\b/i;
+/** "Sanity check <subject>: <verdict>", counted only when the subject is a Cobalt Strike config. */
+const SANITY_VERDICT = /^sanity check\b([^:]*):\s*(\S+)/i;
+const COBALT_STRIKE = /cobalt\s*strike/i;
+/** The header 1768 prints for every file it processes. */
+const FILE_HEADER = /^File:/m;
+/** 1768's failure reports: "Error: ..." lines, its "Number of errors: N" tally, or a traceback. */
+const ERROR_RECORDS = [/^error\b/im, /^number of errors:\s*[1-9]/im, /^Traceback \(most recent call last\):/m];
+/** Payload type, port, C2 server and URI, POST URI, and license ID: the values an analyst pivots on. */
+const KEY_SETTINGS = new Set(["0001", "0002", "0008", "000a", "0025"]);
+const MAX_SETTING_FINDINGS = 15;
+const MAX_VALUE = 200;
+/** Replace anything outside printable ASCII and cap the length before quoting a value back. */
+function printable(s) {
+    const p = s.replace(/[^ -~]/g, "?");
+    return p.length > MAX_VALUE ? `${p.slice(0, MAX_VALUE)}…` : p;
+}
+export function parse1768Output(rawOutput, ctx) {
+    const result = {
+        tool: "1768",
+        parsed: false,
+        findings: [],
+        metadata: {},
+        raw: rawOutput,
+    };
+    // Failure records count on stderr, or in output that is not 1768's normal report (no
+    // File: header, as when stderr stands in for empty stdout). On its normal stdout they are
+    // probe results.
+    const stderr = ctx?.stderr ?? "";
+    const hasHeader = FILE_HEADER.test(rawOutput);
+    const reportedError = ERROR_RECORDS.some((re) => re.test(stderr) || (!hasHeader && re.test(rawOutput)));
+    if (reportedError)
+        result.metadata.tool_reported_error = true;
+    if (!hasHeader) {
+        // Without the header, 1768 either failed before processing the file (and said so)
+        // or printed a format this parser does not know.
+        if (reportedError)
+            result.parsed = true;
+        else
+            result.metadata.parse_error = true;
+        return result;
+    }
+    result.parsed = true;
+    let ok = 0;
+    let nok = 0;
+    let other = 0;
+    const settingNumbers = new Set();
+    const settings = [];
+    let omitted = 0;
+    for (const line of rawOutput.split("\n")) {
+        // Configuration lines start at column 0. Decoded profile instructions are indented.
+        if (!line || /^\s/.test(line))
+            continue;
+        const text = line.trim();
+        const sanity = text.match(SANITY_VERDICT);
+        if (sanity) {
+            if (!COBALT_STRIKE.test(sanity[1]))
+                continue;
+            const verdict = sanity[2].toUpperCase();
+            if (verdict === "OK")
+                ok++;
+            else if (verdict === "NOK")
+                nok++;
+            else
+                other++;
+            continue;
+        }
+        const numbered = text.match(SETTING_NUMBER);
+        if (numbered && numbered[1] !== "0000")
+            settingNumbers.add(numbered[1].toLowerCase());
+        const entry = text.match(CONFIG_ENTRY);
+        if (!entry || !KEY_SETTINGS.has(entry[1].toLowerCase()) || !entry[3])
+            continue;
+        if (settings.length >= MAX_SETTING_FINDINGS) {
+            omitted++;
+            continue;
+        }
+        const id = entry[1].toLowerCase();
+        const label = printable(entry[2].trim()) || "unnamed";
+        settings.push({
+            description: `Cobalt Strike setting ${label} (0x${id}): ${printable(entry[3])}`,
+            category: "cobalt-strike-setting",
+            severity: "info",
+            evidence: printable(text),
+        });
+    }
+    // One numbered line is not a configuration. A real one has dozens of settings.
+    if (ok + nok + other === 0 && settingNumbers.size < 2)
+        return result;
+    const verdict = ok > 0 ? "OK" : nok > 0 ? "NOK" : "not recognized";
+    result.findings.push({
+        description: `Cobalt Strike beacon configuration recovered by 1768 (sanity check: ${verdict})`,
+        category: "cobalt-strike-config",
+        severity: ok > 0 ? "high" : nok > 0 ? "low" : "medium",
+        evidence: `${settingNumbers.size} setting numbers, sanity verdicts ${ok} OK / ${nok} NOK / ${other} other` +
+            (omitted > 0 ? `, ${omitted} more setting values not listed` : ""),
+    });
+    result.findings.push(...settings);
+    return result;
+}
+//# sourceMappingURL=1768.js.map

