@guardbee/mcp-reverse-shield 0.0.0-stage → 0.1.0

package/dist/config.js

@@ -0,0 +1,102 @@
+import { readFileSync, existsSync } from "fs";
+import { resolve, join } from "path";
+const DEFAULTS = {
+    failOn: "any",
+    maxFiles: 5000,
+    exclude: [],
+};
+function findConfigFile(startDir) {
+    const names = ["guardbee.yml", "guardbee.yaml", ".guardbee.yml"];
+    let dir = resolve(startDir);
+    for (let i = 0; i < 5; i++) {
+        for (const name of names) {
+            const p = join(dir, name);
+            if (existsSync(p))
+                return p;
+        }
+        const parent = resolve(dir, "..");
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+// Minimal YAML parser — only handles the flat key: value and list items we need
+function parseYaml(content) {
+    const root = {};
+    let currentSection = null;
+    let currentKey = null;
+    let currentList = null;
+    for (const rawLine of content.split("\n")) {
+        const line = rawLine.replace(/#.*$/, "");
+        if (!line.trim())
+            continue;
+        const indent = line.match(/^(\s*)/)?.[1].length ?? 0;
+        if (indent === 0 && line.trim().endsWith(":")) {
+            if (currentKey && currentList) {
+                root[currentSection][currentKey] = currentList;
+                currentList = null;
+                currentKey = null;
+            }
+            currentSection = line.trim().slice(0, -1);
+            root[currentSection] = {};
+            continue;
+        }
+        if (indent === 2 && currentSection) {
+            if (currentKey && currentList) {
+                root[currentSection][currentKey] = currentList;
+                currentList = null;
+                currentKey = null;
+            }
+            const colonIdx = line.indexOf(":");
+            if (colonIdx === -1)
+                continue;
+            const key = line.slice(0, colonIdx).trim();
+            const value = line.slice(colonIdx + 1).trim();
+            if (value === "") {
+                currentKey = key;
+                currentList = [];
+            }
+            else {
+                root[currentSection][key] = value;
+            }
+            continue;
+        }
+        if (indent === 4 && currentList !== null) {
+            const item = line.trim().replace(/^-\s*/, "").replace(/^['"]|['"]$/g, "");
+            currentList.push(item);
+            continue;
+        }
+    }
+    if (currentKey && currentList && currentSection) {
+        root[currentSection][currentKey] = currentList;
+    }
+    return root;
+}
+export function loadConfig(searchDir, cliOverrides = {}) {
+    const configPath = findConfigFile(searchDir);
+    if (!configPath)
+        return { ...DEFAULTS, ...cliOverrides };
+    let fileConfig = {};
+    try {
+        const raw = readFileSync(configPath, "utf8");
+        const parsed = parseYaml(raw);
+        const section = parsed["reverse-shield"];
+        if (section) {
+            if (typeof section["fail-on"] === "string")
+                fileConfig.failOn = section["fail-on"];
+            if (typeof section["max-files"] === "string")
+                fileConfig.maxFiles = parseInt(section["max-files"], 10);
+            if (Array.isArray(section["exclude"]))
+                fileConfig.exclude = section["exclude"];
+        }
+    }
+    catch {
+        // ignore parse errors, use defaults
+    }
+    return { ...DEFAULTS, ...fileConfig, ...cliOverrides };
+}
+export function configFilePath(searchDir) {
+    return findConfigFile(searchDir);
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAgBrC,MAAM,QAAQ,GAAwB;IACpC,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,WAAW,GAAoB,IAAI,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,cAAe,CAA6B,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;gBAC7E,WAAW,GAAG,IAAI,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,IAAI,MAAM,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,cAAc,CAA6B,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;gBAC5E,WAAW,GAAG,IAAI,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE9C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,UAAU,GAAG,GAAG,CAAC;gBACjB,WAAW,GAAG,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACL,IAAI,CAAC,cAAc,CAA6B,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjE,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,MAAM,KAAK,CAAC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;IACH,CAAC;IAED,IAAI,UAAU,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;QAC/C,IAAI,CAAC,cAAc,CAA6B,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;IAC9E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,eAA6C,EAAE;IAC3F,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IAEzD,IAAI,UAAU,GAAiC,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAwC,CAAC;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACvG,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAAE,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAa,CAAC;QAC7F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,YAAY,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC"}

