blitzstrike 2.4.27 → 2.4.29

package/dist/index.js

@@ -15466,11 +15466,11 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/mcp-status.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 async function checkMcpServers() {
   const out = [];
-  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync8(p));
+  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync9(p));
   const npxOk = spawnSync3("npx", ["--version"], { timeout: 8000 }).error === undefined;
   const devtoolsOk = Boolean(bin) || npxOk;
   out.push({
@@ -15493,9 +15493,9 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join17 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, readFileSync as readFileSync19, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { join as join18 } from "node:path";
+import { homedir as homedir9 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
@@ -15511,7 +15511,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join17(d, e.name));
+          walk(join18(d, e.name));
         else
           n++;
       }
@@ -15524,9 +15524,9 @@ function countFiles(dir) {
 }
 function syncData() {
   if (!dirExists(DATA_ROOT2))
-    mkdirSync7(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join17(DATA_ROOT2, "payloads");
-  const templatesPath = join17(DATA_ROOT2, "templates");
+    mkdirSync8(DATA_ROOT2, { recursive: true });
+  const payloadsPath = join18(DATA_ROOT2, "payloads");
+  const templatesPath = join18(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -15536,8 +15536,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join17(ROOT7, "payloads");
-  const localTemplates = join17(ROOT7, "templates");
+  const localPayloads = join18(ROOT7, "payloads");
+  const localTemplates = join18(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -15550,7 +15550,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join17(DATA_ROOT2, ".tmp-clone");
+    const tmp = join18(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -15558,11 +15558,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join17(tmp, "payloads"), payloadsPath);
+          copyDir(join18(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join17(tmp, "templates"), templatesPath);
+          copyDir(join18(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -15582,20 +15582,20 @@ function copyDir(src, dst) {
   }
 }
 function manualCopy(src, dst) {
-  mkdirSync7(dst, { recursive: true });
+  mkdirSync8(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join17(src, e.name);
-    const d = join17(dst, e.name);
+    const s = join18(src, e.name);
+    const d = join18(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync7(d, readFileSync18(s));
+      writeFileSync7(d, readFileSync19(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join17(fileURLToPath9(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join17(homedir8(), ".blitzstrike", "data");
+  ROOT7 = join18(fileURLToPath9(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join18(homedir9(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -15640,15 +15640,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync20, existsSync as existsSync10 } from "node:fs";
-import { join as join18 } from "node:path";
+import { readFileSync as readFileSync21, existsSync as existsSync11 } from "node:fs";
+import { join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync20(join18(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync21(join19(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -15680,22 +15680,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync10(join18(ROOT8, "package-lock.json")) || existsSync10(join18(ROOT8, "bun.lock")) || existsSync10(join18(ROOT8, "bun.lockb"));
+  return existsSync11(join19(ROOT8, "package-lock.json")) || existsSync11(join19(ROOT8, "bun.lock")) || existsSync11(join19(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join18(fileURLToPath10(new URL(".", import.meta.url)), "..");
+  ROOT8 = join19(fileURLToPath10(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join19 } from "node:path";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync21(join19(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync22(join20(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -15718,13 +15718,13 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join19(fileURLToPath11(new URL(".", import.meta.url)), "..");
+  ROOT9 = join20(fileURLToPath11(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join20, dirname as dirname2 } from "node:path";
-import { homedir as homedir9 } from "node:os";
+import { readFileSync as readFileSync23, existsSync as existsSync12, writeFileSync as writeFileSync8, mkdirSync as mkdirSync9 } from "node:fs";
+import { join as join21, dirname as dirname2 } from "node:path";
+import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
@@ -15768,7 +15768,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync11(join20(ROOT10, "chains.json")) && existsSync11(join20(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync12(join21(ROOT10, "chains.json")) && existsSync12(join21(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -15819,21 +15819,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join20(ROOT10, "src", "index.ts");
-  if (which("bun") && existsSync11(src))
+  const src = join21(ROOT10, "src", "index.ts");
+  if (which("bun") && existsSync12(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join20(ROOT10, "dist", "index.js");
-  if (existsSync11(dist))
+  const dist = join21(ROOT10, "dist", "index.js");
+  if (existsSync12(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync22(p, "utf8"));
+    return JSON.parse(readFileSync23(p, "utf8"));
   } catch {
     return null;
   }
@@ -15841,8 +15841,8 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync11(dir))
-      mkdirSync8(dir, { recursive: true });
+    if (!existsSync12(dir))
+      mkdirSync9(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
@@ -15854,8 +15854,8 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync11(dir))
-      mkdirSync8(dir, { recursive: true });
+    if (!existsSync12(dir))
