daemon-sec-lotl

build-dataset.mjs (24912B)

---

 /**
  * DÆMONBins dataset builder.
  *
  * Reads the three vendored upstreams under vendor/ plus the daemon-sec WADComs
  * additions (and, if present, the DÆMON modernization backlog), normalizes
  * every source to one filterable atom — a Technique — and emits:
  *
  *   src/data/techniques.json     full canonical array (committed; Astro imports it)
  *   src/data/tools.json          per-tool metadata (aliases, Full_Path, contributors)
  *   src/data/facets.json         derived facet indexes + counts
  *   public/data/techniques.json  copy served statically for the catalog island fetch
  *
  * Run locally with `npm run data`. CI never runs this — it builds Astro +
  * Pagefind over the committed JSON. Deterministic: IDs derive from
  * source + tool + index, no wall-clock.
  *
  * All three upstreams are GPL-3.0, so the merged dataset is GPL-3.0.
  */
 import { readFileSync, writeFileSync, readdirSync, existsSync, mkdirSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve } from 'node:path';
 import yaml from 'js-yaml';
 import { enrich, stableId } from './enrich-data.mjs';
 import { impacketScript, canonicalizeFamilyCase } from './wadcoms-normalize.mjs';
 import { PLATFORMS, SOURCES, CAPABILITIES, validateTechniques } from './technique-schema.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = resolve(__dirname, '..');
 const VENDOR = join(ROOT, 'vendor');
 const OUT_SRC = join(ROOT, 'src', 'data');
 const OUT_PUB = join(ROOT, 'public', 'data');
 // Source of truth for the 134 daemon-authored WADComs additions.
 const WADCOMS_JSON = join(OUT_SRC, 'sources', 'wadcoms-additions.json');
 // Optional: the §7 modernization backlog, emitted by the daemonbins-backlog workflow.
 const BACKLOG_JSON = join(OUT_SRC, 'daemon-backlog.json');
 
 // ---------------------------------------------------------------------------
 // Unified vocabulary
 // ---------------------------------------------------------------------------
 // PLATFORMS / SOURCES / CAPABILITIES + TechniqueSchema live in technique-schema.mjs
 // (shared with validate-data.mjs and the one-shot migrations).
 
 // GTFOBins function → capability (BUILD-PROMPT §5)
 const GTFO_FN_CAP = {
   shell: ['Execution'],
   command: ['Execution'],
   'reverse-shell': ['Reverse/Bind Shell'],
   'bind-shell': ['Reverse/Bind Shell'],
   'file-write': ['File Write'],
   'file-read': ['File Read'],
   upload: ['File Upload'],
   download: ['File Download'],
   'library-load': ['Library Load'],
   'privilege-escalation': ['Privilege Escalation'],
 };
 // GTFOBins function → MITRE fallback (from _data/functions.yml)
 const GTFO_FN_MITRE = {
   shell: ['T1059'], command: ['T1059'],
   'reverse-shell': ['T1059', 'T1071'], 'bind-shell': ['T1059', 'T1071'],
   'file-write': ['T1565'], 'file-read': ['T1005'],
   upload: ['T1041'], download: ['T1105'],
   'library-load': ['T1574'], 'privilege-escalation': ['T1548'],
 };
 
 // LOLBAS Category → capability (BUILD-PROMPT §5)
 const LOLBAS_CAT_CAP = {
   Execute: ['Execution'],
   'AWL Bypass': ['AWL / Policy Bypass'],
   Download: ['File Download'],
   Upload: ['File Upload'],
   Copy: ['File Copy'],
   Encode: ['Defense Evasion'],
   Decode: ['Defense Evasion'],
   ADS: ['Defense Evasion', 'File Write'],
   Conceal: ['Defense Evasion'],
   Tamper: ['Defense Evasion'],
   Compile: ['Compile'],
   Credentials: ['Credential Access'],
   Dump: ['Credential Access'],
   Reconnaissance: ['Discovery'],
   'UAC Bypass': ['UAC Bypass', 'Privilege Escalation'],
 };
 