package/dist/dex.d.ts

@@ -0,0 +1,16 @@
+export declare function isDex(buf: Buffer): boolean;
+/** Type descriptors such as `Lcom/example/app/MainActivity;` (primitives and arrays included). */
+export declare function readTypeDescriptors(buf: Buffer): string[];
+export interface ObfuscationVerdict {
+    appClasses: number;
+    shortNamed: number;
+    obfuscated: boolean;
+    sample: string[];
+}
+/**
+ * R8/ProGuard renames everything it is allowed to into one- or two-letter
+ * names, and usually moves it out of the app package. An unobfuscated build
+ * keeps dozens of descriptive classes under the application id.
+ */
+export declare function assessDexObfuscation(descriptors: string[], packageName: string): ObfuscationVerdict;
+//# sourceMappingURL=dex.d.ts.map

package/dist/dex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dex.d.ts","sourceRoot":"","sources":["../src/dex.ts"],"names":[],"mappings":"AAeA,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE1C;AAED,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBzD;AAKD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAenG"}

package/dist/dex.js

@@ -0,0 +1,63 @@
+// Dalvik executable: only the class descriptors are needed, which come from
+// type_ids -> string_ids -> string data (uleb128 length, then MUTF-8 bytes).
+function readUleb128(buf, p) {
+    let value = 0;
+    let shift = 0;
+    let b;
+    do {
+        b = buf[p++];
+        value |= (b & 0x7f) << shift;
+        shift += 7;
+    } while (b & 0x80 && shift < 35);
+    return { value, next: p };
+}
+export function isDex(buf) {
+    return buf.length >= 0x70 && buf.toString("latin1", 0, 4) === "dex\n";
+}
+/** Type descriptors such as `Lcom/example/app/MainActivity;` (primitives and arrays included). */
+export function readTypeDescriptors(buf) {
+    if (!isDex(buf))
+        return [];
+    const stringIdsOff = buf.readUInt32LE(0x3c);
+    const typeIdsSize = buf.readUInt32LE(0x40);
+    const typeIdsOff = buf.readUInt32LE(0x44);
+    const out = [];
+    for (let i = 0; i < typeIdsSize; i++) {
+        const t = typeIdsOff + i * 4;
+        if (t + 4 > buf.length)
+            break;
+        const s = stringIdsOff + buf.readUInt32LE(t) * 4;
+        if (s + 4 > buf.length)
+            break;
+        const { next } = readUleb128(buf, buf.readUInt32LE(s));
+        const end = buf.indexOf(0, next);
+        if (end === -1)
+            break;
+        out.push(buf.toString("utf8", next, end));
+    }
+    return out;
+}
+// Generated by the build for every app; their names say nothing about R8.
+const GENERATED = /^(R|R\$.*|BuildConfig|Manifest|Manifest\$.*|databinding\/.*|BR)$/;
+/**
+ * R8/ProGuard renames everything it is allowed to into one- or two-letter
+ * names, and usually moves it out of the app package. An unobfuscated build
+ * keeps dozens of descriptive classes under the application id.
+ */
+export function assessDexObfuscation(descriptors, packageName) {
+    const prefix = `L${packageName.replace(/\./g, "/")}/`;
+    const app = descriptors
+        .filter((d) => d.startsWith(prefix) && d.endsWith(";"))
+        .map((d) => d.slice(prefix.length, -1))
+        .filter((rel) => !GENERATED.test(rel.split("/").pop() ?? ""));
+    const simple = (rel) => (rel.split("/").pop() ?? "").split("$")[0];
+    const shortNamed = app.filter((rel) => simple(rel).length <= 2).length;
+    const descriptive = app.filter((rel) => simple(rel).length > 2);
+    return {
+        appClasses: app.length,
+        shortNamed,
+        obfuscated: app.length < 25 || shortNamed / app.length >= 0.2,
+        sample: descriptive.slice(0, 3).map((rel) => `${packageName}.${rel.replace(/\//g, ".")}`),
+    };
+}
+//# sourceMappingURL=dex.js.map