+      mkdirSync9(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
@@ -15866,26 +15866,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join20(ROOT10, "opencode-agents");
-  const dstDir = join20(homedir9(), ".config", "opencode", "agents");
-  if (!existsSync11(srcDir))
+  const srcDir = join21(ROOT10, "opencode-agents");
+  const dstDir = join21(homedir10(), ".config", "opencode", "agents");
+  if (!existsSync12(srcDir))
     return;
-  if (!existsSync11(dstDir))
-    mkdirSync8(dstDir, { recursive: true });
+  if (!existsSync12(dstDir))
+    mkdirSync9(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join20(srcDir, f);
-    const dst = join20(dstDir, f);
-    if (existsSync11(src)) {
-      writeFileSync8(dst, readFileSync22(src, "utf8"));
+    const src = join21(srcDir, f);
+    const dst = join21(dstDir, f);
+    if (existsSync12(src)) {
+      writeFileSync8(dst, readFileSync23(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync11(dir))
-      mkdirSync8(dir, { recursive: true });
-    let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
+    if (!existsSync12(dir))
+      mkdirSync9(dir, { recursive: true });
+    let existing = existsSync12(p) ? readFileSync23(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -15902,9 +15902,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync11(dir))
-      mkdirSync8(dir, { recursive: true });
-    let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
+    if (!existsSync12(dir))
+      mkdirSync9(dir, { recursive: true });
+    let existing = existsSync12(p) ? readFileSync23(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -15929,76 +15929,76 @@ mcp_servers:
   };
 }
 function detectAgents() {
-  const home = homedir9();
+  const home = homedir10();
   const agents = [];
-  const claudeJson = join20(home, ".claude.json");
+  const claudeJson = join21(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync11(claudeJson) || which("claude"),
+    installed: () => existsSync12(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join20(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join21(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync11(claudeDesktop),
+    installed: () => existsSync12(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join20(home, ".cursor", "mcp.json");
+  const cursor = join21(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync11(join20(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync12(join21(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join20(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join21(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync11(join20(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync12(join21(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join20(home, ".codex", "config.toml");
+  const codex = join21(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync11(join20(home, ".codex")) || which("codex"),
+    installed: () => existsSync12(join21(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join20(home, ".hermes", "config.yaml");
+  const hermes = join21(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync11(join20(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync12(join21(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join20(home, ".gemini", "settings.json");
+  const gemini = join21(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync11(join20(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync12(join21(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join20(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join21(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync11(join20(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync12(join21(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join20(home, ".copilot", "mcp.json");
+  const copilot = join21(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync11(join20(home, ".copilot")),
+    installed: () => existsSync12(join21(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join20(home, ".cline", "mcp_settings.json");
+  const cline = join21(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync11(join20(home, ".cline")),
+    installed: () => existsSync12(join21(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -16116,7 +16116,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join20(fileURLToPath12(new URL(".", import.meta.url)), "..");
+  ROOT10 = join21(fileURLToPath12(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -30754,7 +30754,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -30837,8 +30837,8 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync8, existsSync as existsSync6, statSync as statSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { readFileSync as readFileSync9, existsSync as existsSync7, statSync as statSync2 } from "node:fs";
+import { join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/memory.ts
@@ -32291,19 +32291,166 @@ function uniqueFindings(findings) {
 }
 
 // src/intel.ts
-import { readFileSync as readFileSync7, existsSync as existsSync5 } from "node:fs";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync8, existsSync as existsSync6 } from "node:fs";
+import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { readdirSync as readdirSync4 } from "node:fs";
+
+// src/intelligence.ts
+import { readFileSync as readFileSync7, appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
 import { homedir as homedir5 } from "node:os";
-var ROOT3 = join8(fileURLToPath4(new URL(".", import.meta.url)), "..");
-var INTEL = join8(ROOT3, "intelligence");
+var HOME_DIR3 = process.env.BLITZSTRIKE_HOME ?? join8(homedir5(), ".blitzstrike");
+var INTEL_PATH = join8(HOME_DIR3, "intelligence.jsonl");
+var SINK_TO_VECTOR = {
+  sql_execution: "sql_injection",
+  command_execution: "command_injection",
+  html_render: "xss",
+  code_execution: "code_execution",
+  http_request: "ssrf",
+  deserialization: "deserialization",
+  file_operations: "path_traversal",
+  file_inclusion: "path_traversal",
+  template_injection: "ssti",
