windows-exe-decompiler-mcp-server 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (190) hide show
  1. package/CODEX_INSTALLATION.md +69 -0
  2. package/COPILOT_INSTALLATION.md +77 -0
  3. package/LICENSE +21 -0
  4. package/README.md +314 -0
  5. package/bin/windows-exe-decompiler-mcp-server.js +3 -0
  6. package/dist/analysis-provenance.d.ts +184 -0
  7. package/dist/analysis-provenance.js +74 -0
  8. package/dist/analysis-task-runner.d.ts +31 -0
  9. package/dist/analysis-task-runner.js +160 -0
  10. package/dist/artifact-inventory.d.ts +23 -0
  11. package/dist/artifact-inventory.js +175 -0
  12. package/dist/cache-manager.d.ts +128 -0
  13. package/dist/cache-manager.js +454 -0
  14. package/dist/confidence-semantics.d.ts +66 -0
  15. package/dist/confidence-semantics.js +122 -0
  16. package/dist/config.d.ts +335 -0
  17. package/dist/config.js +193 -0
  18. package/dist/database.d.ts +227 -0
  19. package/dist/database.js +601 -0
  20. package/dist/decompiler-worker.d.ts +441 -0
  21. package/dist/decompiler-worker.js +1962 -0
  22. package/dist/dynamic-trace.d.ts +95 -0
  23. package/dist/dynamic-trace.js +629 -0
  24. package/dist/env-validator.d.ts +15 -0
  25. package/dist/env-validator.js +249 -0
  26. package/dist/error-handler.d.ts +28 -0
  27. package/dist/error-handler.example.d.ts +22 -0
  28. package/dist/error-handler.example.js +141 -0
  29. package/dist/error-handler.js +139 -0
  30. package/dist/ghidra-analysis-status.d.ts +49 -0
  31. package/dist/ghidra-analysis-status.js +178 -0
  32. package/dist/ghidra-config.d.ts +134 -0
  33. package/dist/ghidra-config.js +464 -0
  34. package/dist/index.d.ts +9 -0
  35. package/dist/index.js +200 -0
  36. package/dist/job-queue.d.ts +169 -0
  37. package/dist/job-queue.js +407 -0
  38. package/dist/logger.d.ts +106 -0
  39. package/dist/logger.js +176 -0
  40. package/dist/policy-guard.d.ts +115 -0
  41. package/dist/policy-guard.js +243 -0
  42. package/dist/process-output.d.ts +15 -0
  43. package/dist/process-output.js +90 -0
  44. package/dist/prompts/function-explanation-review.d.ts +5 -0
  45. package/dist/prompts/function-explanation-review.js +64 -0
  46. package/dist/prompts/semantic-name-review.d.ts +5 -0
  47. package/dist/prompts/semantic-name-review.js +63 -0
  48. package/dist/runtime-correlation.d.ts +34 -0
  49. package/dist/runtime-correlation.js +279 -0
  50. package/dist/runtime-paths.d.ts +3 -0
  51. package/dist/runtime-paths.js +11 -0
  52. package/dist/selection-diff.d.ts +667 -0
  53. package/dist/selection-diff.js +53 -0
  54. package/dist/semantic-name-suggestion-artifacts.d.ts +116 -0
  55. package/dist/semantic-name-suggestion-artifacts.js +314 -0
  56. package/dist/server.d.ts +129 -0
  57. package/dist/server.js +578 -0
  58. package/dist/tools/artifact-read.d.ts +235 -0
  59. package/dist/tools/artifact-read.js +317 -0
  60. package/dist/tools/artifacts-diff.d.ts +728 -0
  61. package/dist/tools/artifacts-diff.js +304 -0
  62. package/dist/tools/artifacts-list.d.ts +515 -0
  63. package/dist/tools/artifacts-list.js +389 -0
  64. package/dist/tools/attack-map.d.ts +290 -0
  65. package/dist/tools/attack-map.js +519 -0
  66. package/dist/tools/cache-observability.d.ts +4 -0
  67. package/dist/tools/cache-observability.js +36 -0
  68. package/dist/tools/code-function-cfg.d.ts +50 -0
  69. package/dist/tools/code-function-cfg.js +102 -0
  70. package/dist/tools/code-function-decompile.d.ts +55 -0
  71. package/dist/tools/code-function-decompile.js +103 -0
  72. package/dist/tools/code-function-disassemble.d.ts +43 -0
  73. package/dist/tools/code-function-disassemble.js +185 -0
  74. package/dist/tools/code-function-explain-apply.d.ts +255 -0
  75. package/dist/tools/code-function-explain-apply.js +225 -0
  76. package/dist/tools/code-function-explain-prepare.d.ts +535 -0
  77. package/dist/tools/code-function-explain-prepare.js +276 -0
  78. package/dist/tools/code-function-explain-review.d.ts +397 -0
  79. package/dist/tools/code-function-explain-review.js +589 -0
  80. package/dist/tools/code-function-rename-apply.d.ts +248 -0
  81. package/dist/tools/code-function-rename-apply.js +220 -0
  82. package/dist/tools/code-function-rename-prepare.d.ts +506 -0
  83. package/dist/tools/code-function-rename-prepare.js +279 -0
  84. package/dist/tools/code-function-rename-review.d.ts +574 -0
  85. package/dist/tools/code-function-rename-review.js +761 -0
  86. package/dist/tools/code-functions-list.d.ts +37 -0
  87. package/dist/tools/code-functions-list.js +91 -0
  88. package/dist/tools/code-functions-rank.d.ts +34 -0
  89. package/dist/tools/code-functions-rank.js +90 -0
  90. package/dist/tools/code-functions-reconstruct.d.ts +2725 -0
  91. package/dist/tools/code-functions-reconstruct.js +2807 -0
  92. package/dist/tools/code-functions-search.d.ts +39 -0
  93. package/dist/tools/code-functions-search.js +90 -0
  94. package/dist/tools/code-reconstruct-export.d.ts +1212 -0
  95. package/dist/tools/code-reconstruct-export.js +4002 -0
  96. package/dist/tools/code-reconstruct-plan.d.ts +274 -0
  97. package/dist/tools/code-reconstruct-plan.js +342 -0
  98. package/dist/tools/dotnet-metadata-extract.d.ts +541 -0
  99. package/dist/tools/dotnet-metadata-extract.js +355 -0
  100. package/dist/tools/dotnet-reconstruct-export.d.ts +567 -0
  101. package/dist/tools/dotnet-reconstruct-export.js +1151 -0
  102. package/dist/tools/dotnet-types-list.d.ts +325 -0
  103. package/dist/tools/dotnet-types-list.js +201 -0
  104. package/dist/tools/dynamic-dependencies.d.ts +115 -0
  105. package/dist/tools/dynamic-dependencies.js +213 -0
  106. package/dist/tools/dynamic-memory-import.d.ts +10 -0
  107. package/dist/tools/dynamic-memory-import.js +567 -0
  108. package/dist/tools/dynamic-trace-import.d.ts +10 -0
  109. package/dist/tools/dynamic-trace-import.js +235 -0
  110. package/dist/tools/entrypoint-fallback-disasm.d.ts +30 -0
  111. package/dist/tools/entrypoint-fallback-disasm.js +89 -0
  112. package/dist/tools/ghidra-analyze.d.ts +88 -0
  113. package/dist/tools/ghidra-analyze.js +208 -0
  114. package/dist/tools/ghidra-health.d.ts +37 -0
  115. package/dist/tools/ghidra-health.js +212 -0
  116. package/dist/tools/ioc-export.d.ts +209 -0
  117. package/dist/tools/ioc-export.js +542 -0
  118. package/dist/tools/packer-detect.d.ts +165 -0
  119. package/dist/tools/packer-detect.js +284 -0
  120. package/dist/tools/pe-exports-extract.d.ts +175 -0
  121. package/dist/tools/pe-exports-extract.js +253 -0
  122. package/dist/tools/pe-fingerprint.d.ts +234 -0
  123. package/dist/tools/pe-fingerprint.js +269 -0
  124. package/dist/tools/pe-imports-extract.d.ts +105 -0
  125. package/dist/tools/pe-imports-extract.js +245 -0
  126. package/dist/tools/report-generate.d.ts +157 -0
  127. package/dist/tools/report-generate.js +457 -0
  128. package/dist/tools/report-summarize.d.ts +2131 -0
  129. package/dist/tools/report-summarize.js +596 -0
  130. package/dist/tools/runtime-detect.d.ts +135 -0
  131. package/dist/tools/runtime-detect.js +247 -0
  132. package/dist/tools/sample-ingest.d.ts +94 -0
  133. package/dist/tools/sample-ingest.js +327 -0
  134. package/dist/tools/sample-profile-get.d.ts +183 -0
  135. package/dist/tools/sample-profile-get.js +121 -0
  136. package/dist/tools/sandbox-execute.d.ts +441 -0
  137. package/dist/tools/sandbox-execute.js +392 -0
  138. package/dist/tools/strings-extract.d.ts +375 -0
  139. package/dist/tools/strings-extract.js +314 -0
  140. package/dist/tools/strings-floss-decode.d.ts +143 -0
  141. package/dist/tools/strings-floss-decode.js +259 -0
  142. package/dist/tools/system-health.d.ts +434 -0
  143. package/dist/tools/system-health.js +446 -0
  144. package/dist/tools/task-cancel.d.ts +21 -0
  145. package/dist/tools/task-cancel.js +70 -0
  146. package/dist/tools/task-status.d.ts +27 -0
  147. package/dist/tools/task-status.js +106 -0
  148. package/dist/tools/task-sweep.d.ts +22 -0
  149. package/dist/tools/task-sweep.js +77 -0
  150. package/dist/tools/tool-help.d.ts +340 -0
  151. package/dist/tools/tool-help.js +261 -0
  152. package/dist/tools/yara-scan.d.ts +554 -0
  153. package/dist/tools/yara-scan.js +313 -0
  154. package/dist/types.d.ts +266 -0
  155. package/dist/types.js +41 -0
  156. package/dist/worker-pool.d.ts +204 -0
  157. package/dist/worker-pool.js +650 -0
  158. package/dist/workflows/deep-static.d.ts +104 -0
  159. package/dist/workflows/deep-static.js +276 -0
  160. package/dist/workflows/function-explanation-review.d.ts +655 -0
  161. package/dist/workflows/function-explanation-review.js +440 -0
  162. package/dist/workflows/reconstruct.d.ts +2053 -0
  163. package/dist/workflows/reconstruct.js +666 -0
  164. package/dist/workflows/semantic-name-review.d.ts +2418 -0
  165. package/dist/workflows/semantic-name-review.js +521 -0
  166. package/dist/workflows/triage.d.ts +659 -0
  167. package/dist/workflows/triage.js +1374 -0
  168. package/dist/workspace-manager.d.ts +150 -0
  169. package/dist/workspace-manager.js +411 -0
  170. package/ghidra_scripts/DecompileFunction.java +487 -0
  171. package/ghidra_scripts/DecompileFunction.py +150 -0
  172. package/ghidra_scripts/ExtractCFG.java +256 -0
  173. package/ghidra_scripts/ExtractCFG.py +233 -0
  174. package/ghidra_scripts/ExtractFunctions.java +442 -0
  175. package/ghidra_scripts/ExtractFunctions.py +101 -0
  176. package/ghidra_scripts/README.md +125 -0
  177. package/ghidra_scripts/SearchFunctionReferences.java +380 -0
  178. package/helpers/DotNetMetadataProbe/DotNetMetadataProbe.csproj +9 -0
  179. package/helpers/DotNetMetadataProbe/Program.cs +566 -0
  180. package/install-to-codex.ps1 +178 -0
  181. package/install-to-copilot.ps1 +303 -0
  182. package/package.json +101 -0
  183. package/requirements.txt +9 -0
  184. package/workers/requirements-dynamic.txt +11 -0
  185. package/workers/requirements.txt +8 -0
  186. package/workers/speakeasy_compat.py +175 -0
  187. package/workers/static_worker.py +5183 -0
  188. package/workers/yara_rules/default.yar +33 -0
  189. package/workers/yara_rules/malware_families.yar +93 -0
  190. package/workers/yara_rules/packers.yar +80 -0
@@ -0,0 +1,2131 @@
1
+ /**
2
+ * report.summarize tool implementation
3
+ * Generates quick triage report with summary, confidence, IOCs, evidence, and recommendations.