package/dist/dex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dex.js","sourceRoot":"","sources":["../src/dex.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,6EAA6E;AAE7E,SAAS,WAAW,CAAC,GAAW,EAAE,CAAS;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAS,CAAC;IACd,GAAG,CAAC;QACF,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC;QAC7B,KAAK,IAAI,CAAC,CAAC;IACb,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,EAAE;IACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC;AACxE,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM;QAC9B,MAAM,CAAC,GAAG,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM;QACtB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,SAAS,GAAG,kEAAkE,CAAC;AASrF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAqB,EAAE,WAAmB;IAC7E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;IACtD,MAAM,GAAG,GAAG,WAAW;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,MAAM;QACtB,UAAU;QACV,UAAU,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG;QAC7D,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC"}

package/dist/electron.d.ts

@@ -0,0 +1,26 @@
+import type { Finding } from "./finding.js";
+/** Marker @electron/fuses writes before the fuse wire: version byte, length byte, then one byte per fuse. */
+export declare const FUSE_SENTINEL: Buffer<ArrayBuffer>;
+export interface FuseWire {
+    version: number;
+    /** One char per fuse: "1" enabled, "0" disabled, "r" removed. */
+    states: string;
+}
+export declare function parseFuseWire(buf: Buffer, sentinelOffset: number): FuseWire | null;
+export declare function readFuseWire(binaryPath: string): FuseWire | null;
+export declare function describeFuses(wire: FuseWire): string;
+export declare function fuseFindings(wire: FuseWire, file: string): Finding[];
+export interface ElectronLayout {
+    root: string;
+    /** Binary that carries the fuse wire (Electron Framework on macOS, the app executable elsewhere). */
+    fuseBinary: string | null;
+    resources: string;
+}
+export declare function detectElectron(dir: string): ElectronLayout | null;
+export interface ElectronResult {
+    findings: Finding[];
+    notes: string[];
+    scannedFiles: number;
+}
+export declare function analyzeElectron(layout: ElectronLayout, maxFiles: number): ElectronResult;
+//# sourceMappingURL=electron.d.ts.map

package/dist/electron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"electron.d.ts","sourceRoot":"","sources":["../src/electron.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAK5C,6GAA6G;AAC7G,eAAO,MAAM,aAAa,qBAAkD,CAAC;AAc7E,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAOlF;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAShE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAIpD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAcpE;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAyBjE;AAUD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CA4CxF"}