+  xml_processing: "xxe",
+  path_traversal: "path_traversal",
+  redirect: "open_redirect",
+  auth_bypass: "auth_bypass",
+  cors_misconfiguration: "cors_misconfiguration"
+};
+function sinkToVector(sinkType) {
+  return SINK_TO_VECTOR[sinkType.toLowerCase()] ?? sinkType.toLowerCase();
+}
+function ensureDir2() {
+  if (!existsSync5(HOME_DIR3))
+    mkdirSync4(HOME_DIR3, { recursive: true });
+}
+function dedupHash2(vector, tech, target, outcome) {
+  return createHash4("sha256").update(`${vector}\x00${tech}\x00${target}\x00${outcome}`).digest("hex").slice(0, 16);
+}
+function loadIntel() {
+  if (!existsSync5(INTEL_PATH))
+    return [];
+  try {
+    const out = [];
+    for (const line of readFileSync7(INTEL_PATH, "utf8").split(`
+`)) {
+      const t = line.trim();
+      if (!t)
+        continue;
+      try {
+        out.push(JSON.parse(t));
+      } catch {}
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+function append2(entry) {
+  ensureDir2();
+  appendFileSync3(INTEL_PATH, JSON.stringify(entry) + `
+`);
+}
+function recordVerdict(input) {
+  const vector = input.vector.trim().toLowerCase();
+  const tech = (input.tech ?? "unknown").trim().toLowerCase();
+  const target = (input.target ?? "").trim();
+  const hash = dedupHash2(vector, tech, target, input.outcome);
+  const existing = loadIntel().find((e) => e.dedup_hash === hash);
+  if (existing) {
+    return { saved: false, duplicate: true, id: existing.id, vector, tech, outcome: input.outcome };
+  }
+  const entry = {
+    id: `int-${hash.slice(0, 12)}`,
+    vector,
+    tech,
+    framework: input.framework,
+    severity: input.severity,
+    outcome: input.outcome,
+    target: target || undefined,
+    cvss: input.cvss,
+    ts: new Date().toISOString(),
+    dedup_hash: hash
+  };
+  append2(entry);
+  return { saved: true, duplicate: false, id: entry.id, vector, tech, outcome: input.outcome };
+}
+function hitRates(tech) {
+  const entries = loadIntel();
+  const filtered = tech ? entries.filter((e) => e.tech === tech.toLowerCase()) : entries;
+  const agg = new Map;
+  for (const e of filtered) {
+    const key = `${e.vector}\x00${e.tech}`;
+    const a = agg.get(key) ?? { vector: e.vector, tech: e.tech, tested: 0, confirmed: 0, false_positive: 0, hit_rate: 0 };
+    a.tested += 1;
+    if (e.outcome === "confirmed")
+      a.confirmed += 1;
+    else
+      a.false_positive += 1;
+    agg.set(key, a);
+  }
+  const list = [...agg.values()].map((a) => ({ ...a, hit_rate: Number((a.confirmed / a.tested).toFixed(3)) }));
+  list.sort((x, y) => y.hit_rate - x.hit_rate || y.tested - x.tested);
+  return { tech: tech ?? null, total_verdicts: filtered.length, entries: list };
+}
+function empiricalPrior(vector, tech, formulaPrior) {
+  const v = vector.toLowerCase();
+  const t = (tech || "unknown").toLowerCase();
+  const all = loadIntel();
+  const specific = all.filter((e) => e.vector === v && e.tech === t);
+  const pool = specific.length > 0 ? specific : all.filter((e) => e.vector === v);
+  if (pool.length === 0)
+    return formulaPrior;
+  const confirmed = pool.filter((e) => e.outcome === "confirmed").length;
+  const tested = pool.length;
+  const K = 5;
+  const alpha = formulaPrior * K;
+  const beta = (1 - formulaPrior) * K;
+  const posterior = (confirmed + alpha) / (tested + alpha + beta);
+  return Math.round(posterior * 100) / 100;
+}
+function topVectors(tech, limit = 10) {
+  const rates = hitRates(tech);
+  const entries = rates.entries.filter((e) => e.hit_rate > 0);
+  return { tech, top: entries.slice(0, limit) };
+}
+function queryIntel(filter = {}) {
+  let entries = loadIntel();
+  if (filter.vector)
+    entries = entries.filter((e) => e.vector === filter.vector.toLowerCase());
+  if (filter.tech)
+    entries = entries.filter((e) => e.tech === filter.tech.toLowerCase());
+  if (filter.outcome)
+    entries = entries.filter((e) => e.outcome === filter.outcome);
+  entries.sort((a, b) => a.ts < b.ts ? 1 : -1);
+  return {
+    total: entries.length,
+    entries: entries.slice(0, 50).map((e) => ({
+      id: e.id,
+      vector: e.vector,
+      tech: e.tech,
+      framework: e.framework,
+      severity: e.severity,
+      outcome: e.outcome,
+      target: e.target,
+      cvss: e.cvss,
+      ts: e.ts
+    }))
+  };
+}
+
+// src/intel.ts
+import { readdirSync as readdirSync4 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+var ROOT3 = join9(fileURLToPath4(new URL(".", import.meta.url)), "..");
+var INTEL = join9(ROOT3, "intelligence");
 function loadJson(name) {
-  const p = join8(INTEL, `${name}.json`);
-  if (!existsSync5(p))
+  const p = join9(INTEL, `${name}.json`);
+  if (!existsSync6(p))
     return null;
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -32528,8 +32675,9 @@ var VECTOR_TIME = {
   wp_plugin_audit: 600
 };
 var DEFAULT_VECTOR_TIME = 180;
-function successProbability(priority) {
-  return Math.round(Math.min(0.85, Math.max(0.25, 0.85 - 0.15 * (priority - 1))) * 100) / 100;
+function successProbability(priority, vector, tech) {
+  const formula = Math.round(Math.min(0.85, Math.max(0.25, 0.85 - 0.15 * (priority - 1))) * 100) / 100;
+  return empiricalPrior(vector, tech, formula);
 }
 function estimateTime(vector) {
   return VECTOR_TIME[vector] ?? DEFAULT_VECTOR_TIME;
@@ -32564,6 +32712,7 @@ function attackPlan(target, tech = [], params = [], mode = "full") {
   else if (mode === "stealth")
     sorted = sorted.filter((p) => STEALTH_VECTORS.has(p.vector));
   const totalTime = sorted.reduce((s, p) => s + estimateTime(p.vector), 0);
+  const techKey = (tech[0] ?? "unknown").toLowerCase();
   return {
     target,
     mode,
@@ -32572,7 +32721,7 @@ function attackPlan(target, tech = [], params = [], mode = "full") {
       order: i + 1,
       vector: p.vector,
       priority: p.priority,
-      success_probability: successProbability(p.priority),
+      success_probability: successProbability(p.priority, p.vector, techKey),
       estimated_time_sec: estimateTime(p.vector),
       reason: p.reason,
       tool: p.tool,