package/dist/parsers/1768.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"1768.js","sourceRoot":"","sources":["../../src/parsers/1768.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,yFAAyF;AACzF,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAE5F,yEAAyE;AACzE,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,oGAAoG;AACpG,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC,0DAA0D;AAC1D,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,8BAA8B,EAAE,wCAAwC,CAAC,CAAC;AAE/G,wGAAwG;AACxG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,+FAA+F;AAC/F,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,GAAkB;IACnE,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,qFAAqF;IACrF,0FAA0F;IAC1F,iBAAiB;IACjB,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxG,IAAI,aAAa;QAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAE9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,kFAAkF;QAClF,iDAAiD;QACjD,IAAI,aAAa;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;;YACnC,MAAM,CAAC,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IAErB,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,oFAAoF;QACpF,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,OAAO,KAAK,IAAI;gBAAE,EAAE,EAAE,CAAC;iBACtB,IAAI,OAAO,KAAK,KAAK;gBAAE,GAAG,EAAE,CAAC;;gBAC7B,KAAK,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/E,IAAI,QAAQ,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,yBAAyB,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/E,QAAQ,EAAE,uBAAuB;YACjC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,IAAI,EAAE,GAAG,GAAG,GAAG,KAAK,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAErE,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACnE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,WAAW,EAAE,uEAAuE,OAAO,GAAG;QAC9F,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QACtD,QAAQ,EACN,GAAG,cAAc,CAAC,IAAI,qCAAqC,EAAE,SAAS,GAAG,UAAU,KAAK,QAAQ;YAChG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/capa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capa.d.ts","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAW,YAAY,EAAE,MAAM,YAAY,CAAC;AAsG1E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,SAAS,CA4B7F;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAsEnE"}
+{"version":3,"file":"capa.d.ts","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAW,YAAY,EAAE,MAAM,YAAY,CAAC;AAsG1E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,SAAS,CA4B7F;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAuEnE"}

package/dist/parsers/capa.js

@@ -204,7 +204,8 @@ export function parseCapaOutput(rawOutput) {
         }
     }
     catch {
-        // JSON parse failed — return unparsed
+        // Not capa's JSON (cut short, or something else printed instead), so nothing was read.
+        result.metadata.parse_error = true;
     }
     return result;
 }