package/dist/electron.js

@@ -0,0 +1,146 @@
+import { closeSync, existsSync, openSync, readFileSync, readdirSync, statSync } from "fs";
+import { basename, extname, join, relative, sep } from "path";
+import { readAsar } from "./asar.js";
+import { finding } from "./finding.js";
+import { findInFile, readAt, walkFiles } from "./fsutil.js";
+import { analyzeWebFiles, isWebAsset } from "./web.js";
+/** Marker @electron/fuses writes before the fuse wire: version byte, length byte, then one byte per fuse. */
+export const FUSE_SENTINEL = Buffer.from("dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX");
+// FuseV1Options order in @electron/fuses
+const FUSES = [
+    "RunAsNode",
+    "EnableCookieEncryption",
+    "EnableNodeOptionsEnvironmentVariable",
+    "EnableNodeCliInspectArguments",
+    "EnableEmbeddedAsarIntegrityValidation",
+    "OnlyLoadAppFromAsar",
+    "LoadBrowserProcessSpecificV8Snapshot",
+    "GrantFileProtocolExtraPrivileges",
+];
+export function parseFuseWire(buf, sentinelOffset) {
+    const p = sentinelOffset + FUSE_SENTINEL.length;
+    if (p + 2 > buf.length)
+        return null;
+    const version = buf[p];
+    const length = buf[p + 1];
+    if (length === 0 || p + 2 + length > buf.length)
+        return null;
+    return { version, states: buf.toString("latin1", p + 2, p + 2 + length) };
+}
+export function readFuseWire(binaryPath) {
+    const [hit] = findInFile(binaryPath, FUSE_SENTINEL, 1);
+    if (hit === undefined)
+        return null;
+    const fd = openSync(binaryPath, "r");
+    try {
+        return parseFuseWire(readAt(fd, hit, FUSE_SENTINEL.length + 2 + 64), 0);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function describeFuses(wire) {
+    return FUSES.slice(0, wire.states.length)
+        .map((name, i) => `${name}=${wire.states[i] === "1" ? "on" : wire.states[i] === "0" ? "off" : "removed"}`)
+        .join(", ");
+}
+export function fuseFindings(wire, file) {
+    const s = wire.states;
+    const findings = [];
+    const on = (i) => s[i] === "1";
+    const off = (i) => s[i] === "0";
+    const add = (id, fuseIndex) => findings.push(finding(id, file, { match: `${FUSES[fuseIndex]}=${on(fuseIndex) ? "on" : "off"}` }));
+    if (on(0))
+        add("electron_fuse_run_as_node", 0);
+    if (on(3))
+        add("electron_fuse_inspect_args", 3);
+    if (on(2))
+        add("electron_fuse_node_options", 2);
+    if (off(4))
+        add("electron_fuse_asar_integrity_off", 4);
+    if (off(5))
+        add("electron_fuse_load_outside_asar", 5);
+    return findings;
+}
+const MIN_ELECTRON_BINARY_BYTES = 20 * 1024 * 1024;
+export function detectElectron(dir) {
+    const macFramework = join(dir, "Contents", "Frameworks", "Electron Framework.framework");
+    if (existsSync(macFramework)) {
+        const bin = join(macFramework, "Electron Framework");
+        return { root: dir, fuseBinary: existsSync(bin) ? bin : null, resources: join(dir, "Contents", "Resources") };
+    }
+    const resources = join(dir, "resources");
+    if (!existsSync(join(resources, "app.asar")) && !existsSync(join(resources, "app", "package.json")))
+        return null;
+    // Windows/Linux: the fuse wire is in the main executable next to resources/.
+    const candidates = [];
+    for (const name of safeReaddir(dir)) {
+        const full = join(dir, name);
+        const ext = extname(name).toLowerCase();
+        if (ext !== "" && ext !== ".exe")
+            continue;
+        try {
+            const st = statSync(full);
+            if (st.isFile() && st.size >= MIN_ELECTRON_BINARY_BYTES)
+                candidates.push(full);
+        }
+        catch {
+            // unreadable entry
+        }
+    }
+    const fuseBinary = candidates.find((c) => findInFile(c, FUSE_SENTINEL, 1).length > 0) ?? null;
+    return { root: dir, fuseBinary, resources };
+}
+function safeReaddir(dir) {
+    try {
+        return readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+}
+export function analyzeElectron(layout, maxFiles) {
+    const findings = [];
+    const notes = [];
+    let scannedFiles = 0;
+    if (layout.fuseBinary) {
+        const wire = readFuseWire(layout.fuseBinary);
+        if (wire) {
+            notes.push(`Electron fuses (${basename(layout.fuseBinary)}): ${describeFuses(wire)}`);
+            findings.push(...fuseFindings(wire, layout.fuseBinary));
+        }
+        else {
+            notes.push(`No Electron fuse wire found in ${layout.fuseBinary} (Electron older than 12, or a custom build).`);
+        }
+    }
+    const appDir = join(layout.resources, "app");
+    if (existsSync(join(appDir, "package.json"))) {
+        findings.push(finding("electron_app_unpacked", appDir, {
+            match: existsSync(join(layout.resources, "app.asar")) ? "resources/app is loaded ahead of app.asar" : "no app.asar",
+        }));
+        const files = [];
+        walkFiles(appDir, { maxFiles, skipDirs: new Set(["node_modules", ".git"]) }, (full) => {
+            const key = relative(appDir, full).split(sep).join("/");
+            if (!isWebAsset(key))
+                return;
+            files.push({ key, display: full, size: statSync(full).size, read: () => readFileSync(full) });
+        });
+        scannedFiles += files.length;
+        findings.push(...analyzeWebFiles(files));
+    }
+    const asarPath = join(layout.resources, "app.asar");
+    if (existsSync(asarPath)) {
+        const entries = readAsar(asarPath);
+        if (entries) {
+            const web = entries.filter((e) => isWebAsset(e.key)).slice(0, maxFiles);
+            notes.push(`app.asar: ${entries.length} file(s), ${web.length} shipped JavaScript/source map file(s) checked`);
+            scannedFiles += web.length;
+            findings.push(...analyzeWebFiles(web));
+        }
+        else {
+            notes.push(`app.asar could not be parsed: ${asarPath}`);
+        }
+    }
+    return { findings, notes, scannedFiles };
+}
+//# sourceMappingURL=electron.js.map

