wowdump 0.2.1 → 0.3.2

package/dist/focus-service.js

@@ -1,1855 +0,0 @@
-import { randomUUID, createHash } from "node:crypto";
-import { mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { FocusedSession, TargetKindSchema, TriggerPlanSchema, validateSelector } from "./focused-session.js";
-import { brokerManagedCommand } from "./frida-runtime.js";
-import { FocusRequestError, asSelectorRequestError, isAttachmentFatalError } from "./focus-errors.js";
-import { BuildBundleStore } from "./build-bundle-loader.js";
-const DEFAULT_MODULE = "Wow.exe";
-const DEFAULT_IMAGE_BASE = "0x140000000";
-const MAX_EVENTS = 100_000;
-const MAX_BYTES = 64 * 1024 * 1024;
-export class FocusAnalysisService {
-    sessions = new Map();
-    executor;
-    runtimeRoot;
-    profileRoot;
-    packagedProfiles;
-    buildBundles;
-    moduleName;
-    imageBase;
-    selectorResolver;
-    targetResolver;
-    hookTargetVerifier;
-    deferAttachmentDetach;
-    lifecycle;
-    lifecycleTimeoutMs;
-    beforeFreezeArtifacts;
-    beforeManifestPublish;
-    beforeArtifactFragmentWrite;
-    onFatal;
-    onDurationExpired;
-    foundationCache = new Map();
-    constructor(options) {
-        if (!options?.executor || typeof options.executor.execute !== "function")
-            throw new TypeError("executor is required");
-        this.executor = options.executor;
-        const compatibilityRoot = options.artifactDir;
-        this.runtimeRoot = resolve(requiredString(options.runtimeRoot ?? compatibilityRoot, "runtimeRoot"));
-        this.profileRoot = resolve(requiredString(options.profileRoot ?? compatibilityRoot, "profileRoot"));
-        this.packagedProfiles = options.profileRoot !== undefined;
-        this.buildBundles = this.packagedProfiles ? new BuildBundleStore(this.profileRoot) : undefined;
-        this.moduleName = options.moduleName ?? DEFAULT_MODULE;
-        this.imageBase = options.imageBase ?? DEFAULT_IMAGE_BASE;
-        this.selectorResolver = options.selectorResolver;
-        this.targetResolver = options.targetResolver ?? (input => this.resolveVerifiedTargetsFromProfile(input));
-        this.hookTargetVerifier = options.hookTargetVerifier;
-        this.deferAttachmentDetach = options.deferAttachmentDetach === true;
-        this.lifecycle = options.lifecycle;
-        this.lifecycleTimeoutMs = bounded(options.lifecycleTimeoutMs, 2_000, 0, 60_000);
-        this.beforeFreezeArtifacts = options.beforeFreezeArtifacts;
-        this.beforeManifestPublish = options.beforeManifestPublish;
-        this.beforeArtifactFragmentWrite = options.beforeArtifactFragmentWrite;
-        this.onFatal = options.onFatal;
-        this.onDurationExpired = options.onDurationExpired;
-    }
-    setFatalHandler(handler) { this.onFatal = handler; }
-    setDurationExpiredHandler(handler) { this.onDurationExpired = handler; }
-    async handleFatal(event) {
-        const record = this.sessions.get(event.sessionId);
-        if (!record || record.session.status === "stopping" || record.session.status === "stopped")
-            return;
-        if (event.failureClass === "capture_fatal") {
-            await this.cleanupSession(event.sessionId, "capture_fatal").catch(() => undefined);
-        }
-    }
-    statusSnapshot() {
-        return [...this.sessions.values()].map(record => {
-            const manifest = record.session.manifest;
-            const cleanup = manifest.cleanupStatus;
-            return {
-                sessionId: record.sessionId,
-                kind: record.kind,
-                pid: record.pid,
-                buildKey: record.buildKey,
-                selector: manifest.selector,
-                state: record.session.status,
-                active: record.session.status === "running" || record.session.status === "paused",
-                eventCount: manifest.eventCount,
-                eventBytes: manifest.eventBytes,
-                droppedEventCount: manifest.droppedEventCount,
-                droppedByteCount: manifest.droppedByteCount,
-                droppedByReason: manifest.droppedByReason,
-                hookIds: manifest.hookIds,
-                scriptIds: record.scriptId ? [record.scriptId] : [],
-                interceptorIds: manifest.hookIds,
-                cleanupState: record.cleanupAttempted ? cleanup : { hooks: manifest.hookIds.length, scripts: record.scriptId ? 1 : 0, interceptors: manifest.hookIds.length },
-            };
-        });
-    }
-    async invoke(operation, input = {}) {
-        switch (operation) {
-            case "wow_focus_start": return this.start("lua_focus", input);
-            case "wow_watch_start": return this.start("watch", input);
-            case "wow_focus_read": return this.read(input);
-            case "wow_watch_read": return this.read(input);
-            case "wow_focus_status": return this.status(input);
-            case "wow_watch_status": return this.status(input);
-            case "wow_focus_pause": return this.pause(input);
-            case "wow_focus_resume": return this.resume(input);
-            case "wow_focus_stop": return this.stop(input);
-            case "wow_watch_stop": return this.stop(input);
-            case "wow_session_checkpoint": return this.checkpoint(input);
-            default: throw new Error(`unsupported focus operation ${operation}`);
-        }
-    }
-    async close() {
-        for (const record of [...this.sessions.values()])
-            await this.cleanupSession(record.sessionId, "service_close").catch(() => undefined);
-    }
-    async cleanupSession(sessionId, reason, cleanupDeadline) {
-        const record = this.sessions.get(requiredSessionId(sessionId));
-        if (!record)
-            return { sessionId, stopped: true, alreadyReleased: true };
-        if (record.durationTimer)
-            clearTimeout(record.durationTimer);
-        record.durationTimer = undefined;
-        let retryReceipt;
-        if (record.artifactPublicationRetry && reason !== "service_close") {
-            retryReceipt = await record.artifactPublicationRetry?.();
-        }
-        else {
-            record.cleanupAttempted = true;
-            if (reason === "target_exit" || reason === "attachment_fatal")
-                await record.session.targetExited(cleanupDeadline);
-            else
-                await record.session.stop(cleanupDeadline);
-        }
-        const result = { ...record.session.manifest, ...(retryReceipt ? { terminalStatus: retryReceipt.terminalStatus, frozen: retryReceipt.terminalStatus === "frozen", state: "stopped" } : {}), terminal: true, sessionId: record.sessionId, stopped: true, artifactDirectory: join(this.runtimeRoot, "focused-sessions", record.sessionId), lifecycleFailures: record.lifecycleFailures };
-        this.dispatchLifecycle({ action: "focus_session_cleanup", operation: record.kind === "watch" ? "wow_watch_stop" : "wow_focus_stop", sessionId: record.sessionId, pid: record.pid, buildKey: record.buildKey, status: record.session.status === "failed" ? "partial" : "passed", reason, result: { cleanupStatus: record.session.manifest.cleanupStatus } }, record);
-        return result;
-    }
-    async start(kind, input) {
-        const pid = positiveInt(input.pid, "pid");
-        const buildKey = requiredString(input.buildKey, "buildKey");
-        const sessionId = requiredSessionId(input.sessionId ?? randomUUID());
-        if (this.sessions.has(sessionId))
-            throw new Error(`session ${sessionId} already exists`);
-        const targetKind = TargetKindSchema.parse(input.targetKind ?? (kind === "watch" ? "data_source" : "lua_wrapper"));
-        if (kind === "watch" && !["data_source", "object", "address_range"].includes(targetKind))
-            throw new FocusRequestError("SELECTOR_INVALID", "watch targetKind is incompatible");
-        if (!this.selectorResolver && !isRecord(input.selector))
-            throw new FocusRequestError("SELECTOR_EMPTY", "selector is required");
-        const { selector, selectorVerbatim } = await this.resolveSelector(input, targetKind);
-        const effectiveMaxBytes = bounded(input.maxBytes, 8 * 1024 * 1024, 1, MAX_BYTES);
-        const verifiedResolution = targetKind === "data_source" || targetKind === "object"
-            ? validateVerifiedResolution(await this.targetResolver({
-                buildKey,
-                targetKind,
-                ids: targetKind === "data_source" ? selector.dataSourceIds ?? [] : selector.objectIds ?? [],
-                maxBytes: effectiveMaxBytes
-            }), effectiveMaxBytes)
-            : undefined;
-        if (verifiedResolution && (verifiedResolution.targets.length === 0 || verifiedResolution.ranges.length === 0))
-            throw new Error("VERIFIED_RANGE_REQUIRED: target has no machine-validated bounded range");
-        const verifiedBytes = verifiedResolution?.ranges.reduce((sum, range) => sum + range.size, 0) ?? 0;
-        if (verifiedBytes > effectiveMaxBytes)
-            throw new Error(`RANGE_LIMIT_EXCEEDED: ${verifiedBytes} bytes exceed maxBytes=${effectiveMaxBytes}`);
-        if (targetKind === "address_range") {
-            const totalRangeBytes = (selector.ranges ?? []).reduce((sum, range) => sum + range.size, 0);
-            if (totalRangeBytes > effectiveMaxBytes)
-                throw new Error(`RANGE_LIMIT_EXCEEDED: ${totalRangeBytes} bytes exceed maxBytes=${effectiveMaxBytes}`);
-        }
-        const environment = requiredRecord(input.environmentDescriptor ?? input.environment, "environmentDescriptor");
-        if (typeof environment.descriptorVersion !== "string" || typeof environment.capturedAt !== "string")
-            throw new Error("ENVIRONMENT_INVALID: descriptorVersion and capturedAt are required");
-        const rawTriggerPlan = requiredRecord(input.triggerPlan, "triggerPlan");
-        const triggerPlan = { ...rawTriggerPlan };
-        if (typeof triggerPlan.planVersion !== "string")
-            triggerPlan.planVersion = "trigger-plan.v1";
-        if (typeof triggerPlan.workloadId !== "string" || (!Array.isArray(triggerPlan.phases) && !Array.isArray(triggerPlan.before) && !Array.isArray(triggerPlan.during) && !Array.isArray(triggerPlan.after)))
-            throw new Error("TRIGGER_PLAN_INVALID: workloadId and ordered phases/actions are required");
-        const normalizedTriggerPlan = TriggerPlanSchema.parse(triggerPlan);
-        validateTriggerPlanOrder(normalizedTriggerPlan);
-        const limits = {
-            snapshotIntervalMs: bounded(input.snapshotIntervalMs, 1000, 0, 60_000),
-            maxEvents: bounded(input.maxEvents, 10_000, 1, MAX_EVENTS),
-            maxBytes: bounded(input.maxBytes, 8 * 1024 * 1024, 1, MAX_BYTES),
-            durationMs: bounded(input.durationMs, 0, 0, 86_400_000),
-            sampling: boundedNumber(input.sampling, 1, Number.EPSILON, 1)
-        };
-        const directory = join(this.runtimeRoot, "focused-sessions", sessionId);
-        if (resolve(directory) !== directory || !directory.startsWith(join(this.runtimeRoot, "focused-sessions") + "\\"))
-            throw new Error("ARTIFACT_PATH_INVALID");
-        const identity = await this.discoverIdentity(pid, buildKey);
-        let verifiedHookTargets;
-        try {
-            verifiedHookTargets = targetKind === "lua_wrapper" || targetKind === "cpp_function"
-                ? await this.verifyHookTargets({
-                    buildKey,
-                    targetKind,
-                    rvas: selector.rvas ?? [],
-                    moduleBase: identity.moduleBase,
-                    moduleSize: identity.moduleSize,
-                    fridaSessionId: identity.fridaSessionId,
-                    pid,
-                })
-                : undefined;
-        }
-        catch (error) {
-            await this.bestEffortDiscoveryDetach(undefined, identity.fridaSessionId, pid, buildKey, error);
-            throw error;
-        }
-        await mkdir(directory, { recursive: true });
-        const streamFiles = {
-            lua: join(directory, `lua-focus-${sessionId}.jsonl`),
-            cpp: join(directory, `cpp-focus-${sessionId}.jsonl`),
-            data: join(directory, `data-watch-${sessionId}.jsonl`),
-            manifest: join(directory, `session-manifest-${sessionId}.json`)
-        };
-        await Promise.all([streamFiles.lua, streamFiles.cpp, streamFiles.data].map(file => writeFile(file, "", { flag: "wx" })));
-        const events = [];
-        const context = { pid, buildKey };
-        let scriptId;
-        let fridaSessionId = identity.fridaSessionId;
-        const transport = {
-            revalidateIdentity: async (expected) => this.revalidate(expected, fridaSessionId),
-            installHooks: async (target, capture) => {
-                const scriptTarget = { ...target };
-                delete scriptTarget.rva;
-                stored.fridaSessionId = fridaSessionId;
-                const loaded = await this.executor.execute(brokerManagedCommand({ operation: "script_load", sessionId: fridaSessionId, source: FOCUS_SCRIPT }, "focus.script_load"), context);
-                scriptId = requiredString(loaded.scriptId, "script_load.scriptId");
-                stored.scriptId = scriptId;
-                const started = await this.executor.execute(brokerManagedCommand({ operation: "script_call", sessionId: fridaSessionId, scriptId, exportName: "focusStart", args: [{ ...scriptTarget, ...capture, ...(selector.rvas?.length ? { rvas: selector.rvas } : {}), ...(verifiedResolution ? { ranges: verifiedResolution.ranges, verifiedTargets: verifiedResolution.targets } : {}), ...(verifiedHookTargets ? { verifiedHookTargets } : {}), moduleBase: identity.moduleBase }] }, "focus.start"), context);
-                const hooks = arrayOfStrings(started.value && started.value.hookIds);
-                return hooks.length ? hooks : ["focus-script:" + scriptId];
-            },
-            snapshot: async (phase) => {
-                if (!scriptId)
-                    return undefined;
-                try {
-                    const result = await this.executor.execute(brokerManagedCommand({ operation: "script_call", sessionId: fridaSessionId, scriptId, exportName: "focusSnapshot", args: [phase] }, `focus.snapshot.${phase}`), context);
-                    return result.value;
-                }
-                catch (error) {
-                    if (!isAttachmentFatalError(error))
-                        throw error;
-                    return { unavailable: true, reason: "attachment_fatal", phase, error: errorText(error) };
-                }