 // WADComs attack_type → capability (BUILD-PROMPT §5). Kept forgiving: unknown
 // values simply don't add a capability, but are always kept in nativeCategory.
 const WAD_ATTACK_CAP = {
   Enumeration: ['Enumeration'],
   Discovery: ['Discovery'],
   Exploitation: ['Execution'],
   PrivEsc: ['Privilege Escalation'],
   'Privilege Escalation': ['Privilege Escalation'],
   Persistence: ['Persistence'],
   'Credential Access': ['Credential Access'],
   'Lateral Movement': ['Lateral Movement'],
   'Defense Evasion': ['Defense Evasion'],
   Collection: ['Collection'],
 };
 
 // Services / items that flag Active Directory scope (BUILD-PROMPT §5).
 const AD_SERVICES = new Set(['SMB', 'LDAP', 'Kerberos', 'RPC', 'WMI', 'DCOM', 'NTLM', 'DNS', 'WinRM', 'MSSQL', 'ADCS']);
 const AD_ITEMS = new Set(['TGS', 'TGT', 'PFX', 'AES_Key']);
 
 // GTFOBins binaries that are also standard on macOS (the classic POSIX/BSD
 // userland). Tagged Linux+macOS; everything else stays Linux-only rather than
 // risk a false macOS claim.
 const GTFO_MACOS = new Set([
   'awk', 'base64', 'basename', 'bash', 'bridge', 'busybox', 'cat', 'chmod', 'chown', 'cp',
   'csh', 'cut', 'date', 'dd', 'df', 'diff', 'dig', 'dmesg', 'du', 'ed', 'env', 'expand',
   'expect', 'file', 'find', 'flock', 'fmt', 'fold', 'ftp', 'gawk', 'gcc', 'gdb', 'gem',
   'genie', 'git', 'grep', 'gzip', 'head', 'hexdump', 'iconv', 'irb', 'jjs', 'join', 'jq',
   'ksh', 'ld.so', 'less', 'ln', 'logsave', 'look', 'lua', 'mail', 'make', 'man', 'more',
   'mv', 'nano', 'nawk', 'nc', 'nice', 'nl', 'nmap', 'node', 'nohup', 'od', 'openssl',
   'perl', 'pexec', 'php', 'pico', 'pip', 'python', 'python2', 'python3', 'rake', 'readelf',
   'ruby', 'run-parts', 'rvim', 'scp', 'screen', 'script', 'sed', 'setarch', 'sftp', 'sh',
   'smbclient', 'socat', 'sort', 'sqlite3', 'ss', 'ssh', 'stdbuf', 'strace', 'systemctl',
   'tac', 'tail', 'tar', 'taskset', 'tbl', 'tclsh', 'tcpdump', 'tee', 'telnet', 'tftp',
   'time', 'timeout', 'tmux', 'top', 'ul', 'unexpand', 'uniq', 'unshare', 'unzip', 'vi',
   'vim', 'watch', 'wc', 'wget', 'xargs', 'xxd', 'zip', 'zsh', 'zypper',
 ]);
 
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 const uniq = (a) => [...new Set(a.filter((x) => x != null && x !== ''))];
 const asArray = (x) => (Array.isArray(x) ? x : x == null ? [] : [x]);
 
 function listFiles(dir) {
   if (!existsSync(dir)) return [];
   return readdirSync(dir).filter((f) => {
     try { return statSync(join(dir, f)).isFile(); } catch { return false; }
   });
 }
 
 function parseGtfoFile(content) {
   // Whole-file Jekyll front matter: strip leading `---` and trailing `...`.
   const body = content.replace(/^---\r?\n/, '').replace(/\r?\n?\.\.\.\s*$/, '');
   return yaml.load(body) || {};
 }
 
 function parseFrontMatter(content) {
   // Tolerate a leading BOM / blank lines before the `---` (some upstream
   // WADComs files, e.g. Rubeus-s4u.md, open with a blank line).
   const s = content.replace(/^/, '').replace(/^\s+/, '');
   const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(s);
   if (!m) return {};
   return yaml.load(m[1]) || {};
 }
 