package/dist/electron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"electron.js","sourceRoot":"","sources":["../src/electron.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGvD,6GAA6G;AAC7G,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;AAE7E,yCAAyC;AACzC,MAAM,KAAK,GAAG;IACZ,WAAW;IACX,wBAAwB;IACxB,sCAAsC;IACtC,+BAA+B;IAC/B,uCAAuC;IACvC,qBAAqB;IACrB,sCAAsC;IACtC,kCAAkC;CAC1B,CAAC;AAQX,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,cAAsB;IAC/D,MAAM,CAAC,GAAG,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;SACzG,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAc,EAAE,IAAY;IACvD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,SAAiB,EAAE,EAAE,CAC5C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAErG,IAAI,EAAE,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,8BAA8B,CAAC,CAAC;IACzF,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;IAChH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjH,6EAA6E;IAC7E,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,MAAM;YAAE,SAAS;QAC3C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,yBAAyB;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9F,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,eAAe,CAAC,MAAsB,EAAE,QAAgB;IACtE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,UAAU,+CAA+C,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,MAAM,EAAE;YACrD,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,aAAa;SACpH,CAAC,CAAC,CAAC;QACJ,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,SAAS,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;YACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;QACH,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,gDAAgD,CAAC,CAAC;YAC/G,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC"}

package/dist/finding.d.ts

@@ -0,0 +1,30 @@
+import type { RuleCategory, Severity, TargetKind } from "./rules.js";
+export interface Finding {
+    patternId: string;
+    patternName: string;
+    target: TargetKind;
+    category: RuleCategory;
+    severity: Severity;
+    recommendation: string;
+    /** Path of the artifact, with `!/inner/path` for files inside an archive (APK, ASAR). */
+    file?: string;
+    /** Artifacts are mostly binary — line/column are 1 unless a text match has a real position. */
+    line: number;
+    column: number;
+    match: string;
+    context: string;
+}
+export declare function finding(id: string, file: string | undefined, detail?: {
+    match?: string;
+    context?: string;
+    severity?: Severity;
+    line?: number;
+    column?: number;
+}): Finding;
+export declare function bySeverity(a: Finding, b: Finding): number;
+/**
+ * A–F reverse-engineering resistance grade: how much an analyst gets for free.
+ * Driven by the worst finding, then nudged down by volume at that level.
+ */
+export declare function grade(findings: Finding[]): "A" | "B" | "C" | "D" | "F";
+//# sourceMappingURL=finding.d.ts.map

package/dist/finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,OAAO,CACrB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACrG,OAAO,CAeT;AAID,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAOtE"}