-            },
-            pauseProducer: async () => {
-                if (!scriptId)
-                    return;
-                await this.executor.execute(brokerManagedCommand({ operation: "script_call", sessionId: fridaSessionId, scriptId, exportName: "focusPause", args: [] }, "focus.pause"), context);
-                await this.ingestScriptEvents(stored);
-            },
-            resumeProducer: async () => {
-                if (!scriptId)
-                    return;
-                await this.executor.execute(brokerManagedCommand({ operation: "script_call", sessionId: fridaSessionId, scriptId, exportName: "focusResume", args: [] }, "focus.resume"), context);
-            },
-            cleanup: async (hooks) => {
-                const steps = [];
-                const residualErrors = [];
-                let targetUnavailable = false;
-                const recordAttachmentLoss = (step, error) => {
-                    if (!isAttachmentFatalError(error))
-                        return false;
-                    targetUnavailable = true;
-                    steps.push({ step, ok: true, targetUnavailable: true, disposition: "released_with_attachment" });
-                    return true;
-                };
-                if (scriptId) {
-                    try {
-                        const stopped = await this.executor.execute(brokerManagedCommand({ operation: "script_call", sessionId: fridaSessionId, scriptId, exportName: "focusStop", args: ["session_stop"] }, "focus.stop"), context);
-                        const stats = isRecord(stopped?.value) ? stopped.value : undefined;
-                        if (stats)
-                            await stored.session.mergeExternalDrops(stats, "frida-script");
-                        steps.push({ step: "stop", ok: true });
-                    }
-                    catch (error) {
-                        if (!recordAttachmentLoss("stop", error)) {
-                            residualErrors.push({ step: "stop", error: errorText(error) });
-                            steps.push({ step: "stop", ok: false });
-                        }
-                    }
-                    if (!targetUnavailable) {
-                        try {
-                            await this.ingestScriptEvents(stored);
-                            steps.push({ step: "drain", ok: true, scriptCursor: stored.scriptCursor });
-                        }
-                        catch (error) {
-                            if (!recordAttachmentLoss("drain", error)) {
-                                residualErrors.push({ step: "drain", error: errorText(error) });
-                                steps.push({ step: "drain", ok: false });
-                            }
-                        }
-                    }
-                    if (!targetUnavailable) {
-                        try {
-                            await this.executor.execute(brokerManagedCommand({ operation: "script_unload", sessionId: fridaSessionId, scriptId }, "focus.script_unload"), context);
-                            steps.push({ step: "script_unload", ok: true });
-                        }
-                        catch (error) {
-                            if (!recordAttachmentLoss("script_unload", error)) {
-                                residualErrors.push({ step: "script_unload", error: errorText(error) });
-                                steps.push({ step: "script_unload", ok: false });
-                            }
-                        }
-                    }
-                    if (targetUnavailable || residualErrors.length === 0) {
-                        scriptId = undefined;
-                        stored.scriptId = undefined;
-                    }
-                }
-                const clean = residualErrors.length === 0;
-                return { hooks: clean ? 0 : hooks.length, scripts: scriptId ? 1 : 0, interceptors: clean ? 0 : hooks.length, targetUnavailable, remainingResourceRefs: clean ? 0 : undefined, residualResourceIds: clean ? [] : hooks, steps, residualErrors };
-            },
-            detach: async () => {
-                if (this.deferAttachmentDetach)
-                    return;
-                if (fridaSessionId)
-                    await this.executor.execute({ operation: "detach", sessionId: fridaSessionId, pid, buildKey }, context);
-                fridaSessionId = undefined;
-                stored.fridaSessionId = undefined;
-            }
-        };
-        const stored = {
-            session: undefined,
-            kind,
-            pid,
-            buildKey,
-            moduleBase: identity.moduleBase,
-            sessionId,
-            events,
-            streamFiles,
-            scriptCursor: 0,
-            checkpointCursor: 0,
-            lifecycleFailures: [],
-            cleanupAttempted: false
-        };
-        const session = new FocusedSession({
-            sessionId,
-            pid,
-            buildKey,
-            moduleBase: identity.moduleBase,
-            imageBase: this.imageBase,
-            processStartTime: identity.processStartTime,
-            moduleIdentity: identity.moduleIdentity,
-            target: selector,
-            selectorVerbatim,
-            targetKind,
-            environment,
-            triggerPlan: normalizedTriggerPlan,
-            captureArgs: bool(input.captureArgs),
-            captureReturns: bool(input.captureReturns),
-            captureCallStack: bool(input.captureCallStack),
-            captureMemoryWrites: bool(input.captureMemoryWrites),
-            captureObjectDiff: bool(input.captureObjectDiff),
-            detachOnCleanup: !this.deferAttachmentDetach,
-            ...limits,
-            transport,
-            onFatal: event => this.onFatal?.(event),
-            eventSink: {
-                append: async (event, signal) => {
-                    await appendJsonlDurable(streamForEvent(event, streamFiles), JSON.stringify(event), signal);
-                    events.push(event);
-                    if (["overflow", "exception", "cleanup"].includes(event.event.kind))
-                        this.dispatchLifecycle({ action: `focus_event_${event.event.kind}`, operation: kind === "watch" ? "wow_watch_internal" : "wow_focus_internal", sessionId, pid, buildKey, status: event.status, result: { seq: event.seq, eventKind: event.event.kind, diff: event.diff ?? null } }, stored);
-                },
-                prefixes: async () => Promise.all(["lua", "cpp", "data"].map(async (stream) => {
-                    const content = await readRecoveredFile(streamFiles[stream]);
-                    return { stream, size: content.byteLength, sha256: createHash("sha256").update(content).digest("hex") };
-                }))
-            },
-            manifestSink: (() => {
-                let terminalStatus;
-                let terminalFragmentFile;
-                let terminalFailureClaimed = false;
-                let publicationGeneration = 0;
-                let failurePublicationAttempt = 0;
-                let frozenPublicationAttempt = 0;
-                let publicationFence = new AbortController();
-                const activePublications = new Set();
-                const activeWrites = new Set();
-                let manifestTail = Promise.resolve();
-                const enqueueManifest = (operation) => {
-                    const result = manifestTail.then(operation);
-                    manifestTail = result.then(() => undefined, () => undefined);
-                    return result;
-                };
-                const committedStatus = () => terminalStatus;
-                const publishGuarded = (value, ownsPublication, beforePublish) => {
-                    const publication = writeJsonAtomicGuarded(streamFiles.manifest, value, ownsPublication, beforePublish, publicationFence.signal);
-                    activePublications.add(publication);
-                    void publication.then(() => activePublications.delete(publication), () => activePublications.delete(publication));
-                    return publication;
-                };
-                const publishTracked = (file, value, ownsPublication, beforePublish, signal) => {
-                    const publication = writeJsonAtomicGuarded(file, value, ownsPublication, beforePublish, signal);
-                    activePublications.add(publication);
-                    void publication.then(() => activePublications.delete(publication), () => activePublications.delete(publication));
-                    return publication;
-                };
-                const trackWrite = (operation) => {
-                    activeWrites.add(operation);
-                    void operation.then(() => activeWrites.delete(operation), () => activeWrites.delete(operation));
-                    return operation;
-                };
-                const quiesce = async () => {
-                    for (;;) {
-                        const pending = [...activePublications, ...activeWrites];
-                        if (pending.length === 0)
-                            return;
-                        await Promise.allSettled(pending);
-                    }
-                };
-                const materialize = (fragment, extra) => ({ ...fragment, streamFiles, ...(verifiedResolution ? { verifiedTargetResolution: verifiedResolution } : {}), ...extra });
-                return {
-                    write: fragment => enqueueManifest(async () => {
-                        if (terminalStatus || terminalFailureClaimed)
-                            return;
-                        const generation = publicationGeneration;
-                        await publishGuarded(materialize(fragment, { frozen: false }), () => generation === publicationGeneration && !terminalStatus && !terminalFailureClaimed, () => this.beforeManifestPublish?.({ kind: "write", file: streamFiles.manifest }));
-                    }),
-                    freeze: (fragment, signal) => enqueueManifest(async () => {
-                        signal?.throwIfAborted();
-                        if (committedStatus() === "frozen")
-                            return { committed: true, terminalStatus: "frozen" };
-                        if (committedStatus() === "failed") {
-                            publicationGeneration += 1;
-                            publicationFence = new AbortController();
-                            terminalFailureClaimed = false;
-                        }
-                        const generation = publicationGeneration;
-                        await this.beforeFreezeArtifacts?.();
-                        signal?.throwIfAborted();
-                        if (committedStatus() === "frozen")
-                            return { committed: true, terminalStatus: "frozen" };
-                        const streamArtifacts = await this.streamArtifacts(streamFiles, { pid, buildKey, sessionId, targetKind, environment, triggerPlan: normalizedTriggerPlan });
-                        signal?.throwIfAborted();
-                        if (committedStatus() === "frozen")
-                            return { committed: true, terminalStatus: "frozen" };
-                        const frozenManifest = materialize(fragment, { streamArtifacts, frozen: true, terminal: true, terminalStatus: "frozen" });
-                        const previousFragmentFile = terminalFragmentFile;
-                        const supersedes = previousFragmentFile
-                            ? await this.fragmentSupersession(previousFragmentFile)
-                            : undefined;
-                        const frozenAttempt = ++frozenPublicationAttempt;
-                        const manifestArtifactPath = join(dirname(streamFiles.manifest), `session-manifest-${sessionId}-frozen-${publicationGeneration}-${frozenAttempt}.json`);
-                        await trackWrite(writeFile(manifestArtifactPath, JSON.stringify(frozenManifest, null, 2) + "\n", { flag: "wx" }));
-                        const fragmentFile = await trackWrite(this.writeArtifactFragment(sessionId, buildKey, [
-                            ...streamArtifacts,
-                            this.manifestArtifactForValue(manifestArtifactPath, frozenManifest, { pid, buildKey, sessionId })
-                        ], previousFragmentFile ? `frozen-retry-${frozenAttempt}` : `frozen-${frozenAttempt}`, supersedes, signal));
-                        try {
-                            const published = await publishGuarded(frozenManifest, () => generation === publicationGeneration && terminalStatus !== "frozen", () => this.beforeManifestPublish?.({ kind: "freeze", file: streamFiles.manifest }));
-                            if (!published)
-                                throw new Error("TERMINAL_FREEZE_PUBLICATION_ABORTED");
-                            terminalStatus = "frozen";
-                            terminalFailureClaimed = false;
-                            terminalFragmentFile = fragmentFile;
-                            stored.artifactPublicationRetry = undefined;
-                            return { committed: true, terminalStatus };
-                        }
-                        catch (error) {
-                            await unlink(fragmentFile).catch(() => undefined);
-                            throw error;
-                        }
-                    }),
-                    terminalFailure: async (fragment, signal) => {
-                        if (terminalStatus === "frozen")
-                            return { committed: true, terminalStatus };
-                        if (stored.artifactPublicationRetry)
-                            return stored.artifactPublicationRetry();
-                        // This fence is intentionally independent of manifestTail. A timed-out
-                        // freeze may never settle, but it must immediately lose publication
-                        // rights so the bounded terminal failure can become canonical.
-                        terminalFailureClaimed = true;
-                        publicationGeneration += 1;
-                        publicationFence.abort();
-                        // Guarded publications race their hook against publicationFence, so
-                        // abort makes this drain independent of a non-cooperative test hook.
-                        // Wait for their finally blocks to remove durable temp files before
-                        // publishing or reporting the terminal failure.
