windows-exe-decompiler-mcp-server 0.1.0 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (134) hide show
  1. package/CLAUDE_INSTALLATION.md +129 -0
  2. package/CODEX_INSTALLATION.md +25 -1
  3. package/COPILOT_INSTALLATION.md +29 -1
  4. package/LICENSE +21 -21
  5. package/README.md +232 -110
  6. package/dist/analysis-provenance.d.ts +50 -2
  7. package/dist/analysis-provenance.js +1 -0
  8. package/dist/analysis-task-runner.js +92 -0
  9. package/dist/config.d.ts +35 -16
  10. package/dist/config.js +37 -3
  11. package/dist/database.js +115 -115
  12. package/dist/decompiler-worker.d.ts +10 -5
  13. package/dist/decompiler-worker.js +240 -58
  14. package/dist/dynamic-trace.d.ts +6 -0
  15. package/dist/dynamic-trace.js +52 -1
  16. package/dist/ghidra-config.js +17 -1
  17. package/dist/index.js +38 -8
  18. package/dist/pe-runtime-functions.d.ts +90 -0
  19. package/dist/pe-runtime-functions.js +452 -0
  20. package/dist/prompts/module-reconstruction-review.d.ts +5 -0
  21. package/dist/prompts/module-reconstruction-review.js +65 -0
  22. package/dist/runtime-correlation.d.ts +5 -0
  23. package/dist/runtime-correlation.js +179 -2
  24. package/dist/sample-workspace.d.ts +28 -0
  25. package/dist/sample-workspace.js +186 -0
  26. package/dist/semantic-name-suggestion-artifacts.d.ts +56 -0
  27. package/dist/semantic-name-suggestion-artifacts.js +87 -0
  28. package/dist/server.js +1 -1
  29. package/dist/setup-guidance.d.ts +73 -0
  30. package/dist/setup-guidance.js +211 -0
  31. package/dist/tools/artifact-read.d.ts +10 -10
  32. package/dist/tools/artifacts-diff.d.ts +8 -8
  33. package/dist/tools/artifacts-list.d.ts +16 -16
  34. package/dist/tools/attack-map.d.ts +8 -8
  35. package/dist/tools/binary-role-profile.d.ts +1197 -0
  36. package/dist/tools/binary-role-profile.js +575 -0
  37. package/dist/tools/code-function-explain-apply.d.ts +12 -12
  38. package/dist/tools/code-function-explain-prepare.d.ts +12 -12
  39. package/dist/tools/code-function-explain-review.d.ts +58 -58
  40. package/dist/tools/code-function-rename-apply.d.ts +12 -12
  41. package/dist/tools/code-function-rename-prepare.d.ts +14 -14
  42. package/dist/tools/code-function-rename-review.d.ts +66 -66
  43. package/dist/tools/code-functions-define.d.ts +337 -0
  44. package/dist/tools/code-functions-define.js +337 -0
  45. package/dist/tools/code-functions-list.js +1 -1
  46. package/dist/tools/code-functions-rank.js +1 -1
  47. package/dist/tools/code-functions-reconstruct.d.ts +368 -58
  48. package/dist/tools/code-functions-reconstruct.js +130 -10
  49. package/dist/tools/code-functions-smart-recover.d.ts +352 -0
  50. package/dist/tools/code-functions-smart-recover.js +190 -0
  51. package/dist/tools/code-module-review-apply.d.ts +233 -0
  52. package/dist/tools/code-module-review-apply.js +209 -0
  53. package/dist/tools/code-module-review-prepare.d.ts +756 -0
  54. package/dist/tools/code-module-review-prepare.js +343 -0
  55. package/dist/tools/code-module-review.d.ts +474 -0
  56. package/dist/tools/code-module-review.js +566 -0
  57. package/dist/tools/code-reconstruct-export.d.ts +193 -21
  58. package/dist/tools/code-reconstruct-export.js +578 -21
  59. package/dist/tools/code-reconstruct-plan.d.ts +20 -20
  60. package/dist/tools/com-role-profile.d.ts +353 -0
  61. package/dist/tools/com-role-profile.js +186 -0
  62. package/dist/tools/dll-export-profile.d.ts +625 -0
  63. package/dist/tools/dll-export-profile.js +230 -0
  64. package/dist/tools/dotnet-metadata-extract.d.ts +122 -122
  65. package/dist/tools/dotnet-reconstruct-export.d.ts +49 -49
  66. package/dist/tools/dotnet-types-list.d.ts +66 -66
  67. package/dist/tools/dynamic-dependencies.d.ts +144 -8
  68. package/dist/tools/dynamic-dependencies.js +20 -1
  69. package/dist/tools/dynamic-memory-import.js +105 -2
  70. package/dist/tools/ghidra-analyze.d.ts +20 -0
  71. package/dist/tools/ghidra-analyze.js +10 -2
  72. package/dist/tools/ghidra-health.d.ts +177 -0
  73. package/dist/tools/ghidra-health.js +28 -0
  74. package/dist/tools/ioc-export.d.ts +8 -8
  75. package/dist/tools/packer-detect.d.ts +14 -14
  76. package/dist/tools/packer-detect.js +6 -9
  77. package/dist/tools/pe-exports-extract.d.ts +8 -8
  78. package/dist/tools/pe-exports-extract.js +6 -9
  79. package/dist/tools/pe-fingerprint.d.ts +36 -36
  80. package/dist/tools/pe-imports-extract.d.ts +8 -8
  81. package/dist/tools/pe-imports-extract.js +6 -9
  82. package/dist/tools/pe-pdata-extract.d.ts +448 -0
  83. package/dist/tools/pe-pdata-extract.js +219 -0
  84. package/dist/tools/pe-symbols-recover.d.ts +227 -0
  85. package/dist/tools/pe-symbols-recover.js +316 -0
  86. package/dist/tools/report-generate.d.ts +15 -1
  87. package/dist/tools/report-generate.js +139 -16
  88. package/dist/tools/report-summarize.d.ts +2242 -8
  89. package/dist/tools/report-summarize.js +246 -10
  90. package/dist/tools/runtime-detect.d.ts +8 -8
  91. package/dist/tools/runtime-detect.js +2 -12
  92. package/dist/tools/rust-binary-analyze.d.ts +2047 -0
  93. package/dist/tools/rust-binary-analyze.js +443 -0
  94. package/dist/tools/sample-profile-get.d.ts +135 -16
  95. package/dist/tools/sample-profile-get.js +35 -32
  96. package/dist/tools/sandbox-execute.d.ts +10 -10
  97. package/dist/tools/strings-extract.d.ts +8 -8
  98. package/dist/tools/strings-extract.js +2 -12
  99. package/dist/tools/strings-floss-decode.d.ts +8 -8
  100. package/dist/tools/system-health.d.ts +172 -36
  101. package/dist/tools/system-health.js +14 -0
  102. package/dist/tools/system-setup-guide.d.ts +179 -0
  103. package/dist/tools/system-setup-guide.js +62 -0
  104. package/dist/tools/tool-help.d.ts +16 -16
  105. package/dist/tools/tool-help.js +172 -0
  106. package/dist/tools/yara-scan.d.ts +8 -8
  107. package/dist/types.d.ts +2 -0
  108. package/dist/workflows/function-explanation-review.d.ts +3034 -76
  109. package/dist/workflows/function-explanation-review.js +172 -42
  110. package/dist/workflows/function-index-recover.d.ts +333 -0
  111. package/dist/workflows/function-index-recover.js +291 -0
  112. package/dist/workflows/module-reconstruction-review.d.ts +3537 -0
  113. package/dist/workflows/module-reconstruction-review.js +354 -0
  114. package/dist/workflows/reconstruct.d.ts +2182 -223
  115. package/dist/workflows/reconstruct.js +575 -32
  116. package/dist/workflows/semantic-name-review.d.ts +1436 -85
  117. package/dist/workflows/semantic-name-review.js +150 -58
  118. package/dist/workflows/triage.d.ts +8 -8
  119. package/ghidra_scripts/DecompileFunction.java +487 -487
  120. package/ghidra_scripts/ExtractCFG.java +256 -256
  121. package/ghidra_scripts/ExtractFunctions.java +442 -442
  122. package/ghidra_scripts/README.md +112 -112
  123. package/ghidra_scripts/SearchFunctionReferences.java +380 -380
  124. package/helpers/DotNetMetadataProbe/DotNetMetadataProbe.csproj +9 -9
  125. package/helpers/DotNetMetadataProbe/Program.cs +566 -566
  126. package/install-to-claude.ps1 +432 -0
  127. package/install-to-codex.ps1 +256 -178
  128. package/install-to-copilot.ps1 +389 -303
  129. package/package.json +4 -2
  130. package/requirements.txt +9 -9
  131. package/workers/requirements-dynamic.txt +11 -11
  132. package/workers/requirements.txt +8 -8
  133. package/workers/speakeasy_compat.py +175 -175
  134. package/workers/static_worker.py +3474 -3474
@@ -382,6 +382,1262 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
382
382
  acceptance_rule?: string | null | undefined;
383
383
  };
384
384
  }>>;
385
+ binary_profile: z.ZodOptional<z.ZodObject<{
386
+ sample_id: z.ZodString;
387
+ original_filename: z.ZodNullable<z.ZodString>;
388
+ binary_role: z.ZodString;
389
+ role_confidence: z.ZodNumber;
390
+ runtime_hint: z.ZodObject<{
391
+ is_dotnet: z.ZodNullable<z.ZodBoolean>;
392
+ dotnet_version: z.ZodNullable<z.ZodString>;
393
+ target_framework: z.ZodNullable<z.ZodString>;
394
+ primary_runtime: z.ZodNullable<z.ZodString>;
395
+ }, "strip", z.ZodTypeAny, {
396
+ is_dotnet: boolean | null;
397
+ dotnet_version: string | null;
398
+ target_framework: string | null;
399
+ primary_runtime: string | null;
400
+ }, {
401
+ is_dotnet: boolean | null;
402
+ dotnet_version: string | null;
403
+ target_framework: string | null;
404
+ primary_runtime: string | null;
405
+ }>;
406
+ export_surface: z.ZodObject<{
407
+ total_exports: z.ZodNumber;
408
+ total_forwarders: z.ZodNumber;
409
+ notable_exports: z.ZodArray<z.ZodString, "many">;
410
+ com_related_exports: z.ZodArray<z.ZodString, "many">;
411
+ service_related_exports: z.ZodArray<z.ZodString, "many">;
412
+ plugin_related_exports: z.ZodArray<z.ZodString, "many">;
413
+ forwarded_exports: z.ZodArray<z.ZodString, "many">;
414
+ }, "strip", z.ZodTypeAny, {
415
+ total_exports: number;
416
+ total_forwarders: number;
417
+ notable_exports: string[];
418
+ com_related_exports: string[];
419
+ service_related_exports: string[];
420
+ plugin_related_exports: string[];
421
+ forwarded_exports: string[];
422
+ }, {
423
+ total_exports: number;
424
+ total_forwarders: number;
425
+ notable_exports: string[];
426
+ com_related_exports: string[];
427
+ service_related_exports: string[];
428
+ plugin_related_exports: string[];
429
+ forwarded_exports: string[];
430
+ }>;
431
+ import_surface: z.ZodObject<{
432
+ dll_count: z.ZodNumber;
433
+ notable_dlls: z.ZodArray<z.ZodString, "many">;
434
+ com_related_imports: z.ZodArray<z.ZodString, "many">;
435
+ service_related_imports: z.ZodArray<z.ZodString, "many">;
436
+ network_related_imports: z.ZodArray<z.ZodString, "many">;
437
+ process_related_imports: z.ZodArray<z.ZodString, "many">;
438
+ }, "strip", z.ZodTypeAny, {
439
+ dll_count: number;
440
+ notable_dlls: string[];
441
+ com_related_imports: string[];
442
+ service_related_imports: string[];
443
+ network_related_imports: string[];