4
+ */
5
+ import { z } from 'zod';
6
+ import type { ToolDefinition, ToolArgs, WorkerResult } from '../types.js';
7
+ import type { WorkspaceManager } from '../workspace-manager.js';
8
+ import type { DatabaseManager } from '../database.js';
9
+ import type { CacheManager } from '../cache-manager.js';
10
+ export declare const ReportSummarizeInputSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
11
+ sample_id: z.ZodString;
12
+ mode: z.ZodDefault<z.ZodEnum<["triage", "dotnet"]>>;
13
+ evidence_scope: z.ZodDefault<z.ZodEnum<["all", "latest", "session"]>>;
14
+ evidence_session_tag: z.ZodOptional<z.ZodString>;
15
+ semantic_scope: z.ZodDefault<z.ZodEnum<["all", "latest", "session"]>>;
16
+ semantic_session_tag: z.ZodOptional<z.ZodString>;
17
+ compare_evidence_scope: z.ZodOptional<z.ZodEnum<["all", "latest", "session"]>>;
18
+ compare_evidence_session_tag: z.ZodOptional<z.ZodString>;
19
+ compare_semantic_scope: z.ZodOptional<z.ZodEnum<["all", "latest", "session"]>>;
20
+ compare_semantic_session_tag: z.ZodOptional<z.ZodString>;
21
+ force_refresh: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
22
+ }, "strip", z.ZodTypeAny, {
23
+ sample_id: string;
24
+ mode: "dotnet" | "triage";
25
+ evidence_scope: "all" | "latest" | "session";
26
+ force_refresh: boolean;
27
+ semantic_scope: "all" | "latest" | "session";
28
+ evidence_session_tag?: string | undefined;
29
+ semantic_session_tag?: string | undefined;
30
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
31
+ compare_evidence_session_tag?: string | undefined;
32
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
33
+ compare_semantic_session_tag?: string | undefined;
34
+ }, {
35
+ sample_id: string;
36
+ mode?: "dotnet" | "triage" | undefined;
37
+ evidence_scope?: "all" | "latest" | "session" | undefined;
38
+ force_refresh?: boolean | undefined;
39
+ evidence_session_tag?: string | undefined;
40
+ semantic_scope?: "all" | "latest" | "session" | undefined;
41
+ semantic_session_tag?: string | undefined;
42
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
43
+ compare_evidence_session_tag?: string | undefined;
44
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
45
+ compare_semantic_session_tag?: string | undefined;
46
+ }>, {
47
+ sample_id: string;
48
+ mode: "dotnet" | "triage";
49
+ evidence_scope: "all" | "latest" | "session";
50
+ force_refresh: boolean;
51
+ semantic_scope: "all" | "latest" | "session";
52
+ evidence_session_tag?: string | undefined;
53
+ semantic_session_tag?: string | undefined;
54
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
55
+ compare_evidence_session_tag?: string | undefined;
56
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
57
+ compare_semantic_session_tag?: string | undefined;
58
+ }, {
59
+ sample_id: string;
60
+ mode?: "dotnet" | "triage" | undefined;
61
+ evidence_scope?: "all" | "latest" | "session" | undefined;
62
+ force_refresh?: boolean | undefined;
63
+ evidence_session_tag?: string | undefined;
64
+ semantic_scope?: "all" | "latest" | "session" | undefined;
65
+ semantic_session_tag?: string | undefined;
66
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
67
+ compare_evidence_session_tag?: string | undefined;
68
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
69
+ compare_semantic_session_tag?: string | undefined;
70
+ }>, {
71
+ sample_id: string;
72
+ mode: "dotnet" | "triage";
73
+ evidence_scope: "all" | "latest" | "session";
74
+ force_refresh: boolean;
75
+ semantic_scope: "all" | "latest" | "session";
76
+ evidence_session_tag?: string | undefined;
77
+ semantic_session_tag?: string | undefined;
78
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
79
+ compare_evidence_session_tag?: string | undefined;
80
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
81
+ compare_semantic_session_tag?: string | undefined;
82
+ }, {
83
+ sample_id: string;
84
+ mode?: "dotnet" | "triage" | undefined;
85
+ evidence_scope?: "all" | "latest" | "session" | undefined;
86
+ force_refresh?: boolean | undefined;
87
+ evidence_session_tag?: string | undefined;
88
+ semantic_scope?: "all" | "latest" | "session" | undefined;
89
+ semantic_session_tag?: string | undefined;
90
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
91
+ compare_evidence_session_tag?: string | undefined;
92
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
93
+ compare_semantic_session_tag?: string | undefined;
94
+ }>, {
95
+ sample_id: string;
96
+ mode: "dotnet" | "triage";
97
+ evidence_scope: "all" | "latest" | "session";
98
+ force_refresh: boolean;
99
+ semantic_scope: "all" | "latest" | "session";
100
+ evidence_session_tag?: string | undefined;
101
+ semantic_session_tag?: string | undefined;
102
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
103
+ compare_evidence_session_tag?: string | undefined;
104
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
105
+ compare_semantic_session_tag?: string | undefined;
106
+ }, {
107
+ sample_id: string;
108
+ mode?: "dotnet" | "triage" | undefined;
109
+ evidence_scope?: "all" | "latest" | "session" | undefined;
110
+ force_refresh?: boolean | undefined;
111
+ evidence_session_tag?: string | undefined;
112
+ semantic_scope?: "all" | "latest" | "session" | undefined;
113
+ semantic_session_tag?: string | undefined;
114
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
115
+ compare_evidence_session_tag?: string | undefined;
116
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
117
+ compare_semantic_session_tag?: string | undefined;
118
+ }>, {
119
+ sample_id: string;
120
+ mode: "dotnet" | "triage";
121
+ evidence_scope: "all" | "latest" | "session";
122
+ force_refresh: boolean;
123
+ semantic_scope: "all" | "latest" | "session";
124
+ evidence_session_tag?: string | undefined;
125
+ semantic_session_tag?: string | undefined;
126
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
127
+ compare_evidence_session_tag?: string | undefined;
128
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
129
+ compare_semantic_session_tag?: string | undefined;
130
+ }, {
131
+ sample_id: string;
132
+ mode?: "dotnet" | "triage" | undefined;
133
+ evidence_scope?: "all" | "latest" | "session" | undefined;
134
+ force_refresh?: boolean | undefined;
135
+ evidence_session_tag?: string | undefined;
136
+ semantic_scope?: "all" | "latest" | "session" | undefined;
137
+ semantic_session_tag?: string | undefined;
138
+ compare_evidence_scope?: "all" | "latest" | "session" | undefined;
139
+ compare_evidence_session_tag?: string | undefined;
140
+ compare_semantic_scope?: "all" | "latest" | "session" | undefined;
141
+ compare_semantic_session_tag?: string | undefined;
142
+ }>;
143
+ export type ReportSummarizeInput = z.infer<typeof ReportSummarizeInputSchema>;
144
+ export declare const ReportSummarizeOutputSchema: z.ZodObject<{
145
+ ok: z.ZodBoolean;
146
+ data: z.ZodOptional<z.ZodObject<{
147
+ summary: z.ZodString;
148
+ confidence: z.ZodNumber;
149
+ threat_level: z.ZodEnum<["clean", "suspicious", "malicious", "unknown"]>;
150
+ iocs: z.ZodObject<{
151
+ suspicious_imports: z.ZodArray<z.ZodString, "many">;
152
+ suspicious_strings: z.ZodArray<z.ZodString, "many">;
153
+ yara_matches: z.ZodArray<z.ZodString, "many">;
154
+ yara_low_confidence: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
155
+ urls: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
156
+ ip_addresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
157
+ file_paths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
158
+ registry_keys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
159
+ high_value_iocs: z.ZodOptional<z.ZodObject<{
160
+ suspicious_apis: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
161
+ commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
162
+ pipes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
163
+ urls: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
164
+ network: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
165
+ }, "strip", z.ZodTypeAny, {
166
+ network?: string[] | undefined;
167
+ urls?: string[] | undefined;
168
+ suspicious_apis?: string[] | undefined;
169
+ commands?: string[] | undefined;
170
+ pipes?: string[] | undefined;
171
+ }, {
172
+ network?: string[] | undefined;
173
+ urls?: string[] | undefined;
174
+ suspicious_apis?: string[] | undefined;
175
+ commands?: string[] | undefined;
176
+ pipes?: string[] | undefined;
177
+ }>>;
178
+ compiler_artifacts: z.ZodOptional<z.ZodObject<{
179
+ cargo_paths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
180
+ rust_markers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
181
+ library_profile: z.ZodOptional<z.ZodObject<{
182
+ ecosystems: z.ZodArray<z.ZodString, "many">;
183
+ top_crates: z.ZodArray<z.ZodString, "many">;
184
+ notable_libraries: z.ZodArray<z.ZodString, "many">;
185
+ evidence: z.ZodArray<z.ZodString, "many">;
186
+ }, "strip", z.ZodTypeAny, {
187
+ evidence: string[];
188
+ ecosystems: string[];
189
+ top_crates: string[];
190
+ notable_libraries: string[];
191
+ }, {
192
+ evidence: string[];
193
+ ecosystems: string[];
194
+ top_crates: string[];
195
+ notable_libraries: string[];
196
+ }>>;
197
+ }, "strip", z.ZodTypeAny, {
198
+ cargo_paths?: string[] | undefined;
199
+ rust_markers?: string[] | undefined;
200
+ library_profile?: {
201
+ evidence: string[];
202
+ ecosystems: string[];
203
+ top_crates: string[];
204
+ notable_libraries: string[];
205
+ } | undefined;
206
+ }, {
207
+ cargo_paths?: string[] | undefined;
208
+ rust_markers?: string[] | undefined;
209
+ library_profile?: {
210
+ evidence: string[];
211
+ ecosystems: string[];
212
+ top_crates: string[];
213
+ notable_libraries: string[];
214
+ } | undefined;
215
+ }>>;
216
+ }, "strip", z.ZodTypeAny, {
217
+ suspicious_imports: string[];
218
+ suspicious_strings: string[];
219
+ yara_matches: string[];
220
+ yara_low_confidence?: string[] | undefined;
221
+ urls?: string[] | undefined;
222
+ ip_addresses?: string[] | undefined;
223
+ file_paths?: string[] | undefined;
224
+ registry_keys?: string[] | undefined;
225
+ high_value_iocs?: {
226
+ network?: string[] | undefined;
227
+ urls?: string[] | undefined;
228
+ suspicious_apis?: string[] | undefined;
229
+ commands?: string[] | undefined;
230
+ pipes?: string[] | undefined;
231
+ } | undefined;
232
+ compiler_artifacts?: {
233
+ cargo_paths?: string[] | undefined;
234
+ rust_markers?: string[] | undefined;
235
+ library_profile?: {
236
+ evidence: string[];
237
+ ecosystems: string[];
238
+ top_crates: string[];
239
+ notable_libraries: string[];
240
+ } | undefined;
241
+ } | undefined;
242
+ }, {
243
+ suspicious_imports: string[];
244