package/dist/parsers/capa.js.map

@@ -1 +1 @@
-{"version":3,"file":"capa.js","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAiC;IAC1D,yDAAyD;IACzD,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,UAAU;IACrB,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,UAAU;IACjB,2EAA2E;IAC3E,GAAG,EAAE,UAAU;IACf,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,gBAAgB,EAAE,UAAU;IAC5B,gBAAgB,EAAE,UAAU;IAC5B,wCAAwC;IACxC,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,uCAAuC;IACvC,MAAM,EAAE,SAAS;IACjB,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,oEAAoE;CACrE,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAiC;IACjE,2CAA2C;IAC3C,aAAa,EAAE,YAAY;IAC3B,YAAY,EAAE,YAAY;IAC1B,kBAAkB,EAAE,YAAY;IAChC,+DAA+D;IAC/D,cAAc,EAAE,UAAU;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,UAAU;IACxB,gBAAgB,EAAE,UAAU;IAC5B,KAAK,EAAE,UAAU;IACjB,YAAY,EAAE,UAAU;IACxB,WAAW,EAAE,UAAU;IACvB,WAAW,EAAE,UAAU;IACvB,oBAAoB,EAAE,UAAU;IAChC,eAAe,EAAE,UAAU;IAC3B,gBAAgB,EAAE,UAAU;CAC7B,CAAC;AAEF,mFAAmF;AACnF,MAAM,mBAAmB,GAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,IAAa,EAAE,GAAsB;IACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,8EAA8E;IAC9E,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;IACrB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAkC,CAAC;YAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;YAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,KAAK,gBAAgB,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,MAAM,EAAE,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;oBAC7C,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,2BAA2B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;QAEtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,qCAAqC;gBACrC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACtC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,EAAE,GAAI,IAAgC,CAAC,SAAS,CAAC;YACvD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;qBAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,MAAM,OAAO,GAAY;oBACvB,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,YAAY;oBACtB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBAEF,4DAA4D;gBAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,IAA+B,CAAC;oBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;6BACxB,MAAM,CAAC,CAAC,CAAC,EAA+B,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;6BACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC;6BACpD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAED,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,aAAa;oBAAE,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;gBAE1D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,yDAAyD;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;gBAChC,mDAAmD;oBACnD,+EAA+E;oBAC/E,4DAA4D;oBAC5D,2DAA2D;oBAC3D,6CAA6C;oBAC7C,0DAA0D;oBAC1D,wEAAwE,CAAC;QAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"capa.js","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAiC;IAC1D,yDAAyD;IACzD,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,UAAU;IACrB,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,UAAU;IACjB,2EAA2E;IAC3E,GAAG,EAAE,UAAU;IACf,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,gBAAgB,EAAE,UAAU;IAC5B,gBAAgB,EAAE,UAAU;IAC5B,wCAAwC;IACxC,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,uCAAuC;IACvC,MAAM,EAAE,SAAS;IACjB,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,oEAAoE;CACrE,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAiC;IACjE,2CAA2C;IAC3C,aAAa,EAAE,YAAY;IAC3B,YAAY,EAAE,YAAY;IAC1B,kBAAkB,EAAE,YAAY;IAChC,+DAA+D;IAC/D,cAAc,EAAE,UAAU;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,UAAU;IACxB,gBAAgB,EAAE,UAAU;IAC5B,KAAK,EAAE,UAAU;IACjB,YAAY,EAAE,UAAU;IACxB,WAAW,EAAE,UAAU;IACvB,WAAW,EAAE,UAAU;IACvB,oBAAoB,EAAE,UAAU;IAChC,eAAe,EAAE,UAAU;IAC3B,gBAAgB,EAAE,UAAU;CAC7B,CAAC;AAEF,mFAAmF;AACnF,MAAM,mBAAmB,GAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,IAAa,EAAE,GAAsB;IACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,8EAA8E;IAC9E,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;IACrB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAkC,CAAC;YAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;YAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,KAAK,gBAAgB,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,MAAM,EAAE,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;oBAC7C,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,2BAA2B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;QAEtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,qCAAqC;gBACrC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACtC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,EAAE,GAAI,IAAgC,CAAC,SAAS,CAAC;YACvD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;qBAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,MAAM,OAAO,GAAY;oBACvB,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,YAAY;oBACtB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBAEF,4DAA4D;gBAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,IAA+B,CAAC;oBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;6BACxB,MAAM,CAAC,CAAC,CAAC,EAA+B,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;6BACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC;6BACpD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAED,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,aAAa;oBAAE,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;gBAE1D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,yDAAyD;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;gBAChC,mDAAmD;oBACnD,+EAA+E;oBAC/E,4DAA4D;oBAC5D,2DAA2D;oBAC3D,6CAA6C;oBAC7C,0DAA0D;oBAC1D,wEAAwE,CAAC;QAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;QACvF,MAAM,CAAC,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/diec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diec.d.ts","sourceRoot":"","sources":["../../src/parsers/diec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAW,MAAM,YAAY,CAAC;AAuB5D,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAiDnE"}
+{"version":3,"file":"diec.d.ts","sourceRoot":"","sources":["../../src/parsers/diec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAW,MAAM,YAAY,CAAC;AAuB5D,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAkDnE"}

package/dist/parsers/diec.js

@@ -70,7 +70,8 @@ export function parseDiecOutput(rawOutput) {
         }
     }
     catch {
-        // JSON parse failed — return unparsed
+        // No diec JSON in the output, so nothing was read.
+        result.metadata.parse_error = true;
     }
     return result;
 }