444
+ process_related_imports: string[];
445
+ }, {
446
+ dll_count: number;
447
+ notable_dlls: string[];
448
+ com_related_imports: string[];
449
+ service_related_imports: string[];
450
+ network_related_imports: string[];
451
+ process_related_imports: string[];
452
+ }>;
453
+ packed: z.ZodBoolean;
454
+ packing_confidence: z.ZodNumber;
455
+ indicators: z.ZodObject<{
456
+ com_server: z.ZodObject<{
457
+ likely: z.ZodBoolean;
458
+ confidence: z.ZodNumber;
459
+ evidence: z.ZodArray<z.ZodString, "many">;
460
+ }, "strip", z.ZodTypeAny, {
461
+ confidence: number;
462
+ evidence: string[];
463
+ likely: boolean;
464
+ }, {
465
+ confidence: number;
466
+ evidence: string[];
467
+ likely: boolean;
468
+ }>;
469
+ service_binary: z.ZodObject<{
470
+ likely: z.ZodBoolean;
471
+ confidence: z.ZodNumber;
472
+ evidence: z.ZodArray<z.ZodString, "many">;
473
+ }, "strip", z.ZodTypeAny, {
474
+ confidence: number;
475
+ evidence: string[];
476
+ likely: boolean;
477
+ }, {
478
+ confidence: number;
479
+ evidence: string[];
480
+ likely: boolean;
481
+ }>;
482
+ plugin_binary: z.ZodObject<{
483
+ likely: z.ZodBoolean;
484
+ confidence: z.ZodNumber;
485
+ evidence: z.ZodArray<z.ZodString, "many">;
486
+ }, "strip", z.ZodTypeAny, {
487
+ confidence: number;
488
+ evidence: string[];
489
+ likely: boolean;
490
+ }, {
491
+ confidence: number;
492
+ evidence: string[];
493
+ likely: boolean;
494
+ }>;
495
+ driver_binary: z.ZodObject<{
496
+ likely: z.ZodBoolean;
497
+ confidence: z.ZodNumber;
498
+ evidence: z.ZodArray<z.ZodString, "many">;
499
+ }, "strip", z.ZodTypeAny, {
500
+ confidence: number;
501
+ evidence: string[];
502
+ likely: boolean;
503
+ }, {
504
+ confidence: number;
505
+ evidence: string[];
506
+ likely: boolean;
507
+ }>;
508
+ }, "strip", z.ZodTypeAny, {
509
+ com_server: {
510
+ confidence: number;
511
+ evidence: string[];
512
+ likely: boolean;
513
+ };
514
+ service_binary: {
515
+ confidence: number;
516
+ evidence: string[];
517
+ likely: boolean;
518
+ };
519
+ plugin_binary: {
520
+ confidence: number;
521
+ evidence: string[];
522
+ likely: boolean;
523
+ };
524
+ driver_binary: {
525
+ confidence: number;
526
+ evidence: string[];
527
+ likely: boolean;
528
+ };
529
+ }, {
530
+ com_server: {
531
+ confidence: number;
532
+ evidence: string[];
533
+ likely: boolean;
534
+ };
535
+ service_binary: {
536
+ confidence: number;
537
+ evidence: string[];
538
+ likely: boolean;
539
+ };
540
+ plugin_binary: {
541
+ confidence: number;
542
+ evidence: string[];
543
+ likely: boolean;
544
+ };
545
+ driver_binary: {
546
+ confidence: number;
547
+ evidence: string[];
548
+ likely: boolean;
549
+ };
550
+ }>;
551
+ export_dispatch_profile: z.ZodObject<{
552
+ command_like_exports: z.ZodArray<z.ZodString, "many">;
553
+ callback_like_exports: z.ZodArray<z.ZodString, "many">;
554
+ registration_exports: z.ZodArray<z.ZodString, "many">;
555
+ ordinal_only_exports: z.ZodNumber;
556
+ likely_dispatch_model: z.ZodString;
557
+ confidence: z.ZodNumber;
558
+ }, "strip", z.ZodTypeAny, {
559
+ confidence: number;
560
+ command_like_exports: string[];
561
+ callback_like_exports: string[];
562
+ registration_exports: string[];
563
+ ordinal_only_exports: number;
564
+ likely_dispatch_model: string;
565
+ }, {
566
+ confidence: number;
567
+ command_like_exports: string[];
568
+ callback_like_exports: string[];
569
+ registration_exports: string[];
570
+ ordinal_only_exports: number;
571
+ likely_dispatch_model: string;
572
+ }>;
573
+ lifecycle_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
574
+ com_profile: z.ZodObject<{
575
+ clsid_strings: z.ZodArray<z.ZodString, "many">;
576
+ progid_strings: z.ZodArray<z.ZodString, "many">;
577
+ interface_hints: z.ZodArray<z.ZodString, "many">;
578
+ registration_strings: z.ZodArray<z.ZodString, "many">;
579
+ class_factory_exports: z.ZodArray<z.ZodString, "many">;
580
+ class_factory_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
581
+ confidence: z.ZodNumber;
582
+ }, "strip", z.ZodTypeAny, {
583
+ confidence: number;
584
+ clsid_strings: string[];
585
+ progid_strings: string[];
586
+ interface_hints: string[];
587
+ registration_strings: string[];
588
+ class_factory_exports: string[];
589
+ class_factory_surface: string[];
590
+ }, {
591
+ confidence: number;
592
+ clsid_strings: string[];
593
+ progid_strings: string[];
594
+ interface_hints: string[];
595
+ registration_strings: string[];
596
+ class_factory_exports: string[];
597
+ class_factory_surface?: string[] | undefined;
598
+ }>;
599
+ host_interaction_profile: z.ZodObject<{
600
+ likely_hosted: z.ZodBoolean;
601
+ host_hints: z.ZodArray<z.ZodString, "many">;
602
+ callback_exports: z.ZodArray<z.ZodString, "many">;
603
+ callback_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
604
+ callback_strings: z.ZodArray<z.ZodString, "many">;
605
+ service_hooks: z.ZodArray<z.ZodString, "many">;
606
+ confidence: z.ZodNumber;
607
+ }, "strip", z.ZodTypeAny, {
608
+ confidence: number;
609
+ callback_surface: string[];
610
+ likely_hosted: boolean;
611
+ host_hints: string[];
612
+ callback_exports: string[];
613
+ callback_strings: string[];
614
+ service_hooks: string[];
615
+ }, {
616
+ confidence: number;
617
+ likely_hosted: boolean;
618
+ host_hints: string[];
619
+ callback_exports: string[];
620
+ callback_strings: string[];
621
+ service_hooks: string[];
622
+ callback_surface?: string[] | undefined;
623
+ }>;
624
+ analysis_priorities: z.ZodArray<z.ZodString, "many">;
625
+ strings_considered: z.ZodNumber;
626
+ }, "strip", z.ZodTypeAny, {
627
+ sample_id: string;
628
+ indicators: {
629
+ com_server: {
630
+ confidence: number;
631
+ evidence: string[];
632
+ likely: boolean;
633
+ };
634
+ service_binary: {
635
+ confidence: number;
636
+ evidence: string[];
637
+ likely: boolean;
638
+ };
639
+ plugin_binary: {
640
+ confidence: number;
641
+ evidence: string[];
642
+ likely: boolean;
643
+ };
644
+ driver_binary: {
645
+ confidence: number;
646
+ evidence: string[];
647
+ likely: boolean;
648
+ };
649
+ };
650
+ export_surface: {
651
+ total_exports: number;
652
+ total_forwarders: number;
653
+ notable_exports: string[];
654
+ com_related_exports: string[];
655
+ service_related_exports: string[];
656
+ plugin_related_exports: string[];
657
+ forwarded_exports: string[];
658
+ };
659
+ packed: boolean;
660
+ binary_role: string;
661
+ original_filename: string | null;
662
+ packing_confidence: number;
663
+ analysis_priorities: string[];
664
+ role_confidence: number;
665
+ runtime_hint: {
666
+ is_dotnet: boolean | null;
667
+ dotnet_version: string | null;
668
+ target_framework: string | null;
669
+ primary_runtime: string | null;
670
+ };
671
+ import_surface: {
672
+ dll_count: number;
673
+ notable_dlls: string[];
674
+ com_related_imports: string[];
675
+ service_related_imports: string[];
676
+ network_related_imports: string[];
677
+ process_related_imports: string[];
678
+ };
679
+ export_dispatch_profile: {
680
+ confidence: number;
681
+ command_like_exports: string[];
682
+ callback_like_exports: string[];
683
+ registration_exports: string[];
684
+ ordinal_only_exports: number;
685
+ likely_dispatch_model: string;
686
+ };
687
+ lifecycle_surface: string[];
688
+ com_profile: {
689
+ confidence: number;
690
+ clsid_strings: string[];
691
+ progid_strings: string[];
692
+ interface_hints: string[];
693
+ registration_strings: string[];
694
+ class_factory_exports: string[];
695
+ class_factory_surface: string[];
696
+ };
697
+ host_interaction_profile: {
698
+ confidence: number;
699
+ callback_surface: string[];
700
+ likely_hosted: boolean;
701
+ host_hints: string[];
702
+ callback_exports: string[];
703
+ callback_strings: string[];
704
+ service_hooks: string[];
705
+ };
706
+ strings_considered: number;
707
+ }, {
708
+ sample_id: string;
709
+ indicators: {
710
+ com_server: {
711
+ confidence: number;
712
+ evidence: string[];
713
+ likely: boolean;
714
+ };
715
+ service_binary: {
716
+ confidence: number;
717
+ evidence: string[];
718
+ likely: boolean;
719
+ };
720
+ plugin_binary: {
721
+ confidence: number;
722
+ evidence: string[];
723
+ likely: boolean;
724
+ };
725
+ driver_binary: {
726
+ confidence: number;
727
+ evidence: string[];
728
+ likely: boolean;
729
+ };
730
+ };
731
+ export_surface: {
732
+ total_exports: number;
733
+ total_forwarders: number;
734
+ notable_exports: string[];
735
+ com_related_exports: string[];
736
+ service_related_exports: string[];
737
+ plugin_related_exports: string[];
738
+ forwarded_exports: string[];
739
+ };
740
+ packed: boolean;
741
+ binary_role: string;
742
+ original_filename: string | null;
743
+ packing_confidence: number;
744
+ analysis_priorities: string[];
745
+ role_confidence: number;
746
+ runtime_hint: {
747
+ is_dotnet: boolean | null;
748
+ dotnet_version: string | null;
749
+ target_framework: string | null;
750
+ primary_runtime: string | null;
751
+ };
752
+ import_surface: {
753
+ dll_count: number;
754
+ notable_dlls: string[];
755
+ com_related_imports: string[];
756
+ service_related_imports: string[];
757
+ network_related_imports: string[];
758
+ process_related_imports: string[];
759
+ };
760
+ export_dispatch_profile: {
761
+ confidence: number;
762
+ command_like_exports: string[];
763
+ callback_like_exports: string[];
764
+ registration_exports: string[];
765
+ ordinal_only_exports: number;
766
+ likely_dispatch_model: string;
767
+ };
768
+ com_profile: {
769
+ confidence: number;
770
+ clsid_strings: string[];
771
+ progid_strings: string[];
772
+ interface_hints: string[];
773
+ registration_strings: string[];
774
+ class_factory_exports: string[];
775
+ class_factory_surface?: string[] | undefined;
776
+ };
777
+ host_interaction_profile: {
778
+ confidence: number;
779
+ likely_hosted: boolean;
780
+ host_hints: string[];
781