@@ -32581,18 +32730,18 @@ function attackPlan(target, tech = [], params = [], mode = "full") {
     total_estimated_time_sec: totalTime
   };
 }
-var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
-var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir5(), ".blitzstrike", "data");
+var PACKAGE_PAYLOADS = join9(ROOT3, "payloads");
+var PACKAGE_TEMPLATES = join9(ROOT3, "templates");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join9(homedir6(), ".blitzstrike", "data");
 function payloadsDir() {
-  if (existsSync5(PACKAGE_PAYLOADS))
+  if (existsSync6(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
-  return join8(DATA_ROOT, "payloads");
+  return join9(DATA_ROOT, "payloads");
 }
 function templatesDir() {
-  if (existsSync5(PACKAGE_TEMPLATES))
+  if (existsSync6(PACKAGE_TEMPLATES))
     return PACKAGE_TEMPLATES;
-  return join8(DATA_ROOT, "templates");
+  return join9(DATA_ROOT, "templates");
 }
 var PAYLOADS = payloadsDir();
 var TEMPLATES = templatesDir();
@@ -32628,7 +32777,7 @@ function payloadLookup(topic) {
   const normalized = ALIASES[key] ?? key;
   const exact = cats.find((c) => c.toLowerCase() === normalized);
   if (exact) {
-    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
+    return { found: true, category: exact, files: listFiles(join9(PAYLOADS, exact)) };
   }
   const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
   const matches = cats.filter((c) => {
@@ -32638,7 +32787,7 @@ function payloadLookup(topic) {
     return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
   });
   if (matches.length > 0) {
-    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
+    return { found: true, category: matches[0], files: listFiles(join9(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
   }
   return { found: false, topic, suggestions: cats.slice(0, 20) };
 }
@@ -32647,19 +32796,19 @@ function readPayload(category, file) {
   const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
   if (!exact)
     return { found: false, category, suggestions: cats.slice(0, 20) };
-  const dir = join8(PAYLOADS, exact);
+  const dir = join9(PAYLOADS, exact);
   const files = listFiles(dir);
   if (!file) {
     const readme = files.find((f) => f.toLowerCase() === "readme.md");
     if (readme) {
-      return { found: true, category: exact, file: readme, content: readFileSync7(join8(dir, readme), "utf8").slice(0, 20000) };
+      return { found: true, category: exact, file: readme, content: readFileSync8(join9(dir, readme), "utf8").slice(0, 20000) };
     }
     return { found: true, category: exact, files };
   }
   const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
   if (!f)
     return { found: false, category: exact, file, suggestions: files };
-  return { found: true, category: exact, file: f, content: readFileSync7(join8(dir, f), "utf8").slice(0, 20000) };
+  return { found: true, category: exact, file: f, content: readFileSync8(join9(dir, f), "utf8").slice(0, 20000) };
 }
 function listFiles(dir) {
   try {
@@ -32674,7 +32823,7 @@ function countTemplates() {
     const walk = (dir) => {
       for (const e of readdirSync4(dir, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join8(dir, e.name));
+          walk(join9(dir, e.name));
         else if (e.name.endsWith(".yaml"))
           n++;
       }
@@ -32699,14 +32848,14 @@ function templateLookup(topic, limit = 10) {
     }
     for (const e of entries) {
       if (e.isDirectory())
-        walk(join8(dir, e.name), depth + 1);
+        walk(join9(dir, e.name), depth + 1);
       else if (e.name.endsWith(".yaml")) {
         const name = e.name.toLowerCase();
         if (name.includes(key)) {
-          const full = join8(dir, e.name);
+          const full = join9(dir, e.name);
           let id = "";
           try {
-            const content = readFileSync7(full, "utf8");
+            const content = readFileSync8(full, "utf8");
             const m = content.match(/^\s*id:\s*(.+)$/m);
             if (m)
               id = m[1].trim();
@@ -33171,10 +33320,83 @@ function cvssAssess(input) {
   return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
 }
 
+// src/compliance.ts
+var CWE_COMPLIANCE = {
+  "79": { name: "Cross-site Scripting (XSS)", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.3"], pci: ["6.5.7"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "89": { name: "SQL Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.4"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "78": { name: "OS Command Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.8"], pci: ["6.5.1"], iso: ["A.8.9"], nist: ["SI-10"] },
+  "94": { name: "Code Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.2.4"], pci: ["6.5.1"], iso: ["A.8.9"], nist: ["SI-10"] },
+  "918": { name: "Server-Side Request Forgery (SSRF)", owasp_top10: "A10:2021 SSRF", asvs: ["V5.2.6"], pci: ["6.5.6"], iso: ["A.8.20"], nist: ["SC-7"] },
+  "611": { name: "XXE", owasp_top10: "A05:2021 Security Misconfiguration", asvs: ["V5.5.2"], pci: ["6.5.3"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "502": { name: "Insecure Deserialization", owasp_top10: "A08:2021 Software and Data Integrity Failures", asvs: ["V5.5.1"], pci: ["6.5.2"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "22": { name: "Path Traversal", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V12.3.1"], pci: ["6.5.8"], iso: ["A.8.12"], nist: ["AC-3"] },
+  "601": { name: "Open Redirect", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V5.1.5"], pci: ["6.5.9"], iso: ["A.8.20"], nist: ["AC-3"] },
+  "434": { name: "Unrestricted File Upload", owasp_top10: "A03:2021 Injection", asvs: ["V12.3.2"], pci: ["6.5.5"], iso: ["A.8.12"], nist: ["SI-10"] },
+  "942": { name: "Permissive Cross-Origin Policy (CORS)", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.2.2"], pci: ["6.5.9"], iso: ["A.8.20"], nist: ["AC-4"] },
+  "287": { name: "Improper Authentication", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.1.1"], pci: ["7.1.1", "8.1.1"], iso: ["A.8.5"], nist: ["IA-2"] },