-                        const drained = await drainAbortedPublications(activePublications, signal);
-                        if (!drained)
-                            await drainAbortedPublications(activePublications);
-                        const failedManifest = materialize(fragment, { frozen: false, terminal: true, terminalStatus: "failed" });
-                        const publishFailure = async (publicationSignal) => {
-                            if (terminalStatus === "frozen") {
-                                stored.artifactPublicationRetry = undefined;
-                                return { committed: true, terminalStatus };
-                            }
-                            const streamArtifacts = await this.streamArtifacts(streamFiles, { pid, buildKey, sessionId, targetKind, environment, triggerPlan: normalizedTriggerPlan });
-                            const previousFragmentFile = terminalFragmentFile;
-                            const supersedes = previousFragmentFile ? await this.fragmentSupersession(previousFragmentFile) : undefined;
-                            const failureAttempt = ++failurePublicationAttempt;
-                            const manifestArtifactPath = join(dirname(streamFiles.manifest), `session-manifest-${sessionId}-failed-${publicationGeneration}-${failureAttempt}.json`);
-                            await trackWrite(writeFile(manifestArtifactPath, JSON.stringify(failedManifest, null, 2) + "\n", { flag: "wx" }));
-                            const fragmentFile = await trackWrite(this.writeArtifactFragment(sessionId, buildKey, [
-                                ...streamArtifacts,
-                                this.manifestArtifactForValue(manifestArtifactPath, failedManifest, { pid, buildKey, sessionId })
-                            ], failureAttempt === 1 ? `failed-${failureAttempt}` : `failure-retry-${failureAttempt}`, supersedes, publicationSignal));
-                            terminalFragmentFile = fragmentFile;
-                            try {
-                                const published = await publishTracked(streamFiles.manifest, failedManifest, () => !publicationSignal?.aborted, () => this.beforeManifestPublish?.({ kind: "failure", file: streamFiles.manifest }), publicationSignal);
-                                if (!published)
-                                    throw new Error("TERMINAL_FAILURE_PUBLICATION_ABORTED");
-                                terminalStatus = "failed";
-                                terminalFragmentFile = fragmentFile;
-                                stored.artifactPublicationRetry = undefined;
-                                return { committed: true, terminalStatus };
-                            }
-                            catch (error) {
-                                // Keep failed fragments append-only for coordinator audit and retry lineage.
-                                throw error;
-                            }
-                        };
-                        stored.artifactPublicationRetry = () => trackWrite(publishFailure());
-                        return trackWrite(publishFailure(signal));
-                    },
-                    quiesce
-                };
-            })()
-        });
-        stored.session = session;
-        this.sessions.set(sessionId, stored);
-        try {
-            await session.start();
-            const durationMs = bounded(input.durationMs, 0, 0, 86_400_000);
-            if (limits.durationMs > 0) {
-                stored.durationTimer = setTimeout(() => {
-                    const expiration = { sessionId, pid, buildKey };
-                    const operation = this.onDurationExpired
-                        ? Promise.resolve(this.onDurationExpired(expiration))
-                        : this.cleanupSession(sessionId, "duration_expired").then(() => undefined);
-                    void operation.catch(() => undefined);
-                }, limits.durationMs);
-                stored.durationTimer.unref?.();
-            }
-            return { ...session.manifest, ...(verifiedResolution ? { verifiedTargetResolution: verifiedResolution } : {}), ready: true, sessionId, targetKind, fridaSessionId, scriptId, artifactDirectory: directory };
-        }
-        catch (error) {
-            stored.cleanupAttempted = true;
-            await session.stop().catch(() => undefined);
-            this.dispatchLifecycle({
-                action: "focus_start_failed",
-                operation: kind === "watch" ? "wow_watch_start" : "wow_focus_start",
-                sessionId,
-                pid,
-                buildKey,
-                status: "partial",
-                error: { message: errorText(error) },
-                result: {
-                    terminalStatus: session.manifest.terminalStatus ?? null,
-                    frozen: session.manifest.frozen,
-                    cleanupStatus: session.manifest.cleanupStatus,
-                    remainingResourceRefs: 0,
-                    residualResourceIds: [],
-                },
-                nextAction: "Start a new session only for a current explicit PID after the target is available."
-            }, stored);
-            throw error;
-        }
-    }
-    async read(input) {
-        const record = this.requireSession(input);
-        await this.routed(record, () => this.assertLive(record), "attachment_fatal");
-        const afterSeq = bounded(input.afterSeq ?? input.cursor, 0, 0, Number.MAX_SAFE_INTEGER);
-        const limit = bounded(input.limit, 1000, 1, 10_000);
-        if (record.scriptId) {
-            await this.routed(record, () => this.ingestScriptEvents(record), "capture_fatal");
-        }
-        const events = record.events.filter(event => event.seq > afterSeq).slice(0, limit);
-        return { active: record.session.status === "running" || record.session.status === "paused", sessionId: record.sessionId, events, oldestSeq: record.events[0]?.seq ?? null, newestSeq: record.events.at(-1)?.seq ?? null, nextAfterSeq: events.at(-1)?.seq ?? afterSeq, droppedEvents: record.session.manifest.droppedEventCount, eof: record.session.status === "stopped" };
-    }
-    async status(input) {
-        const record = this.requireSession(input);
-        await this.routed(record, () => this.assertLive(record), "attachment_fatal");
-        if (record.scriptId) {
-            const result = await this.routed(record, () => this.executor.execute(brokerManagedCommand({ operation: "script_call", sessionId: record.fridaSessionId, scriptId: record.scriptId, exportName: "focusStatus", args: [] }, "focus.status"), { pid: record.pid, buildKey: record.buildKey }), "capture_fatal").catch(() => undefined);
-            if (isRecord(result?.value))
-                await record.session.mergeExternalDrops(result.value, "frida-script");
-        }
-        return { ...record.session.manifest, active: record.session.status === "running" || record.session.status === "paused", eventCount: record.events.length, nextAfterSeq: record.events.at(-1)?.seq ?? 0, scriptId: record.scriptId ?? null, fridaSessionId: record.fridaSessionId ?? null, lifecycleFailures: record.lifecycleFailures };
-    }
-    async pause(input) {
-        const record = this.requireSession(input);
-        await this.routed(record, () => record.session.pause(), "capture_fatal");
-        return this.status(input);
-    }
-    async resume(input) {
-        const record = this.requireSession(input);
-        await this.routed(record, () => record.session.resume(), "capture_fatal");
-        return this.status(input);
-    }
-    async checkpoint(input) {
-        const record = this.requireSession(input);
-        await this.routed(record, () => this.assertLive(record), "attachment_fatal");
-        if (record.session.status !== "running")
-            throw new Error("CHECKPOINT_SESSION_NOT_RUNNING");
-        const phases = TriggerPlanSchema.parse(record.session.options.triggerPlan).phases ?? [];
-        const expected = phases[record.checkpointCursor];
-        if (!expected)
-            throw new Error("CHECKPOINT_PLAN_COMPLETE");
-        const phase = String(input.triggerPhase ?? "");
-        const phaseIndex = bounded(input.phaseIndex, -1, 0, Number.MAX_SAFE_INTEGER);
-        const userAction = requiredString(input.userAction, "userAction");
-        const expectedActions = [...expected.actions.map(action => typeof action === "string" ? action : action.userAction ?? action.description), "userAction" in expected ? expected.userAction : undefined].filter(Boolean);
-        if (phase !== expected.phase || phaseIndex !== expected.phaseIndex || !expectedActions.includes(userAction))
-            throw new Error("CHECKPOINT_PHASE_INVALID");
-        const checkpoint = await record.session.checkpoint(userAction, { phase, phaseIndex, userAction }, input.snapshotNow === true);
-        record.checkpointCursor += 1;
-        return { ...await this.status(input), triggerPhase: phase, phaseIndex, userAction, streamPrefixes: checkpoint.streamPrefixes };
-    }
-    async routed(record, operation, fallback) {
-        try {
-            return await operation();
-        }
-        catch (error) {
-            const text = errorText(error);
-            const failureClass = text.includes("BROKER_FATAL") ? "broker_fatal"
-                : text.includes("ATTACHMENT_FATAL") || text.includes("TARGET_") || text.includes("SESSION_NOT_LIVE") ? "attachment_fatal"
-                    : fallback;
-            const errorCode = failureClass === "broker_fatal" ? "BROKER_FATAL" : failureClass === "attachment_fatal" ? "ATTACHMENT_FATAL" : "CAPTURE_FATAL";
-            void Promise.resolve(this.onFatal?.({ failureClass, errorCode, sessionId: record.sessionId, pid: record.pid, buildKey: record.buildKey, error })).catch(() => undefined);
-            throw error;
-        }
-    }
-    async stop(input) {
-        const record = this.requireSession(input);
-        if (record.session.status !== "stopped")
-            await this.assertLive(record).catch(async (error) => { await record.session.targetExited().catch(() => undefined); throw error; });
-        return this.cleanupSession(record.sessionId, String(input.reason ?? "requested"));
-    }
-    requireSession(input) {
-        const sessionId = requiredString(input.sessionId, "sessionId");
-        const record = this.sessions.get(sessionId);
-        if (!record)
-            throw new Error("SESSION_NOT_FOUND");
-        const pid = positiveInt(input.pid, "pid");
-        const buildKey = requiredString(input.buildKey, "buildKey");
-        if (pid !== record.pid || buildKey !== record.buildKey)
-            throw new Error("SESSION_TARGET_MISMATCH");
-        return record;
-    }
-    async assertLive(record) {
-        try {
-            await record.session.validateIdentity();
-        }
-        catch (error) {
-            await record.session.targetExited().catch(() => undefined);
-            throw error;
-        }
-    }
-    async ingestScriptEvents(record) {
-        if (!record.scriptId)
-            return;
-        for (let page = 0; page < 16; page += 1) {
-            const result = await this.executor.execute(brokerManagedCommand({ operation: "script_call", sessionId: record.fridaSessionId, scriptId: record.scriptId, exportName: "focusRead", args: [record.scriptCursor, 10_000] }, "focus.read"), { pid: record.pid, buildKey: record.buildKey });
-            const scriptResult = isRecord(result.value) ? result.value : {};
-            await record.session.mergeExternalDrops(scriptResult, "frida-script");
-            const scriptEvents = arrayOfRecords(scriptResult.events);
-            for (const event of scriptEvents) {
-                const scriptSeq = numberValue(event.seq);
-                if (scriptSeq !== undefined)
-                    record.scriptCursor = Math.max(record.scriptCursor, scriptSeq);
-                const fallbackTarget = selectorTarget(record.session.resolvedSelector, record.moduleBase);
-                const rawTarget = isRecord(event.target) ? event.target : fallbackTarget;
-                const eventTarget = { ...rawTarget, kind: isTargetKind(rawTarget.kind) ? rawTarget.kind : fallbackTarget.kind };
-                const eventMeta = isRecord(event.event) ? event.event : {};
-                const threadId = numberValue(eventMeta.threadId) ?? 0;
-                const kind = typeof eventMeta.kind === "string" ? eventMeta.kind : "enter";
-                const { seq: _scriptSeq, ingressOrdinal: _scriptIngress, event: _event, ...rest } = event;
-                const invocationId = stringValue(event.invocationId) ?? stringValue(eventMeta.invocationId) ?? null;
-                const parentInvocationId = stringValue(event.parentInvocationId) ?? stringValue(eventMeta.parentInvocationId) ?? null;
-                const recursive = event.recursive === true || eventMeta.recursive === true;
-                const capturedTimestamp = typeof eventMeta.timestamp === "string" ? eventMeta.timestamp : undefined;
-                const capturedMonotonicTimestamp = typeof eventMeta.monotonicTimestamp === "number" && Number.isFinite(eventMeta.monotonicTimestamp)
-                    ? eventMeta.monotonicTimestamp
-                    : undefined;
-                const evidence = Array.isArray(event.evidence) ? [...event.evidence] : [];
-                if (capturedTimestamp !== undefined || capturedMonotonicTimestamp !== undefined)