package/dist/parsers/diec.js.map

@@ -1 +1 @@
-{"version":3,"file":"diec.js","sourceRoot":"","sources":["../../src/parsers/diec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,kCAAkC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;wBACvB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;4BAAE,SAAS;wBAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;wBAChE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC9D,MAAM,OAAO,GAAY;4BACvB,WAAW,EAAE,GAAG,KAAK,KAAK,KAAK,EAAE;4BACjC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;4BAC7B,QAAQ,EAAE,MAAM;yBACjB,CAAC;wBACF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;4BAClC,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;wBAC7C,CAAC;wBACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,oEAAoE;YACpE,8CAA8C;YAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"diec.js","sourceRoot":"","sources":["../../src/parsers/diec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,kCAAkC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;wBACvB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;4BAAE,SAAS;wBAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;wBAChE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC9D,MAAM,OAAO,GAAY;4BACvB,WAAW,EAAE,GAAG,KAAK,KAAK,KAAK,EAAE;4BACjC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;4BAC7B,QAAQ,EAAE,MAAM;yBACjB,CAAC;wBACF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;4BAClC,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;wBAC7C,CAAC;wBACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,oEAAoE;YACpE,8CAA8C;YAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/floss.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floss.d.ts","sourceRoot":"","sources":["../../src/parsers/floss.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAenD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,kBAAuB,GAC/B,gBAAgB,CA6ElB"}
+{"version":3,"file":"floss.d.ts","sourceRoot":"","sources":["../../src/parsers/floss.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAenD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,kBAAuB,GAC/B,gBAAgB,CA+ElB"}

package/dist/parsers/floss.js

@@ -38,7 +38,9 @@ export function parseFlossOutput(rawOutput, options = {}) {
         const lower = trimmed.toLowerCase();
         // Match "─── FLOSS DECODED STRINGS ───" or "FLOSS DECODED STRINGS" or just "DECODED STRINGS"
         const stripped = lower.replace(/[─━═\-]/g, "").trim();
-        if (SECTION_HEADERS[stripped]) {
+        // Own properties only: these lines are the sample's strings, and a string such as
+        // "constructor" would otherwise match an inherited property.
+        if (Object.hasOwn(SECTION_HEADERS, stripped)) {
             currentSection = SECTION_HEADERS[stripped];
             continue;
         }

package/dist/parsers/floss.js.map

@@ -1 +1 @@
-{"version":3,"file":"floss.js","sourceRoot":"","sources":["../../src/parsers/floss.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,eAAe,GAA2B;IAC9C,sBAAsB,EAAE,QAAQ;IAChC,uBAAuB,EAAE,SAAS;IAClC,qBAAqB,EAAE,OAAO;IAC9B,qBAAqB,EAAE,OAAO;IAC9B,gBAAgB,EAAE,QAAQ;IAC1B,iBAAiB,EAAE,SAAS;IAC5B,eAAe,EAAE,OAAO;IACxB,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF,MAAM,UAAU,GAAG,GAAG,CAAC;AAOvB,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,MAAM,QAAQ,GAA6B;QACzC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV,CAAC;IAEF,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,+CAA+C;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QAED,wBAAwB;QACxB,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,IAAI,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC;IAEvC,kDAAkD;IAClD,KAAK,MAAM,OAAO,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC7D,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,WAAW,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,oBAAoB;gBACvE,QAAQ,EAAE,SAAS,OAAO,EAAE;gBAC5B,QAAQ,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBAClD,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,kBAAkB,MAAM,CAAC,CAAC,CAAC,mBAAmB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxG,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,GAAG,2CAA2C,CAAC;IAC9F,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"floss.js","sourceRoot":"","sources":["../../src/parsers/floss.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,eAAe,GAA2B;IAC9C,sBAAsB,EAAE,QAAQ;IAChC,uBAAuB,EAAE,SAAS;IAClC,qBAAqB,EAAE,OAAO;IAC9B,qBAAqB,EAAE,OAAO;IAC9B,gBAAgB,EAAE,QAAQ;IAC1B,iBAAiB,EAAE,SAAS;IAC5B,eAAe,EAAE,OAAO;IACxB,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF,MAAM,UAAU,GAAG,GAAG,CAAC;AAOvB,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,MAAM,QAAQ,GAA6B;QACzC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV,CAAC;IAEF,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,+CAA+C;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,kFAAkF;QAClF,6DAA6D;QAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QAED,wBAAwB;QACxB,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,IAAI,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC;IAEvC,kDAAkD;IAClD,KAAK,MAAM,OAAO,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC7D,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,WAAW,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,oBAAoB;gBACvE,QAAQ,EAAE,SAAS,OAAO,EAAE;gBAC5B,QAAQ,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBAClD,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,kBAAkB,MAAM,CAAC,CAAC,CAAC,mBAAmB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxG,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,GAAG,2CAA2C,CAAC;IAC9F,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/index.d.ts