+ callback_exports: string[];
782
+ callback_strings: string[];
783
+ service_hooks: string[];
784
+ callback_surface?: string[] | undefined;
785
+ };
786
+ strings_considered: number;
787
+ lifecycle_surface?: string[] | undefined;
788
+ }>>;
789
+ rust_profile: z.ZodOptional<z.ZodObject<{
790
+ sample_id: z.ZodString;
791
+ suspected_rust: z.ZodBoolean;
792
+ confidence: z.ZodNumber;
793
+ primary_runtime: z.ZodNullable<z.ZodString>;
794
+ runtime_hints: z.ZodArray<z.ZodString, "many">;
795
+ cargo_paths: z.ZodArray<z.ZodString, "many">;
796
+ rust_markers: z.ZodArray<z.ZodString, "many">;
797
+ async_runtime_markers: z.ZodArray<z.ZodString, "many">;
798
+ panic_markers: z.ZodArray<z.ZodString, "many">;
799
+ crate_hints: z.ZodArray<z.ZodString, "many">;
800
+ library_profile: z.ZodOptional<z.ZodObject<{
801
+ ecosystems: z.ZodArray<z.ZodString, "many">;
802
+ top_crates: z.ZodArray<z.ZodString, "many">;
803
+ notable_libraries: z.ZodArray<z.ZodString, "many">;
804
+ evidence: z.ZodArray<z.ZodString, "many">;
805
+ }, "strip", z.ZodTypeAny, {
806
+ evidence: string[];
807
+ ecosystems: string[];
808
+ top_crates: string[];
809
+ notable_libraries: string[];
810
+ }, {
811
+ evidence: string[];
812
+ ecosystems: string[];
813
+ top_crates: string[];
814
+ notable_libraries: string[];
815
+ }>>;
816
+ binary_profile: z.ZodOptional<z.ZodObject<{
817
+ sample_id: z.ZodString;
818
+ original_filename: z.ZodNullable<z.ZodString>;
819
+ binary_role: z.ZodString;
820
+ role_confidence: z.ZodNumber;
821
+ runtime_hint: z.ZodObject<{
822
+ is_dotnet: z.ZodNullable<z.ZodBoolean>;
823
+ dotnet_version: z.ZodNullable<z.ZodString>;
824
+ target_framework: z.ZodNullable<z.ZodString>;
825
+ primary_runtime: z.ZodNullable<z.ZodString>;
826
+ }, "strip", z.ZodTypeAny, {
827
+ is_dotnet: boolean | null;
828
+ dotnet_version: string | null;
829
+ target_framework: string | null;
830
+ primary_runtime: string | null;
831
+ }, {
832
+ is_dotnet: boolean | null;
833
+ dotnet_version: string | null;
834
+ target_framework: string | null;
835
+ primary_runtime: string | null;
836
+ }>;
837
+ export_surface: z.ZodObject<{
838
+ total_exports: z.ZodNumber;
839
+ total_forwarders: z.ZodNumber;
840
+ notable_exports: z.ZodArray<z.ZodString, "many">;
841
+ com_related_exports: z.ZodArray<z.ZodString, "many">;
842
+ service_related_exports: z.ZodArray<z.ZodString, "many">;
843
+ plugin_related_exports: z.ZodArray<z.ZodString, "many">;
844
+ forwarded_exports: z.ZodArray<z.ZodString, "many">;
845
+ }, "strip", z.ZodTypeAny, {
846
+ total_exports: number;
847
+ total_forwarders: number;
848
+ notable_exports: string[];
849
+ com_related_exports: string[];
850
+ service_related_exports: string[];
851
+ plugin_related_exports: string[];
852
+ forwarded_exports: string[];
853
+ }, {
854
+ total_exports: number;
855
+ total_forwarders: number;
856
+ notable_exports: string[];
857
+ com_related_exports: string[];
858
+ service_related_exports: string[];
859
+ plugin_related_exports: string[];
860
+ forwarded_exports: string[];
861
+ }>;
862
+ import_surface: z.ZodObject<{
863
+ dll_count: z.ZodNumber;
864
+ notable_dlls: z.ZodArray<z.ZodString, "many">;
865
+ com_related_imports: z.ZodArray<z.ZodString, "many">;
866
+ service_related_imports: z.ZodArray<z.ZodString, "many">;
867
+ network_related_imports: z.ZodArray<z.ZodString, "many">;
868
+ process_related_imports: z.ZodArray<z.ZodString, "many">;
869
+ }, "strip", z.ZodTypeAny, {
870
+ dll_count: number;
871
+ notable_dlls: string[];
872
+ com_related_imports: string[];
873
+ service_related_imports: string[];
874
+ network_related_imports: string[];
875
+ process_related_imports: string[];
876
+ }, {
877
+ dll_count: number;
878
+ notable_dlls: string[];
879
+ com_related_imports: string[];
880
+ service_related_imports: string[];
881
+ network_related_imports: string[];
882
+ process_related_imports: string[];
883
+ }>;
884
+ packed: z.ZodBoolean;
885
+ packing_confidence: z.ZodNumber;
886
+ indicators: z.ZodObject<{
887
+ com_server: z.ZodObject<{
888
+ likely: z.ZodBoolean;
889
+ confidence: z.ZodNumber;
890
+ evidence: z.ZodArray<z.ZodString, "many">;
891
+ }, "strip", z.ZodTypeAny, {
892
+ confidence: number;
893
+ evidence: string[];
894
+ likely: boolean;
895
+ }, {
896
+ confidence: number;
897
+ evidence: string[];
898
+ likely: boolean;
899
+ }>;
900
+ service_binary: z.ZodObject<{
901
+ likely: z.ZodBoolean;
902
+ confidence: z.ZodNumber;
903
+ evidence: z.ZodArray<z.ZodString, "many">;
904
+ }, "strip", z.ZodTypeAny, {
905
+ confidence: number;
906
+ evidence: string[];
907
+ likely: boolean;
908
+ }, {
909
+ confidence: number;
910
+ evidence: string[];
911
+ likely: boolean;
912
+ }>;
913
+ plugin_binary: z.ZodObject<{
914
+ likely: z.ZodBoolean;
915
+ confidence: z.ZodNumber;
916
+ evidence: z.ZodArray<z.ZodString, "many">;
917
+ }, "strip", z.ZodTypeAny, {
918
+ confidence: number;
919
+ evidence: string[];
920
+ likely: boolean;
921
+ }, {
922
+ confidence: number;
923
+ evidence: string[];
924
+ likely: boolean;
925
+ }>;
926
+ driver_binary: z.ZodObject<{
927
+ likely: z.ZodBoolean;
928
+ confidence: z.ZodNumber;
929
+ evidence: z.ZodArray<z.ZodString, "many">;
930
+ }, "strip", z.ZodTypeAny, {
931
+ confidence: number;
932
+ evidence: string[];
933
+ likely: boolean;
934
+ }, {
935
+ confidence: number;
936
+ evidence: string[];
937
+ likely: boolean;
938
+ }>;
939
+ }, "strip", z.ZodTypeAny, {
940
+ com_server: {
941
+ confidence: number;
942
+ evidence: string[];
943
+ likely: boolean;
944
+ };
945
+ service_binary: {
946
+ confidence: number;
947
+ evidence: string[];
948
+ likely: boolean;
949
+ };
950
+ plugin_binary: {
951
+ confidence: number;
952
+ evidence: string[];
953
+ likely: boolean;
954
+ };
955
+ driver_binary: {
956
+ confidence: number;
957
+ evidence: string[];
958
+ likely: boolean;
959
+ };
960
+ }, {
961
+ com_server: {
962
+ confidence: number;
963
+ evidence: string[];
964
+ likely: boolean;
965
+ };
966
+ service_binary: {
967
+ confidence: number;
968
+ evidence: string[];
969
+ likely: boolean;
970
+ };
971
+ plugin_binary: {
972
+ confidence: number;
973
+ evidence: string[];
974
+ likely: boolean;
975
+ };
976
+ driver_binary: {
977
+ confidence: number;
978
+ evidence: string[];
979
+ likely: boolean;
980
+ };
981
+ }>;
982
+ export_dispatch_profile: z.ZodObject<{
983
+ command_like_exports: z.ZodArray<z.ZodString, "many">;
984
+ callback_like_exports: z.ZodArray<z.ZodString, "many">;
985
+ registration_exports: z.ZodArray<z.ZodString, "many">;
986
+ ordinal_only_exports: z.ZodNumber;
987
+ likely_dispatch_model: z.ZodString;
988
+ confidence: z.ZodNumber;
989
+ }, "strip", z.ZodTypeAny, {
990
+ confidence: number;
991
+ command_like_exports: string[];
992
+ callback_like_exports: string[];
993
+ registration_exports: string[];
994
+ ordinal_only_exports: number;
995
+ likely_dispatch_model: string;
996
+ }, {
997
+ confidence: number;
998
+ command_like_exports: string[];
999
+ callback_like_exports: string[];
1000
+ registration_exports: string[];
1001
+ ordinal_only_exports: number;
1002
+ likely_dispatch_model: string;
1003
+ }>;
1004
+ lifecycle_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
1005
+ com_profile: z.ZodObject<{
1006
+ clsid_strings: z.ZodArray<z.ZodString, "many">;
1007
+ progid_strings: z.ZodArray<z.ZodString, "many">;
1008
+ interface_hints: z.ZodArray<z.ZodString, "many">;
1009
+ registration_strings: z.ZodArray<z.ZodString, "many">;
1010
+ class_factory_exports: z.ZodArray<z.ZodString, "many">;
1011
+ class_factory_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
1012
+ confidence: z.ZodNumber;
1013
+ }, "strip", z.ZodTypeAny, {
1014
+ confidence: number;
1015
+ clsid_strings: string[];
1016
+ progid_strings: string[];
1017
+ interface_hints: string[];
1018
+ registration_strings: string[];
1019
+ class_factory_exports: string[];
1020
+ class_factory_surface: string[];
1021
+ }, {
1022
+ confidence: number;
1023
+ clsid_strings: string[];
1024
+ progid_strings: string[];
1025
+ interface_hints: string[];
1026
+ registration_strings: string[];
1027
+ class_factory_exports: string[];
1028
+ class_factory_surface?: string[] | undefined;
1029
+ }>;
1030
+ host_interaction_profile: z.ZodObject<{
1031
+ likely_hosted: z.ZodBoolean;
1032
+ host_hints: z.ZodArray<z.ZodString, "many">;
1033
+ callback_exports: z.ZodArray<z.ZodString, "many">;
1034
+ callback_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
1035
+ callback_strings: z.ZodArray<z.ZodString, "many">;
1036
+ service_hooks: z.ZodArray<z.ZodString, "many">;
1037
+ confidence: z.ZodNumber;
1038
+ }, "strip", z.ZodTypeAny, {
1039
+ confidence: number;
1040
+ callback_surface: string[];
1041
+ likely_hosted: boolean;
1042
+ host_hints: string[];
1043
+ callback_exports: string[];
1044
+ callback_strings: string[];
1045
+ service_hooks: string[];
1046
+ }, {
1047
+ confidence: number;
1048
+ likely_hosted: boolean;
1049
+ host_hints: string[];
1050
+ callback_exports: string[];
1051
+ callback_strings: string[];
1052
+ service_hooks: string[];
1053
+ callback_surface?: string[] | undefined;
1054
+ }>;
1055
+ analysis_priorities: z.ZodArray<z.ZodString, "many">;
1056
+ strings_considered: z.ZodNumber;
1057
+ }, "strip", z.ZodTypeAny, {
1058
+ sample_id: string;
1059
+ indicators: {
1060
+ com_server: {
1061
+ confidence: number;
1062
+ evidence: string[];
1063
+ likely: boolean;
1064
+ };
1065
+ service_binary: {
1066
+ confidence: number;
1067
+ evidence: string[];
1068
+ likely: boolean;
1069
+ };
1070
+ plugin_binary: {
1071
+ confidence: number;
1072
+ evidence: string[];
1073
+ likely: boolean;
1074
+ };
1075
+ driver_binary: {
1076
+ confidence: number;
1077
+ evidence: string[];
1078
+ likely: boolean;
1079
+ };
1080
+ };
1081
+ export_surface: {
1082
+ total_exports: number;
1083
+ total_forwarders: number;
1084