-                    evidence.push({ source: "frida-gumjs", capturedTimestamp: capturedTimestamp ?? null, capturedMonotonicTimestamp: capturedMonotonicTimestamp ?? null });
-                const payload = {
-                    ...rest,
-                    arguments: event.arguments ?? rest.arguments ?? null,
-                    returnValue: event.returnValue ?? rest.returnValue ?? null,
-                    callStack: Array.isArray(event.callStack) ? event.callStack : (Array.isArray(rest.callStack) ? rest.callStack : []),
-                    evidence,
-                    target: eventTarget,
-                    trigger: event.trigger ?? { phase: "during" },
-                    status: event.status ?? "dynamic"
-                };
-                await record.session.emitTransport({
-                    ...payload,
-                    event: {
-                        kind: normalizeTimelineKind(kind),
-                        threadId,
-                        depth: numberValue(eventMeta.depth) ?? 0,
-                        invocationId,
-                        parentInvocationId,
-                        recursive,
-                        monotonicTimestamp: capturedMonotonicTimestamp
-                    }
-                });
-            }
-            const newestSeq = numberValue(scriptResult.newestSeq) ?? record.scriptCursor;
-            if (scriptEvents.length === 0 || record.scriptCursor >= newestSeq)
-                return;
-        }
-        throw new Error("SCRIPT_DRAIN_LIMIT_EXCEEDED");
-    }
-    async streamArtifacts(files, inputs) {
-        return Promise.all(["lua", "cpp", "data"].map(async (stream) => {
-            const file = resolve(files[stream]);
-            const bytes = await readRecoveredFile(file);
-            const text = bytes.toString("utf8");
-            const lineCount = text.length ? text.split("\n").filter(Boolean).length : 0;
-            const verificationCode = "const fs=require('fs'),c=require('crypto'),p=process.argv[1],b=fs.readFileSync(p),n=b.length?b.toString('utf8').split('\\n').filter(Boolean).length:0;console.log(JSON.stringify({size:b.length,lineCount:n,sha256:c.createHash('sha256').update(b).digest('hex')}))";
-            return { path: file, role: stream === "lua" ? "lua-focus" : stream === "cpp" ? "cpp-focus" : "data-watch", applicability: lineCount === 0 ? "not_applicable" : "applicable", lineCount, eventCount: lineCount, size: bytes.byteLength, sha256: createHash("sha256").update(bytes).digest("hex"), generationInputs: inputs, verificationCommand: `node -e ${JSON.stringify(verificationCode)} ${JSON.stringify(file)}` };
-        }));
-    }
-    async discoverIdentity(pid, buildKey, existingSessionId) {
-        const processes = await this.executor.execute({ operation: "processes" });
-        const list = arrayOfRecords(processes.processes ?? processes.value);
-        const process = list.find(item => numberValue(item.pid) === pid && (stringValue(item.name) ?? "").toLowerCase() === this.moduleName.toLowerCase());
-        if (!process)
-            throw new Error("PID_NOT_WOW");
-        const context = { pid, buildKey };
-        const attached = existingSessionId ? undefined : await this.executor.execute({ operation: "attach", pid, buildKey }, context);
-        const sessionId = existingSessionId ?? requiredString(attached?.sessionId, "attach.sessionId");
-        let modules;
-        try {
-            modules = await this.executor.execute({ operation: "modules", sessionId }, context);
-        }
-        catch (error) {
-            await this.bestEffortDiscoveryDetach(existingSessionId, sessionId, pid, buildKey, error);
-            throw error;
-        }
-        const module = arrayOfRecords(modules.modules ?? modules.value).find(item => (stringValue(item.name) ?? "").toLowerCase() === this.moduleName.toLowerCase());
-        if (!module) {
-            const error = new Error("MODULE_NOT_FOUND");
-            await this.bestEffortDiscoveryDetach(existingSessionId, sessionId, pid, buildKey, error);
-            throw error;
-        }
-        let moduleBase;
-        try {
-            moduleBase = requiredString(module.base, "module.base");
-        }
-        catch (error) {
-            await this.bestEffortDiscoveryDetach(existingSessionId, sessionId, pid, buildKey, error);
-            throw error;
-        }
-        const parsedStartTime = typeof process.startTime === "string" ? Date.parse(process.startTime) : numberValue(process.startTime) ?? numberValue(process.startTimeMs) ?? numberValue(process.creationTime);
-        const processStartTime = typeof parsedStartTime === "number" && Number.isFinite(parsedStartTime) ? parsedStartTime : undefined;
-        const moduleSize = numberValue(module.size);
-        if (moduleSize === undefined || moduleSize <= 0) {
-            const error = new Error("MODULE_SIZE_INVALID");
-            await this.bestEffortDiscoveryDetach(existingSessionId, sessionId, pid, buildKey, error);
-            throw error;
-        }
-        const moduleIdentity = createHash("sha256").update(JSON.stringify({ name: module.name, path: module.path, size: module.size, base: module.base })).digest("hex");
-        return { pid, buildKey, moduleBase, imageBase: this.imageBase, processStartTime, moduleIdentity, fridaSessionId: sessionId, moduleSize };
-    }
-    async bestEffortDiscoveryDetach(existingSessionId, sessionId, pid, buildKey, error) {
-        if (existingSessionId || this.deferAttachmentDetach)
-            return;
-        const audit = { attempted: true, sessionId, ok: false };
-        try {
-            await this.executor.execute({ operation: "detach", sessionId, pid, buildKey }, { pid, buildKey });
-            audit.ok = true;
-        }
-        catch (detachError) {
-            audit.error = errorText(detachError);
-        }
-        if (error && typeof error === "object")
-            error.attachmentCleanup = audit;
-    }
-    manifestArtifactForValue(file, value, inputs) {
-        const bytes = Buffer.from(JSON.stringify(value, null, 2) + "\n", "utf8");
-        return { path: resolve(file), role: "Focused session manifest", buildKey: inputs.buildKey, inputs: [inputs], outputs: [resolve(file)], size: bytes.byteLength, sha256: createHash("sha256").update(bytes).digest("hex"), generationCommand: "wow_focus_start", verificationCommand: `node -e ${JSON.stringify("JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8')); console.log('ok')")} ${JSON.stringify(resolve(file))}`, allPassed: true };
-    }
-    async fragmentSupersession(file) {
-        const bytes = await readFile(file);
-        return { path: resolve(file), sha256: createHash("sha256").update(bytes).digest("hex") };
-    }
-    async writeArtifactFragment(sessionId, buildKey, entries, publicationLabel, supersedes, signal) {
-        const manifestPath = join(this.runtimeRoot, "analysis-artifact-manifest-68974.json");
-        let baseGeneration = null;
-        try {
-            const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
-            baseGeneration = Number.isInteger(manifest.generation) ? Number(manifest.generation) : null;
-        }
-        catch (error) {
-            if (error?.code !== "ENOENT")
-                throw error;
-        }
-        const generation = (baseGeneration ?? 0) + 1;
-        const directory = join(this.runtimeRoot, "manifest-staging", String(generation));
-        await mkdir(directory, { recursive: true });
-        const fragment = { schema: "wow.artifact-manifest-fragment.v1", producerId: `focus:${sessionId}`, generation, baseGeneration, ...(supersedes ? { supersedes } : {}), entries };
-        const file = join(directory, `focus-${sessionId}${publicationLabel ? `-${publicationLabel}` : ""}.json`);
-        if (!await waitForPublication(() => this.beforeArtifactFragmentWrite?.({ sessionId, file }), signal))
-            throw new Error("ARTIFACT_FRAGMENT_WRITE_ABORTED");
-        if (signal?.aborted)
-            throw new Error("ARTIFACT_FRAGMENT_WRITE_ABORTED");
-        await writeFile(file, JSON.stringify(fragment, null, 2) + "\n", { flag: "wx" });
-        return file;
-    }
-    async revalidate(expected, sessionId) {
-        const actual = await this.discoverIdentity(expected.pid, expected.buildKey, sessionId);
-        if (actual.moduleBase.toLowerCase() !== expected.moduleBase.toLowerCase() || (expected.processStartTime !== undefined && actual.processStartTime !== expected.processStartTime) || (expected.moduleIdentity !== undefined && actual.moduleIdentity !== expected.moduleIdentity))
-            throw new Error("PID_REUSED");
-        return actual;
-    }
-    async resolveSelector(input, targetKind) {
-        if (this.selectorResolver) {
-            const selector = await this.selectorResolver(input);
-            return { selector, selectorVerbatim: isRecord(input.selector) ? { ...input.selector } : stripSelectorFields(selector) };
-        }
-        const selector = isRecord(input.selector) ? { ...input.selector } : {
-            ...(Array.isArray(input.APIs) ? { apis: input.APIs } : {}),
-            ...(Array.isArray(input.apis) ? { apis: input.apis } : {}),
-            ...(typeof input.namespace === "string" ? { namespace: input.namespace } : {}),
-            ...(typeof input.glob === "string" ? { glob: input.glob } : {}),
-            ...(input.rva !== undefined ? { rva: Array.isArray(input.rva) ? String(input.rva[0]) : String(input.rva) } : {}),
-            ...(typeof input.address === "string" ? { address: input.address } : {}),
-            ...(typeof input.start === "string" ? { start: input.start } : {}),
-            ...(typeof input.end === "string" ? { end: input.end } : {})
-        };
-        const kind = TargetKindSchema.parse(targetKind);
-        let normalized;
-        try {
-            normalized = validateSelector(selector, kind);
-        }
-        catch (error) {
-            throw asSelectorRequestError(error);
-        }
-        const selectorVerbatim = stripSelectorFields(normalized);
-        if (kind !== "lua_wrapper")
-            return { selector: normalized, selectorVerbatim };
-        const resolvedRvas = await this.resolveLuaRvas(normalized, requiredString(input.buildKey, "buildKey"));
-        if (resolvedRvas.length === 0)
-            throw new FocusRequestError("SELECTOR_EMPTY", "selector did not resolve to a current-build Lua wrapper");
-        try {
-            return {
-                selector: validateSelector({ combine: normalized.combine, rvas: resolvedRvas, maxTargets: normalized.maxTargets }, kind),
-                selectorVerbatim,
-            };
-        }
-        catch (error) {
-            throw asSelectorRequestError(error);
-        }
-    }
-    async resolveLuaRvas(selector, buildKey) {
-        const records = await this.loadFoundation(buildKey);
-        const fields = [];
-        if (selector.apis?.length)
-            fields.push(new Set(records.filter(record => selector.apis.includes(String(record.api ?? record.name ?? ""))).map(record => String(record.wrapperRva))));
-        if (selector.namespaces?.length)
-            fields.push(new Set(records.filter(record => selector.namespaces.includes(String(record.namespace ?? ""))).map(record => String(record.wrapperRva))));
-        if (selector.globs?.length)
-            fields.push(new Set(records.filter(record => selector.globs.some(glob => globMatch(glob, `${String(record.namespace ?? "")}.${String(record.name ?? "")}`))).map(record => String(record.wrapperRva))));
-        if (selector.rvas?.length)
-            fields.push(new Set(selector.rvas));
-        if (fields.length === 0)
-            return [];
-        const result = selector.combine === "all"
-            ? [...fields[0]].filter(value => fields.every(field => field.has(value)))
-            : [...new Set(fields.flatMap(field => [...field]))];
-        result.sort((left, right) => BigInt(left) < BigInt(right) ? -1 : BigInt(left) > BigInt(right) ? 1 : 0);
-        if (result.length > selector.maxTargets)
-            throw new FocusRequestError("TARGETS_OVER_LIMIT", `selector resolves to ${result.length} targets, exceeding maxTargets=${selector.maxTargets}`, { resolvedTargets: result.length, maxTargets: selector.maxTargets });
-        return result;
-    }
-    loadFoundation(buildKey) {
-        const cached = this.foundationCache.get(buildKey);
-        if (cached)
-            return cached;
-        const suffix = buildKey.split(".").at(-1) ?? "";
-        const promise = this.packagedProfiles
-            ? this.buildBundles.readJsonl(buildKey, "lua-targets.jsonl")
-            : readFile(join(this.profileRoot, `lua-foundation-${suffix}.jsonl`), "utf8")
-                .then(text => text.split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line)).filter(record => record.buildKey === buildKey));
-        this.foundationCache.set(buildKey, promise);
-        void promise.catch(() => {
-            if (this.foundationCache.get(buildKey) === promise)
-                this.foundationCache.delete(buildKey);
-        });
-        return promise;
-    }
-    async verifyHookTargets(request) {
-        if (request.rvas.length === 0)
-            throw new FocusRequestError("SELECTOR_EMPTY", "hook selector resolved to no RVAs");
-        if (this.hookTargetVerifier)
-            return validateVerifiedHookTargets(await this.hookTargetVerifier(request), request);
-        if (request.targetKind === "cpp_function")
-            return this.verifyProfileHookTargets(request);