+ suspicious_strings: string[];
245
+ yara_matches: string[];
246
+ yara_low_confidence?: string[] | undefined;
247
+ urls?: string[] | undefined;
248
+ ip_addresses?: string[] | undefined;
249
+ file_paths?: string[] | undefined;
250
+ registry_keys?: string[] | undefined;
251
+ high_value_iocs?: {
252
+ network?: string[] | undefined;
253
+ urls?: string[] | undefined;
254
+ suspicious_apis?: string[] | undefined;
255
+ commands?: string[] | undefined;
256
+ pipes?: string[] | undefined;
257
+ } | undefined;
258
+ compiler_artifacts?: {
259
+ cargo_paths?: string[] | undefined;
260
+ rust_markers?: string[] | undefined;
261
+ library_profile?: {
262
+ evidence: string[];
263
+ ecosystems: string[];
264
+ top_crates: string[];
265
+ notable_libraries: string[];
266
+ } | undefined;
267
+ } | undefined;
268
+ }>;
269
+ evidence: z.ZodArray<z.ZodString, "many">;
270
+ evidence_lineage: z.ZodOptional<z.ZodObject<{
271
+ layers: z.ZodArray<z.ZodObject<{
272
+ layer: z.ZodEnum<["static_only", "safe_simulation", "memory_or_hybrid", "executed_trace"]>;
273
+ confidence_band: z.ZodEnum<["baseline", "suggestive", "high"]>;
274
+ artifact_count: z.ZodNumber;
275
+ source_formats: z.ZodArray<z.ZodString, "many">;
276
+ evidence_kinds: z.ZodArray<z.ZodString, "many">;
277
+ source_names: z.ZodArray<z.ZodString, "many">;
278
+ latest_imported_at: z.ZodNullable<z.ZodString>;
279
+ summary: z.ZodString;
280
+ }, "strip", z.ZodTypeAny, {
281
+ summary: string;
282
+ artifact_count: number;
283
+ latest_imported_at: string | null;
284
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
285
+ source_formats: string[];
286
+ evidence_kinds: string[];
287
+ source_names: string[];
288
+ confidence_band: "baseline" | "suggestive" | "high";
289
+ }, {
290
+ summary: string;
291
+ artifact_count: number;
292
+ latest_imported_at: string | null;
293
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
294
+ source_formats: string[];
295
+ evidence_kinds: string[];
296
+ source_names: string[];
297
+ confidence_band: "baseline" | "suggestive" | "high";
298
+ }>, "many">;
299
+ latest_runtime_artifact_at: z.ZodNullable<z.ZodString>;
300
+ scope_note: z.ZodString;
301
+ }, "strip", z.ZodTypeAny, {
302
+ scope_note: string;
303
+ layers: {
304
+ summary: string;
305
+ artifact_count: number;
306
+ latest_imported_at: string | null;
307
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
308
+ source_formats: string[];
309
+ evidence_kinds: string[];
310
+ source_names: string[];
311
+ confidence_band: "baseline" | "suggestive" | "high";
312
+ }[];
313
+ latest_runtime_artifact_at: string | null;
314
+ }, {
315
+ scope_note: string;
316
+ layers: {
317
+ summary: string;
318
+ artifact_count: number;
319
+ latest_imported_at: string | null;
320
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
321
+ source_formats: string[];
322
+ evidence_kinds: string[];
323
+ source_names: string[];
324
+ confidence_band: "baseline" | "suggestive" | "high";
325
+ }[];
326
+ latest_runtime_artifact_at: string | null;
327
+ }>>;
328
+ confidence_semantics: z.ZodOptional<z.ZodObject<{
329
+ assessment: z.ZodObject<{
330
+ score_kind: z.ZodEnum<["heuristic_reconstruction", "runtime_correlation", "naming_resolution", "report_assessment"]>;
331
+ score: z.ZodNullable<z.ZodNumber>;
332
+ band: z.ZodEnum<["none", "low", "medium", "high"]>;
333
+ calibrated: z.ZodBoolean;
334
+ meaning: z.ZodString;
335
+ compare_within: z.ZodString;
336
+ caution: z.ZodString;
337
+ acceptance_rule: z.ZodOptional<z.ZodNullable<z.ZodString>>;
338
+ drivers: z.ZodArray<z.ZodString, "many">;
339
+ }, "strip", z.ZodTypeAny, {
340
+ score: number | null;
341
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
342
+ band: "high" | "none" | "low" | "medium";
343
+ calibrated: boolean;
344
+ meaning: string;
345
+ compare_within: string;
346
+ caution: string;
347
+ drivers: string[];
348
+ acceptance_rule?: string | null | undefined;
349
+ }, {
350
+ score: number | null;
351
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
352
+ band: "high" | "none" | "low" | "medium";
353
+ calibrated: boolean;
354
+ meaning: string;
355
+ compare_within: string;
356
+ caution: string;
357
+ drivers: string[];
358
+ acceptance_rule?: string | null | undefined;
359
+ }>;
360
+ }, "strip", z.ZodTypeAny, {
361
+ assessment: {
362
+ score: number | null;
363
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
364
+ band: "high" | "none" | "low" | "medium";
365
+ calibrated: boolean;
366
+ meaning: string;
367
+ compare_within: string;
368
+ caution: string;
369
+ drivers: string[];
370
+ acceptance_rule?: string | null | undefined;
371
+ };
372
+ }, {
373
+ assessment: {
374
+ score: number | null;
375
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
376
+ band: "high" | "none" | "low" | "medium";
377
+ calibrated: boolean;
378
+ meaning: string;
379
+ compare_within: string;
380
+ caution: string;
381
+ drivers: string[];
382
+ acceptance_rule?: string | null | undefined;
383
+ };
384
+ }>>;
385
+ provenance: z.ZodOptional<z.ZodObject<{
386
+ runtime: z.ZodObject<{
387
+ scope: z.ZodEnum<["all", "latest", "session"]>;
388
+ session_selector: z.ZodNullable<z.ZodString>;
389
+ artifact_count: z.ZodNumber;
390
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
391
+ session_tags: z.ZodArray<z.ZodString, "many">;
392
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
393
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
394
+ scope_note: z.ZodString;
395
+ }, "strip", z.ZodTypeAny, {
396
+ artifact_count: number;
397
+ scope_note: string;
398
+ artifact_ids: string[];
399
+ session_selector: string | null;
400
+ session_tags: string[];
401
+ scope: "all" | "latest" | "session";
402
+ earliest_artifact_at: string | null;
403
+ latest_artifact_at: string | null;
404
+ }, {
405
+ artifact_count: number;
406
+ scope_note: string;
407
+ artifact_ids: string[];
408
+ session_selector: string | null;
409
+ session_tags: string[];
410
+ scope: "all" | "latest" | "session";
411
+ earliest_artifact_at: string | null;
412
+ latest_artifact_at: string | null;
413
+ }>;
414
+ semantic_names: z.ZodOptional<z.ZodObject<{
415
+ scope: z.ZodEnum<["all", "latest", "session"]>;
416
+ session_selector: z.ZodNullable<z.ZodString>;
417
+ artifact_count: z.ZodNumber;
418
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
419
+ session_tags: z.ZodArray<z.ZodString, "many">;
420
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
421
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
422
+ scope_note: z.ZodString;
423
+ }, "strip", z.ZodTypeAny, {
424
+ artifact_count: number;
425
+ scope_note: string;
426
+ artifact_ids: string[];
427
+ session_selector: string | null;
428
+ session_tags: string[];
429
+ scope: "all" | "latest" | "session";
430
+ earliest_artifact_at: string | null;
431
+ latest_artifact_at: string | null;
432
+ }, {
433
+ artifact_count: number;
434
+ scope_note: string;
435
+ artifact_ids: string[];
436
+ session_selector: string | null;
437
+ session_tags: string[];
438
+ scope: "all" | "latest" | "session";
439
+ earliest_artifact_at: string | null;
440
+ latest_artifact_at: string | null;
441
+ }>>;
442
+ semantic_explanations: z.ZodOptional<z.ZodObject<{
443
+ scope: z.ZodEnum<["all", "latest", "session"]>;
444
+ session_selector: z.ZodNullable<z.ZodString>;
445
+ artifact_count: z.ZodNumber;
446
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
447
+ session_tags: z.ZodArray<z.ZodString, "many">;
448
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
449
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
450
+ scope_note: z.ZodString;
451
+ }, "strip", z.ZodTypeAny, {
452
+ artifact_count: number;
453
+ scope_note: string;
454
+ artifact_ids: string[];
455
+ session_selector: string | null;
456
+ session_tags: string[];
457
+ scope: "all" | "latest" | "session";
458
+ earliest_artifact_at: string | null;
459
+ latest_artifact_at: string | null;
460
+ }, {
461
+ artifact_count: number;
462
+ scope_note: string;
463
+ artifact_ids: string[];
464
+ session_selector: string | null;
465
+ session_tags: string[];
466
+ scope: "all" | "latest" | "session";
467
+ earliest_artifact_at: string | null;
468
+ latest_artifact_at: string | null;
469
+ }>>;
470
+ }, "strip", z.ZodTypeAny, {
471
+ runtime: {
472
+ artifact_count: number;
473
+ scope_note: string;
474
+ artifact_ids: string[];
475
+ session_selector: string | null;
476
+ session_tags: string[];
477
+ scope: "all" | "latest" | "session";
478
+ earliest_artifact_at: string | null;
479
+ latest_artifact_at: string | null;
480
+ };
481
+ semantic_names?: {
482
+ artifact_count: number;
483
+ scope_note: string;
484
+ artifact_ids: string[];
485
+ session_selector: string | null;
486
+ session_tags: string[];
487
+ scope: "all" | "latest" | "session";
488
+ earliest_artifact_at: string | null;
489
+ latest_artifact_at: string | null;
490
+ } | undefined;
491
+ semantic_explanations?: {
492
+ artifact_count: number;
493
+ scope_note: string;
494
+ artifact_ids: string[];
495
+ session_selector: string | null;
496
+ session_tags: string[];
497
+ scope: "all" | "latest" | "session";
498
+ earliest_artifact_at: string | null;
499
+ latest_artifact_at: string | null;
500
+ } | undefined;
501
+ }, {
502
+ runtime: {
503
+ artifact_count: number;
504
+ scope_note: string;
505
+ artifact_ids: string[];
506
+ session_selector: string | null;
507
+ session_tags: string[];
508
+ scope: "all" | "latest" | "session";
509
+ earliest_artifact_at: string | null;
510
+ latest_artifact_at: string | null;
511
+ };
512
+ semantic_names?: {
513
+ artifact_count: number;
514
+ scope_note: string;
515
+ artifact_ids: string[];
516
+ session_selector: string | null;
517
+ session_tags: string[];
518
+ scope: "all" | "latest" | "session";
519
+ earliest_artifact_at: string | null;
520
+ latest_artifact_at: string | null;
521
+ } | undefined;
522
+ semantic_explanations?: {
523
+ artifact_count: number;
524
+ scope_note: string;
525
+ artifact_ids: string[];
526
+ session_selector: string | null;
527
+ session_tags: string[];
528
+ scope: "all" | "latest" | "session";
529
+ earliest_artifact_at: string | null;
530
+ latest_artifact_at: string | null;
531
+ } | undefined;
532
+ }>>;
533
+ selection_diffs: z.ZodOptional<z.ZodObject<{
534
+ runtime: z.ZodOptional<z.ZodObject<{
535
+ label: z.ZodEnum<["runtime", "semantic_names", "semantic_explanations"]>;
536
+ current: z.ZodObject<{
537
+ scope: z.ZodEnum<["all", "latest", "session"]>;
538
+ session_selector: z.ZodNullable<z.ZodString>;
539
+ artifact_count: z.ZodNumber;
540
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
541