+ notable_exports: string[];
1085
+ com_related_exports: string[];
1086
+ service_related_exports: string[];
1087
+ plugin_related_exports: string[];
1088
+ forwarded_exports: string[];
1089
+ };
1090
+ packed: boolean;
1091
+ binary_role: string;
1092
+ original_filename: string | null;
1093
+ packing_confidence: number;
1094
+ analysis_priorities: string[];
1095
+ role_confidence: number;
1096
+ runtime_hint: {
1097
+ is_dotnet: boolean | null;
1098
+ dotnet_version: string | null;
1099
+ target_framework: string | null;
1100
+ primary_runtime: string | null;
1101
+ };
1102
+ import_surface: {
1103
+ dll_count: number;
1104
+ notable_dlls: string[];
1105
+ com_related_imports: string[];
1106
+ service_related_imports: string[];
1107
+ network_related_imports: string[];
1108
+ process_related_imports: string[];
1109
+ };
1110
+ export_dispatch_profile: {
1111
+ confidence: number;
1112
+ command_like_exports: string[];
1113
+ callback_like_exports: string[];
1114
+ registration_exports: string[];
1115
+ ordinal_only_exports: number;
1116
+ likely_dispatch_model: string;
1117
+ };
1118
+ lifecycle_surface: string[];
1119
+ com_profile: {
1120
+ confidence: number;
1121
+ clsid_strings: string[];
1122
+ progid_strings: string[];
1123
+ interface_hints: string[];
1124
+ registration_strings: string[];
1125
+ class_factory_exports: string[];
1126
+ class_factory_surface: string[];
1127
+ };
1128
+ host_interaction_profile: {
1129
+ confidence: number;
1130
+ callback_surface: string[];
1131
+ likely_hosted: boolean;
1132
+ host_hints: string[];
1133
+ callback_exports: string[];
1134
+ callback_strings: string[];
1135
+ service_hooks: string[];
1136
+ };
1137
+ strings_considered: number;
1138
+ }, {
1139
+ sample_id: string;
1140
+ indicators: {
1141
+ com_server: {
1142
+ confidence: number;
1143
+ evidence: string[];
1144
+ likely: boolean;
1145
+ };
1146
+ service_binary: {
1147
+ confidence: number;
1148
+ evidence: string[];
1149
+ likely: boolean;
1150
+ };
1151
+ plugin_binary: {
1152
+ confidence: number;
1153
+ evidence: string[];
1154
+ likely: boolean;
1155
+ };
1156
+ driver_binary: {
1157
+ confidence: number;
1158
+ evidence: string[];
1159
+ likely: boolean;
1160
+ };
1161
+ };
1162
+ export_surface: {
1163
+ total_exports: number;
1164
+ total_forwarders: number;
1165
+ notable_exports: string[];
1166
+ com_related_exports: string[];
1167
+ service_related_exports: string[];
1168
+ plugin_related_exports: string[];
1169
+ forwarded_exports: string[];
1170
+ };
1171
+ packed: boolean;
1172
+ binary_role: string;
1173
+ original_filename: string | null;
1174
+ packing_confidence: number;
1175
+ analysis_priorities: string[];
1176
+ role_confidence: number;
1177
+ runtime_hint: {
1178
+ is_dotnet: boolean | null;
1179
+ dotnet_version: string | null;
1180
+ target_framework: string | null;
1181
+ primary_runtime: string | null;
1182
+ };
1183
+ import_surface: {
1184
+ dll_count: number;
1185
+ notable_dlls: string[];
1186
+ com_related_imports: string[];
1187
+ service_related_imports: string[];
1188
+ network_related_imports: string[];
1189
+ process_related_imports: string[];
1190
+ };
1191
+ export_dispatch_profile: {
1192
+ confidence: number;
1193
+ command_like_exports: string[];
1194
+ callback_like_exports: string[];
1195
+ registration_exports: string[];
1196
+ ordinal_only_exports: number;
1197
+ likely_dispatch_model: string;
1198
+ };
1199
+ com_profile: {
1200
+ confidence: number;
1201
+ clsid_strings: string[];
1202
+ progid_strings: string[];
1203
+ interface_hints: string[];
1204
+ registration_strings: string[];
1205
+ class_factory_exports: string[];
1206
+ class_factory_surface?: string[] | undefined;
1207
+ };
1208
+ host_interaction_profile: {
1209
+ confidence: number;
1210
+ likely_hosted: boolean;
1211
+ host_hints: string[];
1212
+ callback_exports: string[];
1213
+ callback_strings: string[];
1214
+ service_hooks: string[];
1215
+ callback_surface?: string[] | undefined;
1216
+ };
1217
+ strings_considered: number;
1218
+ lifecycle_surface?: string[] | undefined;
1219
+ }>>;
1220
+ recovered_function_count: z.ZodNumber;
1221
+ recovered_function_strategy: z.ZodArray<z.ZodString, "many">;
1222
+ recovered_symbol_count: z.ZodNumber;
1223
+ recovered_symbol_preview: z.ZodArray<z.ZodObject<{
1224
+ address: z.ZodString;
1225
+ recovered_name: z.ZodString;
1226
+ name_strategy: z.ZodString;
1227
+ confidence: z.ZodNumber;
1228
+ }, "strip", z.ZodTypeAny, {
1229
+ address: string;
1230
+ confidence: number;
1231
+ recovered_name: string;
1232
+ name_strategy: string;
1233
+ }, {
1234
+ address: string;
1235
+ confidence: number;
1236
+ recovered_name: string;
1237
+ name_strategy: string;
1238
+ }>, "many">;
1239
+ components: z.ZodObject<{
1240
+ runtime_detect: z.ZodObject<{
1241
+ ok: z.ZodBoolean;
1242
+ warning_count: z.ZodNumber;
1243
+ error_count: z.ZodNumber;
1244
+ }, "strip", z.ZodTypeAny, {
1245
+ ok: boolean;
1246
+ warning_count: number;
1247
+ error_count: number;
1248
+ }, {
1249
+ ok: boolean;
1250
+ warning_count: number;
1251
+ error_count: number;
1252
+ }>;
1253
+ strings_extract: z.ZodObject<{
1254
+ ok: z.ZodBoolean;
1255
+ warning_count: z.ZodNumber;
1256
+ error_count: z.ZodNumber;
1257
+ }, "strip", z.ZodTypeAny, {
1258
+ ok: boolean;
1259
+ warning_count: number;
1260
+ error_count: number;
1261
+ }, {
1262
+ ok: boolean;
1263
+ warning_count: number;
1264
+ error_count: number;
1265
+ }>;
1266
+ smart_recover: z.ZodObject<{
1267
+ ok: z.ZodBoolean;
1268
+ warning_count: z.ZodNumber;
1269
+ error_count: z.ZodNumber;
1270
+ }, "strip", z.ZodTypeAny, {
1271
+ ok: boolean;
1272
+ warning_count: number;
1273
+ error_count: number;
1274
+ }, {
1275
+ ok: boolean;
1276
+ warning_count: number;
1277
+ error_count: number;
1278
+ }>;
1279
+ symbols_recover: z.ZodObject<{
1280
+ ok: z.ZodBoolean;
1281
+ warning_count: z.ZodNumber;
1282
+ error_count: z.ZodNumber;
1283
+ }, "strip", z.ZodTypeAny, {
1284
+ ok: boolean;
1285
+ warning_count: number;
1286
+ error_count: number;
1287
+ }, {
1288
+ ok: boolean;
1289
+ warning_count: number;
1290
+ error_count: number;
1291
+ }>;
1292
+ binary_role_profile: z.ZodObject<{
1293
+ ok: z.ZodBoolean;
1294
+ warning_count: z.ZodNumber;
1295
+ error_count: z.ZodNumber;
1296
+ }, "strip", z.ZodTypeAny, {
1297
+ ok: boolean;
1298
+ warning_count: number;
1299
+ error_count: number;
1300
+ }, {
1301
+ ok: boolean;
1302
+ warning_count: number;
1303
+ error_count: number;
1304
+ }>;
1305
+ }, "strip", z.ZodTypeAny, {
1306
+ runtime_detect: {
1307
+ ok: boolean;
1308
+ warning_count: number;
1309
+ error_count: number;
1310
+ };
1311
+ strings_extract: {
1312
+ ok: boolean;
1313
+ warning_count: number;
1314
+ error_count: number;
1315
+ };
1316
+ smart_recover: {
1317
+ ok: boolean;
1318
+ warning_count: number;
1319
+ error_count: number;
1320
+ };
1321
+ symbols_recover: {
1322
+ ok: boolean;
1323
+ warning_count: number;
1324
+ error_count: number;
1325
+ };
1326
+ binary_role_profile: {
1327
+ ok: boolean;
1328
+ warning_count: number;
1329
+ error_count: number;
1330
+ };
1331
+ }, {
1332
+ runtime_detect: {
1333
+ ok: boolean;
1334
+ warning_count: number;
1335
+ error_count: number;
1336
+ };
1337
+ strings_extract: {
1338
+ ok: boolean;
1339
+ warning_count: number;
1340
+ error_count: number;
1341
+ };
1342
+ smart_recover: {
1343
+ ok: boolean;
1344
+ warning_count: number;
1345
+ error_count: number;
1346
+ };
1347
+ symbols_recover: {
1348
+ ok: boolean;
1349
+ warning_count: number;
1350
+ error_count: number;
1351
+ };
1352
+ binary_role_profile: {
1353
+ ok: boolean;
1354
+ warning_count: number;
1355
+ error_count: number;
1356
+ };
1357
+ }>;
1358
+ importable_with_code_functions_define: z.ZodBoolean;
1359
+ evidence: z.ZodArray<z.ZodString, "many">;
1360
+ analysis_priorities: z.ZodArray<z.ZodString, "many">;
1361
+ next_steps: z.ZodArray<z.ZodString, "many">;
1362
+ }, "strip", z.ZodTypeAny, {
1363
+ sample_id: string;
1364
+ confidence: number;
1365
+ evidence: string[];
1366
+ cargo_paths: string[];
1367
+ rust_markers: string[];
1368
+ primary_runtime: string | null;
1369
+ analysis_priorities: string[];
1370
+ crate_hints: string[];
1371
+ runtime_hints: string[];
1372
+ suspected_rust: boolean;
1373
+ async_runtime_markers: string[];
1374
+ panic_markers: string[];
1375
+ recovered_function_count: number;
1376
+ recovered_function_strategy: string[];
1377
+ recovered_symbol_count: number;
1378
+ recovered_symbol_preview: {
1379
+ address: string;
1380
+ confidence: number;
1381
+ recovered_name: string;
1382
+ name_strategy: string;
1383
+ }[];
1384
+ components: {
1385
+ runtime_detect: {
1386
+ ok: boolean;
1387
+ warning_count: number;
1388
+ error_count: number;
1389
+ };
1390
+ strings_extract: {
1391
+ ok: boolean;
1392
+ warning_count: number;
1393
+ error_count: number;
1394
+ };
1395
+ smart_recover: {
1396
+ ok: boolean;
1397
+ warning_count: number;
1398
+ error_count: number;
1399
+ };
1400
+ symbols_recover: {
1401
+ ok: boolean;
1402
+ warning_count: number;
1403
+ error_count: number;
1404
+ };
1405
+ binary_role_profile: {
1406
+ ok: boolean;
1407
+ warning_count: number;
1408
+ error_count: number;
1409
+ };
1410
+ };
1411
+ importable_with_code_functions_define: boolean;
1412
+ next_steps: string[];
1413
+ library_profile?: {
1414
+ evidence: string[];
1415
+ ecosystems: string[];
1416
+ top_crates: string[];
1417
+ notable_libraries: string[];
1418
+ } | undefined;
1419
+ binary_profile?: {
1420
+ sample_id: string;
1421
+ indicators: {
1422
+ com_server: {
1423
+ confidence: number;
1424
+ evidence: string[];
1425
+ likely: boolean;
1426
+ };
1427
+ service_binary: {
1428
+ confidence: number;
1429
+ evidence: string[];
1430
+ likely: boolean;
1431
+ };
1432
+ plugin_binary: {
1433
+ confidence: number;
1434
+ evidence: string[];
1435
+ likely: boolean;