@@ -3,14 +3,14 @@
  *
  * Falls back to passthrough for tools without a dedicated parser.
  */
-import type { ParsedToolOutput } from "./types.js";
+import type { ParsedToolOutput, ParseContext } from "./types.js";
 /**
  * Parse tool output using a registered parser, or passthrough if none exists.
  */
-export declare function parseToolOutput(toolName: string, rawOutput: string): ParsedToolOutput;
+export declare function parseToolOutput(toolName: string, rawOutput: string, ctx?: ParseContext): ParsedToolOutput;
 /**
  * Check if a dedicated parser exists for the given tool.
  */
 export declare function hasParser(toolName: string): boolean;
-export type { ParsedToolOutput, ToolOutputParser, Finding } from "./types.js";
+export type { ParsedToolOutput, ToolOutputParser, ParseContext, Finding } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/parsers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parsers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;AA2BrE;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAMrF;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parsers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAC;AA+BnF;;GAEG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,YAAY,GACjB,gBAAgB,CAMlB;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC"}

package/dist/parsers/index.js

@@ -13,7 +13,8 @@ import { parseOleidOutput } from "./oleid.js";
 import { parseReadelfOutput } from "./readelf.js";
 import { parsePdfParserOutput } from "./pdf-parser.js";
 import { parseFlossOutput } from "./floss.js";
-import { parseYaraOutput } from "./yara.js";
+import { parseYaraOutput, parseYaraForgeOutput } from "./yara.js";
+import { parse1768Output } from "./1768.js";
 /** Map of tool name → parser function. */
 const PARSERS = {
     "capa": parseCapaOutput,
@@ -24,16 +25,19 @@ const PARSERS = {
     "peframe": parsePeframeOutput,
     "oleid": parseOleidOutput,
     "readelf-header": parseReadelfOutput,
-    "floss": parseFlossOutput,
+    // parseFlossOutput's second parameter is its own options object, not a ParseContext.
+    "floss": (rawOutput) => parseFlossOutput(rawOutput),
     "yara-rules": parseYaraOutput,
+    "yara-forge": parseYaraForgeOutput,
+    "1768": parse1768Output,
 };
 /**
  * Parse tool output using a registered parser, or passthrough if none exists.
  */
-export function parseToolOutput(toolName, rawOutput) {
+export function parseToolOutput(toolName, rawOutput, ctx) {
     const parser = PARSERS[toolName];
     if (parser) {
-        return parser(rawOutput);
+        return parser(rawOutput, ctx);
     }
     return passthroughParser(toolName, rawOutput);
 }

package/dist/parsers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parsers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,OAAO,GAAqC;IAChD,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,oBAAoB;IAClC,QAAQ,EAAE,iBAAiB;IAC3B,SAAS,EAAE,kBAAkB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,eAAe;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,QAAQ,IAAI,OAAO,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parsers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,0CAA0C;AAC1C,MAAM,OAAO,GAAqC;IAChD,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,oBAAoB;IAClC,QAAQ,EAAE,iBAAiB;IAC3B,SAAS,EAAE,kBAAkB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,gBAAgB,EAAE,kBAAkB;IACpC,qFAAqF;IACrF,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;IACnD,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,oBAAoB;IAClC,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,SAAiB,EACjB,GAAkB;IAElB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,QAAQ,IAAI,OAAO,CAAC;AAC7B,CAAC"}

package/dist/parsers/types.d.ts

@@ -44,6 +44,13 @@ export interface ParsedToolOutput {
     /** Raw output preserved for reference */
     raw: string;
 }
+/** What the server knows about the run that produced the output. Optional throughout. */
+export interface ParseContext {
+    /** Absolute path the tool was pointed at, when the server built the command. */
+    targetPath?: string;
+    /** The tool's stderr, for a tool that reports failures there while exiting 0. */
+    stderr?: string;
+}
 /** A parser function: takes raw output, returns structured data. */
-export type ToolOutputParser = (rawOutput: string) => ParsedToolOutput;
+export type ToolOutputParser = (rawOutput: string, ctx?: ParseContext) => ParsedToolOutput;
 //# sourceMappingURL=types.d.ts.map