 function parseMitreFromRefs(refs) {
   const out = [];
   for (const r of asArray(refs)) {
     const re = /attack\.mitre\.org\/techniques\/(T\d{4})(?:\/(\d{3}))?/gi;
     let m;
     while ((m = re.exec(String(r))) !== null) out.push(m[2] ? `${m[1]}.${m[2]}` : m[1]);
   }
   return uniq(out);
 }
 
 function normPrivilege(raw) {
   const s = String(raw || '').toLowerCase();
   if (!s) return undefined;
   if (/(system|nt authority|trustedinstaller)/.test(s)) return 'system';
   if (/(admin|elevated|high integrity|local administrator)/.test(s)) return 'admin';
   return 'user';
 }
 
 const lolbasUrlType = { OSBinaries: 'Binaries', OSLibraries: 'Libraries', OSScripts: 'Scripts', OtherMSBinaries: 'OtherMSBinaries' };
 const lolbasType = { OSBinaries: 'Binary', OSLibraries: 'Library', OSScripts: 'Script', OtherMSBinaries: 'OtherMSBinary' };
 
 
 // ---------------------------------------------------------------------------
 // GTFOBins
 // ---------------------------------------------------------------------------
 function ingestGtfobins() {
   const dir = join(VENDOR, 'gtfobins', '_gtfobins');
   const files = listFiles(dir);
   const techniques = [];
   const tools = new Map();
   const aliasEdges = []; // {from: aliasFile, to: canonical}
 
   // Pass 1 — parse every file into a map.
   const parsed = new Map();
   for (const bin of files) {
     const data = parseGtfoFile(readFileSync(join(dir, bin), 'utf8'));
     parsed.set(bin, data);
   }
 
   // Resolve the function set a binary exposes (for inherit capability union).
   const funcsOf = (bin, seen = new Set()) => {
     if (seen.has(bin)) return [];
     seen.add(bin);
     const d = parsed.get(bin);
     if (!d) return [];
     if (d.alias) return funcsOf(String(d.alias), seen);
     return Object.keys(d.functions || {}).filter((f) => f !== 'inherit');
   };
 
   for (const bin of files) {
     const data = parsed.get(bin);
     if (data.alias) { aliasEdges.push({ from: bin, to: String(data.alias) }); continue; }
     const fns = data.functions || {};
     const toolId = `gtfo:${bin}`;
     const pageUrl = `https://gtfobins.github.io/gtfobins/${bin}/`;
     const platform = GTFO_MACOS.has(bin) ? ['Linux', 'macOS'] : ['Linux'];
     if (!tools.has(toolId)) {
       tools.set(toolId, { id: toolId, name: bin, source: 'GTFOBins', platform, aliases: [], references: [pageUrl], count: 0 });
     }
 
     for (const [fn, examples] of Object.entries(fns)) {
       asArray(examples).forEach((ex, i) => {
         const contexts = ex.contexts && Object.keys(ex.contexts).length ? Object.keys(ex.contexts) : ['unprivileged'];
         contexts.forEach((ctx) => {
           const ctxObj = ex.contexts?.[ctx] || null;
           const command = (ctxObj && ctxObj.code) || ex.code;
           if (!command || !String(command).trim()) return;
 
           let capability, nativeCategory, mitre, name;
           if (fn === 'inherit') {
             const from = String(ex.from || '');
             const inheritedFns = funcsOf(from);
             const caps = uniq(inheritedFns.flatMap((f) => GTFO_FN_CAP[f] || []));
             capability = caps.length ? caps : ['Execution'];
             const mit = uniq(inheritedFns.flatMap((f) => GTFO_FN_MITRE[f] || []));
             mitre = uniq([...(ex.mitre || []), ...(mit.length ? mit : ['T1059'])]);
             nativeCategory = uniq(['inherit', ...inheritedFns.map((f) => `from:${from}`)]);
             name = `inherit ← ${from}`;
           } else {
             capability = [...(GTFO_FN_CAP[fn] || ['Execution'])];
             nativeCategory = [fn];
             mitre = uniq([...(ex.mitre || []), ...(GTFO_FN_MITRE[fn] || [])]);
             name = fn;
           }
           // sudo/suid/capabilities contexts also grant Privilege Escalation.
           if ((ctx === 'sudo' || ctx === 'suid' || ctx === 'capabilities') && !capability.includes('Privilege Escalation')) {
             capability = [...capability, 'Privilege Escalation'];
           }
 