1436
+ };
1437
+ driver_binary: {
1438
+ confidence: number;
1439
+ evidence: string[];
1440
+ likely: boolean;
1441
+ };
1442
+ };
1443
+ export_surface: {
1444
+ total_exports: number;
1445
+ total_forwarders: number;
1446
+ notable_exports: string[];
1447
+ com_related_exports: string[];
1448
+ service_related_exports: string[];
1449
+ plugin_related_exports: string[];
1450
+ forwarded_exports: string[];
1451
+ };
1452
+ packed: boolean;
1453
+ binary_role: string;
1454
+ original_filename: string | null;
1455
+ packing_confidence: number;
1456
+ analysis_priorities: string[];
1457
+ role_confidence: number;
1458
+ runtime_hint: {
1459
+ is_dotnet: boolean | null;
1460
+ dotnet_version: string | null;
1461
+ target_framework: string | null;
1462
+ primary_runtime: string | null;
1463
+ };
1464
+ import_surface: {
1465
+ dll_count: number;
1466
+ notable_dlls: string[];
1467
+ com_related_imports: string[];
1468
+ service_related_imports: string[];
1469
+ network_related_imports: string[];
1470
+ process_related_imports: string[];
1471
+ };
1472
+ export_dispatch_profile: {
1473
+ confidence: number;
1474
+ command_like_exports: string[];
1475
+ callback_like_exports: string[];
1476
+ registration_exports: string[];
1477
+ ordinal_only_exports: number;
1478
+ likely_dispatch_model: string;
1479
+ };
1480
+ lifecycle_surface: string[];
1481
+ com_profile: {
1482
+ confidence: number;
1483
+ clsid_strings: string[];
1484
+ progid_strings: string[];
1485
+ interface_hints: string[];
1486
+ registration_strings: string[];
1487
+ class_factory_exports: string[];
1488
+ class_factory_surface: string[];
1489
+ };
1490
+ host_interaction_profile: {
1491
+ confidence: number;
1492
+ callback_surface: string[];
1493
+ likely_hosted: boolean;
1494
+ host_hints: string[];
1495
+ callback_exports: string[];
1496
+ callback_strings: string[];
1497
+ service_hooks: string[];
1498
+ };
1499
+ strings_considered: number;
1500
+ } | undefined;
1501
+ }, {
1502
+ sample_id: string;
1503
+ confidence: number;
1504
+ evidence: string[];
1505
+ cargo_paths: string[];
1506
+ rust_markers: string[];
1507
+ primary_runtime: string | null;
1508
+ analysis_priorities: string[];
1509
+ crate_hints: string[];
1510
+ runtime_hints: string[];
1511
+ suspected_rust: boolean;
1512
+ async_runtime_markers: string[];
1513
+ panic_markers: string[];
1514
+ recovered_function_count: number;
1515
+ recovered_function_strategy: string[];
1516
+ recovered_symbol_count: number;
1517
+ recovered_symbol_preview: {
1518
+ address: string;
1519
+ confidence: number;
1520
+ recovered_name: string;
1521
+ name_strategy: string;
1522
+ }[];
1523
+ components: {
1524
+ runtime_detect: {
1525
+ ok: boolean;
1526
+ warning_count: number;
1527
+ error_count: number;
1528
+ };
1529
+ strings_extract: {
1530
+ ok: boolean;
1531
+ warning_count: number;
1532
+ error_count: number;
1533
+ };
1534
+ smart_recover: {
1535
+ ok: boolean;
1536
+ warning_count: number;
1537
+ error_count: number;
1538
+ };
1539
+ symbols_recover: {
1540
+ ok: boolean;
1541
+ warning_count: number;
1542
+ error_count: number;
1543
+ };
1544
+ binary_role_profile: {
1545
+ ok: boolean;
1546
+ warning_count: number;
1547
+ error_count: number;
1548
+ };
1549
+ };
1550
+ importable_with_code_functions_define: boolean;
1551
+ next_steps: string[];
1552
+ library_profile?: {
1553
+ evidence: string[];
1554
+ ecosystems: string[];
1555
+ top_crates: string[];
1556
+ notable_libraries: string[];
1557
+ } | undefined;
1558
+ binary_profile?: {
1559
+ sample_id: string;
1560
+ indicators: {
1561
+ com_server: {
1562
+ confidence: number;
1563
+ evidence: string[];
1564
+ likely: boolean;
1565
+ };
1566
+ service_binary: {
1567
+ confidence: number;
1568
+ evidence: string[];
1569
+ likely: boolean;
1570
+ };
1571
+ plugin_binary: {
1572
+ confidence: number;
1573
+ evidence: string[];
1574
+ likely: boolean;
1575
+ };
1576
+ driver_binary: {
1577
+ confidence: number;
1578
+ evidence: string[];
1579
+ likely: boolean;
1580
+ };
1581
+ };
1582
+ export_surface: {
1583
+ total_exports: number;
1584
+ total_forwarders: number;
1585
+ notable_exports: string[];
1586
+ com_related_exports: string[];
1587
+ service_related_exports: string[];
1588
+ plugin_related_exports: string[];
1589
+ forwarded_exports: string[];
1590
+ };
1591
+ packed: boolean;
1592
+ binary_role: string;
1593
+ original_filename: string | null;
1594
+ packing_confidence: number;
1595
+ analysis_priorities: string[];
1596
+ role_confidence: number;
1597
+ runtime_hint: {
1598
+ is_dotnet: boolean | null;
1599
+ dotnet_version: string | null;
1600
+ target_framework: string | null;
1601
+ primary_runtime: string | null;
1602
+ };
1603
+ import_surface: {
1604
+ dll_count: number;
1605
+ notable_dlls: string[];
1606
+ com_related_imports: string[];
1607
+ service_related_imports: string[];
1608
+ network_related_imports: string[];
1609
+ process_related_imports: string[];
1610
+ };
1611
+ export_dispatch_profile: {
1612
+ confidence: number;
1613
+ command_like_exports: string[];
1614
+ callback_like_exports: string[];
1615
+ registration_exports: string[];
1616
+ ordinal_only_exports: number;
1617
+ likely_dispatch_model: string;
1618
+ };
1619
+ com_profile: {
1620
+ confidence: number;
1621
+ clsid_strings: string[];
1622
+ progid_strings: string[];
1623
+ interface_hints: string[];
1624
+ registration_strings: string[];
1625
+ class_factory_exports: string[];
1626
+ class_factory_surface?: string[] | undefined;
1627
+ };
1628
+ host_interaction_profile: {
1629
+ confidence: number;
1630
+ likely_hosted: boolean;
1631
+ host_hints: string[];
1632
+ callback_exports: string[];
1633
+ callback_strings: string[];
1634
+ service_hooks: string[];
1635
+ callback_surface?: string[] | undefined;
1636
+ };
1637
+ strings_considered: number;
1638
+ lifecycle_surface?: string[] | undefined;
1639
+ } | undefined;
1640
+ }>>;
385
1641
  provenance: z.ZodOptional<z.ZodObject<{
386
1642
  runtime: z.ZodObject<{
387
1643
  scope: z.ZodEnum<["all", "latest", "session"]>;
@@ -467,6 +1723,34 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
467
1723
  earliest_artifact_at: string | null;
468
1724
  latest_artifact_at: string | null;
469
1725
  }>>;
1726
+ semantic_module_reviews: z.ZodOptional<z.ZodObject<{
1727
+ scope: z.ZodEnum<["all", "latest", "session"]>;
1728
+ session_selector: z.ZodNullable<z.ZodString>;
1729
+ artifact_count: z.ZodNumber;
1730
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
1731
+ session_tags: z.ZodArray<z.ZodString, "many">;
1732
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
1733
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
1734
+ scope_note: z.ZodString;
1735
+ }, "strip", z.ZodTypeAny, {
1736
+ artifact_count: number;
1737
+ scope_note: string;
1738
+ artifact_ids: string[];
1739
+ session_selector: string | null;
1740
+ session_tags: string[];
1741
+ scope: "all" | "latest" | "session";
1742
+ earliest_artifact_at: string | null;
1743
+ latest_artifact_at: string | null;
1744
+ }, {
1745
+ artifact_count: number;
1746
+ scope_note: string;
1747
+ artifact_ids: string[];
1748
+ session_selector: string | null;
1749
+ session_tags: string[];
1750
+ scope: "all" | "latest" | "session";
1751
+ earliest_artifact_at: string | null;
1752
+ latest_artifact_at: string | null;
1753
+ }>>;
470
1754
  }, "strip", z.ZodTypeAny, {
471
1755
  runtime: {
472
1756
  artifact_count: number;
@@ -478,6 +1762,16 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
478
1762
  earliest_artifact_at: string | null;
479
1763
  latest_artifact_at: string | null;
480
1764
  };
1765
+ semantic_module_reviews?: {
1766
+ artifact_count: number;
1767
+ scope_note: string;
1768
+ artifact_ids: string[];
1769
+ session_selector: string | null;
1770
+ session_tags: string[];
1771
+ scope: "all" | "latest" | "session";
1772
+ earliest_artifact_at: string | null;
1773
+ latest_artifact_at: string | null;
1774
+ } | undefined;
481
1775
  semantic_names?: {
482
1776
  artifact_count: number;
483
1777
  scope_note: string;
@@ -509,6 +1803,16 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
509
1803
  earliest_artifact_at: string | null;
510
1804
  latest_artifact_at: string | null;
511
1805
  };
1806
+ semantic_module_reviews?: {
1807
+ artifact_count: number;
1808
+ scope_note: string;
1809
+ artifact_ids: string[];
1810
+ session_selector: string | null;
1811
+ session_tags: string[];
1812
+ scope: "all" | "latest" | "session";
1813
+ earliest_artifact_at: string | null;
1814
+ latest_artifact_at: string | null;
1815
+ } | undefined;
512
1816
  semantic_names?: {
513
1817
  artifact_count: number;
514
1818
  scope_note: string;
@@ -1263,6 +2567,16 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1263
2567
  earliest_artifact_at: string | null;
1264
2568
  latest_artifact_at: string | null;
1265
2569
  };
2570
+ semantic_module_reviews?: {
2571
+ artifact_count: number;
2572
+ scope_note: string;
2573
+ artifact_ids: string[];
2574
+ session_selector: string | null;
2575
+ session_tags: string[];
2576
+ scope: "all" | "latest" | "session";
2577
+ earliest_artifact_at: string | null;
2578
+ latest_artifact_at: string | null;
2579
+ } | undefined;
1266
2580
  semantic_names?: {
1267
2581
  artifact_count: number;
1268
2582
  scope_note: string;
@@ -1312,6 +2626,228 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1312
2626
  runtime: number;
1313
2627
  import: number;
1314
2628
  } | undefined;
2629
+ binary_profile?: {
2630
+ sample_id: string;
2631
+ indicators: {
2632
+ com_server: {
2633
+ confidence: number;
2634
+ evidence: string[];
2635
+ likely: boolean;
2636
+ };
2637
+ service_binary: {
2638
+ confidence: number;
2639
+ evidence: string[];
2640
+ likely: boolean;
2641
+ };
2642
+ plugin_binary: {
2643
+ confidence: number;
2644
+ evidence: string[];
2645