+ session_tags: z.ZodArray<z.ZodString, "many">;
542
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
543
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
544
+ scope_note: z.ZodString;
545
+ }, "strip", z.ZodTypeAny, {
546
+ artifact_count: number;
547
+ scope_note: string;
548
+ artifact_ids: string[];
549
+ session_selector: string | null;
550
+ session_tags: string[];
551
+ scope: "all" | "latest" | "session";
552
+ earliest_artifact_at: string | null;
553
+ latest_artifact_at: string | null;
554
+ }, {
555
+ artifact_count: number;
556
+ scope_note: string;
557
+ artifact_ids: string[];
558
+ session_selector: string | null;
559
+ session_tags: string[];
560
+ scope: "all" | "latest" | "session";
561
+ earliest_artifact_at: string | null;
562
+ latest_artifact_at: string | null;
563
+ }>;
564
+ baseline: z.ZodObject<{
565
+ scope: z.ZodEnum<["all", "latest", "session"]>;
566
+ session_selector: z.ZodNullable<z.ZodString>;
567
+ artifact_count: z.ZodNumber;
568
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
569
+ session_tags: z.ZodArray<z.ZodString, "many">;
570
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
571
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
572
+ scope_note: z.ZodString;
573
+ }, "strip", z.ZodTypeAny, {
574
+ artifact_count: number;
575
+ scope_note: string;
576
+ artifact_ids: string[];
577
+ session_selector: string | null;
578
+ session_tags: string[];
579
+ scope: "all" | "latest" | "session";
580
+ earliest_artifact_at: string | null;
581
+ latest_artifact_at: string | null;
582
+ }, {
583
+ artifact_count: number;
584
+ scope_note: string;
585
+ artifact_ids: string[];
586
+ session_selector: string | null;
587
+ session_tags: string[];
588
+ scope: "all" | "latest" | "session";
589
+ earliest_artifact_at: string | null;
590
+ latest_artifact_at: string | null;
591
+ }>;
592
+ added_artifact_ids: z.ZodArray<z.ZodString, "many">;
593
+ removed_artifact_ids: z.ZodArray<z.ZodString, "many">;
594
+ added_session_tags: z.ZodArray<z.ZodString, "many">;
595
+ removed_session_tags: z.ZodArray<z.ZodString, "many">;
596
+ artifact_count_delta: z.ZodNumber;
597
+ summary: z.ZodString;
598
+ }, "strip", z.ZodTypeAny, {
599
+ summary: string;
600
+ baseline: {
601
+ artifact_count: number;
602
+ scope_note: string;
603
+ artifact_ids: string[];
604
+ session_selector: string | null;
605
+ session_tags: string[];
606
+ scope: "all" | "latest" | "session";
607
+ earliest_artifact_at: string | null;
608
+ latest_artifact_at: string | null;
609
+ };
610
+ label: "runtime" | "semantic_names" | "semantic_explanations";
611
+ current: {
612
+ artifact_count: number;
613
+ scope_note: string;
614
+ artifact_ids: string[];
615
+ session_selector: string | null;
616
+ session_tags: string[];
617
+ scope: "all" | "latest" | "session";
618
+ earliest_artifact_at: string | null;
619
+ latest_artifact_at: string | null;
620
+ };
621
+ added_artifact_ids: string[];
622
+ removed_artifact_ids: string[];
623
+ added_session_tags: string[];
624
+ removed_session_tags: string[];
625
+ artifact_count_delta: number;
626
+ }, {
627
+ summary: string;
628
+ baseline: {
629
+ artifact_count: number;
630
+ scope_note: string;
631
+ artifact_ids: string[];
632
+ session_selector: string | null;
633
+ session_tags: string[];
634
+ scope: "all" | "latest" | "session";
635
+ earliest_artifact_at: string | null;
636
+ latest_artifact_at: string | null;
637
+ };
638
+ label: "runtime" | "semantic_names" | "semantic_explanations";
639
+ current: {
640
+ artifact_count: number;
641
+ scope_note: string;
642
+ artifact_ids: string[];
643
+ session_selector: string | null;
644
+ session_tags: string[];
645
+ scope: "all" | "latest" | "session";
646
+ earliest_artifact_at: string | null;
647
+ latest_artifact_at: string | null;
648
+ };
649
+ added_artifact_ids: string[];
650
+ removed_artifact_ids: string[];
651
+ added_session_tags: string[];
652
+ removed_session_tags: string[];
653
+ artifact_count_delta: number;
654
+ }>>;
655
+ semantic_names: z.ZodOptional<z.ZodObject<{
656
+ label: z.ZodEnum<["runtime", "semantic_names", "semantic_explanations"]>;
657
+ current: z.ZodObject<{
658
+ scope: z.ZodEnum<["all", "latest", "session"]>;
659
+ session_selector: z.ZodNullable<z.ZodString>;
660
+ artifact_count: z.ZodNumber;
661
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
662
+ session_tags: z.ZodArray<z.ZodString, "many">;
663
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
664
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
665
+ scope_note: z.ZodString;
666
+ }, "strip", z.ZodTypeAny, {
667
+ artifact_count: number;
668
+ scope_note: string;
669
+ artifact_ids: string[];
670
+ session_selector: string | null;
671
+ session_tags: string[];
672
+ scope: "all" | "latest" | "session";
673
+ earliest_artifact_at: string | null;
674
+ latest_artifact_at: string | null;
675
+ }, {
676
+ artifact_count: number;
677
+ scope_note: string;
678
+ artifact_ids: string[];
679
+ session_selector: string | null;
680
+ session_tags: string[];
681
+ scope: "all" | "latest" | "session";
682
+ earliest_artifact_at: string | null;
683
+ latest_artifact_at: string | null;
684
+ }>;
685
+ baseline: z.ZodObject<{
686
+ scope: z.ZodEnum<["all", "latest", "session"]>;
687
+ session_selector: z.ZodNullable<z.ZodString>;
688
+ artifact_count: z.ZodNumber;
689
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
690
+ session_tags: z.ZodArray<z.ZodString, "many">;
691
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
692
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
693
+ scope_note: z.ZodString;
694
+ }, "strip", z.ZodTypeAny, {
695
+ artifact_count: number;
696
+ scope_note: string;
697
+ artifact_ids: string[];
698
+ session_selector: string | null;
699
+ session_tags: string[];
700
+ scope: "all" | "latest" | "session";
701
+ earliest_artifact_at: string | null;
702
+ latest_artifact_at: string | null;
703
+ }, {
704
+ artifact_count: number;
705
+ scope_note: string;
706
+ artifact_ids: string[];
707
+ session_selector: string | null;
708
+ session_tags: string[];
709
+ scope: "all" | "latest" | "session";
710
+ earliest_artifact_at: string | null;
711
+ latest_artifact_at: string | null;
712
+ }>;
713
+ added_artifact_ids: z.ZodArray<z.ZodString, "many">;
714
+ removed_artifact_ids: z.ZodArray<z.ZodString, "many">;
715
+ added_session_tags: z.ZodArray<z.ZodString, "many">;
716
+ removed_session_tags: z.ZodArray<z.ZodString, "many">;
717
+ artifact_count_delta: z.ZodNumber;
718
+ summary: z.ZodString;
719
+ }, "strip", z.ZodTypeAny, {
720
+ summary: string;
721
+ baseline: {
722
+ artifact_count: number;
723
+ scope_note: string;
724
+ artifact_ids: string[];
725
+ session_selector: string | null;
726
+ session_tags: string[];
727
+ scope: "all" | "latest" | "session";
728
+ earliest_artifact_at: string | null;
729
+ latest_artifact_at: string | null;
730
+ };
731
+ label: "runtime" | "semantic_names" | "semantic_explanations";
732
+ current: {
733
+ artifact_count: number;
734
+ scope_note: string;
735
+ artifact_ids: string[];
736
+ session_selector: string | null;
737
+ session_tags: string[];
738
+ scope: "all" | "latest" | "session";
739
+ earliest_artifact_at: string | null;
740
+ latest_artifact_at: string | null;
741
+ };
742
+ added_artifact_ids: string[];
743
+ removed_artifact_ids: string[];
744
+ added_session_tags: string[];
745
+ removed_session_tags: string[];
746
+ artifact_count_delta: number;
747
+ }, {
748
+ summary: string;
749
+ baseline: {
750
+ artifact_count: number;
751
+ scope_note: string;
752
+ artifact_ids: string[];
753
+ session_selector: string | null;
754
+ session_tags: string[];
755
+ scope: "all" | "latest" | "session";
756
+ earliest_artifact_at: string | null;
757
+ latest_artifact_at: string | null;
758
+ };
759
+ label: "runtime" | "semantic_names" | "semantic_explanations";
760
+ current: {
761
+ artifact_count: number;
762
+ scope_note: string;
763
+ artifact_ids: string[];
764
+ session_selector: string | null;
765
+ session_tags: string[];
766
+ scope: "all" | "latest" | "session";
767
+ earliest_artifact_at: string | null;
768
+ latest_artifact_at: string | null;
769
+ };
770
+ added_artifact_ids: string[];
771
+ removed_artifact_ids: string[];
772
+ added_session_tags: string[];
773
+ removed_session_tags: string[];
774
+ artifact_count_delta: number;
775
+ }>>;
776
+ semantic_explanations: z.ZodOptional<z.ZodObject<{
777
+ label: z.ZodEnum<["runtime", "semantic_names", "semantic_explanations"]>;
778
+ current: z.ZodObject<{
779
+ scope: z.ZodEnum<["all", "latest", "session"]>;
780
+ session_selector: z.ZodNullable<z.ZodString>;
781
+ artifact_count: z.ZodNumber;
782
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
783
+ session_tags: z.ZodArray<z.ZodString, "many">;
784
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
785
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
786
+ scope_note: z.ZodString;
787
+ }, "strip", z.ZodTypeAny, {
788
+ artifact_count: number;
789
+ scope_note: string;
790
+ artifact_ids: string[];
791
+ session_selector: string | null;
792
+ session_tags: string[];
793
+ scope: "all" | "latest" | "session";
794
+ earliest_artifact_at: string | null;
795
+ latest_artifact_at: string | null;
796
+ }, {
797
+ artifact_count: number;
798
+ scope_note: string;
799
+ artifact_ids: string[];
800
+ session_selector: string | null;
801
+ session_tags: string[];
802
+ scope: "all" | "latest" | "session";
803
+ earliest_artifact_at: string | null;
804
+ latest_artifact_at: string | null;
805
+ }>;
806
+ baseline: z.ZodObject<{
807
+ scope: z.ZodEnum<["all", "latest", "session"]>;
808
+ session_selector: z.ZodNullable<z.ZodString>;
809
+ artifact_count: z.ZodNumber;
810
+ artifact_ids: z.ZodArray<z.ZodString, "many">;
811
+ session_tags: z.ZodArray<z.ZodString, "many">;
812
+ earliest_artifact_at: z.ZodNullable<z.ZodString>;
813
+ latest_artifact_at: z.ZodNullable<z.ZodString>;
814
+ scope_note: z.ZodString;
815
+ }, "strip", z.ZodTypeAny, {
816
+ artifact_count: number;
817
+ scope_note: string;
818
+ artifact_ids: string[];
819
+ session_selector: string | null;
820
+ session_tags: string[];
821
+ scope: "all" | "latest" | "session";
822
+ earliest_artifact_at: string | null;
823
+ latest_artifact_at: string | null;
824
+ }, {
825
+ artifact_count: number;
826
+ scope_note: string;
827
+ artifact_ids: string[];
828
+ session_selector: string | null;
829
+ session_tags: string[];
830
+ scope: "all" | "latest" | "session";
831
+ earliest_artifact_at: string | null;
832
+ latest_artifact_at: string | null;
833
+ }>;
834
+ added_artifact_ids: z.ZodArray<z.ZodString, "many">;
835