           techniques.push({
             id: `gtfo:${bin}:${fn}:${i}:${ctx}`,
             toolId, toolName: bin, name,
             source: 'GTFOBins', platform,
             capability, nativeCategory,
             command: String(command),
             description: (ctxObj && ctxObj.comment) || ex.comment || undefined,
             mitre,
             privilege: ctx,
             context: ctx,
             references: [pageUrl],
           });
           tools.get(toolId).count++;
         });
       });
     }
   }
 
   // Attach aliases to their canonical tool.
   for (const { from, to } of aliasEdges) {
     const t = tools.get(`gtfo:${to}`);
     if (t) t.aliases.push(from);
   }
   return { techniques, tools: [...tools.values()], aliasCount: aliasEdges.length };
 }
 
 // ---------------------------------------------------------------------------
 // LOLBAS
 // ---------------------------------------------------------------------------
 function ingestLolbas() {
   const base = join(VENDOR, 'lolbas', 'yml');
   const dirs = ['OSBinaries', 'OSLibraries', 'OSScripts', 'OtherMSBinaries']; // HonorableMentions skipped
   const techniques = [];
   const tools = [];
 
   for (const d of dirs) {
     const dir = join(base, d);
     for (const f of listFiles(dir).filter((x) => x.endsWith('.yml'))) {
       const data = yaml.load(readFileSync(join(dir, f), 'utf8')) || {};
       const name = data.Name || f.replace(/\.yml$/, '');
       const stem = name.replace(/\.(exe|dll|ps1|com|scr|bat|cmd|vbs|js|msc|cpl|inf)$/i, '');
       // Slug the FULL name (extension included) so exe/vbs twins such as
       // SyncAppvPublishingServer.{exe,vbs} stay distinct tools/ids.
       const nameSlug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
       const toolId = `lolbas:${nameSlug}`;
       const pageUrl = `https://lolbas-project.github.io/lolbas/${lolbasUrlType[d]}/${stem}/`;
       const fullPath = asArray(data.Full_Path).map((p) => p.Path).filter(Boolean);
       const aliases = asArray(data.Aliases).map((a) => a.Alias).filter(Boolean);
       const contributors = asArray(data.Acknowledgement)
         .map((a) => [a.Person, a.Handle].filter(Boolean).join(' '))
         .filter((s) => s && s.toLowerCase() !== 'unknown');
 
       tools.push({
         id: toolId, name, source: 'LOLBAS', platform: ['Windows'], toolType: lolbasType[d],
         aliases, fullPath, author: data.Author || undefined, created: data.Created || undefined,
         contributors, references: [pageUrl], count: 0,
       });
       const tool = tools[tools.length - 1];
 
       asArray(data.Commands).forEach((c, i) => {
         const cat = c.Category;
         const capability = LOLBAS_CAT_CAP[cat] ? [...LOLBAS_CAT_CAP[cat]] : ['Execution'];
         const detection = asArray(data.Detection).map((det) => {
           const key = ['IOC', 'Sigma', 'Analysis', 'Elastic', 'Splunk', 'BlockRule'].find((k) => det[k]);
           return key ? { type: key, value: String(det[key]) } : null;
         }).filter(Boolean);
         const references = uniq([...asArray(data.Resources).map((r) => r.Link), pageUrl]);
 
         techniques.push({
           id: `${toolId}:${i}`,
           toolId, toolName: name, name: cat,
           source: 'LOLBAS', platform: ['Windows'],
           capability, nativeCategory: [cat],
           command: String(c.Command || '').trim(),
           description: c.Description || undefined,
           usecase: c.Usecase || undefined,
           mitre: c.MitreID ? [String(c.MitreID)] : [],
           privilege: normPrivilege(c.Privileges),
           fullPath, toolType: lolbasType[d],
           detection: detection.length ? detection : undefined,
           references,
         });
         tool.count++;
       });
     }
   }
   return { techniques, tools };
 }
 