+ likely: boolean;
2646
+ };
2647
+ driver_binary: {
2648
+ confidence: number;
2649
+ evidence: string[];
2650
+ likely: boolean;
2651
+ };
2652
+ };
2653
+ export_surface: {
2654
+ total_exports: number;
2655
+ total_forwarders: number;
2656
+ notable_exports: string[];
2657
+ com_related_exports: string[];
2658
+ service_related_exports: string[];
2659
+ plugin_related_exports: string[];
2660
+ forwarded_exports: string[];
2661
+ };
2662
+ packed: boolean;
2663
+ binary_role: string;
2664
+ original_filename: string | null;
2665
+ packing_confidence: number;
2666
+ analysis_priorities: string[];
2667
+ role_confidence: number;
2668
+ runtime_hint: {
2669
+ is_dotnet: boolean | null;
2670
+ dotnet_version: string | null;
2671
+ target_framework: string | null;
2672
+ primary_runtime: string | null;
2673
+ };
2674
+ import_surface: {
2675
+ dll_count: number;
2676
+ notable_dlls: string[];
2677
+ com_related_imports: string[];
2678
+ service_related_imports: string[];
2679
+ network_related_imports: string[];
2680
+ process_related_imports: string[];
2681
+ };
2682
+ export_dispatch_profile: {
2683
+ confidence: number;
2684
+ command_like_exports: string[];
2685
+ callback_like_exports: string[];
2686
+ registration_exports: string[];
2687
+ ordinal_only_exports: number;
2688
+ likely_dispatch_model: string;
2689
+ };
2690
+ lifecycle_surface: string[];
2691
+ com_profile: {
2692
+ confidence: number;
2693
+ clsid_strings: string[];
2694
+ progid_strings: string[];
2695
+ interface_hints: string[];
2696
+ registration_strings: string[];
2697
+ class_factory_exports: string[];
2698
+ class_factory_surface: string[];
2699
+ };
2700
+ host_interaction_profile: {
2701
+ confidence: number;
2702
+ callback_surface: string[];
2703
+ likely_hosted: boolean;
2704
+ host_hints: string[];
2705
+ callback_exports: string[];
2706
+ callback_strings: string[];
2707
+ service_hooks: string[];
2708
+ };
2709
+ strings_considered: number;
2710
+ } | undefined;
2711
+ rust_profile?: {
2712
+ sample_id: string;
2713
+ confidence: number;
2714
+ evidence: string[];
2715
+ cargo_paths: string[];
2716
+ rust_markers: string[];
2717
+ primary_runtime: string | null;
2718
+ analysis_priorities: string[];
2719
+ crate_hints: string[];
2720
+ runtime_hints: string[];
2721
+ suspected_rust: boolean;
2722
+ async_runtime_markers: string[];
2723
+ panic_markers: string[];
2724
+ recovered_function_count: number;
2725
+ recovered_function_strategy: string[];
2726
+ recovered_symbol_count: number;
2727
+ recovered_symbol_preview: {
2728
+ address: string;
2729
+ confidence: number;
2730
+ recovered_name: string;
2731
+ name_strategy: string;
2732
+ }[];
2733
+ components: {
2734
+ runtime_detect: {
2735
+ ok: boolean;
2736
+ warning_count: number;
2737
+ error_count: number;
2738
+ };
2739
+ strings_extract: {
2740
+ ok: boolean;
2741
+ warning_count: number;
2742
+ error_count: number;
2743
+ };
2744
+ smart_recover: {
2745
+ ok: boolean;
2746
+ warning_count: number;
2747
+ error_count: number;
2748
+ };
2749
+ symbols_recover: {
2750
+ ok: boolean;
2751
+ warning_count: number;
2752
+ error_count: number;
2753
+ };
2754
+ binary_role_profile: {
2755
+ ok: boolean;
2756
+ warning_count: number;
2757
+ error_count: number;
2758
+ };
2759
+ };
2760
+ importable_with_code_functions_define: boolean;
2761
+ next_steps: string[];
2762
+ library_profile?: {
2763
+ evidence: string[];
2764
+ ecosystems: string[];
2765
+ top_crates: string[];
2766
+ notable_libraries: string[];
2767
+ } | undefined;
2768
+ binary_profile?: {
2769
+ sample_id: string;
2770
+ indicators: {
2771
+ com_server: {
2772
+ confidence: number;
2773
+ evidence: string[];
2774
+ likely: boolean;
2775
+ };
2776
+ service_binary: {
2777
+ confidence: number;
2778
+ evidence: string[];
2779
+ likely: boolean;
2780
+ };
2781
+ plugin_binary: {
2782
+ confidence: number;
2783
+ evidence: string[];
2784
+ likely: boolean;
2785
+ };
2786
+ driver_binary: {
2787
+ confidence: number;
2788
+ evidence: string[];
2789
+ likely: boolean;
2790
+ };
2791
+ };
2792
+ export_surface: {
2793
+ total_exports: number;
2794
+ total_forwarders: number;
2795
+ notable_exports: string[];
2796
+ com_related_exports: string[];
2797
+ service_related_exports: string[];
2798
+ plugin_related_exports: string[];
2799
+ forwarded_exports: string[];
2800
+ };
2801
+ packed: boolean;
2802
+ binary_role: string;
2803
+ original_filename: string | null;
2804
+ packing_confidence: number;
2805
+ analysis_priorities: string[];
2806
+ role_confidence: number;
2807
+ runtime_hint: {
2808
+ is_dotnet: boolean | null;
2809
+ dotnet_version: string | null;
2810
+ target_framework: string | null;
2811
+ primary_runtime: string | null;
2812
+ };
2813
+ import_surface: {
2814
+ dll_count: number;
2815
+ notable_dlls: string[];
2816
+ com_related_imports: string[];
2817
+ service_related_imports: string[];
2818
+ network_related_imports: string[];
2819
+ process_related_imports: string[];
2820
+ };
2821
+ export_dispatch_profile: {
2822
+ confidence: number;
2823
+ command_like_exports: string[];
2824
+ callback_like_exports: string[];
2825
+ registration_exports: string[];
2826
+ ordinal_only_exports: number;
2827
+ likely_dispatch_model: string;
2828
+ };
2829
+ lifecycle_surface: string[];
2830
+ com_profile: {
2831
+ confidence: number;
2832
+ clsid_strings: string[];
2833
+ progid_strings: string[];
2834
+ interface_hints: string[];
2835
+ registration_strings: string[];
2836
+ class_factory_exports: string[];
2837
+ class_factory_surface: string[];
2838
+ };
2839
+ host_interaction_profile: {
2840
+ confidence: number;
2841
+ callback_surface: string[];
2842
+ likely_hosted: boolean;
2843
+ host_hints: string[];
2844
+ callback_exports: string[];
2845
+ callback_strings: string[];
2846
+ service_hooks: string[];
2847
+ };
2848
+ strings_considered: number;
2849
+ } | undefined;
2850
+ } | undefined;
1315
2851
  selection_diffs?: {
1316
2852
  runtime?: {
1317
2853
  summary: string;
@@ -1481,6 +3017,16 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1481
3017
  earliest_artifact_at: string | null;
1482
3018
  latest_artifact_at: string | null;
1483
3019
  };
3020
+ semantic_module_reviews?: {
3021
+ artifact_count: number;
3022
+ scope_note: string;
3023
+ artifact_ids: string[];
3024
+ session_selector: string | null;
3025
+ session_tags: string[];
3026
+ scope: "all" | "latest" | "session";
3027
+ earliest_artifact_at: string | null;
3028
+ latest_artifact_at: string | null;
3029
+ } | undefined;
1484
3030
  semantic_names?: {
1485
3031
  artifact_count: number;
1486
3032
  scope_note: string;
@@ -1530,6 +3076,228 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1530
3076
  runtime: number;
1531
3077
  import: number;
1532
3078
  } | undefined;
3079
+ binary_profile?: {
3080
+ sample_id: string;
3081
+ indicators: {
3082
+ com_server: {
3083
+ confidence: number;
3084
+ evidence: string[];
3085
+ likely: boolean;
3086
+ };
3087
+ service_binary: {
3088
+ confidence: number;
3089
+ evidence: string[];
3090
+ likely: boolean;
3091
+ };
3092
+ plugin_binary: {
3093
+ confidence: number;
3094
+ evidence: string[];
3095
+ likely: boolean;
3096
+ };
3097
+ driver_binary: {
3098
+ confidence: number;
3099
+ evidence: string[];
3100
+ likely: boolean;
3101
+ };
3102
+ };
3103
+ export_surface: {
3104
+ total_exports: number;
3105
+ total_forwarders: number;
3106
+ notable_exports: string[];
3107
+ com_related_exports: string[];
3108
+ service_related_exports: string[];
3109
+ plugin_related_exports: string[];
3110
+ forwarded_exports: string[];
3111
+ };
3112
+ packed: boolean;
3113
+ binary_role: string;
3114
+ original_filename: string | null;
3115
+ packing_confidence: number;
3116
+ analysis_priorities: string[];
3117
+ role_confidence: number;
3118
+ runtime_hint: {
3119
+ is_dotnet: boolean | null;
3120
+ dotnet_version: string | null;
3121
+ target_framework: string | null;
3122
+ primary_runtime: string | null;
3123
+ };
3124
+ import_surface: {
3125
+ dll_count: number;
3126
+ notable_dlls: string[];
3127
+ com_related_imports: string[];
3128
+ service_related_imports: string[];
3129
+ network_related_imports: string[];
3130
+ process_related_imports: string[];
3131
+ };
3132
+ export_dispatch_profile: {
3133
+ confidence: number;
3134
+ command_like_exports: string[];
3135
+ callback_like_exports: string[];
3136
+ registration_exports: string[];
3137
+ ordinal_only_exports: number;
3138
+ likely_dispatch_model: string;
3139
+ };
3140
+ com_profile: {
3141
+ confidence: number;
3142
+ clsid_strings: string[];
3143
+ progid_strings: string[];
3144
+ interface_hints: string[];
3145
+ registration_strings: string[];
3146
+ class_factory_exports: string[];
3147
+ class_factory_surface?: string[] | undefined;
3148
+ };
3149
+ host_interaction_profile: {
3150
+ confidence: number;
3151
+ likely_hosted: boolean;
3152
+ host_hints: string[];
3153
+ callback_exports: string[];
3154
+ callback_strings: string[];
3155
+ service_hooks: string[];
3156
+ callback_surface?: string[] | undefined;
3157
+ };
3158
+ strings_considered: number;
3159
+ lifecycle_surface?: string[] | undefined;
3160
+ } | undefined;
3161
+ rust_profile?: {
3162
+ sample_id: string;
3163
+ confidence: number;
3164
+ evidence: string[];
3165
+ cargo_paths: string[];
3166
+ rust_markers: string[];
3167
+ primary_runtime: string | null;
3168
+ analysis_priorities: string[];
3169
+ crate_hints: string[];
3170
+ runtime_hints: string[];
3171
+ suspected_rust: boolean;
3172
+ async_runtime_markers: string[];
3173
+ panic_markers: string[];
3174
+ recovered_function_count: number;
3175
+ recovered_function_strategy: string[];
3176
+ recovered_symbol_count: number;
3177
+ recovered_symbol_preview: {
3178
+ address: string;
3179
+ confidence: number;
3180
+ recovered_name: string;
3181
+ name_strategy: string;
3182
+ }[];