package/dist/parsers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAE9E,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAE9E,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,YAAY,KAAK,gBAAgB,CAAC"}

package/dist/parsers/yara.d.ts

@@ -1,8 +1,22 @@
 /**
- * Parser for yara-rules output.
+ * Parser for YARA scanner output (yara-rules and yara-forge).
  *
- * Deduplicates packer-family rule variants (e.g., 24 PECompact rules → 1 finding with count).
+ * YARA prints one line per matched rule, `[namespace:]rule [tags] [meta] <scanned path>`,
+ * and writes its warnings and errors to stderr. For yara-rules, packer-family rule
+ * variants are deduplicated (e.g., 24 PECompact rules → 1 finding with count); for
+ * yara-forge, whose rules name malware families, each matched rule is its own finding.
  */
-import type { ParsedToolOutput } from "./types.js";
-export declare function parseYaraOutput(rawOutput: string): ParsedToolOutput;
+import type { ParsedToolOutput, ParseContext } from "./types.js";
+/**
+ * The rules a YARA run matched, in first-seen order.
+ *
+ * A match line starts with a rule identifier and names the scanned file. When the
+ * caller knows that file (`targetPath`), the line must end with it; otherwise it must
+ * carry at least one more token. Nothing else counts: not the server's "(no output)"
+ * placeholder, not a warning or error line, and not an indented or `-s` detail line.
+ */
+export declare function extractYaraRuleMatches(rawOutput: string, targetPath?: string): string[];
+export declare function parseYaraOutput(rawOutput: string, ctx?: ParseContext, toolName?: "yara-rules" | "yara-forge"): ParsedToolOutput;
+/** Parser entry for yara-forge (family-attribution ruleset). */
+export declare const parseYaraForgeOutput: (rawOutput: string, ctx?: ParseContext) => ParsedToolOutput;
 //# sourceMappingURL=yara.d.ts.map

package/dist/parsers/yara.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yara.d.ts","sourceRoot":"","sources":["../../src/parsers/yara.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAwBnD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAkEnE"}
+{"version":3,"file":"yara.d.ts","sourceRoot":"","sources":["../../src/parsers/yara.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA8BjE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBvF;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,YAAY,EAClB,QAAQ,GAAE,YAAY,GAAG,YAA2B,GACnD,gBAAgB,CAiElB;AAED,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,GAAI,WAAW,MAAM,EAAE,MAAM,YAAY,KAAG,gBAC9B,CAAC"}