+ removed_artifact_ids: z.ZodArray<z.ZodString, "many">;
836
+ added_session_tags: z.ZodArray<z.ZodString, "many">;
837
+ removed_session_tags: z.ZodArray<z.ZodString, "many">;
838
+ artifact_count_delta: z.ZodNumber;
839
+ summary: z.ZodString;
840
+ }, "strip", z.ZodTypeAny, {
841
+ summary: string;
842
+ baseline: {
843
+ artifact_count: number;
844
+ scope_note: string;
845
+ artifact_ids: string[];
846
+ session_selector: string | null;
847
+ session_tags: string[];
848
+ scope: "all" | "latest" | "session";
849
+ earliest_artifact_at: string | null;
850
+ latest_artifact_at: string | null;
851
+ };
852
+ label: "runtime" | "semantic_names" | "semantic_explanations";
853
+ current: {
854
+ artifact_count: number;
855
+ scope_note: string;
856
+ artifact_ids: string[];
857
+ session_selector: string | null;
858
+ session_tags: string[];
859
+ scope: "all" | "latest" | "session";
860
+ earliest_artifact_at: string | null;
861
+ latest_artifact_at: string | null;
862
+ };
863
+ added_artifact_ids: string[];
864
+ removed_artifact_ids: string[];
865
+ added_session_tags: string[];
866
+ removed_session_tags: string[];
867
+ artifact_count_delta: number;
868
+ }, {
869
+ summary: string;
870
+ baseline: {
871
+ artifact_count: number;
872
+ scope_note: string;
873
+ artifact_ids: string[];
874
+ session_selector: string | null;
875
+ session_tags: string[];
876
+ scope: "all" | "latest" | "session";
877
+ earliest_artifact_at: string | null;
878
+ latest_artifact_at: string | null;
879
+ };
880
+ label: "runtime" | "semantic_names" | "semantic_explanations";
881
+ current: {
882
+ artifact_count: number;
883
+ scope_note: string;
884
+ artifact_ids: string[];
885
+ session_selector: string | null;
886
+ session_tags: string[];
887
+ scope: "all" | "latest" | "session";
888
+ earliest_artifact_at: string | null;
889
+ latest_artifact_at: string | null;
890
+ };
891
+ added_artifact_ids: string[];
892
+ removed_artifact_ids: string[];
893
+ added_session_tags: string[];
894
+ removed_session_tags: string[];
895
+ artifact_count_delta: number;
896
+ }>>;
897
+ }, "strip", z.ZodTypeAny, {
898
+ runtime?: {
899
+ summary: string;
900
+ baseline: {
901
+ artifact_count: number;
902
+ scope_note: string;
903
+ artifact_ids: string[];
904
+ session_selector: string | null;
905
+ session_tags: string[];
906
+ scope: "all" | "latest" | "session";
907
+ earliest_artifact_at: string | null;
908
+ latest_artifact_at: string | null;
909
+ };
910
+ label: "runtime" | "semantic_names" | "semantic_explanations";
911
+ current: {
912
+ artifact_count: number;
913
+ scope_note: string;
914
+ artifact_ids: string[];
915
+ session_selector: string | null;
916
+ session_tags: string[];
917
+ scope: "all" | "latest" | "session";
918
+ earliest_artifact_at: string | null;
919
+ latest_artifact_at: string | null;
920
+ };
921
+ added_artifact_ids: string[];
922
+ removed_artifact_ids: string[];
923
+ added_session_tags: string[];
924
+ removed_session_tags: string[];
925
+ artifact_count_delta: number;
926
+ } | undefined;
927
+ semantic_names?: {
928
+ summary: string;
929
+ baseline: {
930
+ artifact_count: number;
931
+ scope_note: string;
932
+ artifact_ids: string[];
933
+ session_selector: string | null;
934
+ session_tags: string[];
935
+ scope: "all" | "latest" | "session";
936
+ earliest_artifact_at: string | null;
937
+ latest_artifact_at: string | null;
938
+ };
939
+ label: "runtime" | "semantic_names" | "semantic_explanations";
940
+ current: {
941
+ artifact_count: number;
942
+ scope_note: string;
943
+ artifact_ids: string[];
944
+ session_selector: string | null;
945
+ session_tags: string[];
946
+ scope: "all" | "latest" | "session";
947
+ earliest_artifact_at: string | null;
948
+ latest_artifact_at: string | null;
949
+ };
950
+ added_artifact_ids: string[];
951
+ removed_artifact_ids: string[];
952
+ added_session_tags: string[];
953
+ removed_session_tags: string[];
954
+ artifact_count_delta: number;
955
+ } | undefined;
956
+ semantic_explanations?: {
957
+ summary: string;
958
+ baseline: {
959
+ artifact_count: number;
960
+ scope_note: string;
961
+ artifact_ids: string[];
962
+ session_selector: string | null;
963
+ session_tags: string[];
964
+ scope: "all" | "latest" | "session";
965
+ earliest_artifact_at: string | null;
966
+ latest_artifact_at: string | null;
967
+ };
968
+ label: "runtime" | "semantic_names" | "semantic_explanations";
969
+ current: {
970
+ artifact_count: number;
971
+ scope_note: string;
972
+ artifact_ids: string[];
973
+ session_selector: string | null;
974
+ session_tags: string[];
975
+ scope: "all" | "latest" | "session";
976
+ earliest_artifact_at: string | null;
977
+ latest_artifact_at: string | null;
978
+ };
979
+ added_artifact_ids: string[];
980
+ removed_artifact_ids: string[];
981
+ added_session_tags: string[];
982
+ removed_session_tags: string[];
983
+ artifact_count_delta: number;
984
+ } | undefined;
985
+ }, {
986
+ runtime?: {
987
+ summary: string;
988
+ baseline: {
989
+ artifact_count: number;
990
+ scope_note: string;
991
+ artifact_ids: string[];
992
+ session_selector: string | null;
993
+ session_tags: string[];
994
+ scope: "all" | "latest" | "session";
995
+ earliest_artifact_at: string | null;
996
+ latest_artifact_at: string | null;
997
+ };
998
+ label: "runtime" | "semantic_names" | "semantic_explanations";
999
+ current: {
1000
+ artifact_count: number;
1001
+ scope_note: string;
1002
+ artifact_ids: string[];
1003
+ session_selector: string | null;
1004
+ session_tags: string[];
1005
+ scope: "all" | "latest" | "session";
1006
+ earliest_artifact_at: string | null;
1007
+ latest_artifact_at: string | null;
1008
+ };
1009
+ added_artifact_ids: string[];
1010
+ removed_artifact_ids: string[];
1011
+ added_session_tags: string[];
1012
+ removed_session_tags: string[];
1013
+ artifact_count_delta: number;
1014
+ } | undefined;
1015
+ semantic_names?: {
1016
+ summary: string;
1017
+ baseline: {
1018
+ artifact_count: number;
1019
+ scope_note: string;
1020
+ artifact_ids: string[];
1021
+ session_selector: string | null;
1022
+ session_tags: string[];
1023
+ scope: "all" | "latest" | "session";
1024
+ earliest_artifact_at: string | null;
1025
+ latest_artifact_at: string | null;
1026
+ };
1027
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1028
+ current: {
1029
+ artifact_count: number;
1030
+ scope_note: string;
1031
+ artifact_ids: string[];
1032
+ session_selector: string | null;
1033
+ session_tags: string[];
1034
+ scope: "all" | "latest" | "session";
1035
+ earliest_artifact_at: string | null;
1036
+ latest_artifact_at: string | null;
1037
+ };
1038
+ added_artifact_ids: string[];
1039
+ removed_artifact_ids: string[];
1040
+ added_session_tags: string[];
1041
+ removed_session_tags: string[];
1042
+ artifact_count_delta: number;
1043
+ } | undefined;
1044
+ semantic_explanations?: {
1045
+ summary: string;
1046
+ baseline: {
1047
+ artifact_count: number;
1048
+ scope_note: string;
1049
+ artifact_ids: string[];
1050
+ session_selector: string | null;
1051
+ session_tags: string[];
1052
+ scope: "all" | "latest" | "session";
1053
+ earliest_artifact_at: string | null;
1054
+ latest_artifact_at: string | null;
1055
+ };
1056
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1057
+ current: {
1058
+ artifact_count: number;
1059
+ scope_note: string;
1060
+ artifact_ids: string[];
1061
+ session_selector: string | null;
1062
+ session_tags: string[];
1063
+ scope: "all" | "latest" | "session";
1064
+ earliest_artifact_at: string | null;
1065
+ latest_artifact_at: string | null;
1066
+ };
1067
+ added_artifact_ids: string[];
1068
+ removed_artifact_ids: string[];
1069
+ added_session_tags: string[];
1070
+ removed_session_tags: string[];
1071
+ artifact_count_delta: number;
1072
+ } | undefined;
1073
+ }>>;
1074
+ function_explanations: z.ZodOptional<z.ZodArray<z.ZodObject<{
1075
+ address: z.ZodNullable<z.ZodString>;
1076
+ function: z.ZodNullable<z.ZodString>;
1077
+ behavior: z.ZodString;
1078
+ summary: z.ZodString;
1079
+ confidence: z.ZodNumber;
1080
+ rewrite_guidance: z.ZodArray<z.ZodString, "many">;
1081
+ source: z.ZodNullable<z.ZodString>;
1082
+ }, "strip", z.ZodTypeAny, {
1083
+ function: string | null;
1084
+ address: string | null;
1085
+ summary: string;
1086
+ source: string | null;
1087
+ confidence: number;
1088
+ behavior: string;
1089
+ rewrite_guidance: string[];
1090
+ }, {
1091
+ function: string | null;
1092
+ address: string | null;
1093
+ summary: string;
1094
+ source: string | null;
1095
+ confidence: number;
1096
+ behavior: string;
1097
+ rewrite_guidance: string[];
1098
+ }>, "many">>;
1099
+ evidence_weights: z.ZodOptional<z.ZodObject<{
1100
+ import: z.ZodNumber;
1101
+ string: z.ZodNumber;
1102
+ runtime: z.ZodNumber;
1103
+ }, "strip", z.ZodTypeAny, {
1104
+ string: number;
1105
+ runtime: number;
1106
+ import: number;
1107
+ }, {
1108
+ string: number;
1109
+ runtime: number;
1110
+ import: number;
1111
+ }>>;
1112
+ inference: z.ZodOptional<z.ZodObject<{
1113
+ classification: z.ZodEnum<["benign", "suspicious", "malicious", "unknown"]>;
1114
+ hypotheses: z.ZodArray<z.ZodString, "many">;
1115
+ false_positive_risks: z.ZodArray<z.ZodString, "many">;
1116
+ intent_assessment: z.ZodOptional<z.ZodObject<{
1117
+ label: z.ZodEnum<["dual_use_tool", "operator_utility", "malware_like_payload", "unknown"]>;
1118
+ confidence: z.ZodNumber;
1119
+ evidence: z.ZodArray<z.ZodString, "many">;
1120
+ counter_evidence: z.ZodArray<z.ZodString, "many">;
1121
+ }, "strip", z.ZodTypeAny, {
1122
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1123
+ confidence: number;
1124
+ evidence: string[];
1125
+ counter_evidence: string[];
1126
+ }, {
1127
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1128
+ confidence: number;
1129
+ evidence: string[];
1130
+ counter_evidence: string[];
1131
+ }>>;
1132
+ tooling_assessment: z.ZodOptional<z.ZodObject<{
1133
+ help_text_detected: z.ZodBoolean;
1134
+ cli_surface_detected: z.ZodBoolean;
1135
+ framework_hints: z.ZodArray<z.ZodString, "many">;
1136
+ toolchain_markers: z.ZodArray<z.ZodString, "many">;
1137
+ library_profile: z.ZodOptional<z.ZodObject<{
1138
+ ecosystems: z.ZodArray<z.ZodString, "many">;
1139
+ top_crates: z.ZodArray<z.ZodString, "many">;
1140
+ notable_libraries: z.ZodArray<z.ZodString, "many">;
1141
+ evidence: z.ZodArray<z.ZodString, "many">;
1142
+ }, "strip", z.ZodTypeAny, {
1143
+ evidence: string[];
1144
+ ecosystems: string[];
1145
+ top_crates: string[];
1146
+ notable_libraries: string[];
1147
+ }, {
1148
+ evidence: string[];
1149
+ ecosystems: string[];
1150
+ top_crates: string[];
1151
+ notable_libraries: string[];
1152
+ }>>;