3183
+ components: {
3184
+ runtime_detect: {
3185
+ ok: boolean;
3186
+ warning_count: number;
3187
+ error_count: number;
3188
+ };
3189
+ strings_extract: {
3190
+ ok: boolean;
3191
+ warning_count: number;
3192
+ error_count: number;
3193
+ };
3194
+ smart_recover: {
3195
+ ok: boolean;
3196
+ warning_count: number;
3197
+ error_count: number;
3198
+ };
3199
+ symbols_recover: {
3200
+ ok: boolean;
3201
+ warning_count: number;
3202
+ error_count: number;
3203
+ };
3204
+ binary_role_profile: {
3205
+ ok: boolean;
3206
+ warning_count: number;
3207
+ error_count: number;
3208
+ };
3209
+ };
3210
+ importable_with_code_functions_define: boolean;
3211
+ next_steps: string[];
3212
+ library_profile?: {
3213
+ evidence: string[];
3214
+ ecosystems: string[];
3215
+ top_crates: string[];
3216
+ notable_libraries: string[];
3217
+ } | undefined;
3218
+ binary_profile?: {
3219
+ sample_id: string;
3220
+ indicators: {
3221
+ com_server: {
3222
+ confidence: number;
3223
+ evidence: string[];
3224
+ likely: boolean;
3225
+ };
3226
+ service_binary: {
3227
+ confidence: number;
3228
+ evidence: string[];
3229
+ likely: boolean;
3230
+ };
3231
+ plugin_binary: {
3232
+ confidence: number;
3233
+ evidence: string[];
3234
+ likely: boolean;
3235
+ };
3236
+ driver_binary: {
3237
+ confidence: number;
3238
+ evidence: string[];
3239
+ likely: boolean;
3240
+ };
3241
+ };
3242
+ export_surface: {
3243
+ total_exports: number;
3244
+ total_forwarders: number;
3245
+ notable_exports: string[];
3246
+ com_related_exports: string[];
3247
+ service_related_exports: string[];
3248
+ plugin_related_exports: string[];
3249
+ forwarded_exports: string[];
3250
+ };
3251
+ packed: boolean;
3252
+ binary_role: string;
3253
+ original_filename: string | null;
3254
+ packing_confidence: number;
3255
+ analysis_priorities: string[];
3256
+ role_confidence: number;
3257
+ runtime_hint: {
3258
+ is_dotnet: boolean | null;
3259
+ dotnet_version: string | null;
3260
+ target_framework: string | null;
3261
+ primary_runtime: string | null;
3262
+ };
3263
+ import_surface: {
3264
+ dll_count: number;
3265
+ notable_dlls: string[];
3266
+ com_related_imports: string[];
3267
+ service_related_imports: string[];
3268
+ network_related_imports: string[];
3269
+ process_related_imports: string[];
3270
+ };
3271
+ export_dispatch_profile: {
3272
+ confidence: number;
3273
+ command_like_exports: string[];
3274
+ callback_like_exports: string[];
3275
+ registration_exports: string[];
3276
+ ordinal_only_exports: number;
3277
+ likely_dispatch_model: string;
3278
+ };
3279
+ com_profile: {
3280
+ confidence: number;
3281
+ clsid_strings: string[];
3282
+ progid_strings: string[];
3283
+ interface_hints: string[];
3284
+ registration_strings: string[];
3285
+ class_factory_exports: string[];
3286
+ class_factory_surface?: string[] | undefined;
3287
+ };
3288
+ host_interaction_profile: {
3289
+ confidence: number;
3290
+ likely_hosted: boolean;
3291
+ host_hints: string[];
3292
+ callback_exports: string[];
3293
+ callback_strings: string[];
3294
+ service_hooks: string[];
3295
+ callback_surface?: string[] | undefined;
3296
+ };
3297
+ strings_considered: number;
3298
+ lifecycle_surface?: string[] | undefined;
3299
+ } | undefined;
3300
+ } | undefined;
1533
3301
  selection_diffs?: {
1534
3302
  runtime?: {
1535
3303
  summary: string;
@@ -1670,10 +3438,6 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1670
3438
  }>>;
1671
3439
  }, "strip", z.ZodTypeAny, {
1672
3440
  ok: boolean;
1673
- metrics?: {
1674
- elapsed_ms: number;
1675
- tool: string;
1676
- } | undefined;
1677
3441
  data?: {
1678
3442
  summary: string;
1679
3443
  confidence: number;
@@ -1718,6 +3482,16 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1718
3482
  earliest_artifact_at: string | null;
1719
3483
  latest_artifact_at: string | null;
1720
3484
  };
3485
+ semantic_module_reviews?: {
3486
+ artifact_count: number;
3487
+ scope_note: string;
3488
+ artifact_ids: string[];
3489
+ session_selector: string | null;
3490
+ session_tags: string[];
3491
+ scope: "all" | "latest" | "session";
3492
+ earliest_artifact_at: string | null;
3493
+ latest_artifact_at: string | null;
3494
+ } | undefined;
1721
3495
  semantic_names?: {
1722
3496
  artifact_count: number;
1723
3497
  scope_note: string;
@@ -1767,6 +3541,228 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1767
3541
  runtime: number;
1768
3542
  import: number;
1769
3543
  } | undefined;
3544
+ binary_profile?: {
3545
+ sample_id: string;
3546
+ indicators: {
3547
+ com_server: {
3548
+ confidence: number;
3549
+ evidence: string[];
3550
+ likely: boolean;
3551
+ };
3552
+ service_binary: {
3553
+ confidence: number;
3554
+ evidence: string[];
3555
+ likely: boolean;
3556
+ };
3557
+ plugin_binary: {
3558
+ confidence: number;
3559
+ evidence: string[];
3560
+ likely: boolean;
3561
+ };
3562
+ driver_binary: {
3563
+ confidence: number;
3564
+ evidence: string[];
3565
+ likely: boolean;
3566
+ };
3567
+ };
3568
+ export_surface: {
3569
+ total_exports: number;
3570
+ total_forwarders: number;
3571
+ notable_exports: string[];
3572
+ com_related_exports: string[];
3573
+ service_related_exports: string[];
3574
+ plugin_related_exports: string[];
3575
+ forwarded_exports: string[];
3576
+ };
3577
+ packed: boolean;
3578
+ binary_role: string;
3579
+ original_filename: string | null;
3580
+ packing_confidence: number;
3581
+ analysis_priorities: string[];
3582
+ role_confidence: number;
3583
+ runtime_hint: {
3584
+ is_dotnet: boolean | null;
3585
+ dotnet_version: string | null;
3586
+ target_framework: string | null;
3587
+ primary_runtime: string | null;
3588
+ };
3589
+ import_surface: {
3590
+ dll_count: number;
3591
+ notable_dlls: string[];
3592
+ com_related_imports: string[];
3593
+ service_related_imports: string[];
3594
+ network_related_imports: string[];
3595
+ process_related_imports: string[];
3596
+ };
3597
+ export_dispatch_profile: {
3598
+ confidence: number;
3599
+ command_like_exports: string[];
3600
+ callback_like_exports: string[];
3601
+ registration_exports: string[];
3602
+ ordinal_only_exports: number;
3603
+ likely_dispatch_model: string;
3604
+ };
3605
+ lifecycle_surface: string[];
3606
+ com_profile: {
3607
+ confidence: number;
3608
+ clsid_strings: string[];
3609
+ progid_strings: string[];
3610
+ interface_hints: string[];
3611
+ registration_strings: string[];
3612
+ class_factory_exports: string[];
3613
+ class_factory_surface: string[];
3614
+ };
3615
+ host_interaction_profile: {
3616
+ confidence: number;
3617
+ callback_surface: string[];
3618
+ likely_hosted: boolean;
3619
+ host_hints: string[];
3620
+ callback_exports: string[];
3621
+ callback_strings: string[];
3622
+ service_hooks: string[];
3623
+ };
3624
+ strings_considered: number;
3625
+ } | undefined;
3626
+ rust_profile?: {
3627
+ sample_id: string;
3628
+ confidence: number;
3629
+ evidence: string[];
3630
+ cargo_paths: string[];
3631
+ rust_markers: string[];
3632
+ primary_runtime: string | null;
3633
+ analysis_priorities: string[];
3634
+ crate_hints: string[];
3635
+ runtime_hints: string[];
3636
+ suspected_rust: boolean;
3637
+ async_runtime_markers: string[];
3638
+ panic_markers: string[];
3639
+ recovered_function_count: number;
3640
+ recovered_function_strategy: string[];
3641
+ recovered_symbol_count: number;
3642
+ recovered_symbol_preview: {
3643
+ address: string;
3644
+ confidence: number;
3645
+ recovered_name: string;
3646
+ name_strategy: string;
3647
+ }[];
3648
+ components: {
3649
+ runtime_detect: {
3650
+ ok: boolean;
3651
+ warning_count: number;
3652
+ error_count: number;
3653
+ };
3654
+ strings_extract: {
3655
+ ok: boolean;
3656
+ warning_count: number;
3657
+ error_count: number;
3658
+ };
3659
+ smart_recover: {
3660
+ ok: boolean;
3661
+ warning_count: number;
3662
+ error_count: number;
3663
+ };
3664
+ symbols_recover: {
3665
+ ok: boolean;
3666
+ warning_count: number;
3667
+ error_count: number;
3668
+ };
3669
+ binary_role_profile: {
3670
+ ok: boolean;
3671
+ warning_count: number;
3672
+ error_count: number;
3673
+ };
3674
+ };
3675
+ importable_with_code_functions_define: boolean;
3676
+ next_steps: string[];
3677
+ library_profile?: {
3678
+ evidence: string[];
3679
+ ecosystems: string[];
3680
+ top_crates: string[];
3681
+ notable_libraries: string[];
3682
+ } | undefined;
3683
+ binary_profile?: {
3684
+ sample_id: string;
3685
+ indicators: {
3686
+ com_server: {
3687
+ confidence: number;
3688
+ evidence: string[];
3689
+ likely: boolean;
3690
+ };
3691
+ service_binary: {
3692
+ confidence: number;
3693
+ evidence: string[];
3694
+ likely: boolean;
3695
+ };
3696
+ plugin_binary: {
3697
+ confidence: number;
3698
+ evidence: string[];
3699
+ likely: boolean;
3700
+ };
3701
+ driver_binary: {
3702
+ confidence: number;
3703
+ evidence: string[];
3704
+ likely: boolean;
3705
+ };
3706
+ };
3707
+ export_surface: {
3708
+ total_exports: number;
3709
+ total_forwarders: number;
3710
+ notable_exports: string[];
3711
+ com_related_exports: string[];
3712
+ service_related_exports: string[];
3713
+ plugin_related_exports: string[];
3714
+ forwarded_exports: string[];
3715
+ };
3716
+ packed: boolean;
3717
+ binary_role: string;
3718
+ original_filename: string | null;
3719
+ packing_confidence: number;
3720
+ analysis_priorities: string[];
3721
+ role_confidence: number;
3722
+ runtime_hint: {
3723
+ is_dotnet: boolean | null;
3724
+ dotnet_version: string | null;
3725
+ target_framework: string | null;
3726
+ primary_runtime: string | null;
3727
+ };
3728
+ import_surface: {
3729
+ dll_count: number;
3730
+ notable_dlls: string[];
3731
+ com_related_imports: string[];
3732
+ service_related_imports: string[];
3733
+ network_related_imports: string[];
3734
+ process_related_imports: string[];
3735
+ };
3736
+ export_dispatch_profile: {