package/dist/parsers/yara.js

@@ -1,7 +1,10 @@
 /**
- * Parser for yara-rules output.
+ * Parser for YARA scanner output (yara-rules and yara-forge).
  *
- * Deduplicates packer-family rule variants (e.g., 24 PECompact rules → 1 finding with count).
+ * YARA prints one line per matched rule, `[namespace:]rule [tags] [meta] <scanned path>`,
+ * and writes its warnings and errors to stderr. For yara-rules, packer-family rule
+ * variants are deduplicated (e.g., 24 PECompact rules → 1 finding with count); for
+ * yara-forge, whose rules name malware families, each matched rule is its own finding.
  */
 /** Patterns that indicate packer-family rule variants. */
 const PACKER_FAMILY_PATTERNS = [
@@ -24,65 +27,103 @@ function getPackerFamily(ruleName) {
     }
     return null;
 }
-export function parseYaraOutput(rawOutput) {
+/** A YARA rule identifier, optionally namespace-qualified. */
+const RULE_NAME = /^(?:[^\s:]+:)?[A-Za-z_][A-Za-z0-9_]*$/;
+/** YARA's own diagnostics, which reach the parser when stderr stands in for empty stdout. */
+const DIAGNOSTIC = /^(?:warning|error)\b/i;
+/**
+ * The rules a YARA run matched, in first-seen order.
+ *
+ * A match line starts with a rule identifier and names the scanned file. When the
+ * caller knows that file (`targetPath`), the line must end with it; otherwise it must
+ * carry at least one more token. Nothing else counts: not the server's "(no output)"
+ * placeholder, not a warning or error line, and not an indented or `-s` detail line.
+ */
+export function extractYaraRuleMatches(rawOutput, targetPath) {
+    // Lines are compared trimmed, and connectors trim captured output, so trim the path too.
+    const target = targetPath?.trim();
+    const rules = [];
+    for (const rawLine of rawOutput.split("\n")) {
+        if (/^\s/.test(rawLine))
+            continue;
+        const line = rawLine.trim();
+        if (!line || DIAGNOSTIC.test(line))
+            continue;
+        const space = line.search(/\s/);
+        if (space === -1)
+            continue;
+        const rule = line.slice(0, space);
+        if (!RULE_NAME.test(rule))
+            continue;
+        if (target && !line.endsWith(` ${target}`))
+            continue;
+        if (!rules.includes(rule))
+            rules.push(rule);
+    }
+    return rules;
+}
+export function parseYaraOutput(rawOutput, ctx, toolName = "yara-rules") {
     const result = {
-        tool: "yara-rules",
+        tool: toolName,
         parsed: false,
         findings: [],
         metadata: {},
         raw: rawOutput,
     };
-    const lines = rawOutput.split("\n").filter((l) => l.trim());
-    if (lines.length === 0)
-        return result;
-    // YARA output format: "RuleName filePath" per line
-    const ruleNames = [];
-    for (const line of lines) {
-        const match = line.match(/^(\S+)\s+/);
-        if (match)
-            ruleNames.push(match[1]);
-    }
+    const ruleNames = extractYaraRuleMatches(rawOutput, ctx?.targetPath);
     if (ruleNames.length === 0)
         return result;
-    // Group by packer family for deduplication
-    const packerGroups = new Map();
-    const nonPackerRules = [];
-    for (const name of ruleNames) {
-        const family = getPackerFamily(name);
-        if (family) {
-            const existing = packerGroups.get(family) ?? [];
-            existing.push(name);
-            packerGroups.set(family, existing);
-        }
-        else {
-            nonPackerRules.push(name);
+    if (toolName === "yara-forge") {
+        for (const name of ruleNames) {
+            result.findings.push({
+                description: `YARA family signature: ${name}`,
+                category: "yara-family",
+                severity: "medium",
+                evidence: name,
+            });
         }
     }
-    // Emit deduplicated packer findings
-    for (const [family, variants] of packerGroups) {
-        result.findings.push({
-            description: variants.length > 1
-                ? `Packer: ${family} (${variants.length} rule variants matched)`
-                : `Packer: ${family}`,
-            category: "packer",
-            severity: "medium",
-            evidence: variants.length <= 3 ? variants.join(", ") : `${variants.slice(0, 3).join(", ")} +${variants.length - 3} more`,
-        });
-    }
-    // Emit individual non-packer rules
-    for (const name of nonPackerRules) {
-        result.findings.push({
-            description: `YARA match: ${name}`,
-            category: "yara-match",
-            severity: "low",
-            evidence: name,
-        });
+    else {
+        // Group by packer family for deduplication
+        const packerGroups = new Map();
+        const nonPackerRules = [];
+        for (const name of ruleNames) {
+            const family = getPackerFamily(name);
+            if (family) {
+                const existing = packerGroups.get(family) ?? [];
+                existing.push(name);
+                packerGroups.set(family, existing);
+            }
+            else {
+                nonPackerRules.push(name);
+            }
+        }
+        // Emit deduplicated packer findings
+        for (const [family, variants] of packerGroups) {
+            result.findings.push({
+                description: variants.length > 1
+                    ? `Packer: ${family} (${variants.length} rule variants matched)`
+                    : `Packer: ${family}`,
+                category: "packer",
+                severity: "medium",
+                evidence: variants.length <= 3 ? variants.join(", ") : `${variants.slice(0, 3).join(", ")} +${variants.length - 3} more`,
+            });
+        }
+        // Emit individual non-packer rules
+        for (const name of nonPackerRules) {
+            result.findings.push({
+                description: `YARA match: ${name}`,
+                category: "yara-match",
+                severity: "low",
+                evidence: name,
+            });
+        }
     }
     result.metadata.total_rules_matched = ruleNames.length;
     result.metadata.deduplicated_findings = result.findings.length;
-    if (result.findings.length > 0) {
-        result.parsed = true;
-    }
+    result.parsed = true;
     return result;
 }
+/** Parser entry for yara-forge (family-attribution ruleset). */
+export const parseYaraForgeOutput = (rawOutput, ctx) => parseYaraOutput(rawOutput, ctx, "yara-forge");
 //# sourceMappingURL=yara.js.map