+  "1336": { name: "Server-Side Template Injection (SSTI)", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.12"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "915": { name: "Mass Assignment", owasp_top10: "A04:2021 Insecure Design", asvs: ["V5.1.2"], pci: ["6.5.4"], iso: ["A.8.2"], nist: ["AC-3"] },
+  "1321": { name: "Prototype Pollution", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.12"], pci: ["6.5.2"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "352": { name: "Cross-Site Request Forgery (CSRF)", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.2.2"], pci: ["6.5.9"], iso: ["A.8.5"], nist: ["AC-3"] },
+  "319": { name: "Cleartext Transmission of Sensitive Information", owasp_top10: "A02:2021 Cryptographic Failures", asvs: ["V9.1.1"], pci: ["4.1.1"], iso: ["A.8.24"], nist: ["SC-8"] },
+  "693": { name: "Protection Mechanism Failure", owasp_top10: "A05:2021 Security Misconfiguration", asvs: ["V14.2.1"], pci: ["6.5.x"], iso: ["A.8.8"], nist: ["SI-2"] },
+  "200": { name: "Exposure of Sensitive Information", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V7.4.1"], pci: ["6.5.x"], iso: ["A.8.11"], nist: ["AC-4"] },
+  "862": { name: "Missing Authorization", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.1.1"], pci: ["7.1.1"], iso: ["A.8.2"], nist: ["AC-3"] },
+  "639": { name: "Insecure Direct Object Reference (IDOR)", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.1.2"], pci: ["7.1.1"], iso: ["A.8.2"], nist: ["AC-3"] },
+  "640": { name: "Weak Password Recovery", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.5.2"], pci: ["8.3.6"], iso: ["A.8.5"], nist: ["IA-5"] },
+  "798": { name: "Hard-coded Credentials", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.10.4"], pci: ["8.3.8"], iso: ["A.8.5"], nist: ["IA-5"] },
+  "327": { name: "Weak Cryptography", owasp_top10: "A02:2021 Cryptographic Failures", asvs: ["V6.2.1"], pci: ["3.5.1"], iso: ["A.8.24"], nist: ["SC-13"] },
+  "306": { name: "Missing Authentication for Critical Function", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V1.2.1"], pci: ["8.1.1"], iso: ["A.8.5"], nist: ["IA-2"] }
+};
+function complianceMap(cwe) {
+  const id = (cwe ?? "").toUpperCase().replace(/^CWE-?/, "");
+  const m = CWE_COMPLIANCE[id];
+  if (!m)
+    return null;
+  return { cwe: `CWE-${id}`, ...m };
+}
+function complianceSummary(cwes) {
+  const by_owasp = {};
+  const by_asvs = {};
+  const by_pci = {};
+  const by_iso = {};
+  const by_nist = {};
+  const mappings = [];
+  let mapped = 0;
+  let unmapped = 0;
+  for (const cwe of cwes) {
+    if (!cwe) {
+      unmapped += 1;
+      continue;
+    }
+    const m = complianceMap(cwe);
+    if (!m) {
+      unmapped += 1;
+      continue;
+    }
+    mapped += 1;
+    if (m.owasp_top10)
+      by_owasp[m.owasp_top10] = (by_owasp[m.owasp_top10] ?? 0) + 1;
+    for (const a of m.asvs ?? [])
+      by_asvs[a] = (by_asvs[a] ?? 0) + 1;
+    for (const p of m.pci ?? [])
+      by_pci[p] = (by_pci[p] ?? 0) + 1;
+    for (const i of m.iso ?? [])
+      by_iso[i] = (by_iso[i] ?? 0) + 1;
+    for (const n of m.nist ?? [])
+      by_nist[n] = (by_nist[n] ?? 0) + 1;
+    if (!mappings.some((x) => x.cwe === m.cwe)) {
+      mappings.push({ cwe: m.cwe, name: m.name, owasp_top10: m.owasp_top10 ?? null, asvs: m.asvs ?? [], pci: m.pci ?? [], iso: m.iso ?? [], nist: m.nist ?? [] });
+    }
+  }
+  mappings.sort((a, b) => a.cwe.localeCompare(b.cwe));
+  return { total_mapped: mapped, total_unmapped: unmapped, by_owasp, by_asvs, by_pci, by_iso, by_nist, mappings };
+}
+
 // src/report.ts
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join9 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join10 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 var SEVERITY_METRICS = {
   critical: { AV: "N", AC: "L", PR: "N", UI: "N", S: "U", C: "H", I: "H", A: "H" },
   high: { AV: "N", AC: "L", PR: "L", UI: "N", S: "U", C: "H", I: "H", A: "N" },
@@ -33333,7 +33555,34 @@ function reportMarkdown(findings, opts = {}) {
       lines.push("");
     });
   }
-  lines.push("## 6. Recommendations");
+  lines.push("## 6. Compliance Mapping");
+  lines.push("");
+  const comp = complianceSummary(findings.map((f) => f.classification?.cwe ?? null));
+  if (comp.total_mapped === 0) {
+    lines.push("No CWE-tagged findings to map.");
+  } else {
+    lines.push("Maps each finding's CWE to OWASP Top 10 (2021), OWASP ASVS v4.0, PCI DSS v4.0, ISO 27001:2022 (Annex A), and NIST SP 800-53.");
+    lines.push("");
+    for (const m of comp.mappings) {
+      lines.push(`- **${m.cwe}** ${m.name}`);
+      if (m.owasp_top10)
+        lines.push(`  - OWASP Top 10: \`${m.owasp_top10}\``);
+      if (m.asvs.length)
+        lines.push(`  - ASVS v4.0: \`${m.asvs.join(", ")}\``);
+      if (m.pci.length)
+        lines.push(`  - PCI DSS v4.0: \`${m.pci.join(", ")}\``);
+      if (m.iso.length)
+        lines.push(`  - ISO 27001:2022: \`${m.iso.join(", ")}\``);
+      if (m.nist.length)
+        lines.push(`  - NIST 800-53: \`${m.nist.join(", ")}\``);
+    }
+    if (comp.total_unmapped > 0) {
+      lines.push("");
+      lines.push(`_${comp.total_unmapped} finding(s) had no CWE and were not mapped._`);
+    }
+  }
+  lines.push("");
+  lines.push("## 7. Recommendations");
   lines.push("");
   if (findings.length === 0) {
     lines.push("No findings — no remediation required.");
@@ -33344,7 +33593,7 @@ function reportMarkdown(findings, opts = {}) {
     });
   }
   lines.push("");
-  lines.push("## 7. Appendix");
+  lines.push("## 8. Appendix");
   lines.push("");
   if (hypotheses.length) {
     lines.push("### Unverified hypotheses (kept for follow-up)");
@@ -33377,18 +33626,18 @@ function reportJson(findings, opts = {}) {
   };
   return JSON.stringify(payload, null, 2);
 }
-var REPORT_DIR = process.env.BLITZSTRIKE_REPORT_DIR ?? join9(homedir6(), ".blitzstrike", "reports");
+var REPORT_DIR = process.env.BLITZSTRIKE_REPORT_DIR ?? join10(homedir7(), ".blitzstrike", "reports");
 function slugify2(s) {
   const slug = s.toLowerCase().replace(/^https?:\/\//, "").replace(/[^a-z0-9.-]+/g, "-").replace(/^-+|-+$/g, "").replace(/\./g, "_").slice(0, 60);