1153
+ }, "strip", z.ZodTypeAny, {
1154
+ help_text_detected: boolean;
1155
+ cli_surface_detected: boolean;
1156
+ framework_hints: string[];
1157
+ toolchain_markers: string[];
1158
+ library_profile?: {
1159
+ evidence: string[];
1160
+ ecosystems: string[];
1161
+ top_crates: string[];
1162
+ notable_libraries: string[];
1163
+ } | undefined;
1164
+ }, {
1165
+ help_text_detected: boolean;
1166
+ cli_surface_detected: boolean;
1167
+ framework_hints: string[];
1168
+ toolchain_markers: string[];
1169
+ library_profile?: {
1170
+ evidence: string[];
1171
+ ecosystems: string[];
1172
+ top_crates: string[];
1173
+ notable_libraries: string[];
1174
+ } | undefined;
1175
+ }>>;
1176
+ }, "strip", z.ZodTypeAny, {
1177
+ classification: "unknown" | "suspicious" | "malicious" | "benign";
1178
+ hypotheses: string[];
1179
+ false_positive_risks: string[];
1180
+ intent_assessment?: {
1181
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1182
+ confidence: number;
1183
+ evidence: string[];
1184
+ counter_evidence: string[];
1185
+ } | undefined;
1186
+ tooling_assessment?: {
1187
+ help_text_detected: boolean;
1188
+ cli_surface_detected: boolean;
1189
+ framework_hints: string[];
1190
+ toolchain_markers: string[];
1191
+ library_profile?: {
1192
+ evidence: string[];
1193
+ ecosystems: string[];
1194
+ top_crates: string[];
1195
+ notable_libraries: string[];
1196
+ } | undefined;
1197
+ } | undefined;
1198
+ }, {
1199
+ classification: "unknown" | "suspicious" | "malicious" | "benign";
1200
+ hypotheses: string[];
1201
+ false_positive_risks: string[];
1202
+ intent_assessment?: {
1203
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1204
+ confidence: number;
1205
+ evidence: string[];
1206
+ counter_evidence: string[];
1207
+ } | undefined;
1208
+ tooling_assessment?: {
1209
+ help_text_detected: boolean;
1210
+ cli_surface_detected: boolean;
1211
+ framework_hints: string[];
1212
+ toolchain_markers: string[];
1213
+ library_profile?: {
1214
+ evidence: string[];
1215
+ ecosystems: string[];
1216
+ top_crates: string[];
1217
+ notable_libraries: string[];
1218
+ } | undefined;
1219
+ } | undefined;
1220
+ }>>;
1221
+ recommendation: z.ZodString;
1222
+ }, "strip", z.ZodTypeAny, {
1223
+ summary: string;
1224
+ confidence: number;
1225
+ evidence: string[];
1226
+ threat_level: "unknown" | "clean" | "suspicious" | "malicious";
1227
+ iocs: {
1228
+ suspicious_imports: string[];
1229
+ suspicious_strings: string[];
1230
+ yara_matches: string[];
1231
+ yara_low_confidence?: string[] | undefined;
1232
+ urls?: string[] | undefined;
1233
+ ip_addresses?: string[] | undefined;
1234
+ file_paths?: string[] | undefined;
1235
+ registry_keys?: string[] | undefined;
1236
+ high_value_iocs?: {
1237
+ network?: string[] | undefined;
1238
+ urls?: string[] | undefined;
1239
+ suspicious_apis?: string[] | undefined;
1240
+ commands?: string[] | undefined;
1241
+ pipes?: string[] | undefined;
1242
+ } | undefined;
1243
+ compiler_artifacts?: {
1244
+ cargo_paths?: string[] | undefined;
1245
+ rust_markers?: string[] | undefined;
1246
+ library_profile?: {
1247
+ evidence: string[];
1248
+ ecosystems: string[];
1249
+ top_crates: string[];
1250
+ notable_libraries: string[];
1251
+ } | undefined;
1252
+ } | undefined;
1253
+ };
1254
+ recommendation: string;
1255
+ provenance?: {
1256
+ runtime: {
1257
+ artifact_count: number;
1258
+ scope_note: string;
1259
+ artifact_ids: string[];
1260
+ session_selector: string | null;
1261
+ session_tags: string[];
1262
+ scope: "all" | "latest" | "session";
1263
+ earliest_artifact_at: string | null;
1264
+ latest_artifact_at: string | null;
1265
+ };
1266
+ semantic_names?: {
1267
+ artifact_count: number;
1268
+ scope_note: string;
1269
+ artifact_ids: string[];
1270
+ session_selector: string | null;
1271
+ session_tags: string[];
1272
+ scope: "all" | "latest" | "session";
1273
+ earliest_artifact_at: string | null;
1274
+ latest_artifact_at: string | null;
1275
+ } | undefined;
1276
+ semantic_explanations?: {
1277
+ artifact_count: number;
1278
+ scope_note: string;
1279
+ artifact_ids: string[];
1280
+ session_selector: string | null;
1281
+ session_tags: string[];
1282
+ scope: "all" | "latest" | "session";
1283
+ earliest_artifact_at: string | null;
1284
+ latest_artifact_at: string | null;
1285
+ } | undefined;
1286
+ } | undefined;
1287
+ inference?: {
1288
+ classification: "unknown" | "suspicious" | "malicious" | "benign";
1289
+ hypotheses: string[];
1290
+ false_positive_risks: string[];
1291
+ intent_assessment?: {
1292
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1293
+ confidence: number;
1294
+ evidence: string[];
1295
+ counter_evidence: string[];
1296
+ } | undefined;
1297
+ tooling_assessment?: {
1298
+ help_text_detected: boolean;
1299
+ cli_surface_detected: boolean;
1300
+ framework_hints: string[];
1301
+ toolchain_markers: string[];
1302
+ library_profile?: {
1303
+ evidence: string[];
1304
+ ecosystems: string[];
1305
+ top_crates: string[];
1306
+ notable_libraries: string[];
1307
+ } | undefined;
1308
+ } | undefined;
1309
+ } | undefined;
1310
+ evidence_weights?: {
1311
+ string: number;
1312
+ runtime: number;
1313
+ import: number;
1314
+ } | undefined;
1315
+ selection_diffs?: {
1316
+ runtime?: {
1317
+ summary: string;
1318
+ baseline: {
1319
+ artifact_count: number;
1320
+ scope_note: string;
1321
+ artifact_ids: string[];
1322
+ session_selector: string | null;
1323
+ session_tags: string[];
1324
+ scope: "all" | "latest" | "session";
1325
+ earliest_artifact_at: string | null;
1326
+ latest_artifact_at: string | null;
1327
+ };
1328
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1329
+ current: {
1330
+ artifact_count: number;
1331
+ scope_note: string;
1332
+ artifact_ids: string[];
1333
+ session_selector: string | null;
1334
+ session_tags: string[];
1335
+ scope: "all" | "latest" | "session";
1336
+ earliest_artifact_at: string | null;
1337
+ latest_artifact_at: string | null;
1338
+ };
1339
+ added_artifact_ids: string[];
1340
+ removed_artifact_ids: string[];
1341
+ added_session_tags: string[];
1342
+ removed_session_tags: string[];
1343
+ artifact_count_delta: number;
1344
+ } | undefined;
1345
+ semantic_names?: {
1346
+ summary: string;
1347
+ baseline: {
1348
+ artifact_count: number;
1349
+ scope_note: string;
1350
+ artifact_ids: string[];
1351
+ session_selector: string | null;
1352
+ session_tags: string[];
1353
+ scope: "all" | "latest" | "session";
1354
+ earliest_artifact_at: string | null;
1355
+ latest_artifact_at: string | null;
1356
+ };
1357
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1358
+ current: {
1359
+ artifact_count: number;
1360
+ scope_note: string;
1361
+ artifact_ids: string[];
1362
+ session_selector: string | null;
1363
+ session_tags: string[];
1364
+ scope: "all" | "latest" | "session";
1365
+ earliest_artifact_at: string | null;
1366
+ latest_artifact_at: string | null;
1367
+ };
1368
+ added_artifact_ids: string[];
1369
+ removed_artifact_ids: string[];
1370
+ added_session_tags: string[];
1371
+ removed_session_tags: string[];
1372
+ artifact_count_delta: number;
1373
+ } | undefined;
1374
+ semantic_explanations?: {
1375
+ summary: string;
1376
+ baseline: {
1377
+ artifact_count: number;
1378
+ scope_note: string;
1379
+ artifact_ids: string[];
1380
+ session_selector: string | null;
1381
+ session_tags: string[];
1382
+ scope: "all" | "latest" | "session";
1383
+ earliest_artifact_at: string | null;
1384
+ latest_artifact_at: string | null;
1385
+ };
1386
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1387
+ current: {
1388
+ artifact_count: number;
1389
+ scope_note: string;
1390
+ artifact_ids: string[];
1391
+ session_selector: string | null;
1392
+ session_tags: string[];
1393
+ scope: "all" | "latest" | "session";
1394
+ earliest_artifact_at: string | null;
1395
+ latest_artifact_at: string | null;
1396
+ };
1397
+ added_artifact_ids: string[];
1398
+ removed_artifact_ids: string[];
1399
+ added_session_tags: string[];
1400
+ removed_session_tags: string[];
1401
+ artifact_count_delta: number;
1402
+ } | undefined;
1403
+ } | undefined;
1404
+ evidence_lineage?: {
1405
+ scope_note: string;
1406
+ layers: {
1407
+ summary: string;
1408
+ artifact_count: number;
1409
+ latest_imported_at: string | null;
1410
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
1411
+ source_formats: string[];
1412
+ evidence_kinds: string[];
1413
+ source_names: string[];
1414
+ confidence_band: "baseline" | "suggestive" | "high";
1415
+ }[];
1416
+ latest_runtime_artifact_at: string | null;
1417
+ } | undefined;
1418
+ confidence_semantics?: {
1419
+ assessment: {
1420
+ score: number | null;
1421
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
1422
+ band: "high" | "none" | "low" | "medium";
1423
+ calibrated: boolean;
1424
+ meaning: string;
1425
+ compare_within: string;
1426
+ caution: string;
1427
+ drivers: string[];
1428
+ acceptance_rule?: string | null | undefined;
1429
+ };
1430
+ } | undefined;
1431
+ function_explanations?: {
1432
+ function: string | null;
1433
+ address: string | null;
1434
+ summary: string;
1435
+ source: string | null;
1436
+ confidence: number;
1437
+ behavior: string;
1438
+ rewrite_guidance: string[];
1439
+ }[] | undefined;
1440
+ }, {
1441
+ summary: string;
1442
+ confidence: number;
1443
+ evidence: string[];
1444
+ threat_level: "unknown" | "clean" | "suspicious" | "malicious";
1445
+ iocs: {
1446
+ suspicious_imports: string[];
1447
+ suspicious_strings: string[];
1448
+ yara_matches: string[];
1449
+ yara_low_confidence?: string[] | undefined;
1450
+ urls?: string[] | undefined;
1451
+ ip_addresses?: string[] | undefined;
1452
+ file_paths?: string[] | undefined;
1453
+ registry_keys?: string[] | undefined;
1454
+ high_value_iocs?: {
1455
+ network?: string[] | undefined;
1456
+ urls?: string[] | undefined;
1457
+ suspicious_apis?: string[] | undefined;
1458
+ commands?: string[] | undefined;
1459
+ pipes?: string[] | undefined;
1460
+ } | undefined;
1461
+ compiler_artifacts?: {
1462
+ cargo_paths?: string[] | undefined;
1463
+ rust_markers?: string[] | undefined;
1464
+ library_profile?: {
1465
+ evidence: string[];
1466
+ ecosystems: string[];
1467
+ top_crates: string[];
1468
+ notable_libraries: string[];
1469
+ } | undefined;
1470
+ } | undefined;
1471
+ };
1472
+ recommendation: string;
1473
+ provenance?: {
1474
+ runtime: {
1475
+ artifact_count: number;
1476
+ scope_note: string;
1477
+ artifact_ids: string[];
1478
+ session_selector: string | null;
1479
+ session_tags: string[];
1480
+ scope: "all" | "latest" | "session";
1481
+ earliest_artifact_at: string | null;
1482