package/dist/parsers/yara.js.map

@@ -1 +1 @@
-{"version":3,"file":"yara.js","sourceRoot":"","sources":["../../src/parsers/yara.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG;IAC7B,yBAAyB;IACzB,mBAAmB;IACnB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,sBAAsB;CACvB,CAAC;AAEF,SAAS,eAAe,CAAC,QAAgB;IACvC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEtC,mDAAmD;IACnD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAE1C,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC9B,CAAC,CAAC,WAAW,MAAM,KAAK,QAAQ,CAAC,MAAM,yBAAyB;gBAChE,CAAC,CAAC,WAAW,MAAM,EAAE;YACvB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,OAAO;SACzH,CAAC,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,eAAe,IAAI,EAAE;YAClC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC,MAAM,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE/D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"yara.js","sourceRoot":"","sources":["../../src/parsers/yara.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG;IAC7B,yBAAyB;IACzB,mBAAmB;IACnB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,sBAAsB;CACvB,CAAC;AAEF,SAAS,eAAe,CAAC,QAAgB;IACvC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAE1D,6FAA6F;AAC7F,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,UAAmB;IAC3E,yFAAyF;IACzF,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;YAAE,SAAS;QACrD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,GAAkB,EAClB,WAAwC,YAAY;IAEpD,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,MAAM,SAAS,GAAG,sBAAsB,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAE1C,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,WAAW,EAAE,0BAA0B,IAAI,EAAE;gBAC7C,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;QACjD,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,WAAW,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,WAAW,MAAM,KAAK,QAAQ,CAAC,MAAM,yBAAyB;oBAChE,CAAC,CAAC,WAAW,MAAM,EAAE;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,OAAO;aACzH,CAAC,CAAC;QACL,CAAC;QAED,mCAAmC;QACnC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,WAAW,EAAE,eAAe,IAAI,EAAE;gBAClC,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC,MAAM,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/D,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IAErB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAE,GAAkB,EAAoB,EAAE,CAC9F,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC"}

package/dist/tools/advisories.d.ts

@@ -4,6 +4,7 @@
  * These advisories evaluate results across multiple tools to surface
  * actionable guidance that individual tools can't provide alone.
  */
+import type { Finding } from "../parsers/types.js";
 export interface PostAnalysisAdvisory {
     name: string;
     priority: number;
@@ -12,10 +13,12 @@ export interface PostAnalysisAdvisory {
     remediation: string;
 }
 export interface AdvisoryContext {
+    /** `findings` are what the tool's parser resolved, when it has one. */
     toolsRun: Array<{
         name: string;
         exit_code?: number;
         output?: string;
+        findings?: Finding[];
     }>;
     toolsFailed?: Array<{
         name: string;

package/dist/tools/advisories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advisories.d.ts","sourceRoot":"","sources":["../../src/tools/advisories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,wBAAwB,EAAE,oBAAoB,EAgH1D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,eAAe,GACvB,oBAAoB,EAAE,CAIxB"}
+{"version":3,"file":"advisories.d.ts","sourceRoot":"","sources":["../../src/tools/advisories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7F,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,wBAAwB,EAAE,oBAAoB,EAyG1D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,eAAe,GACvB,oBAAoB,EAAE,CAIxB"}

package/dist/tools/advisories.js

@@ -80,18 +80,9 @@ export const POST_ANALYSIS_ADVISORIES = [
     {
         name: "yara-family-attribution",
         priority: 7,
-        shouldApply: (ctx) => {
-            const forge = ctx.toolsRun.find((t) => t.name === "yara-forge");
-            if (!forge?.output)
-                return false;
-            const lines = forge.output.trim().split("\n");
-            return lines.some((line) => {
-                const trimmed = line.trim();
-                return trimmed.length > 0 &&
-                    !trimmed.startsWith("warning:") &&
-                    !trimmed.startsWith("error:");
-            });
-        },
+        // Reads the rules yara-forge's parser resolved, so this cannot disagree with the
+        // tool's summary entry or the triage token.
+        shouldApply: (ctx) => (ctx.toolsRun.find((t) => t.name === "yara-forge")?.findings?.length ?? 0) > 0,
         issue: "YARA family signatures matched. These indicate resemblance to known malware families " +
             "based on static patterns, not confirmed attribution. Signatures can match shared code, " +
             "common libraries, or reused techniques across unrelated families.",