3737
+ confidence: number;
3738
+ command_like_exports: string[];
3739
+ callback_like_exports: string[];
3740
+ registration_exports: string[];
3741
+ ordinal_only_exports: number;
3742
+ likely_dispatch_model: string;
3743
+ };
3744
+ lifecycle_surface: string[];
3745
+ com_profile: {
3746
+ confidence: number;
3747
+ clsid_strings: string[];
3748
+ progid_strings: string[];
3749
+ interface_hints: string[];
3750
+ registration_strings: string[];
3751
+ class_factory_exports: string[];
3752
+ class_factory_surface: string[];
3753
+ };
3754
+ host_interaction_profile: {
3755
+ confidence: number;
3756
+ callback_surface: string[];
3757
+ likely_hosted: boolean;
3758
+ host_hints: string[];
3759
+ callback_exports: string[];
3760
+ callback_strings: string[];
3761
+ service_hooks: string[];
3762
+ };
3763
+ strings_considered: number;
3764
+ } | undefined;
3765
+ } | undefined;
1770
3766
  selection_diffs?: {
1771
3767
  runtime?: {
1772
3768
  summary: string;
@@ -1893,14 +3889,14 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1893
3889
  rewrite_guidance: string[];
1894
3890
  }[] | undefined;
1895
3891
  } | undefined;
1896
- warnings?: string[] | undefined;
1897
- errors?: string[] | undefined;
1898
- }, {
1899
- ok: boolean;
1900
3892
  metrics?: {
1901
3893
  elapsed_ms: number;
1902
3894
  tool: string;
1903
3895
  } | undefined;
3896
+ warnings?: string[] | undefined;
3897
+ errors?: string[] | undefined;
3898
+ }, {
3899
+ ok: boolean;
1904
3900
  data?: {
1905
3901
  summary: string;
1906
3902
  confidence: number;
@@ -1945,6 +3941,16 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1945
3941
  earliest_artifact_at: string | null;
1946
3942
  latest_artifact_at: string | null;
1947
3943
  };
3944
+ semantic_module_reviews?: {
3945
+ artifact_count: number;
3946
+ scope_note: string;
3947
+ artifact_ids: string[];
3948
+ session_selector: string | null;
3949
+ session_tags: string[];
3950
+ scope: "all" | "latest" | "session";
3951
+ earliest_artifact_at: string | null;
3952
+ latest_artifact_at: string | null;
3953
+ } | undefined;
1948
3954
  semantic_names?: {
1949
3955
  artifact_count: number;
1950
3956
  scope_note: string;
@@ -1994,6 +4000,228 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
1994
4000
  runtime: number;
1995
4001
  import: number;
1996
4002
  } | undefined;
4003
+ binary_profile?: {
4004
+ sample_id: string;
4005
+ indicators: {
4006
+ com_server: {
4007
+ confidence: number;
4008
+ evidence: string[];
4009
+ likely: boolean;
4010
+ };
4011
+ service_binary: {
4012
+ confidence: number;
4013
+ evidence: string[];
4014
+ likely: boolean;
4015
+ };
4016
+ plugin_binary: {
4017
+ confidence: number;
4018
+ evidence: string[];
4019
+ likely: boolean;
4020
+ };
4021
+ driver_binary: {
4022
+ confidence: number;
4023
+ evidence: string[];
4024
+ likely: boolean;
4025
+ };
4026
+ };
4027
+ export_surface: {
4028
+ total_exports: number;
4029
+ total_forwarders: number;
4030
+ notable_exports: string[];
4031
+ com_related_exports: string[];
4032
+ service_related_exports: string[];
4033
+ plugin_related_exports: string[];
4034
+ forwarded_exports: string[];
4035
+ };
4036
+ packed: boolean;
4037
+ binary_role: string;
4038
+ original_filename: string | null;
4039
+ packing_confidence: number;
4040
+ analysis_priorities: string[];
4041
+ role_confidence: number;
4042
+ runtime_hint: {
4043
+ is_dotnet: boolean | null;
4044
+ dotnet_version: string | null;
4045
+ target_framework: string | null;
4046
+ primary_runtime: string | null;
4047
+ };
4048
+ import_surface: {
4049
+ dll_count: number;
4050
+ notable_dlls: string[];
4051
+ com_related_imports: string[];
4052
+ service_related_imports: string[];
4053
+ network_related_imports: string[];
4054
+ process_related_imports: string[];
4055
+ };
4056
+ export_dispatch_profile: {
4057
+ confidence: number;
4058
+ command_like_exports: string[];
4059
+ callback_like_exports: string[];
4060
+ registration_exports: string[];
4061
+ ordinal_only_exports: number;
4062
+ likely_dispatch_model: string;
4063
+ };
4064
+ com_profile: {
4065
+ confidence: number;
4066
+ clsid_strings: string[];
4067
+ progid_strings: string[];
4068
+ interface_hints: string[];
4069
+ registration_strings: string[];
4070
+ class_factory_exports: string[];
4071
+ class_factory_surface?: string[] | undefined;
4072
+ };
4073
+ host_interaction_profile: {
4074
+ confidence: number;
4075
+ likely_hosted: boolean;
4076
+ host_hints: string[];
4077
+ callback_exports: string[];
4078
+ callback_strings: string[];
4079
+ service_hooks: string[];
4080
+ callback_surface?: string[] | undefined;
4081
+ };
4082
+ strings_considered: number;
4083
+ lifecycle_surface?: string[] | undefined;
4084
+ } | undefined;
4085
+ rust_profile?: {
4086
+ sample_id: string;
4087
+ confidence: number;
4088
+ evidence: string[];
4089
+ cargo_paths: string[];
4090
+ rust_markers: string[];
4091
+ primary_runtime: string | null;
4092
+ analysis_priorities: string[];
4093
+ crate_hints: string[];
4094
+ runtime_hints: string[];
4095
+ suspected_rust: boolean;
4096
+ async_runtime_markers: string[];
4097
+ panic_markers: string[];
4098
+ recovered_function_count: number;
4099
+ recovered_function_strategy: string[];
4100
+ recovered_symbol_count: number;
4101
+ recovered_symbol_preview: {
4102
+ address: string;
4103
+ confidence: number;
4104
+ recovered_name: string;
4105
+ name_strategy: string;
4106
+ }[];
4107
+ components: {
4108
+ runtime_detect: {
4109
+ ok: boolean;
4110
+ warning_count: number;
4111
+ error_count: number;
4112
+ };
4113
+ strings_extract: {
4114
+ ok: boolean;
4115
+ warning_count: number;
4116
+ error_count: number;
4117
+ };
4118
+ smart_recover: {
4119
+ ok: boolean;
4120
+ warning_count: number;
4121
+ error_count: number;
4122
+ };
4123
+ symbols_recover: {
4124
+ ok: boolean;
4125
+ warning_count: number;
4126
+ error_count: number;
4127
+ };
4128
+ binary_role_profile: {
4129
+ ok: boolean;
4130
+ warning_count: number;
4131
+ error_count: number;
4132
+ };
4133
+ };
4134
+ importable_with_code_functions_define: boolean;
4135
+ next_steps: string[];
4136
+ library_profile?: {
4137
+ evidence: string[];
4138
+ ecosystems: string[];
4139
+ top_crates: string[];
4140
+ notable_libraries: string[];
4141
+ } | undefined;
4142
+ binary_profile?: {
4143
+ sample_id: string;
4144
+ indicators: {
4145
+ com_server: {
4146
+ confidence: number;
4147
+ evidence: string[];
4148
+ likely: boolean;
4149
+ };
4150
+ service_binary: {
4151
+ confidence: number;
4152
+ evidence: string[];
4153
+ likely: boolean;
4154
+ };
4155
+ plugin_binary: {
4156
+ confidence: number;
4157
+ evidence: string[];
4158
+ likely: boolean;
4159
+ };
4160
+ driver_binary: {
4161
+ confidence: number;
4162
+ evidence: string[];
4163
+ likely: boolean;
4164
+ };
4165
+ };
4166
+ export_surface: {
4167
+ total_exports: number;
4168
+ total_forwarders: number;
4169
+ notable_exports: string[];
4170
+ com_related_exports: string[];
4171
+ service_related_exports: string[];
4172
+ plugin_related_exports: string[];
4173
+ forwarded_exports: string[];
4174
+ };
4175
+ packed: boolean;
4176
+ binary_role: string;
4177
+ original_filename: string | null;
4178
+ packing_confidence: number;
4179
+ analysis_priorities: string[];
4180
+ role_confidence: number;
4181
+ runtime_hint: {
4182
+ is_dotnet: boolean | null;
4183
+ dotnet_version: string | null;
4184
+ target_framework: string | null;
4185
+ primary_runtime: string | null;
4186
+ };
4187
+ import_surface: {
4188
+ dll_count: number;
4189
+ notable_dlls: string[];
4190
+ com_related_imports: string[];
4191
+ service_related_imports: string[];
4192
+ network_related_imports: string[];
4193
+ process_related_imports: string[];
4194
+ };
4195
+ export_dispatch_profile: {
4196
+ confidence: number;
4197
+ command_like_exports: string[];
4198
+ callback_like_exports: string[];
4199
+ registration_exports: string[];
4200
+ ordinal_only_exports: number;
4201
+ likely_dispatch_model: string;
4202
+ };
4203
+ com_profile: {
4204
+ confidence: number;
4205
+ clsid_strings: string[];
4206
+ progid_strings: string[];
4207
+ interface_hints: string[];
4208
+ registration_strings: string[];
4209
+ class_factory_exports: string[];
4210
+ class_factory_surface?: string[] | undefined;
4211
+ };
4212
+ host_interaction_profile: {
4213
+ confidence: number;
4214
+ likely_hosted: boolean;
4215
+ host_hints: string[];
4216
+ callback_exports: string[];
4217
+ callback_strings: string[];
4218
+ service_hooks: string[];
4219
+ callback_surface?: string[] | undefined;
4220
+ };
4221
+ strings_considered: number;
4222
+ lifecycle_surface?: string[] | undefined;
4223
+ } | undefined;
4224
+ } | undefined;
1997
4225
  selection_diffs?: {
1998
4226
  runtime?: {
1999
4227
  summary: string;
@@ -2120,6 +4348,10 @@ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
2120
4348
  rewrite_guidance: string[];
2121
4349
  }[] | undefined;
2122
4350
  } | undefined;
4351
+ metrics?: {
4352
+ elapsed_ms: number;
4353
+ tool: string;
4354
+ } | undefined;
2123
4355
  warnings?: string[] | undefined;
2124
4356
  errors?: string[] | undefined;
2125
4357
  }>;
@@ -2127,5 +4359,7 @@ export type ReportSummarizeOutput = z.infer<typeof ReportSummarizeOutputSchema>;
2127
4359
  export declare const reportSummarizeToolDefinition: ToolDefinition;
2128
4360
  export declare function createReportSummarizeHandler(workspaceManager: WorkspaceManager, database: DatabaseManager, cacheManager: CacheManager, deps?: {
2129
4361
  triageHandler?: (args: ToolArgs) => Promise<WorkerResult>;
4362
+ binaryRoleProfileHandler?: (args: ToolArgs) => Promise<WorkerResult>;
4363
+ rustBinaryAnalyzeHandler?: (args: ToolArgs) => Promise<WorkerResult>;
2130
4364
  }): (args: ToolArgs) => Promise<WorkerResult>;
2131
4365
  //# sourceMappingURL=report-summarize.d.ts.map