+ latest_artifact_at: string | null;
1483
+ };
1484
+ semantic_names?: {
1485
+ artifact_count: number;
1486
+ scope_note: string;
1487
+ artifact_ids: string[];
1488
+ session_selector: string | null;
1489
+ session_tags: string[];
1490
+ scope: "all" | "latest" | "session";
1491
+ earliest_artifact_at: string | null;
1492
+ latest_artifact_at: string | null;
1493
+ } | undefined;
1494
+ semantic_explanations?: {
1495
+ artifact_count: number;
1496
+ scope_note: string;
1497
+ artifact_ids: string[];
1498
+ session_selector: string | null;
1499
+ session_tags: string[];
1500
+ scope: "all" | "latest" | "session";
1501
+ earliest_artifact_at: string | null;
1502
+ latest_artifact_at: string | null;
1503
+ } | undefined;
1504
+ } | undefined;
1505
+ inference?: {
1506
+ classification: "unknown" | "suspicious" | "malicious" | "benign";
1507
+ hypotheses: string[];
1508
+ false_positive_risks: string[];
1509
+ intent_assessment?: {
1510
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1511
+ confidence: number;
1512
+ evidence: string[];
1513
+ counter_evidence: string[];
1514
+ } | undefined;
1515
+ tooling_assessment?: {
1516
+ help_text_detected: boolean;
1517
+ cli_surface_detected: boolean;
1518
+ framework_hints: string[];
1519
+ toolchain_markers: string[];
1520
+ library_profile?: {
1521
+ evidence: string[];
1522
+ ecosystems: string[];
1523
+ top_crates: string[];
1524
+ notable_libraries: string[];
1525
+ } | undefined;
1526
+ } | undefined;
1527
+ } | undefined;
1528
+ evidence_weights?: {
1529
+ string: number;
1530
+ runtime: number;
1531
+ import: number;
1532
+ } | undefined;
1533
+ selection_diffs?: {
1534
+ runtime?: {
1535
+ summary: string;
1536
+ baseline: {
1537
+ artifact_count: number;
1538
+ scope_note: string;
1539
+ artifact_ids: string[];
1540
+ session_selector: string | null;
1541
+ session_tags: string[];
1542
+ scope: "all" | "latest" | "session";
1543
+ earliest_artifact_at: string | null;
1544
+ latest_artifact_at: string | null;
1545
+ };
1546
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1547
+ current: {
1548
+ artifact_count: number;
1549
+ scope_note: string;
1550
+ artifact_ids: string[];
1551
+ session_selector: string | null;
1552
+ session_tags: string[];
1553
+ scope: "all" | "latest" | "session";
1554
+ earliest_artifact_at: string | null;
1555
+ latest_artifact_at: string | null;
1556
+ };
1557
+ added_artifact_ids: string[];
1558
+ removed_artifact_ids: string[];
1559
+ added_session_tags: string[];
1560
+ removed_session_tags: string[];
1561
+ artifact_count_delta: number;
1562
+ } | undefined;
1563
+ semantic_names?: {
1564
+ summary: string;
1565
+ baseline: {
1566
+ artifact_count: number;
1567
+ scope_note: string;
1568
+ artifact_ids: string[];
1569
+ session_selector: string | null;
1570
+ session_tags: string[];
1571
+ scope: "all" | "latest" | "session";
1572
+ earliest_artifact_at: string | null;
1573
+ latest_artifact_at: string | null;
1574
+ };
1575
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1576
+ current: {
1577
+ artifact_count: number;
1578
+ scope_note: string;
1579
+ artifact_ids: string[];
1580
+ session_selector: string | null;
1581
+ session_tags: string[];
1582
+ scope: "all" | "latest" | "session";
1583
+ earliest_artifact_at: string | null;
1584
+ latest_artifact_at: string | null;
1585
+ };
1586
+ added_artifact_ids: string[];
1587
+ removed_artifact_ids: string[];
1588
+ added_session_tags: string[];
1589
+ removed_session_tags: string[];
1590
+ artifact_count_delta: number;
1591
+ } | undefined;
1592
+ semantic_explanations?: {
1593
+ summary: string;
1594
+ baseline: {
1595
+ artifact_count: number;
1596
+ scope_note: string;
1597
+ artifact_ids: string[];
1598
+ session_selector: string | null;
1599
+ session_tags: string[];
1600
+ scope: "all" | "latest" | "session";
1601
+ earliest_artifact_at: string | null;
1602
+ latest_artifact_at: string | null;
1603
+ };
1604
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1605
+ current: {
1606
+ artifact_count: number;
1607
+ scope_note: string;
1608
+ artifact_ids: string[];
1609
+ session_selector: string | null;
1610
+ session_tags: string[];
1611
+ scope: "all" | "latest" | "session";
1612
+ earliest_artifact_at: string | null;
1613
+ latest_artifact_at: string | null;
1614
+ };
1615
+ added_artifact_ids: string[];
1616
+ removed_artifact_ids: string[];
1617
+ added_session_tags: string[];
1618
+ removed_session_tags: string[];
1619
+ artifact_count_delta: number;
1620
+ } | undefined;
1621
+ } | undefined;
1622
+ evidence_lineage?: {
1623
+ scope_note: string;
1624
+ layers: {
1625
+ summary: string;
1626
+ artifact_count: number;
1627
+ latest_imported_at: string | null;
1628
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
1629
+ source_formats: string[];
1630
+ evidence_kinds: string[];
1631
+ source_names: string[];
1632
+ confidence_band: "baseline" | "suggestive" | "high";
1633
+ }[];
1634
+ latest_runtime_artifact_at: string | null;
1635
+ } | undefined;
1636
+ confidence_semantics?: {
1637
+ assessment: {
1638
+ score: number | null;
1639
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
1640
+ band: "high" | "none" | "low" | "medium";
1641
+ calibrated: boolean;
1642
+ meaning: string;
1643
+ compare_within: string;
1644
+ caution: string;
1645
+ drivers: string[];
1646
+ acceptance_rule?: string | null | undefined;
1647
+ };
1648
+ } | undefined;
1649
+ function_explanations?: {
1650
+ function: string | null;
1651
+ address: string | null;
1652
+ summary: string;
1653
+ source: string | null;
1654
+ confidence: number;
1655
+ behavior: string;
1656
+ rewrite_guidance: string[];
1657
+ }[] | undefined;
1658
+ }>>;
1659
+ warnings: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
1660
+ errors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
1661
+ metrics: z.ZodOptional<z.ZodObject<{
1662
+ elapsed_ms: z.ZodNumber;
1663
+ tool: z.ZodString;
1664
+ }, "strip", z.ZodTypeAny, {
1665
+ elapsed_ms: number;
1666
+ tool: string;
1667
+ }, {
1668
+ elapsed_ms: number;
1669
+ tool: string;
1670
+ }>>;
1671
+ }, "strip", z.ZodTypeAny, {
1672
+ ok: boolean;
1673
+ metrics?: {
1674
+ elapsed_ms: number;
1675
+ tool: string;
1676
+ } | undefined;
1677
+ data?: {
1678
+ summary: string;
1679
+ confidence: number;
1680
+ evidence: string[];
1681
+ threat_level: "unknown" | "clean" | "suspicious" | "malicious";
1682
+ iocs: {
1683
+ suspicious_imports: string[];
1684
+ suspicious_strings: string[];
1685
+ yara_matches: string[];
1686
+ yara_low_confidence?: string[] | undefined;
1687
+ urls?: string[] | undefined;
1688
+ ip_addresses?: string[] | undefined;
1689
+ file_paths?: string[] | undefined;
1690
+ registry_keys?: string[] | undefined;
1691
+ high_value_iocs?: {
1692
+ network?: string[] | undefined;
1693
+ urls?: string[] | undefined;
1694
+ suspicious_apis?: string[] | undefined;
1695
+ commands?: string[] | undefined;
1696
+ pipes?: string[] | undefined;
1697
+ } | undefined;
1698
+ compiler_artifacts?: {
1699
+ cargo_paths?: string[] | undefined;
1700
+ rust_markers?: string[] | undefined;
1701
+ library_profile?: {
1702
+ evidence: string[];
1703
+ ecosystems: string[];
1704
+ top_crates: string[];
1705
+ notable_libraries: string[];
1706
+ } | undefined;
1707
+ } | undefined;
1708
+ };
1709
+ recommendation: string;
1710
+ provenance?: {
1711
+ runtime: {
1712
+ artifact_count: number;
1713
+ scope_note: string;
1714
+ artifact_ids: string[];
1715
+ session_selector: string | null;
1716
+ session_tags: string[];
1717
+ scope: "all" | "latest" | "session";
1718
+ earliest_artifact_at: string | null;
1719
+ latest_artifact_at: string | null;
1720
+ };
1721
+ semantic_names?: {
1722
+ artifact_count: number;
1723
+ scope_note: string;
1724
+ artifact_ids: string[];
1725
+ session_selector: string | null;
1726
+ session_tags: string[];
1727
+ scope: "all" | "latest" | "session";
1728
+ earliest_artifact_at: string | null;
1729
+ latest_artifact_at: string | null;
1730
+ } | undefined;
1731
+ semantic_explanations?: {
1732
+ artifact_count: number;
1733
+ scope_note: string;
1734
+ artifact_ids: string[];
1735
+ session_selector: string | null;
1736
+ session_tags: string[];
1737
+ scope: "all" | "latest" | "session";
1738
+ earliest_artifact_at: string | null;
1739
+ latest_artifact_at: string | null;
1740
+ } | undefined;
1741
+ } | undefined;
1742
+ inference?: {
1743
+ classification: "unknown" | "suspicious" | "malicious" | "benign";
1744
+ hypotheses: string[];
1745
+ false_positive_risks: string[];
1746
+ intent_assessment?: {
1747
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1748
+ confidence: number;
1749
+ evidence: string[];
1750
+ counter_evidence: string[];
1751
+ } | undefined;
1752
+ tooling_assessment?: {
1753
+ help_text_detected: boolean;
1754
+ cli_surface_detected: boolean;
1755
+ framework_hints: string[];
1756
+ toolchain_markers: string[];
1757
+ library_profile?: {
1758
+ evidence: string[];
1759
+ ecosystems: string[];
1760
+ top_crates: string[];
1761
+ notable_libraries: string[];
1762
+ } | undefined;
1763
+ } | undefined;
1764
+ } | undefined;
1765
+ evidence_weights?: {
1766
+ string: number;
1767
+ runtime: number;
1768
+ import: number;
1769
+ } | undefined;
1770
+ selection_diffs?: {
1771
+ runtime?: {
1772
+ summary: string;
1773
+ baseline: {
1774
+ artifact_count: number;
1775
+ scope_note: string;
1776
+ artifact_ids: string[];
1777
+ session_selector: string | null;
1778
+ session_tags: string[];
1779
+ scope: "all" | "latest" | "session";
1780
+ earliest_artifact_at: string | null;
1781
+ latest_artifact_at: string | null;
1782
+ };
1783
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1784
+ current: {
1785
+ artifact_count: number;
1786
+ scope_note: string;
1787
+ artifact_ids: string[];
1788
+ session_selector: string | null;
1789
+ session_tags: string[];
1790
+ scope: "all" | "latest" | "session";
1791
+ earliest_artifact_at: string | null;
1792
+ latest_artifact_at: string | null;
1793
+ };
1794
+ added_artifact_ids: string[];
1795
+ removed_artifact_ids: string[];
1796
+ added_session_tags: string[];
1797
+ removed_session_tags: string[];
1798
+ artifact_count_delta: number;
1799
+ } | undefined;
1800
+ semantic_names?: {
1801
+ summary: string;
1802
+ baseline: {
1803
+ artifact_count: number;
1804
+ scope_note: string;
1805
+ artifact_ids: string[];
1806
+ session_selector: string | null;
1807
+ session_tags: string[];
1808
+ scope: "all" | "latest" | "session";
1809
+ earliest_artifact_at: string | null;
1810
+ latest_artifact_at: string | null;
1811
+ };
1812
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1813
+ current: {
1814
+ artifact_count: number;