   return slug || "engagement";
 }
 function saveReport(content, opts = {}) {
-  mkdirSync4(REPORT_DIR, { recursive: true });
+  mkdirSync5(REPORT_DIR, { recursive: true });
   const slug = slugify2(opts.scope ?? opts.title ?? "engagement");
   const ts = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const ext = opts.format === "json" ? "json" : "md";
   const filename = `${slug}-${ts}.${ext}`;
-  const path = join9(REPORT_DIR, filename);
+  const path = join10(REPORT_DIR, filename);
   writeFileSync2(path, content, "utf8");
   return { path, dir: REPORT_DIR, filename };
 }
@@ -33969,7 +34218,7 @@ function classifyTarget(target) {
   if (/^https?:\/\//i.test(target))
     return { kind: "live", target };
   try {
-    if (existsSync6(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
+    if (existsSync7(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
       return { kind: "source", target };
     }
   } catch {}
@@ -33985,9 +34234,9 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join10(fileURLToPath5(new URL(".", import.meta.url)), "..");
-    const path = join10(dir, "chains.json");
-    const raw = JSON.parse(readFileSync8(path, "utf8"));
+    const dir = join11(fileURLToPath5(new URL(".", import.meta.url)), "..");
+    const path = join11(dir, "chains.json");
+    const raw = JSON.parse(readFileSync9(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
   } catch {
@@ -34110,7 +34359,7 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   };
   const isPath = (() => {
     try {
-      return existsSync6(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+      return existsSync7(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
     } catch {
       return false;
     }
@@ -34765,8 +35014,8 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join10(fileURLToPath5(new URL(".", import.meta.url)), "..");
-    const data = JSON.parse(readFileSync8(join10(dir, "intelligence", "chain_links.json"), "utf8"));
+    const dir = join11(fileURLToPath5(new URL(".", import.meta.url)), "..");
+    const data = JSON.parse(readFileSync9(join11(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
     return [];
@@ -34922,24 +35171,24 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join11 } from "node:path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function tasksDir() {
-  return join11(fileURLToPath6(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join12(fileURLToPath6(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
-  return join11(tasksDir(), `${id}.json`);
+  return join12(tasksDir(), `${id}.json`);
 }
 function load(id) {
   try {
-    return JSON.parse(readFileSync9(taskPath(id), "utf8"));
+    return JSON.parse(readFileSync10(taskPath(id), "utf8"));
   } catch {
     return null;
   }
 }
 function save(t) {
-  mkdirSync5(tasksDir(), { recursive: true });
+  mkdirSync6(tasksDir(), { recursive: true });
   writeFileSync3(taskPath(t.task_id), JSON.stringify(t, null, 2));
 }
 function taskStart(id, objective, plan) {
@@ -35238,16 +35487,16 @@ function engagementStatus() {
 // src/incremental.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { writeFileSync as writeFileSync4, mkdtempSync, rmSync } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/eagle2.ts
 var import_php_parser2 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 
 // src/dataflow.ts
 init_scanner();
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -35332,7 +35581,7 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    text = readFileSync10(path, "utf8");
+    text = readFileSync11(path, "utf8");
   } catch {
     return result;
   }
@@ -35413,7 +35662,7 @@ init_scanner();
 
 // src/callgraph.ts
 var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -35474,7 +35723,7 @@ function buildCallGraph(path) {
   const g = { nodes: new Map, edges: [] };
   let code;
   try {
-    code = readFileSync11(path, "utf8");
+    code = readFileSync12(path, "utf8");
   } catch {
     return g;
   }
@@ -35617,12 +35866,12 @@ function entryPoints(g) {
 
 // src/cache.ts
 init_version();
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 var mem = new Map;
 var hits = 0;
 var misses = 0;
 function cacheKey(kind, source) {
-  const h = createHash4("sha256").update(source).digest("hex").slice(0, 20);
+  const h = createHash5("sha256").update(source).digest("hex").slice(0, 20);
   return `${kind}:${VERSION}:${h}`;
 }
 function getCache(kind, source) {
@@ -36136,7 +36385,7 @@ function resolveFuncId(name, summaries) {
 function analyzeDataFlow2(path) {
   let cacheCode = "";
   try {
-    cacheCode = readFileSync12(path, "utf8");
+    cacheCode = readFileSync13(path, "utf8");
   } catch {}
   if (cacheCode) {
     const cached = getCache("eagle2", cacheCode);
@@ -36158,7 +36407,7 @@ function analyzeDataFlow2(path) {
   };
   let code;
   try {
-    code = cacheCode || readFileSync12(path, "utf8");
+    code = cacheCode || readFileSync13(path, "utf8");
   } catch {
     return result;
   }
@@ -54753,8 +55002,8 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
       continue;
     const lang = detectLanguage(file)?.language;
     if (lang === "php") {
-      const dir = mkdtempSync(join12(tmpdir(), "blitz-incr-"));
-      const tmp = join12(dir, "changed.php");
+      const dir = mkdtempSync(join13(tmpdir(), "blitz-incr-"));
+      const tmp = join13(dir, "changed.php");
       writeFileSync4(tmp, code);
       try {
         const r = analyzeDataFlow2(tmp);
@@ -54775,7 +55024,7 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
 // src/taint.ts
 init_scanner();
 var import_php_parser4 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 var parser4 = new import_php_parser4.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -55073,7 +55322,7 @@ function analyzeTaint(path) {
   const result = { file: path, findings: [], suppressed: 0 };
   let code;
   try {
-    code = readFileSync13(path, "utf8");
+    code = readFileSync14(path, "utf8");
   } catch {
     return result;
   }