 // ---------------------------------------------------------------------------
 // WADComs — shared normalizer for upstream (.md) and daemon-authored (TS/JSON).
 // ---------------------------------------------------------------------------
 function wadPlatform(os, services, items) {
   const plats = new Set();
   for (const o of asArray(os)) {
     const s = String(o).toLowerCase();
     if (s.includes('windows')) plats.add('Windows');
     else if (s.includes('linux') || s.includes('unix')) plats.add('Linux');
     else if (s.includes('mac') || s.includes('osx') || s.includes('darwin')) plats.add('macOS');
   }
   const isAD = asArray(services).some((s) => AD_SERVICES.has(s)) || asArray(items).some((i) => AD_ITEMS.has(i));
   if (isAD) { plats.add('ActiveDirectory'); plats.add('Windows'); }
   if (plats.size === 0) plats.add('Windows');
   return [...plats];
 }
 
 function wadTechnique(entry, source) {
   const attackTypes = asArray(entry.attackTypes ?? entry.attack_types);
   const os = asArray(entry.os ?? entry.OS);
   const services = asArray(entry.services);
   const items = asArray(entry.items);
   const references = asArray(entry.references);
   const capability = uniq(attackTypes.flatMap((a) => WAD_ATTACK_CAP[a] || []));
   const slug = entry.slug;
   const family = String(slug).split('-')[0] || slug;
   // Impacket is a *suite* of independent example scripts, not one tool — file
   // each technique under its own `examples/<script>.py` so the ~48 Impacket
   // techniques split into per-script pages instead of collapsing onto one.
   let toolId = `wadcoms:${family}`;
   let toolName = family;
   if (family === 'Impacket') {
     const script = impacketScript(references, entry.command);
     if (script) { toolId = `wadcoms:Impacket-${script}`; toolName = `Impacket-${script}`; }
   }
   return {
     id: `wadcoms:${slug}`,
     toolId,
     toolName,
     name: entry.name || slug,
     source,
     platform: wadPlatform(os, services, items),
     capability,
     nativeCategory: attackTypes.slice(),
     command: String(entry.command || '').trim(),
     description: entry.description || undefined,
     mitre: parseMitreFromRefs(references),
     requires: items.length ? items : undefined,
     services: services.length ? services : undefined,
     references,
     added: source === 'DAEMON' ? true : undefined,
   };
 }
 
 function ingestWadcomsUpstream() {
   const dir = join(VENDOR, 'wadcoms', '_wadcoms');
   const techniques = [];
   for (const f of listFiles(dir).filter((x) => x.endsWith('.md'))) {
     const fm = parseFrontMatter(readFileSync(join(dir, f), 'utf8'));
     const slug = f.replace(/\.md$/, '');
     const t = wadTechnique({ ...fm, slug }, 'WADComs');
     if (t.command) techniques.push(t);
   }
   return techniques;
 }
 
 async function ingestWadcomsAdditions() {
   const entries = JSON.parse(readFileSync(WADCOMS_JSON, 'utf8'));
   if (!entries.length) throw new Error('Authored WADComs source is empty');
   return entries;
 }
 
 // ---------------------------------------------------------------------------
 // DÆMON modernization backlog (§7) — optional, from the workflow output.
 // ---------------------------------------------------------------------------
 function ingestBacklog() {
   if (!existsSync(BACKLOG_JSON)) {
     console.warn('  ! DÆMON backlog not found (src/data/daemon-backlog.json) — skipping §7 additions');
     return { techniques: [], tools: [] };
   }
   const raw = JSON.parse(readFileSync(BACKLOG_JSON, 'utf8'));
   const list = Array.isArray(raw) ? raw : raw.entries || raw.keep || [];
   const techniques = [];
   const toolMap = new Map();
   list.forEach((e, i) => {
     const toolId = `daemon:${e.toolId || String(e.toolName).toLowerCase().replace(/[^a-z0-9]+/g, '-')}`;
     const platform = (e.platform || []).filter((p) => PLATFORMS.includes(p));
     const capability = uniq((e.capability || []).filter((c) => CAPABILITIES.includes(c)));
     techniques.push({
       id: `daemon:${e.toolId || i}:${i}`,
       toolId, toolName: e.toolName,
       name: (e.nativeCategory && e.nativeCategory[0]) || undefined,
       source: 'DAEMON',
       platform: platform.length ? platform : ['Windows'],
       capability: capability.length ? capability : ['Execution'],
       nativeCategory: e.nativeCategory || [],
       command: String(e.command || '').trim(),
       description: e.description || undefined,
       usecase: e.usecase || undefined,
       mitre: uniq(e.mitre || []),
       privilege: e.privilege || undefined,
       detection: e.detection
         ? (Array.isArray(e.detection) ? e.detection : [{ type: 'Detection', value: String(e.detection) }])
         : undefined,
       references: asArray(e.references),
       added: true,
       verifyNote: e.verifyNote || undefined,
     });
     if (!toolMap.has(toolId)) {
       toolMap.set(toolId, { id: toolId, name: e.toolName, source: 'DAEMON', platform: platform.length ? platform : ['Windows'], references: asArray(e.references), count: 0 });
     }
     toolMap.get(toolId).count++;
   });
   return { techniques, tools: [...toolMap.values()] };
 }
 
 // Build per-tool records for the WADComs (upstream + daemon) techniques, which
 // carry no separate tool file.
 function toolsFromWad(techniques) {
   const map = new Map();
   for (const t of techniques) {
     if (!map.has(t.toolId)) {
       map.set(t.toolId, { id: t.toolId, name: t.toolName, source: t.source, platform: [], references: [], count: 0 });
     }
     const tool = map.get(t.toolId);
     tool.count++;
     tool.platform = uniq([...tool.platform, ...t.platform]);
     tool.references = uniq([...tool.references, ...t.references]);
     // A wadcoms tool family may hold both upstream and daemon entries; if any
     // is daemon-authored keep the source honest as mixed → prefer WADComs base.
     if (t.source === 'DAEMON' && tool.source !== 'DAEMON') tool.source = 'WADComs';
   }
   return [...map.values()];
 }
 
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 async function main() {
   console.log('DÆMONBins dataset build\n');
   for (const dir of ['gtfobins/_gtfobins', 'lolbas/yml', 'wadcoms/_wadcoms']) {
     if (!existsSync(join(VENDOR, dir))) throw new Error(`Missing upstream source: vendor/${dir}`);
   }
   const oldRows = JSON.parse(readFileSync(join(OUT_SRC, 'techniques.json'), 'utf8'));
 
   const gtfo = ingestGtfobins();
   console.log(`  GTFOBins : ${gtfo.techniques.length} techniques, ${gtfo.tools.length} tools (${gtfo.aliasCount} aliases)`);
 
   const lolbas = ingestLolbas();
   console.log(`  LOLBAS   : ${lolbas.techniques.length} techniques, ${lolbas.tools.length} tools`);
 
   const wadUp = ingestWadcomsUpstream();
   console.log(`  WADComs  : ${wadUp.length} techniques (upstream)`);
 
   const wadAdd = await ingestWadcomsAdditions();
   console.log(`  WADComs+ : ${wadAdd.length} techniques (daemon additions)`);
 
   const backlog = ingestBacklog();
   console.log(`  DÆMON §7 : ${backlog.techniques.length} techniques (modernization backlog)`);
 