1815
+ scope_note: string;
1816
+ artifact_ids: string[];
1817
+ session_selector: string | null;
1818
+ session_tags: string[];
1819
+ scope: "all" | "latest" | "session";
1820
+ earliest_artifact_at: string | null;
1821
+ latest_artifact_at: string | null;
1822
+ };
1823
+ added_artifact_ids: string[];
1824
+ removed_artifact_ids: string[];
1825
+ added_session_tags: string[];
1826
+ removed_session_tags: string[];
1827
+ artifact_count_delta: number;
1828
+ } | undefined;
1829
+ semantic_explanations?: {
1830
+ summary: string;
1831
+ baseline: {
1832
+ artifact_count: number;
1833
+ scope_note: string;
1834
+ artifact_ids: string[];
1835
+ session_selector: string | null;
1836
+ session_tags: string[];
1837
+ scope: "all" | "latest" | "session";
1838
+ earliest_artifact_at: string | null;
1839
+ latest_artifact_at: string | null;
1840
+ };
1841
+ label: "runtime" | "semantic_names" | "semantic_explanations";
1842
+ current: {
1843
+ artifact_count: number;
1844
+ scope_note: string;
1845
+ artifact_ids: string[];
1846
+ session_selector: string | null;
1847
+ session_tags: string[];
1848
+ scope: "all" | "latest" | "session";
1849
+ earliest_artifact_at: string | null;
1850
+ latest_artifact_at: string | null;
1851
+ };
1852
+ added_artifact_ids: string[];
1853
+ removed_artifact_ids: string[];
1854
+ added_session_tags: string[];
1855
+ removed_session_tags: string[];
1856
+ artifact_count_delta: number;
1857
+ } | undefined;
1858
+ } | undefined;
1859
+ evidence_lineage?: {
1860
+ scope_note: string;
1861
+ layers: {
1862
+ summary: string;
1863
+ artifact_count: number;
1864
+ latest_imported_at: string | null;
1865
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
1866
+ source_formats: string[];
1867
+ evidence_kinds: string[];
1868
+ source_names: string[];
1869
+ confidence_band: "baseline" | "suggestive" | "high";
1870
+ }[];
1871
+ latest_runtime_artifact_at: string | null;
1872
+ } | undefined;
1873
+ confidence_semantics?: {
1874
+ assessment: {
1875
+ score: number | null;
1876
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
1877
+ band: "high" | "none" | "low" | "medium";
1878
+ calibrated: boolean;
1879
+ meaning: string;
1880
+ compare_within: string;
1881
+ caution: string;
1882
+ drivers: string[];
1883
+ acceptance_rule?: string | null | undefined;
1884
+ };
1885
+ } | undefined;
1886
+ function_explanations?: {
1887
+ function: string | null;
1888
+ address: string | null;
1889
+ summary: string;
1890
+ source: string | null;
1891
+ confidence: number;
1892
+ behavior: string;
1893
+ rewrite_guidance: string[];
1894
+ }[] | undefined;
1895
+ } | undefined;
1896
+ warnings?: string[] | undefined;
1897
+ errors?: string[] | undefined;
1898
+ }, {
1899
+ ok: boolean;
1900
+ metrics?: {
1901
+ elapsed_ms: number;
1902
+ tool: string;
1903
+ } | undefined;
1904
+ data?: {
1905
+ summary: string;
1906
+ confidence: number;
1907
+ evidence: string[];
1908
+ threat_level: "unknown" | "clean" | "suspicious" | "malicious";
1909
+ iocs: {
1910
+ suspicious_imports: string[];
1911
+ suspicious_strings: string[];
1912
+ yara_matches: string[];
1913
+ yara_low_confidence?: string[] | undefined;
1914
+ urls?: string[] | undefined;
1915
+ ip_addresses?: string[] | undefined;
1916
+ file_paths?: string[] | undefined;
1917
+ registry_keys?: string[] | undefined;
1918
+ high_value_iocs?: {
1919
+ network?: string[] | undefined;
1920
+ urls?: string[] | undefined;
1921
+ suspicious_apis?: string[] | undefined;
1922
+ commands?: string[] | undefined;
1923
+ pipes?: string[] | undefined;
1924
+ } | undefined;
1925
+ compiler_artifacts?: {
1926
+ cargo_paths?: string[] | undefined;
1927
+ rust_markers?: string[] | undefined;
1928
+ library_profile?: {
1929
+ evidence: string[];
1930
+ ecosystems: string[];
1931
+ top_crates: string[];
1932
+ notable_libraries: string[];
1933
+ } | undefined;
1934
+ } | undefined;
1935
+ };
1936
+ recommendation: string;
1937
+ provenance?: {
1938
+ runtime: {
1939
+ artifact_count: number;
1940
+ scope_note: string;
1941
+ artifact_ids: string[];
1942
+ session_selector: string | null;
1943
+ session_tags: string[];
1944
+ scope: "all" | "latest" | "session";
1945
+ earliest_artifact_at: string | null;
1946
+ latest_artifact_at: string | null;
1947
+ };
1948
+ semantic_names?: {
1949
+ artifact_count: number;
1950
+ scope_note: string;
1951
+ artifact_ids: string[];
1952
+ session_selector: string | null;
1953
+ session_tags: string[];
1954
+ scope: "all" | "latest" | "session";
1955
+ earliest_artifact_at: string | null;
1956
+ latest_artifact_at: string | null;
1957
+ } | undefined;
1958
+ semantic_explanations?: {
1959
+ artifact_count: number;
1960
+ scope_note: string;
1961
+ artifact_ids: string[];
1962
+ session_selector: string | null;
1963
+ session_tags: string[];
1964
+ scope: "all" | "latest" | "session";
1965
+ earliest_artifact_at: string | null;
1966
+ latest_artifact_at: string | null;
1967
+ } | undefined;
1968
+ } | undefined;
1969
+ inference?: {
1970
+ classification: "unknown" | "suspicious" | "malicious" | "benign";
1971
+ hypotheses: string[];
1972
+ false_positive_risks: string[];
1973
+ intent_assessment?: {
1974
+ label: "unknown" | "dual_use_tool" | "operator_utility" | "malware_like_payload";
1975
+ confidence: number;
1976
+ evidence: string[];
1977
+ counter_evidence: string[];
1978
+ } | undefined;
1979
+ tooling_assessment?: {
1980
+ help_text_detected: boolean;
1981
+ cli_surface_detected: boolean;
1982
+ framework_hints: string[];
1983
+ toolchain_markers: string[];
1984
+ library_profile?: {
1985
+ evidence: string[];
1986
+ ecosystems: string[];
1987
+ top_crates: string[];
1988
+ notable_libraries: string[];
1989
+ } | undefined;
1990
+ } | undefined;
1991
+ } | undefined;
1992
+ evidence_weights?: {
1993
+ string: number;
1994
+ runtime: number;
1995
+ import: number;
1996
+ } | undefined;
1997
+ selection_diffs?: {
1998
+ runtime?: {
1999
+ summary: string;
2000
+ baseline: {
2001
+ artifact_count: number;
2002
+ scope_note: string;
2003
+ artifact_ids: string[];
2004
+ session_selector: string | null;
2005
+ session_tags: string[];
2006
+ scope: "all" | "latest" | "session";
2007
+ earliest_artifact_at: string | null;
2008
+ latest_artifact_at: string | null;
2009
+ };
2010
+ label: "runtime" | "semantic_names" | "semantic_explanations";
2011
+ current: {
2012
+ artifact_count: number;
2013
+ scope_note: string;
2014
+ artifact_ids: string[];
2015
+ session_selector: string | null;
2016
+ session_tags: string[];
2017
+ scope: "all" | "latest" | "session";
2018
+ earliest_artifact_at: string | null;
2019
+ latest_artifact_at: string | null;
2020
+ };
2021
+ added_artifact_ids: string[];
2022
+ removed_artifact_ids: string[];
2023
+ added_session_tags: string[];
2024
+ removed_session_tags: string[];
2025
+ artifact_count_delta: number;
2026
+ } | undefined;
2027
+ semantic_names?: {
2028
+ summary: string;
2029
+ baseline: {
2030
+ artifact_count: number;
2031
+ scope_note: string;
2032
+ artifact_ids: string[];
2033
+ session_selector: string | null;
2034
+ session_tags: string[];
2035
+ scope: "all" | "latest" | "session";
2036
+ earliest_artifact_at: string | null;
2037
+ latest_artifact_at: string | null;
2038
+ };
2039
+ label: "runtime" | "semantic_names" | "semantic_explanations";
2040
+ current: {
2041
+ artifact_count: number;
2042
+ scope_note: string;
2043
+ artifact_ids: string[];
2044
+ session_selector: string | null;
2045
+ session_tags: string[];
2046
+ scope: "all" | "latest" | "session";
2047
+ earliest_artifact_at: string | null;
2048
+ latest_artifact_at: string | null;
2049
+ };
2050
+ added_artifact_ids: string[];
2051
+ removed_artifact_ids: string[];
2052
+ added_session_tags: string[];
2053
+ removed_session_tags: string[];
2054
+ artifact_count_delta: number;
2055
+ } | undefined;
2056
+ semantic_explanations?: {
2057
+ summary: string;
2058
+ baseline: {
2059
+ artifact_count: number;
2060
+ scope_note: string;
2061
+ artifact_ids: string[];
2062
+ session_selector: string | null;
2063
+ session_tags: string[];
2064
+ scope: "all" | "latest" | "session";
2065
+ earliest_artifact_at: string | null;
2066
+ latest_artifact_at: string | null;
2067
+ };
2068
+ label: "runtime" | "semantic_names" | "semantic_explanations";
2069
+ current: {
2070
+ artifact_count: number;
2071
+ scope_note: string;
2072
+ artifact_ids: string[];
2073
+ session_selector: string | null;
2074
+ session_tags: string[];
2075
+ scope: "all" | "latest" | "session";
2076
+ earliest_artifact_at: string | null;
2077
+ latest_artifact_at: string | null;
2078
+ };
2079
+ added_artifact_ids: string[];
2080
+ removed_artifact_ids: string[];
2081
+ added_session_tags: string[];
2082
+ removed_session_tags: string[];
2083
+ artifact_count_delta: number;
2084
+ } | undefined;
2085
+ } | undefined;
2086
+ evidence_lineage?: {
2087
+ scope_note: string;
2088
+ layers: {
2089
+ summary: string;
2090
+ artifact_count: number;
2091
+ latest_imported_at: string | null;
2092
+ layer: "safe_simulation" | "memory_or_hybrid" | "executed_trace" | "static_only";
2093
+ source_formats: string[];
2094
+ evidence_kinds: string[];
2095
+ source_names: string[];
2096
+ confidence_band: "baseline" | "suggestive" | "high";
2097
+ }[];
2098
+ latest_runtime_artifact_at: string | null;
2099
+ } | undefined;
2100
+ confidence_semantics?: {
2101
+ assessment: {
2102
+ score: number | null;
2103
+ score_kind: "heuristic_reconstruction" | "runtime_correlation" | "naming_resolution" | "report_assessment";
2104
+ band: "high" | "none" | "low" | "medium";
2105
+ calibrated: boolean;
2106
+ meaning: string;
2107
+ compare_within: string;
2108
+ caution: string;
2109
+ drivers: string[];
2110
+ acceptance_rule?: string | null | undefined;
2111
+ };
2112
+ } | undefined;
2113
+ function_explanations?: {
2114
+ function: string | null;
2115
+ address: string | null;
2116
+ summary: string;
2117
+ source: string | null;
2118
+ confidence: number;
2119
+ behavior: string;
2120
+ rewrite_guidance: string[];
2121
+ }[] | undefined;
2122
+ } | undefined;
2123
+ warnings?: string[] | undefined;
2124
+ errors?: string[] | undefined;
2125
+ }>;
2126
+ export type ReportSummarizeOutput = z.infer<typeof ReportSummarizeOutputSchema>;
2127
+ export declare const reportSummarizeToolDefinition: ToolDefinition;
2128
+ export declare function createReportSummarizeHandler(workspaceManager: WorkspaceManager, database: DatabaseManager, cacheManager: CacheManager, deps?: {
2129
+ triageHandler?: (args: ToolArgs) => Promise<WorkerResult>;
2130
+ }): (args: ToolArgs) => Promise<WorkerResult>;
2131
+ //# sourceMappingURL=report-summarize.d.ts.map