@@ -55167,15 +55416,15 @@ function taintTree(root, maxFiles = 2000) {
 }
 
 // src/differential.ts
-import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14 } from "node:fs";
-import { join as join13 } from "node:path";
+import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15 } from "node:fs";
+import { join as join14 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 import { execFileSync as execFileSync3 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync2(join13(tmpdir2(), "blitz-diff-"));
-    const tmp = join13(dir, "old.php");
+    const dir = mkdtempSync2(join14(tmpdir2(), "blitz-diff-"));
+    const tmp = join14(dir, "old.php");
     writeFileSync5(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
@@ -55329,8 +55578,8 @@ function languageOf(file) {
   return adapter?.language ?? "php";
 }
 function analyzeDifferentialFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync14(oldPath, "utf8");
-  const newCode = readFileSync14(newPath, "utf8");
+  const oldCode = readFileSync15(oldPath, "utf8");
+  const newCode = readFileSync15(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzeDifferential(oldCode, newCode, lang, newPath);
 }
@@ -55360,20 +55609,20 @@ function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
 }
 
 // src/frameworks.ts
-import { readFileSync as readFileSync15, existsSync as existsSync7 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readFileSync as readFileSync16, existsSync as existsSync8 } from "node:fs";
+import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
-var ROOT4 = join14(fileURLToPath7(new URL(".", import.meta.url)), "..");
-var INTEL2 = join14(ROOT4, "intelligence");
+var ROOT4 = join15(fileURLToPath7(new URL(".", import.meta.url)), "..");
+var INTEL2 = join15(ROOT4, "intelligence");
 var cache = null;
 function load2() {
   if (cache)
     return cache;
-  const p = join14(INTEL2, "frameworks.json");
-  if (!existsSync7(p))
+  const p = join15(INTEL2, "frameworks.json");
+  if (!existsSync8(p))
     return null;
   try {
-    cache = JSON.parse(readFileSync15(p, "utf8"));
+    cache = JSON.parse(readFileSync16(p, "utf8"));
     return cache;
   } catch {
     return null;
@@ -56150,17 +56399,17 @@ function nextSteps(ctx) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync16, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join15 } from "node:path";
+import { readFileSync as readFileSync17, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
-import { tmpdir as tmpdir3, homedir as homedir7 } from "node:os";
-var ROOT5 = join15(fileURLToPath8(new URL(".", import.meta.url)), "..");
-var CORPUS = join15(ROOT5, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join15(homedir7(), ".blitzstrike", "corpus");
+import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
+var ROOT5 = join16(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var CORPUS = join16(ROOT5, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join16(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync16(path, "utf8");
+    text = readFileSync17(path, "utf8");
   } catch {
     return null;
   }
@@ -56216,7 +56465,7 @@ function loadDir(dir) {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join15(dir, f));
+      const e = parseCorpusFile(join16(dir, f));
       if (e)
         entries.push(e);
     }
@@ -56227,7 +56476,7 @@ function loadCorpus() {
   return [...loadDir(CORPUS), ...loadDir(CAPTURED_CORPUS_DIR)];
 }
 function captureFalsePositive(input) {
-  mkdirSync6(CAPTURED_CORPUS_DIR, { recursive: true });
+  mkdirSync7(CAPTURED_CORPUS_DIR, { recursive: true });
   const slug = (input.note ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "captured";
   const id = `fp-${slug}-${Date.now().toString(36)}`;
   const ext = { php: "php", javascript: "js", typescript: "ts", python: "py", java: "java", js: "js" }[input.language.toLowerCase()] ?? input.language;
@@ -56243,7 +56492,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join15(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join16(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -56265,7 +56514,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join15(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join16(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -56330,16 +56579,16 @@ function runBenchmark() {
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync9, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join16, resolve } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync18, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { join as join17, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join16(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join16(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join16(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join16(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join16(ROOT6, "wp-batch-route"), expected_vulns: 1 },
-  { id: "php-complex", dir: join16(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join17(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join17(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join17(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join17(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join17(ROOT6, "wp-batch-route"), expected_vulns: 1 },
+  { id: "php-complex", dir: join17(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -56351,7 +56600,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join16(dir, e);
+      const p = join17(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -56372,7 +56621,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync17(f, "utf8");
+      code = readFileSync18(f, "utf8");
     } catch {
       continue;
     }
@@ -56390,7 +56639,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync9(fx.dir)) {
+    if (!existsSync10(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -56568,7 +56817,7 @@ function createServer() {
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
 ` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + `DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.