-        const records = await this.loadFoundation(request.buildKey);
-        const byRva = new Map();
-        for (const record of records) {
-            const rva = canonicalRva(requiredString(record.wrapperRva, "foundation.wrapperRva"));
-            const values = byRva.get(rva) ?? [];
-            values.push(record);
-            byRva.set(rva, values);
-        }
-        let registrationRecords = records;
-        if (!this.packagedProfiles) {
-            const suffix = request.buildKey.split(".").at(-1) ?? "";
-            const registration = JSON.parse(await readFile(join(this.profileRoot, `wow-lua-api-all-rva-${suffix}.json`), "utf8"));
-            registrationRecords = arrayOfRecords(registration.records);
-        }
-        const registrationByRva = new Map(registrationRecords.map(record => [canonicalRva(requiredString(record.rva ?? record.wrapperRva, "registration.rva")), record]));
-        const verified = [];
-        for (const rawRva of request.rvas) {
-            const rva = canonicalRva(rawRva);
-            const candidates = byRva.get(rva) ?? [];
-            const record = candidates.find(value => isRecord(value.abi) && value.abi.status === "confirmed" && isConfirmedFunctionBoundary(value.functionBoundary) && isSha256(value.entryHash));
-            if (!record)
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} lacks confirmed ABI, function boundary, or entry hash`);
-            const numericRva = BigInt(rva);
-            const registration = registrationByRva.get(rva);
-            const expectedHex = registration && typeof registration.entryBytesHex === "string" ? registration.entryBytesHex.toLowerCase() : "";
-            if (!/^[0-9a-f]{64}$/.test(expectedHex))
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} lacks a 32-byte build entry baseline`);
-            const expected = Buffer.from(expectedHex, "hex");
-            const entryLength = expected.length;
-            if (numericRva + BigInt(entryLength) > BigInt(request.moduleSize))
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} is outside the runtime module`);
-            const expectedHash = createHash("sha256").update(expected).digest("hex");
-            if (expectedHash !== String(record.entryHash).toLowerCase())
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} static entry hash mismatch`);
-            const runtimeAddress = addHex(request.moduleBase, rva);
-            const read = await this.executor.execute(brokerManagedCommand({ operation: "read_memory", sessionId: request.fridaSessionId, address: runtimeAddress, size: entryLength }, "focus.verify_hook_entry"), { pid: request.pid, buildKey: request.buildKey });
-            const actualHex = requiredString(read.bytesHex ?? read.hex, "read_memory.bytesHex").toLowerCase();
-            const actualHash = createHash("sha256").update(Buffer.from(actualHex, "hex")).digest("hex");
-            if (actualHex !== expected.toString("hex") || actualHash !== expectedHash)
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} runtime entry bytes do not match build baseline`, { rva, runtimeAddress, expectedHash, actualHash });
-            verified.push({ rva, runtimeAddress, entryBytesHex: actualHex, entryBytesSha256: actualHash, entryBytesLength: entryLength, functionBoundary: record.functionBoundary, abiStatus: "confirmed" });
-        }
-        return validateVerifiedHookTargets(verified, request);
-    }
-    async verifyProfileHookTargets(request) {
-        let signatures;
-        try {
-            const suffix = request.buildKey.split(".").at(-1) ?? "";
-            const payload = this.packagedProfiles
-                ? await this.buildBundles.readJson(request.buildKey, "signatures.json")
-                : JSON.parse(await readFile(join(this.profileRoot, `build-profile-${suffix}.json`), "utf8"));
-            if (payload.buildKey !== request.buildKey)
-                throw new Error("signatures buildKey mismatch");
-            signatures = arrayOfRecords(payload.signatures);
-        }
-        catch (error) {
-            throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: build profile is unavailable: ${errorText(error)}`);
-        }
-        const byRva = new Map(signatures.map(signature => [canonicalRva(requiredString(signature.rva, "signature.rva")), signature]));
-        const verified = [];
-        for (const rawRva of request.rvas) {
-            const rva = canonicalRva(rawRva);
-            const signature = byRva.get(rva);
-            const expectedHex = signature && typeof signature.entryBytesHex === "string" ? signature.entryBytesHex.toLowerCase() : "";
-            const expectedHash = signature && typeof signature.entryBytesSha256 === "string" ? signature.entryBytesSha256.toLowerCase() : "";
-            if (!/^[0-9a-f]{32,128}$/.test(expectedHex) || expectedHex.length % 2 !== 0 || !isSha256(expectedHash))
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} is not a signed build-profile function`);
-            const entryBytes = Buffer.from(expectedHex, "hex");
-            const recomputedHash = createHash("sha256").update(entryBytes).digest("hex");
-            if (recomputedHash !== expectedHash)
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} build-profile entry hash mismatch`);
-            if (BigInt(rva) + BigInt(entryBytes.length) > BigInt(request.moduleSize))
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} is outside the runtime module`);
-            const runtimeAddress = addHex(request.moduleBase, rva);
-            const read = await this.executor.execute(brokerManagedCommand({ operation: "read_memory", sessionId: request.fridaSessionId, address: runtimeAddress, size: entryBytes.length }, "focus.verify_cpp_entry"), { pid: request.pid, buildKey: request.buildKey });
-            const actualHex = requiredString(read.bytesHex ?? read.hex, "read_memory.bytesHex").toLowerCase();
-            const actualHash = createHash("sha256").update(Buffer.from(actualHex, "hex")).digest("hex");
-            if (actualHex !== expectedHex || actualHash !== expectedHash)
-                throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: ${rva} runtime entry bytes do not match build profile`, { rva, runtimeAddress, expectedHash, actualHash });
-            verified.push({ rva, runtimeAddress, entryBytesHex: actualHex, entryBytesSha256: actualHash, entryBytesLength: entryBytes.length, functionBoundary: { status: "confirmed", startVa: addHex(this.imageBase, rva), size: `0x${entryBytes.length.toString(16)}`, evidenceKind: "build_profile_signature" }, abiStatus: "confirmed" });
-        }
-        return validateVerifiedHookTargets(verified, request);
-    }
-    async resolveVerifiedTargetsFromProfile(request) {
-        const suffix = request.buildKey.split(".").at(-1) ?? "";
-        let profile;
-        try {
-            profile = this.packagedProfiles
-                ? await this.buildBundles.readJson(request.buildKey, "build-profile.json")
-                : JSON.parse(await readFile(join(this.profileRoot, `build-profile-${suffix}.json`), "utf8"));
-        }
-        catch (error) {
-            if (error?.code === "ENOENT")
-                throw new Error("VERIFIED_RANGE_REQUIRED: build profile is unavailable");
-            throw error;
-        }
-        if (profile.buildKey !== request.buildKey)
-            throw new Error("VERIFIED_RANGE_REQUIRED: build profile does not match the requested build");
-        const roots = arrayOfRecords(profile.dataRoots);
-        const readers = arrayOfRecords(profile.readers);
-        const objects = [...arrayOfRecords(profile.objects), ...arrayOfRecords(profile.focusTargets)];
-        const targets = [];
-        const ranges = [];
-        const evidence = [];
-        for (const id of request.ids) {
-            const root = request.targetKind === "data_source" ? roots.find(item => item.dataSourceId === id) : undefined;
-            const reader = request.targetKind === "data_source"
-                ? readers.find(item => item.dataSourceId === id)
-                : objects.find(item => item.objectId === id || item.id === id);
-            const status = stringValue(reader?.status) ?? stringValue(root?.status);
-            const machineValidated = reader?.machineValidated === true || root?.machineValidated === true;
-            const invariants = dedupeInvariants([
-                ...arrayOfRecords(root?.invariants).map(normalizeInvariant),
-                ...arrayOfRecords(reader?.invariants).map(normalizeInvariant)
-            ]);
-            const rawRanges = [...arrayOfRecords(root?.watchRanges), ...arrayOfRecords(reader?.watchRanges)];
-            if (status !== "reader_ready" || !machineValidated || invariants.length === 0 || rawRanges.length === 0)
-                throw new Error(`VERIFIED_RANGE_REQUIRED: ${id} is not reader_ready with machine-validated ranges and invariants`);
-            const semanticDefault = request.targetKind === "object"
-                ? "object"
-                : isRecord(root?.containerDefinition) || reader?.kind === "container" ? "container" : "memory";
-            const targetRanges = rawRanges.map(range => {
-                const rva = canonicalRva(requiredString(range.rva, `${id}.watchRanges.rva`));
-                const size = positiveInt(range.size, `${id}.watchRanges.size`);
-                const semantic = stringValue(range.semanticKind);
-                const semanticKind = semantic === "object" || semantic === "container" || semantic === "memory" ? semantic : semanticDefault;
-                return { rva, size, semanticKind, targetId: id, invariants };
-            });
-            targets.push({ id, status: "reader_ready", machineValidated: true, invariants });
-            ranges.push(...targetRanges);
-            evidence.push({
-                buildProfile: this.packagedProfiles
-                    ? `${this.profileRoot}:${request.buildKey}:build-profile.json`
-                    : resolve(this.profileRoot, `build-profile-${suffix}.json`),
-                targetId: id,
-                status,
-                machineValidated,
-                invariants,
-                ranges: targetRanges
-            });
-        }
-        const unique = new Map(ranges.map(range => [`${range.rva}:${range.size}:${range.semanticKind}:${range.targetId}`, range]));
-        const normalized = [...unique.values()].sort((left, right) => BigInt(left.rva) < BigInt(right.rva) ? -1 : BigInt(left.rva) > BigInt(right.rva) ? 1 : left.size - right.size);
-        if (normalized.reduce((sum, range) => sum + range.size, 0) > request.maxBytes)
-            throw new Error("RANGE_LIMIT_EXCEEDED: verified target ranges exceed maxBytes");
-        return { targets, ranges: normalized, evidence };
-    }
-    dispatchLifecycle(event, record) {
-        if (!this.lifecycle)
-            return;
-        let callback;
-        try {
-            callback = this.lifecycle(event);
-        }
-        catch (error) {
-            record.lifecycleFailures.push({ errorCode: "LIFECYCLE_CALLBACK_FAILED", error: errorText(error), event });
-            return;
-        }
-        const operation = Promise.resolve(callback);
-        let timer;
-        const boundedOperation = this.lifecycleTimeoutMs > 0
-            ? Promise.race([
-                operation,
-                new Promise((_, reject) => {
-                    timer = setTimeout(() => {
-                        const timeout = new Error("LIFECYCLE_CALLBACK_TIMEOUT");
-                        timeout.name = "LifecycleTimeoutError";
-                        reject(timeout);
-                    }, this.lifecycleTimeoutMs);
-                    timer.unref?.();
-                }),
-            ])
-            : operation;
-        void boundedOperation
-            .catch(error => {
-            record.lifecycleFailures.push({
-                errorCode: error?.name === "LifecycleTimeoutError" ? "LIFECYCLE_CALLBACK_TIMEOUT" : "LIFECYCLE_CALLBACK_FAILED",
-                error: errorText(error),
-                event,
-            });
-        })
-            .finally(() => { if (timer)
-            clearTimeout(timer); })
-            .catch(() => undefined);
-    }
-}
-function validateVerifiedResolution(value, maxBytes) {
-    if (!value || !Array.isArray(value.targets) || !Array.isArray(value.ranges) || !Array.isArray(value.evidence))
-        throw new Error("VERIFIED_RANGE_REQUIRED: resolver returned an invalid resolution");
-    const targets = value.targets.map(target => {
-        if (!target || target.status !== "reader_ready" || target.machineValidated !== true || typeof target.id !== "string")
-            throw new Error("VERIFIED_RANGE_REQUIRED: target is not machine validated");
-        const invariants = dedupeInvariants(arrayOfRecords(target.invariants).map(normalizeInvariant));
-        if (!invariants.length)
-            throw new Error(`VERIFIED_RANGE_REQUIRED: ${target.id} has no executable invariants`);
-        return { id: target.id, status: "reader_ready", machineValidated: true, invariants };
-    });
-    const targetIds = new Set(targets.map(target => target.id));
-    const ranges = value.ranges.map(range => {
-        if (!range || !targetIds.has(range.targetId))
-            throw new Error("VERIFIED_RANGE_REQUIRED: range target is not registered");
-        const size = positiveInt(range.size, `${range.targetId}.range.size`);
-        const invariants = dedupeInvariants(arrayOfRecords(range.invariants).map(normalizeInvariant));