package/dist/finding.js

@@ -0,0 +1,38 @@
+import { getRule } from "./rules.js";
+export function finding(id, file, detail = {}) {
+    const rule = getRule(id);
+    return {
+        patternId: rule.id,
+        patternName: rule.name,
+        target: rule.target,
+        category: rule.category,
+        severity: detail.severity ?? rule.severity,
+        recommendation: rule.recommendation,
+        file,
+        line: detail.line ?? 1,
+        column: detail.column ?? 1,
+        match: detail.match ?? "",
+        context: detail.context ?? rule.exposes,
+    };
+}
+const RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+export function bySeverity(a, b) {
+    return RANK[a.severity] - RANK[b.severity];
+}
+/**
+ * A–F reverse-engineering resistance grade: how much an analyst gets for free.
+ * Driven by the worst finding, then nudged down by volume at that level.
+ */
+export function grade(findings) {
+    if (findings.length === 0)
+        return "A";
+    const worst = Math.min(...findings.map((f) => RANK[f.severity]));
+    if (worst === RANK.critical)
+        return "F";
+    if (worst === RANK.high)
+        return findings.filter((f) => f.severity === "high").length >= 3 ? "F" : "D";
+    if (worst === RANK.medium)
+        return "C";
+    return "B";
+}
+//# sourceMappingURL=finding.js.map

package/dist/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAmBrC,MAAM,UAAU,OAAO,CACrB,EAAU,EACV,IAAwB,EACxB,SAAoG,EAAE;IAEtG,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,WAAW,EAAE,IAAI,CAAC,IAAI;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC1C,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEnF,MAAM,UAAU,UAAU,CAAC,CAAU,EAAE,CAAU;IAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,QAAmB;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACtG,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/fsutil.d.ts

@@ -0,0 +1,20 @@
+export declare function readAt(fd: number, offset: number, length: number): Buffer;
+export declare function readPrefix(filePath: string, length: number): Buffer;
+/**
+ * Finds every offset of `needle` in a file without loading it whole — the
+ * Electron framework binary that carries the fuse wire is 150–250 MB.
+ */
+export declare function findInFile(filePath: string, needle: Buffer, maxHits?: number): number[];
+export interface WalkOptions {
+    maxFiles: number;
+    include?: string[];
+    exclude?: string[];
+    /** Directory names never descended into. */
+    skipDirs: Set<string>;
+    /** Called for directories; returning true stops the walk from descending (the caller handles it as a unit). */
+    claimDir?: (path: string) => boolean;
+}
+export declare function walkFiles(root: string, options: WalkOptions, onFile: (path: string) => void): {
+    truncated: boolean;
+};
+//# sourceMappingURL=fsutil.d.ts.map

package/dist/fsutil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fsutil.d.ts","sourceRoot":"","sources":["../src/fsutil.ts"],"names":[],"mappings":"AAGA,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzE;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,MAAM,EAAE,CAgBlF;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,+GAA+G;IAC/G,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACtC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,CAiCpH"}