   // Fold case-duplicate WADComs families (e.g. Enum4Linux / enum4linux) onto
   // one canonical page so the static router never silently drops a tool.
   const wadTechs = canonicalizeFamilyCase([...wadUp, ...wadAdd]);
   const techniques = [
     ...gtfo.techniques, ...lolbas.techniques, ...wadTechs, ...backlog.techniques,
   ];
   // Retain all established anchors. New records use content-derived IDs rather
   // than upstream positions, so reordering cannot reassign a bookmarked ID.
   const identity = t => JSON.stringify([t.toolId, t.command, t.context || t.privilege || '', t.nativeCategory]);
   const oldIds = new Map();
   for (const t of oldRows) {
     const key = identity(t), ids = oldIds.get(key) || [];
     ids.push(t.id); oldIds.set(key, ids);
   }
   for (const t of techniques) t.id = oldIds.get(identity(t))?.shift() || stableId(t.toolId, identity(t));
   const wadTools = toolsFromWad(wadTechs);
   const tools = [...gtfo.tools, ...lolbas.tools, ...wadTools, ...backlog.tools];
 
   // Validate every record (schema + unique ids); fail the build on any bad one.
   const problems = validateTechniques(techniques);
   if (problems.length) {
     for (const p of problems.slice(0, 10)) console.error(`  ✗ ${p}`);
     console.error(`\nBUILD FAILED: ${problems.length} invalid/duplicate technique record(s).`);
     process.exit(1);
   }
 
   // Derived facet indexes + counts.
   const count = (arr, key) => arr.reduce((m, v) => ((m[v] = (m[v] || 0) + 1), m), {});
   const bySource = count(techniques.map((t) => t.source));
   const byPlatform = {};
   const byCapability = {};
   for (const t of techniques) {
     for (const p of t.platform) byPlatform[p] = (byPlatform[p] || 0) + 1;
     for (const c of t.capability) byCapability[c] = (byCapability[c] || 0) + 1;
   }
   const facets = {
     platforms: PLATFORMS.filter((p) => byPlatform[p]),
     capabilities: CAPABILITIES.filter((c) => byCapability[c]),
     sources: SOURCES.filter((s) => bySource[s]),
     counts: {
       techniques: techniques.length,
       tools: tools.length,
       added: techniques.filter((t) => t.added).length,
       bySource, byPlatform, byCapability,
       toolsBySource: count(tools.map((t) => t.source)),
     },
     commits: {
       gtfobins: readCommit('gtfobins'), lolbas: readCommit('lolbas'), wadcoms: readCommit('wadcoms'),
     },
   };
 
   // Emit.
   mkdirSync(OUT_SRC, { recursive: true });
   mkdirSync(OUT_PUB, { recursive: true });
   const j = (o) => JSON.stringify(o, null, 0);
   writeFileSync(join(OUT_SRC, 'techniques.json'), JSON.stringify(techniques));
   writeFileSync(join(OUT_SRC, 'tools.json'), JSON.stringify(tools));
   writeFileSync(join(OUT_SRC, 'facets.json'), JSON.stringify(facets, null, 2));
   writeFileSync(join(OUT_PUB, 'techniques.json'), j(techniques));
 
   console.log(`\n  TOTAL    : ${techniques.length} techniques, ${tools.length} tools`);
   console.log(`  by source: ${JSON.stringify(bySource)}`);
   console.log(`  by platform: ${JSON.stringify(byPlatform)}`);
   console.log(`  added(NEW): ${facets.counts.added}`);
   console.log('\n  wrote src/data/{techniques,tools,facets}.json + public/data/techniques.json');
   enrich();
 }
 
 function readCommit(name) {
   try {
     const head = readFileSync(join(VENDOR, name, '.git', 'HEAD'), 'utf8').trim();
     if (head.startsWith('ref:')) {
       const ref = head.slice(4).trim();
       return readFileSync(join(VENDOR, name, '.git', ref), 'utf8').trim().slice(0, 7);
     }
     return head.slice(0, 7);
   } catch { return null; }
 }
 
 main().catch((e) => { console.error(e); process.exit(1); });