-        if (!invariants.length)
-            throw new Error(`VERIFIED_RANGE_REQUIRED: ${range.targetId} range has no executable invariants`);
-        for (const invariant of invariants)
-            assertInvariantBounds(invariant, size, range.targetId);
-        const semanticKind = range.semanticKind === "object" || range.semanticKind === "container" || range.semanticKind === "memory" ? range.semanticKind : "memory";
-        return { rva: canonicalRva(range.rva), size, semanticKind, targetId: range.targetId, invariants };
-    });
-    if (ranges.reduce((sum, range) => sum + range.size, 0) > maxBytes)
-        throw new Error("RANGE_LIMIT_EXCEEDED: verified target ranges exceed maxBytes");
-    return { targets, ranges, evidence: value.evidence.map(item => ({ ...item })) };
-}
-function normalizeInvariant(value) {
-    const kind = requiredString(value.kind, "invariant.kind");
-    if (kind === "readable_range")
-        return { kind };
-    if (kind === "protection") {
-        const require = requiredString(value.require, "invariant.require");
-        if (!/^[rwx-]{3}$/.test(require))
-            throw new Error("VERIFIED_RANGE_REQUIRED: protection.require must be a three-character protection mask");
-        return { kind, require };
-    }
-    if (kind === "bytes_equal") {
-        const offset = nonNegativeInt(value.offset, "invariant.offset");
-        const bytesHex = requiredString(value.bytesHex, "invariant.bytesHex").toLowerCase();
-        if (!/^(?:[0-9a-f]{2})+$/.test(bytesHex))
-            throw new Error("VERIFIED_RANGE_REQUIRED: bytes_equal requires even-length hex bytes");
-        return { kind, offset, bytesHex };
-    }
-    if (kind === "pointer_in_module" || kind === "vtable_in_module")
-        return { kind, offset: nonNegativeInt(value.offset, "invariant.offset"), ...(value.allowNull === true ? { allowNull: true } : {}) };
-    if (kind === "count_capacity")
-        return { kind, countOffset: nonNegativeInt(value.countOffset, "invariant.countOffset"), capacityOffset: nonNegativeInt(value.capacityOffset, "invariant.capacityOffset"), width: value.width === 4 ? 4 : failInvariant("count_capacity.width must be 4"), maxCapacity: positiveInt(value.maxCapacity, "invariant.maxCapacity") };
-    if (kind === "string_length")
-        return { kind, lengthOffset: nonNegativeInt(value.lengthOffset, "invariant.lengthOffset"), width: value.width === 4 ? 4 : failInvariant("string_length.width must be 4"), maxLength: positiveInt(value.maxLength, "invariant.maxLength") };
-    if (kind === "traversal_limit")
-        return { kind, countOffset: nonNegativeInt(value.countOffset, "invariant.countOffset"), width: value.width === 4 ? 4 : failInvariant("traversal_limit.width must be 4"), maxItems: positiveInt(value.maxItems, "invariant.maxItems") };
-    throw new Error(`VERIFIED_RANGE_REQUIRED: unsupported invariant kind ${kind}`);
-}
-function assertInvariantBounds(invariant, size, targetId) {
-    const check = (offset, width) => { if (offset + width > size)
-        throw new Error(`VERIFIED_RANGE_REQUIRED: ${targetId} invariant exceeds bounded range`); };
-    if (invariant.kind === "bytes_equal")
-        check(invariant.offset, invariant.bytesHex.length / 2);
-    if (invariant.kind === "pointer_in_module" || invariant.kind === "vtable_in_module")
-        check(invariant.offset, 8);
-    if (invariant.kind === "count_capacity") {
-        check(invariant.countOffset, invariant.width);
-        check(invariant.capacityOffset, invariant.width);
-    }
-    if (invariant.kind === "string_length")
-        check(invariant.lengthOffset, invariant.width);
-    if (invariant.kind === "traversal_limit")
-        check(invariant.countOffset, invariant.width);
-}
-function dedupeInvariants(values) {
-    return [...new Map(values.map(value => [JSON.stringify(value), value])).values()];
-}
-function nonNegativeInt(value, name) {
-    if (!Number.isSafeInteger(value) || Number(value) < 0)
-        throw new Error(`${name} must be a non-negative integer`);
-    return Number(value);
-}
-function failInvariant(message) { throw new Error(`VERIFIED_RANGE_REQUIRED: ${message}`); }
-const FOCUS_SCRIPT = String.raw `
-let listeners = [];
-let events = [];
-let active = false;
-let admitting = false;
-let snapshotTimer = null;
-let seq = 0;
-let ingressOrdinal = 0;
-let eventBytes = 0;
-let droppedEventCount = 0;
-let droppedByteCount = 0;
-let droppedByReason = {};
-let dropWindows = {};
-let stacks = {};
-let invocationCounter = 0;
-let ranges = [];
-let lastSnapshots = [];
-let wowModule = null;
-let limits = { maxEvents: 10000, maxBytes: 8388608, sampling: 1, captureArgs: false, captureReturns: false, captureCallStack: false, captureMemoryWrites: false, captureObjectDiff: false, snapshotIntervalMs: 1000 };
-
-function jsonBytes(value) {
-  try { return JSON.stringify(value).length; } catch (_) { return 0; }
-}
-
-const DIFF_PREVIEW_BYTES = 64;
-const SHA256_K = [
-  0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
-  0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
-  0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
-  0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
-  0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
-  0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
-  0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
-  0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
-];
-function sha256Hex(hex) {
-  const bytes = [];
-  for (let i = 0; i + 1 < hex.length; i += 2) bytes.push(parseInt(hex.slice(i, i + 2), 16));
-  const bitLength = bytes.length * 8;
-  bytes.push(0x80);
-  while ((bytes.length % 64) !== 56) bytes.push(0);
-  for (let shift = 7; shift >= 0; shift--) bytes.push((bitLength / Math.pow(2, shift * 8)) & 0xff);
-  let h0=0x6a09e667,h1=0xbb67ae85,h2=0x3c6ef372,h3=0xa54ff53a,h4=0x510e527f,h5=0x9b05688c,h6=0x1f83d9ab,h7=0x5be0cd19;
-  for (let offset = 0; offset < bytes.length; offset += 64) {
-    const w = new Array(64).fill(0);
-    for (let i=0;i<16;i++) w[i]=((bytes[offset+i*4]<<24)|(bytes[offset+i*4+1]<<16)|(bytes[offset+i*4+2]<<8)|bytes[offset+i*4+3])>>>0;
-    for (let i=16;i<64;i++) { const a=w[i-15], b=w[i-2]; const s0=((a>>>7)|(a<<25))^((a>>>18)|(a<<14))^(a>>>3); const s1=((b>>>17)|(b<<15))^((b>>>19)|(b<<13))^(b>>>10); w[i]=(w[i-16]+s0+w[i-7]+s1)>>>0; }
-    let a=h0,b=h1,c=h2,d=h3,e=h4,f=h5,g=h6,hh=h7;
-    for (let i=0;i<64;i++) { const s1=((e>>>6)|(e<<26))^((e>>>11)|(e<<21))^((e>>>25)|(e<<7)); const ch=(e&f)^(~e&g); const t1=(hh+s1+ch+SHA256_K[i]+w[i])>>>0; const s0=((a>>>2)|(a<<30))^((a>>>13)|(a<<19))^((a>>>22)|(a<<10)); const maj=(a&b)^(a&c)^(b&c); const t2=(s0+maj)>>>0; hh=g;g=f;f=e;e=(d+t1)>>>0;d=c;c=b;b=a;a=(t1+t2)>>>0; }
-    h0=(h0+a)>>>0;h1=(h1+b)>>>0;h2=(h2+c)>>>0;h3=(h3+d)>>>0;h4=(h4+e)>>>0;h5=(h5+f)>>>0;h6=(h6+g)>>>0;h7=(h7+hh)>>>0;
-  }
-  return [h0,h1,h2,h3,h4,h5,h6,h7].map(v=>('00000000'+v.toString(16)).slice(-8)).join('');
-}
-function boundedBytesEvidence(hex) {
-  const normalized = typeof hex === 'string' ? hex : '';
-  const byteLength = Math.floor(normalized.length / 2);
-  const previewHex = normalized.slice(0, DIFF_PREVIEW_BYTES * 2);
-  return { byteLength, sha256: sha256Hex(normalized), previewHex, previewTruncated: byteLength > DIFF_PREVIEW_BYTES };
-}
-
-function u32le(bytes, offset) {
-  return (bytes[offset] | (bytes[offset + 1] << 8) | (bytes[offset + 2] << 16) | (bytes[offset + 3] << 24)) >>> 0;
-}
-
-function validateInvariant(invariant, address, bytes, protection) {
-  if (invariant.kind === 'readable_range') return { kind: invariant.kind, valid: bytes.length > 0 && typeof protection === 'string' && protection.indexOf('r') >= 0, protection };
-  if (invariant.kind === 'protection') {
-    const required = String(invariant.require || '---');
-    const valid = required.length === 3 && typeof protection === 'string' && required.split('').every((flag, index) => flag === '-' || protection[index] === flag);
-    return { kind: invariant.kind, valid, required, actual: protection || null };
-  }
-  if (invariant.kind === 'bytes_equal') {
-    let actual = '';
-    const count = invariant.bytesHex.length / 2;
-    for (let i = 0; i < count; i++) actual += ('0' + bytes[invariant.offset + i].toString(16)).slice(-2);
-    return { kind: invariant.kind, valid: actual === invariant.bytesHex, offset: invariant.offset, expected: invariant.bytesHex, actual };
-  }
-  if (invariant.kind === 'pointer_in_module' || invariant.kind === 'vtable_in_module') {
-    const pointer = address.add(invariant.offset).readPointer();
-    const valid = (invariant.allowNull === true && pointer.isNull()) || (!pointer.isNull() && wowModule !== null && pointer.compare(wowModule.base) >= 0 && pointer.compare(wowModule.base.add(wowModule.size)) < 0);
-    return { kind: invariant.kind, valid, offset: invariant.offset, pointer: pointer.toString(), moduleBase: wowModule ? wowModule.base.toString() : null };
-  }
-  if (invariant.kind === 'count_capacity') {
-    const count = u32le(bytes, invariant.countOffset); const capacity = u32le(bytes, invariant.capacityOffset);
-    return { kind: invariant.kind, valid: count <= capacity && capacity <= invariant.maxCapacity, count, capacity, maxCapacity: invariant.maxCapacity };
-  }
-  if (invariant.kind === 'string_length') {
-    const length = u32le(bytes, invariant.lengthOffset);
-    return { kind: invariant.kind, valid: length <= invariant.maxLength, length, maxLength: invariant.maxLength };
-  }
-  if (invariant.kind === 'traversal_limit') {
-    const count = u32le(bytes, invariant.countOffset);
-    return { kind: invariant.kind, valid: count <= invariant.maxItems, count, maxItems: invariant.maxItems, traversalAllowed: Math.min(count, invariant.maxItems) };
-  }
-  return { kind: String(invariant.kind), valid: false, error: 'unsupported invariant' };
-}
-
-function drop(reason, size, ingress, threadId) {
-  const now = new Date().toISOString();
-  droppedEventCount += 1;
-  droppedByteCount += size;
-  droppedByReason[reason] = (droppedByReason[reason] || 0) + 1;
-  const current = dropWindows[reason] || { firstLostIngressOrdinal: ingress, firstTimestamp: now, producer: 'gumjs', threadIds: [], chainCompletenessAffected: true };
-  current.lastLostIngressOrdinal = ingress; current.lastTimestamp = now;
-  if (threadId && current.threadIds.indexOf(threadId) < 0) current.threadIds.push(threadId);
-  dropWindows[reason] = current;
-}
-
-function append(kind, target, payload, threadId, depth) {
-  const ingress = ++ingressOrdinal;
-  if (!admitting) { drop('producer_paused', 0, ingress, threadId); return false; }
-  const event = { ...payload, seq: 0, ingressOrdinal: ingress, target, event: { kind, timestamp: new Date().toISOString(), threadId: threadId || 0, depth: depth || 0 }, status: payload.status === 'partial' || payload.status === 'unresolved' ? payload.status : 'dynamic' };
-  const size = jsonBytes(event);
-  if (limits.sampling < 1 && Math.random() > limits.sampling) { drop('sampling', size, ingress, threadId); return false; }
-  if (events.length >= limits.maxEvents) { drop('max_events', size, ingress, threadId); return false; }
-  if (eventBytes + size > limits.maxBytes) { drop('max_bytes', size, ingress, threadId); return false; }
-  event.seq = ++seq;
-  events.push(event);
-  eventBytes += size;
-  return true;
-}
-
-function readRange(range) {
-  const address = ptr(range.runtimeAddress);
-  const queried = Process.findRangeByAddress(address);
-  if (!queried || queried.protection.indexOf('r') < 0 || address.add(range.size).compare(queried.base.add(queried.size)) > 0) throw new Error('RANGE_VALIDATION_FAILED:' + range.rva);
-  const raw = address.readByteArray(range.size);
-  const bytes = raw ? new Uint8Array(raw) : new Uint8Array(0);
-  const invariantResults = (range.invariants || []).map(invariant => validateInvariant(invariant, address, bytes, queried.protection));
-  if (invariantResults.some(result => result.valid !== true)) throw new Error('INVARIANT_VALIDATION_FAILED:' + range.rva + ':' + JSON.stringify(invariantResults));
-  return { rva: range.rva, runtimeAddress: range.runtimeAddress, size: range.size, protection: queried.protection, semanticKind: range.semanticKind || 'memory', targetId: range.targetId || null, invariants: range.invariants || [], invariantResults, bytesHex: Array.prototype.map.call(bytes, b => ('0' + b.toString(16)).slice(-2)).join('') };
-}
-
-function snapshot(phase) {
-  const values = [];
-  for (const range of ranges) {
-    try { values.push({ ...readRange(range), valid: true }); }
-    catch (error) { values.push({ rva: range.rva, runtimeAddress: range.runtimeAddress, size: range.size, protection: range.protection, semanticKind: range.semanticKind || 'memory', targetId: range.targetId || null, valid: false, status: 'unresolved', error: { code: String(error).indexOf('INVARIANT_VALIDATION_FAILED') >= 0 ? 'INVARIANT_VALIDATION_FAILED' : 'RANGE_VALIDATION_FAILED', message: String(error) } }); }
-  }
-  return { phase, capturedAt: new Date().toISOString(), ranges: values };
-}
-
-function pollRanges() {
-  if (!active || !admitting || !ranges.length) return;
-  const current = snapshot('during').ranges;
-  for (let index = 0; index < current.length; index++) {
-    const before = lastSnapshots[index]; const after = current[index];
-    if (after && after.valid !== true) {
-      append('exception', { kind: after.semanticKind || 'address_range', name: after.targetId || undefined, rva: after.rva, runtimeAddress: after.runtimeAddress }, { before: before || {}, after, diff: {}, error: { code: after.error && after.error.code ? after.error.code : 'INVARIANT_VALIDATION_FAILED', message: after.error && after.error.message ? after.error.message : 'runtime invariant failed' }, status: 'partial' }, Process.getCurrentThreadId(), 0);
-    } else if (before && before.valid === true && after && after.valid === true && before.bytesHex !== after.bytesHex) {
-      const semantic = after.semanticKind === 'object' || after.semanticKind === 'container' ? after.semanticKind : 'memory';
-      const eventKind = limits.captureObjectDiff && semantic !== 'memory' ? semantic + '_change' : 'memory_change';
-      append(eventKind, { kind: semantic === 'memory' ? 'address_range' : semantic, name: after.targetId || undefined, rva: after.rva, runtimeAddress: after.runtimeAddress }, { before, after, diff: { changed: true, captureMode: 'bounded_range_polling', semanticKind: semantic, targetId: after.targetId || null, invariants: after.invariants || [], old: boundedBytesEvidence(before.bytesHex), new: boundedBytesEvidence(after.bytesHex) } }, Process.getCurrentThreadId(), 0);
-    }
-  }
-  lastSnapshots = current;
-}
-
-function callStack(context) {
-  if (!limits.captureCallStack) return [];
-  try { return Thread.backtrace(context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).map(symbol => symbol.toString()); } catch (_) { return []; }
-}
-
-function focusStart(config) {
-  if (active) throw new Error('focus session already active');
-  const module = Process.getModuleByName('Wow.exe');
-  wowModule = module;
-  limits = {
-    maxEvents: Number.isSafeInteger(config.maxEvents) && config.maxEvents > 0 ? config.maxEvents : 10000,
-    maxBytes: Number.isSafeInteger(config.maxBytes) && config.maxBytes > 0 ? config.maxBytes : 8388608,
-    sampling: typeof config.sampling === 'number' && config.sampling > 0 && config.sampling <= 1 ? config.sampling : 1,
-    captureArgs: config.captureArgs === true,
-    captureReturns: config.captureReturns === true,
-    captureCallStack: config.captureCallStack === true,
-    captureMemoryWrites: config.captureMemoryWrites === true,
-    captureObjectDiff: config.captureObjectDiff === true,
-    snapshotIntervalMs: Number.isSafeInteger(config.snapshotIntervalMs) && config.snapshotIntervalMs >= 0 ? config.snapshotIntervalMs : 1000
-  };
-  events = []; seq = 0; ingressOrdinal = 0; eventBytes = 0; droppedEventCount = 0; droppedByteCount = 0; droppedByReason = {}; dropWindows = {}; stacks = {}; invocationCounter = 0; ranges = [];
-  const ids = [];
-  const verifiedHooks = Array.isArray(config.verifiedHookTargets) ? config.verifiedHookTargets : [];
-  const rvas = [];
-  if (config.rva) rvas.push(config.rva);
-  if (Array.isArray(config.rvas)) rvas.push(...config.rvas);
-  if (rvas.length && verifiedHooks.length !== rvas.length) throw new Error('HOOK_TARGET_UNVERIFIED: verified target count mismatch (rvas=' + rvas.length + ', verified=' + verifiedHooks.length + ')');
-  const pendingHooks = [];
-  for (const raw of rvas) {
-    const expected = verifiedHooks.find(value => String(value.rva).toLowerCase() === String(raw).toLowerCase());
-    if (!expected || expected.abiStatus !== 'confirmed' || !expected.functionBoundary || expected.functionBoundary.status !== 'confirmed') throw new Error('HOOK_TARGET_UNVERIFIED:' + raw);
-    const address = module.base.add(ptr(raw));
-    if (address.toString().toLowerCase() !== String(expected.runtimeAddress).toLowerCase()) throw new Error('HOOK_TARGET_ADDRESS_MISMATCH:' + raw);
-    if (address.compare(module.base) < 0 || address.add(expected.entryBytesLength).compare(module.base.add(module.size)) > 0) throw new Error('HOOK_TARGET_RANGE_INVALID:' + raw);
-    const entryRange = Process.findRangeByAddress(address);
-    if (!entryRange || entryRange.protection.indexOf('r') < 0 || entryRange.protection.indexOf('x') < 0 || address.add(expected.entryBytesLength).compare(entryRange.base.add(entryRange.size)) > 0) throw new Error('HOOK_TARGET_NOT_EXECUTABLE:' + raw);
-    const actual = address.readByteArray(expected.entryBytesLength);
-    const actualHex = actual ? Array.prototype.map.call(new Uint8Array(actual), b => ('0' + b.toString(16)).slice(-2)).join('') : '';
-    if (actualHex.toLowerCase() !== String(expected.entryBytesHex).toLowerCase()) throw new Error('HOOK_TARGET_BYTES_MISMATCH:' + raw);
-    pendingHooks.push({ raw, address, entryRange });
-  }
-  for (const item of pendingHooks) {
-    const raw = item.raw; const address = item.address; const entryRange = item.entryRange;
-    const target = { kind: config.kind, rva: String(raw), runtimeAddress: address.toString() };
-    const listener = Interceptor.attach(address, {
-      onEnter(args) {
-        this.focusTarget = target;
-        const key = String(this.threadId); const stack = stacks[key] || []; const invocationId = 'gumjs:' + (++invocationCounter); const parentInvocationId = stack.length ? stack[stack.length - 1] : null; stack.push(invocationId); stacks[key] = stack; this.focusInvocationId = invocationId; this.focusParentInvocationId = parentInvocationId; this.focusDepth = stack.length;
-        append('enter', target, { arguments: limits.captureArgs ? [args[0] ? args[0].toString() : null] : [], callStack: callStack(this.context), invocationId, parentInvocationId, recursive: stack.length > 1 }, this.threadId, this.focusDepth);
-      },
-      onLeave(retval) {
-        append('leave', this.focusTarget || target, { returnValue: limits.captureReturns ? retval.toString() : undefined, invocationId: this.focusInvocationId, parentInvocationId: this.focusParentInvocationId, recursive: (this.focusDepth || 1) > 1 }, this.threadId, this.focusDepth || 1);
-        const key = String(this.threadId); const stack = stacks[key] || []; stack.pop(); if (stack.length) stacks[key] = stack; else delete stacks[key];
-      }
-    });
-    listeners.push(listener); ids.push('interceptor-' + ids.length);
-    if (entryRange && address.add(16).compare(entryRange.base.add(entryRange.size)) <= 0) ranges.push({ rva: String(raw), runtimeAddress: address.toString(), size: 16, protection: entryRange.protection, watch: false });
-  }
-  if (Array.isArray(config.ranges)) for (const range of config.ranges) {
-    const address = module.base.add(ptr(range.rva)); const queried = Process.findRangeByAddress(address);
-    if (!queried || queried.protection.indexOf('r') < 0 || range.size <= 0 || address.compare(module.base) < 0 || address.add(range.size).compare(module.base.add(module.size)) > 0 || address.add(range.size).compare(queried.base.add(queried.size)) > 0) throw new Error('RANGE_VALIDATION_FAILED:' + range.rva);
-    ranges.push({ rva: String(range.rva), runtimeAddress: address.toString(), size: range.size, protection: queried.protection, watch: true, semanticKind: range.semanticKind || 'memory', targetId: range.targetId || null, invariants: Array.isArray(range.invariants) ? range.invariants : [] });
-  }
-  lastSnapshots = snapshot('before').ranges;
-  const invalidBefore = lastSnapshots.find(value => value.valid !== true);
-  if (invalidBefore) {
-    for (const listener of listeners.splice(0)) { try { listener.detach(); } catch (_) {} }
-    ranges = []; lastSnapshots = [];
-    throw new Error('INVARIANT_VALIDATION_FAILED:' + JSON.stringify({ code: 'INVARIANT_VALIDATION_FAILED', status: 'unresolved', range: invalidBefore }));
-  }
-  active = true; admitting = false;
-  if (ranges.length && limits.snapshotIntervalMs > 0) snapshotTimer = setInterval(pollRanges, limits.snapshotIntervalMs);
-  return { active, hookIds: ids, moduleBase: module.base.toString() };
-}
-function focusSnapshot(phase) { return snapshot(phase || 'checkpoint'); }
-function focusPause() { admitting = false; return focusStatus(); }
-function focusResume() { if (!active) throw new Error('focus session is not active'); lastSnapshots = snapshot('resume').ranges; admitting = true; return focusStatus(); }
-function focusStatus() { return { active, admitting, captureMode: 'bounded_range_polling', newestSeq: seq, eventBytes, ingressOrdinal, droppedEventCount, droppedByteCount, droppedByReason, dropWindows }; }
-function focusRead(afterSeq, limit) { return { ...focusStatus(), events: events.filter(e => e.seq > afterSeq).slice(0, limit) }; }
-function focusStop() { admitting = false; if (snapshotTimer !== null) { clearInterval(snapshotTimer); snapshotTimer = null; } for (const listener of listeners.splice(0)) { try { listener.detach(); } catch (_) {} } active = false; return { ...focusStatus(), hooks: 0, scripts: 0, interceptors: 0 }; }
-rpc.exports = { focusStart, focusSnapshot, focusPause, focusResume, focusRead, focusStatus, focusStop, dispose: focusStop };
-`;
-function streamForEvent(event, files) {
-    const kind = event.event.kind;
-    if (["memory_change", "object_change", "container_change", "snapshot", "checkpoint", "pause", "resume", "cleanup", "overflow"].includes(kind))
-        return files.data;
-    if (event.target.kind === "lua_wrapper")
-        return files.lua;
-    return files.cpp;
-}
-async function writeJsonAtomic(file, value) {
-    await writeJsonAtomicGuarded(file, value, () => true);
-}
-async function writeJsonAtomicGuarded(file, value, ownsPublication, beforePublish, publicationSignal) {
-    const temporary = `${file}.tmp-${process.pid}-${randomUUID()}`;
-    const payload = JSON.stringify(value, null, 2) + "\n";
-    let handle;
-    try {
-        handle = await open(temporary, "wx", 0o600);
-        await handle.writeFile(payload, "utf8");
-        await handle.sync();
-        await handle.close();
-        handle = undefined;
-        if (!await waitForPublication(beforePublish, publicationSignal)) {
-            await unlink(temporary).catch(() => undefined);
-            return false;
-        }
-        if (publicationSignal?.aborted || !ownsPublication()) {
-            await unlink(temporary).catch(() => undefined);
-            return false;
-        }
-        await rename(temporary, file);
-        await syncParentDirectory(file);
-        return true;
-    }
-    catch (error) {
-        await handle?.close().catch(() => undefined);
-        await unlink(temporary).catch(() => undefined);
-        throw error;
-    }
-}
-async function waitForPublication(beforePublish, signal) {
-    if (signal?.aborted)
-        return false;
-    if (!beforePublish)
-        return true;
-    if (!signal) {
-        await beforePublish();
-        return true;
-    }
-    let abortListener;
-    const aborted = new Promise(resolve => {
-        abortListener = () => resolve(false);
-        signal.addEventListener("abort", abortListener, { once: true });
-    });
-    try {
-        // Promise.race keeps a rejection handler attached to a late hook promise,
-        // so cancellation cannot turn a later hook rejection into an unhandled one.
-        return await Promise.race([
-            Promise.resolve().then(beforePublish).then(() => !signal.aborted),
-            aborted
-        ]);
-    }
-    finally {
-        if (abortListener)
-            signal.removeEventListener("abort", abortListener);
-    }
-}
-async function drainAbortedPublications(publications, signal) {
-    const pending = [...publications];
-    if (pending.length === 0)
-        return true;
-    const drained = Promise.allSettled(pending).then(() => true);
-    if (!signal)
-        return drained;
-    // Let abort-aware guarded writers enter their unlink/finally path before
-    // observing a concurrently expiring aggregate cleanup signal.
-    await Promise.resolve();
-    if (signal.aborted)
-        return false;
-    let abortListener;
-    const deadline = new Promise(resolve => {
-        abortListener = () => resolve(false);
-        signal.addEventListener("abort", abortListener, { once: true });
-    });
-    try {
-        return await Promise.race([drained, deadline]);
-    }
-    finally {
-        if (abortListener)
-            signal.removeEventListener("abort", abortListener);
-    }
-}
-async function syncParentDirectory(file) {
-    let handle;
-    try {
-        handle = await open(dirname(file), "r");
-        await handle.sync();
-    }
-    catch (error) {
-        const code = error?.code;
-        if (!code || !["EACCES", "EBADF", "EISDIR", "EINVAL", "ENOSYS", "ENOTSUP", "EPERM"].includes(code))
-            throw error;
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-}
-export async function appendJsonlDurable(file, line, signal, hooks = {}) {
-    signal?.throwIfAborted();
-    await recoverJsonlTail(file);
-    signal?.throwIfAborted();
-    const handle = await open(file, "a+", 0o600);
-    let closed = false;
-    const close = async () => {
-        if (closed)
-            return;
-        closed = true;
-        await handle.close();
-    };
-    const originalLength = Number((await handle.stat()).size);
-    try {
-        let prefix = "";
-        if (originalLength > 0) {
-            const lastByte = Buffer.alloc(1);
-            await handle.read(lastByte, 0, 1, originalLength - 1);
-            if (lastByte[0] !== 0x0a)
-                prefix = "\n";
-        }
-        const payload = Buffer.from(`${prefix}${line}\n`, "utf8");
-        signal?.throwIfAborted();
-        if (hooks.write)
-            await hooks.write(handle, payload, signal);
-        else
-            await handle.writeFile(payload, { signal });
-        // Abort is checked before the durability barrier only. Once sync starts,
-        // the append is committed and its sequence/byte accounting must stand.
-        throwIfAborted(signal);
-        if (hooks.sync)
-            await hooks.sync(handle);
-        else
-            await handle.sync();
-    }
-    catch (error) {
-        await close().catch(() => undefined);
-        try {
-            await rollbackJsonlAppend(file, originalLength, error);
-        }
-        catch (rollbackError) {
-            if (error && typeof error === "object")
-                Object.assign(error, { rollbackError: errorText(rollbackError) });
-            else
-                throw new AggregateError([error, rollbackError], "STREAM_APPEND_ROLLBACK_FAILED");
-        }
-        throw error;
-    }
-    finally {
-        await close();
-    }
-}
-function throwIfAborted(signal) {
-    if (!signal?.aborted)
-        return;
-    const reason = signal.reason;
-    if (reason && typeof reason === "object" && "name" in reason)
-        throw reason;
-    const error = new Error("The append was aborted");
-    error.name = "AbortError";
-    throw error;
-}
-async function rollbackJsonlAppend(file, originalLength, cause) {
-    let content;
-    try {
-        content = await readFile(file);
-    }
-    catch (error) {
-        if (error.code === "ENOENT" && originalLength === 0)
-            return;
-        throw error;
-    }
-    if (content.length < originalLength)
-        throw new Error(`STREAM_APPEND_BASE_CHANGED:${file}`);
-    const appended = content.subarray(originalLength);
-    let restoreError;
-    try {
-        const handle = await open(file, "r+");
-        try {
-            await handle.truncate(originalLength);
-            await handle.sync();
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch (error) {
-        restoreError = error;
-    }
-    let evidenceError;
-    if (appended.length > 0) {
-        try {
-            await writeAppendRollbackEvidence(file, originalLength, appended, cause);
-        }
-        catch (error) {
-            evidenceError = error;
-        }
-    }
-    if (restoreError && evidenceError)
-        throw new AggregateError([restoreError, evidenceError], "STREAM_APPEND_ROLLBACK_AND_EVIDENCE_FAILED");
-    if (restoreError)
-        throw restoreError;
-    if (evidenceError)
-        throw evidenceError;
-}
-async function writeAppendRollbackEvidence(file, offset, bytes, cause) {
-    const sha256 = createHash("sha256").update(bytes).digest("hex");
-    const causeText = errorText(cause);
-    const evidenceKey = createHash("sha256").update(bytes).update(causeText).digest("hex");
-    const preview = bytes.subarray(0, 1024 * 1024);
-    const quarantine = `${file}.append-${evidenceKey}.quarantine.json`;
-    const evidence = JSON.stringify({
-        schemaVersion: 1,
-        kind: "focused-jsonl-append-rollback",
-        sourcePath: resolve(file),
-        byteOffset: offset,
-        bytes: bytes.length,
-        sha256,
-        encoding: "base64",
-        data: preview.toString("base64"),
-        dataBytes: preview.length,
-        dataTruncated: preview.length !== bytes.length,
-        cause: causeText,
-    }) + "\n";
-    try {
-        const handle = await open(quarantine, "wx", 0o600);
-        let complete = false;
-        try {
-            await handle.writeFile(evidence, "utf8");
-            await handle.sync();
-            complete = true;
-        }
-        finally {
-            await handle.close().catch(() => undefined);
-            if (!complete)
-                await unlink(quarantine).catch(() => undefined);
-        }
-    }
-    catch (error) {
-        if (error.code !== "EEXIST")
-            throw error;
-        const prior = await readFile(quarantine, "utf8");
-        if (prior !== evidence)
-            throw new Error(`STREAM_QUARANTINE_CONFLICT:${quarantine}`);
-    }
-}
-async function readRecoveredFile(file) {
-    await recoverJsonlTail(file);
-    return readFile(file).catch(error => {
-        if (error.code === "ENOENT")
-            return Buffer.alloc(0);
-        throw error;
-    });
-}
-async function recoverJsonlTail(file) {
-    let content;
-    try {
-        content = await readFile(file);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    if (content.length === 0 || content.at(-1) === 0x0a)
-        return;
-    const offset = content.lastIndexOf(0x0a) + 1;
-    const tail = content.subarray(offset);
-    try {
-        JSON.parse(tail.toString("utf8"));
-        return;
-    }
-    catch (error) {
-        if (!isIncompleteJsonTail(tail))
-            throw new Error(`STREAM_TAIL_CORRUPT:${file}:${error instanceof Error ? error.message : String(error)}`);
-    }
-    const sha256 = createHash("sha256").update(tail).digest("hex");
-    const quarantine = `${file}.tail-${sha256}.quarantine.json`;
-    const evidence = JSON.stringify({ schemaVersion: 1, kind: "focused-jsonl-incomplete-tail", sourcePath: resolve(file), byteOffset: offset, bytes: tail.length, sha256, encoding: "base64", data: tail.toString("base64") }) + "\n";
-    try {
-        const quarantineHandle = await open(quarantine, "wx");
-        let complete = false;
-        try {
-            await quarantineHandle.writeFile(evidence, "utf8");
-            await quarantineHandle.sync();
-            complete = true;
-        }
-        finally {
-            await quarantineHandle.close().catch(() => undefined);
-            if (!complete)
-                await unlink(quarantine).catch(() => undefined);
-        }
-    }
-    catch (error) {
-        if (error.code !== "EEXIST")
-            throw error;
-        const prior = await readFile(quarantine, "utf8");
-        if (prior !== evidence)
-            throw new Error(`STREAM_QUARANTINE_CONFLICT:${quarantine}`);
-    }
-    const handle = await open(file, "r+");
-    try {
-        await handle.truncate(offset);
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-}
-function isIncompleteJsonTail(tail) {
-    const text = tail.toString("utf8").trimStart();
-    if (!text.startsWith("{"))
-        return false;
-    const stack = [];
-    let inString = false;
-    let escaped = false;
-    for (let index = 0; index < text.length; index += 1) {
-        const character = text[index];
-        if (inString) {
-            if (escaped)
-                escaped = false;
-            else if (character === "\\")
-                escaped = true;
-            else if (character === '"')
-                inString = false;
-            continue;
-        }
-        if (character === '"')
-            inString = true;
-        else if (character === "{" || character === "[")
-            stack.push(character);
-        else if (character === "}" || character === "]") {
-            const expected = character === "}" ? "{" : "[";
-            if (stack.pop() !== expected)
-                return false;
-            if (stack.length === 0 && text.slice(index + 1).trim())
-                return false;
-        }
-    }
-    return inString || escaped || stack.length > 0;
-}
-function normalizeTimelineKind(kind) {
-    return ["snapshot", "enter", "leave", "memory_change", "object_change", "container_change", "exception", "checkpoint", "pause", "resume", "overflow", "cleanup"].includes(kind)
-        ? kind
-        : "exception";
-}
-function isTargetKind(value) { return ["lua_wrapper", "cpp_function", "data_source", "object", "address_range"].includes(String(value)); }
-function selectorTarget(selector, moduleBase) { return { kind: selector.kind, rva: selector.rva, runtimeAddress: selector.rva ? addHex(moduleBase, selector.rva) : undefined }; }
-function addHex(base, rva) { try {
-    return `0x${(BigInt(base) + BigInt(rva)).toString(16)}`;
-}
-catch {
-    return base;
-} }
-function canonicalRva(value) { try {
-    return `0x${BigInt(value).toString(16).toUpperCase()}`;
-}
-catch {
-    throw new Error(`invalid RVA ${value}`);
-} }
-function isSha256(value) { return typeof value === "string" && /^[0-9a-f]{64}$/i.test(value); }
-function isConfirmedFunctionBoundary(value) {
-    return isRecord(value) && value.status === "confirmed" && typeof value.startVa === "string" && typeof value.size === "string";
-}
-function validateVerifiedHookTargets(values, request) {
-    if (!Array.isArray(values) || values.length !== request.rvas.length)
-        throw new FocusRequestError("SELECTOR_INVALID", "HOOK_TARGET_UNVERIFIED: verified target count mismatch");
-    const requested = new Set(request.rvas.map(canonicalRva));
-    const seen = new Set();
-    for (const value of values) {
-        const rva = canonicalRva(value.rva);
-        if (!requested.has(rva) || seen.has(rva))
-            throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: unexpected or duplicate target ${rva}`);
-        seen.add(rva);
-        if (value.abiStatus !== "confirmed" || !isConfirmedFunctionBoundary(value.functionBoundary) || !isSha256(value.entryBytesSha256) || !/^[0-9a-f]+$/i.test(value.entryBytesHex) || value.entryBytesHex.length !== value.entryBytesLength * 2 || value.entryBytesLength < 16 || value.entryBytesLength > 64)
-            throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: incomplete evidence for ${rva}`);
-        const recomputedHash = createHash("sha256").update(Buffer.from(value.entryBytesHex, "hex")).digest("hex");
-        if (recomputedHash !== value.entryBytesSha256.toLowerCase())
-            throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: entry hash does not match entry bytes for ${rva}`);
-        if (value.runtimeAddress.toLowerCase() !== addHex(request.moduleBase, rva).toLowerCase())
-            throw new FocusRequestError("SELECTOR_INVALID", `HOOK_TARGET_UNVERIFIED: runtime address mismatch for ${rva}`);
-    }
-    return values.map(value => ({ ...value, rva: canonicalRva(value.rva), entryBytesHex: value.entryBytesHex.toLowerCase(), entryBytesSha256: value.entryBytesSha256.toLowerCase() }));
-}
-function requiredString(value, field, fallback) { const v = typeof value === "string" && value.trim() ? value : fallback; if (!v)
-    throw new Error(`${field} is required`); return v; }
-function requiredSessionId(value) { const id = requiredString(value, "sessionId"); if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(id))
-    throw new Error("SESSION_ID_INVALID"); return id; }
-function positiveInt(value, field) { if (!Number.isSafeInteger(value) || Number(value) <= 0)
-    throw new Error(`${field} must be a positive integer`); return Number(value); }
-function bounded(value, fallback, min, max) { if (value === undefined)
-    return fallback; if (!Number.isSafeInteger(value) || Number(value) < min || Number(value) > max)
-    throw new Error(`value must be an integer in [${min},${max}]`); return Number(value); }
-function boundedNumber(value, fallback, min, max) { if (value === undefined)
-    return fallback; if (typeof value !== "number" || !Number.isFinite(value) || value < min || value > max)
-    throw new Error(`value must be in [${min},${max}]`); return value; }
-function bool(value) { return value === true; }
-function requiredRecord(value, field) { if (!isRecord(value))
-    throw new Error(`${field} is required`); return value; }
-function isRecord(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
-function stringValue(value) { return typeof value === "string" && value.trim() ? value : undefined; }
-function numberValue(value) { return typeof value === "number" && Number.isSafeInteger(value) ? value : undefined; }
-function errorText(error) { return error instanceof Error ? error.message : String(error); }
-function validateTriggerPlanOrder(plan) {
-    let lastRank = -1;
-    const ranks = { before: 0, during: 1, after: 2 };
-    for (const phase of plan.phases ?? []) {
-        const rank = ranks[phase.phase];
-        if (rank < lastRank)
-            throw new Error("TRIGGER_PLAN_INVALID: phases must be ordered before, during, after");
-        lastRank = rank;
-    }
-}
-function arrayOfRecords(value) { return Array.isArray(value) ? value.filter(isRecord) : []; }
-function arrayOfStrings(value) { return Array.isArray(value) ? value.filter(item => typeof item === "string") : []; }
-function stripSelectorFields(selector) {
-    return {
-        combine: selector.combine,
-        ...(selector.apis ? { apis: selector.apis } : {}),
-        ...(selector.namespaces ? { namespaces: selector.namespaces } : {}),
-        ...(selector.globs ? { globs: selector.globs } : {}),
-        ...(selector.rvas ? { rvas: selector.rvas } : {}),
-        ...(selector.dataSourceIds ? { dataSourceIds: selector.dataSourceIds } : {}),
-        ...(selector.objectIds ? { objectIds: selector.objectIds } : {}),
-        ...(selector.ranges ? { ranges: selector.ranges } : {}),
-        maxTargets: selector.maxTargets
-    };
-}
-function globMatch(pattern, value) {
-    let source = "^";
-    let escaped = false;
-    for (const character of pattern) {
-        if (escaped) {
-            source += escapeRegex(character);
-            escaped = false;
-            continue;
-        }
-        if (character === "\\") {
-            escaped = true;
-            continue;
-        }
-        if (character === "*")
-            source += ".*";
-        else if (character === "?")
-            source += ".";
-        else
-            source += escapeRegex(character);
-    }
-    if (escaped)
-        return false;
-    return new RegExp(`${source}$`, "u").test(value);
-}
-function escapeRegex(value) { return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&"); }