package/dist/fsutil.js

@@ -0,0 +1,80 @@
+import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+export function readAt(fd, offset, length) {
+    if (length <= 0)
+        return Buffer.alloc(0);
+    const buf = Buffer.alloc(length);
+    const bytesRead = readSync(fd, buf, 0, length, offset);
+    return bytesRead === length ? buf : buf.subarray(0, bytesRead);
+}
+export function readPrefix(filePath, length) {
+    const fd = openSync(filePath, "r");
+    try {
+        return readAt(fd, 0, length);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Finds every offset of `needle` in a file without loading it whole — the
+ * Electron framework binary that carries the fuse wire is 150–250 MB.
+ */
+export function findInFile(filePath, needle, maxHits = 8) {
+    const CHUNK = 16 * 1024 * 1024;
+    const size = statSync(filePath).size;
+    const hits = [];
+    const fd = openSync(filePath, "r");
+    try {
+        for (let pos = 0; pos < size && hits.length < maxHits; pos += CHUNK) {
+            const chunk = readAt(fd, pos, Math.min(CHUNK + needle.length - 1, size - pos));
+            for (let i = chunk.indexOf(needle); i !== -1 && hits.length < maxHits; i = chunk.indexOf(needle, i + 1)) {
+                if (i < CHUNK)
+                    hits.push(pos + i);
+            }
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+    return hits;
+}
+export function walkFiles(root, options, onFile) {
+    let count = 0;
+    let truncated = false;
+    const visit = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (count >= options.maxFiles) {
+                truncated = true;
+                return;
+            }
+            const full = join(dir, entry.name);
+            if (options.exclude?.some((e) => full.includes(e)))
+                continue;
+            if (entry.isDirectory()) {
+                if (options.skipDirs.has(entry.name))
+                    continue;
+                if (options.claimDir?.(full))
+                    continue;
+                visit(full);
+            }
+            else if (entry.isFile()) {
+                if (options.include && options.include.length > 0 && !options.include.some((i) => full.includes(i)))
+                    continue;
+                count++;
+                onFile(full);
+            }
+        }
+    };
+    visit(root);
+    return { truncated };
+}
+//# sourceMappingURL=fsutil.js.map

package/dist/fsutil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fsutil.js","sourceRoot":"","sources":["../src/fsutil.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,UAAU,MAAM,CAAC,EAAU,EAAE,MAAc,EAAE,MAAc;IAC/D,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAO,GAAG,CAAC;IACtE,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACrC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC;YACpE,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;YAC/E,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxG,IAAI,CAAC,GAAG,KAAK;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAoB,EAAE,MAA8B;IAC1F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACvC,KAAK,CAAC,IAAI,CAAC,CAAC;YACd,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC9G,KAAK,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export { scanPath } from "./scanner.js";
+export type { ScanOptions, ScanResult } from "./scanner.js";
+export { scanUrl } from "./live.js";
+export type { UrlScanOptions } from "./live.js";
+export { RULES, getRule } from "./rules.js";
+export type { Rule, RuleCategory, Severity, TargetKind } from "./rules.js";
+export { grade } from "./finding.js";
+export type { Finding } from "./finding.js";
+export { analyzeJavaScript, analyzeWebFiles, parseSourceMap } from "./web.js";
+export { analyzeApk } from "./apk.js";
+export { parseAxml } from "./axml.js";
+export { readAsar } from "./asar.js";
+export { analyzeElectron, detectElectron, parseFuseWire, readFuseWire, FUSE_SENTINEL } from "./electron.js";
+export { analyzeNative, detectNativeFormat } from "./native.js";
+export { registerTools } from "./server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+export { scanPath } from "./scanner.js";
+export { scanUrl } from "./live.js";
+export { RULES, getRule } from "./rules.js";
+export { grade } from "./finding.js";
+export { analyzeJavaScript, analyzeWebFiles, parseSourceMap } from "./web.js";
+export { analyzeApk } from "./apk.js";
+export { parseAxml } from "./axml.js";
+export { readAsar } from "./asar.js";
+export { analyzeElectron, detectElectron, parseFuseWire, readFuseWire, FUSE_SENTINEL } from "./electron.js";
+export { analyzeNative, detectNativeFormat } from "./native.js";
+export { registerTools } from "./server.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/live.d.ts

@@ -0,0 +1,14 @@
+import type { ScanResult } from "./scanner.js";
+export interface UrlScanOptions {
+    maxScripts?: number;
+    timeoutMs?: number;
+    /** Injected in tests. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Loads a live page, then checks the same-site scripts it pulls in the way
+ * an analyst would start: read the bundles, follow their source map comments,
+ * and try `<bundle>.map` even when the comment was stripped.
+ */
+export declare function scanUrl(pageUrl: string, options?: UrlScanOptions): Promise<ScanResult>;
+//# sourceMappingURL=live.d.ts.map