-` + `KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these.
+` + `KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability).
 ` + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
@@ -56753,6 +57002,16 @@ function createServer() {
       return { content: [{ type: "text", text: JSON.stringify({ error: "invalid verdict JSON" }) }] };
     }
     const updated = resolveFinding(f, v);
+    const outcome = v.status === "confirmed" ? "confirmed" : v.status === "false_positive" ? "false_positive" : null;
+    if (outcome) {
+      recordVerdict({
+        vector: sinkToVector(f.sink?.type ?? ""),
+        outcome,
+        severity: f.classification?.severity,
+        target: f.target?.host ?? f.target?.endpoint,
+        cvss: f.classification?.cvss_score
+      });
+    }
     return { content: [{ type: "text", text: JSON.stringify(updated) }] };
   });
   server.registerTool("scan_leaked_source", {
@@ -57211,6 +57470,42 @@ ${statusLine}` : statusLine },
   }, async ({ target, tech, params, mode }) => {
     return { content: [{ type: "text", text: JSON.stringify(attackPlan(target, tech ?? [], params ?? [], mode ?? "full")) }] };
   });
+  server.registerTool("intelligence", {
+    title: "Query the empirical intelligence ledger",
+    description: "INTELLIGENCE: query the cross-engagement empirical ledger — hit-rates per (vector, tech), top vectors for a tech, or raw query. Verdicts are recorded AUTOMATICALLY by strike_resolve (confirmed/false_positive). Use this to learn what historically worked on a tech BEFORE planning, so a new Laravel target inherits the hit-rates of past Laravel engagements.",
+    inputSchema: {
+      action: _enum(["hit_rates", "top_vectors", "query"]).describe("hit_rates (aggregate) / top_vectors (ranked for a tech) / query (raw filter)"),
+      tech: string2().optional().describe("Tech/framework filter (e.g. flask, laravel, wordpress)"),
+      vector: string2().optional().describe("Vector filter (e.g. sql_injection)"),
+      outcome: string2().optional().describe("Outcome filter (confirmed/false_positive)")
+    }
+  }, async ({ action, tech, vector, outcome }) => {
+    const out = action === "hit_rates" ? hitRates(tech) : action === "top_vectors" ? topVectors(tech ?? "unknown", 10) : queryIntel({ vector, tech, outcome });
+    return { content: [{ type: "text", text: JSON.stringify(out) }] };
+  });
+  server.registerTool("compliance", {
+    title: "Map CWE(s) to compliance frameworks",
+    description: "COMPLIANCE: map a CWE (or a JSON array of CWEs from findings) to OWASP Top 10 (2021), OWASP ASVS v4.0, PCI DSS v4.0, ISO 27001:2022 Annex A, and NIST SP 800-53. Pass a single `cwe` for one mapping, or `cwes` (JSON array) for an aggregate summary. Tells a CISO/auditor which controls a finding violates.",
+    inputSchema: {
+      cwe: string2().optional().describe("A single CWE id (e.g. CWE-89 or 89)"),
+      cwes: string2().optional().describe("JSON array of CWE ids for an aggregate summary")
+    }
+  }, async ({ cwe, cwes }) => {
+    if (cwes) {
+      let arr;
+      try {
+        arr = JSON.parse(cwes);
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "invalid cwes JSON" }) }] };
+      }
+      return { content: [{ type: "text", text: JSON.stringify(complianceSummary(arr)) }] };
+    }
+    const m = complianceMap(cwe ?? "");
+    if (!m) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "CWE not in the compliance table", cwe, hint: "supported ids: 79, 89, 78, 94, 918, 611, 502, 22, 601, 434, 942, 287, 1336, 915, 1321, 352, 319, 693, 200, 862, 639, 640, 798, 327, 306" }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(m) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",
@@ -57719,7 +58014,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync19(path, "utf8");
+    const code = readFileSync20(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -57733,7 +58028,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), and SSTI (user input into a template render with no sandbox).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync19(path, "utf8");
+    const code = readFileSync20(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -57800,7 +58095,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync19(path, "utf8");
+        src = readFileSync20(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -58036,15 +58331,15 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
-import { join as join21 } from "node:path";
+import { readFileSync as readFileSync24, existsSync as existsSync13 } from "node:fs";
+import { join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
-var ROOT11 = join21(fileURLToPath13(new URL(".", import.meta.url)), "..");
+var ROOT11 = join22(fileURLToPath13(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join21(ROOT11, "package.json");
-    if (existsSync12(p))
-      return JSON.parse(readFileSync23(p, "utf8")).version ?? "1.0.0";
+    const p = join22(ROOT11, "package.json");
+    if (existsSync13(p))
+      return JSON.parse(readFileSync24(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }