@guardbee/mcp-reverse-shield 0.0.0-stage → 0.1.0

package/dist/scanner.js

@@ -0,0 +1,169 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { basename, join, relative, sep } from "path";
+import { analyzeApk, isApk } from "./apk.js";
+import { readAsar } from "./asar.js";
+import { analyzeElectron, detectElectron } from "./electron.js";
+import { bySeverity, grade } from "./finding.js";
+import { readPrefix, walkFiles } from "./fsutil.js";
+import { analyzeNative, detectNativeFormat } from "./native.js";
+import { analyzeWebFiles, isWebAsset } from "./web.js";
+const DEFAULT_MAX_FILES = 5000;
+const MAX_NATIVE_BYTES = 256 * 1024 * 1024;
+// Build output (dist/, build/, out/) is exactly what this scanner is for, so
+// unlike the source scanners only VCS, dependency and cache folders are skipped.
+const SKIP_DIRS = new Set(["node_modules", ".git", ".svn", ".hg", "__pycache__", ".venv", "venv", ".gradle", ".idea", ".turbo", ".cache"]);
+class Collector {
+    findings = [];
+    notes = [];
+    kinds = new Set();
+    scannedFiles = 0;
+    truncated = false;
+    add(findings, kind) {
+        this.findings.push(...findings);
+        if (kind)
+            this.kinds.add(kind);
+        for (const f of findings)
+            this.kinds.add(f.target);
+    }
+}
+function analyzeNativeFile(path, c) {
+    const size = statSync(path).size;
+    if (size < 64)
+        return false;
+    const format = detectNativeFormat(readPrefix(path, 8));
+    if (!format)
+        return false;
+    if (size > MAX_NATIVE_BYTES) {
+        c.notes.push(`${path}: ${format} binary larger than ${MAX_NATIVE_BYTES / 1024 / 1024} MiB, not parsed`);
+        return true;
+    }
+    const result = analyzeNative(readFileSync(path), path);
+    if (!result)
+        return false;
+    c.scannedFiles++;
+    c.notes.push(...result.notes);
+    c.add(result.findings, result.flavor === "dotnet" ? "dotnet" : "native");
+    return true;
+}
+function macMainExecutables(appDir) {
+    const dir = join(appDir, "Contents", "MacOS");
+    try {
+        return readdirSync(dir).map((n) => join(dir, n)).filter((p) => statSync(p).isFile());
+    }
+    catch {
+        return [];
+    }
+}
+function scanAppBundle(dir, c, maxFiles) {
+    const electron = detectElectron(dir);
+    if (electron) {
+        const result = analyzeElectron(electron, maxFiles);
+        c.scannedFiles += result.scannedFiles;
+        c.notes.push(...result.notes);
+        c.add(result.findings, "electron");
+    }
+    // The app's own executable; bundled frameworks (Electron, Sparkle, ...) are third-party builds.
+    for (const exe of macMainExecutables(dir))
+        analyzeNativeFile(exe, c);
+}
+function scanFile(path, c) {
+    if (isApk(path)) {
+        const result = analyzeApk(path);
+        if (!result) {
+            c.notes.push(`${path}: no AndroidManifest.xml, not an APK`);
+            return;
+        }
+        c.scannedFiles += result.scannedFiles;
+        c.notes.push(...result.notes);
+        c.add(result.findings, "android");
+        return;
+    }
+    if (/\.asar$/i.test(path)) {
+        const entries = readAsar(path);
+        if (!entries) {
+            c.notes.push(`${path}: not a readable ASAR archive`);
+            return;
+        }
+        const web = entries.filter((e) => isWebAsset(e.key));
+        c.scannedFiles += web.length;
+        c.add(analyzeWebFiles(web), "electron");
+        return;
+    }
+    if (isWebAsset(basename(path))) {
+        c.scannedFiles++;
+        c.add(analyzeWebFiles([{ key: basename(path), display: path, size: statSync(path).size, read: () => readFileSync(path) }]), "web");
+        return;
+    }
+    if (!analyzeNativeFile(path, c))
+        c.notes.push(`${path}: not a recognised artifact (APK, ASAR, JavaScript, source map, ELF, Mach-O or PE)`);
+}
+function scanDir(root, c, options, maxFiles) {
+    if (root.endsWith(".app") || detectElectron(root)) {
+        scanAppBundle(root, c, maxFiles);
+        return;
+    }
+    const web = [];
+    const { truncated } = walkFiles(root, {
+        maxFiles,
+        include: options.include,
+        exclude: options.exclude,
+        skipDirs: SKIP_DIRS,
+        claimDir: (dir) => {
+            if (!dir.endsWith(".app") && !detectElectron(dir))
+                return false;
+            scanAppBundle(dir, c, maxFiles);
+            return true;
+        },
+    }, (full) => {
+        const key = relative(root, full).split(sep).join("/");
+        if (isWebAsset(key)) {
+            web.push({ key, display: full, size: statSync(full).size, read: () => readFileSync(full) });
+        }
+        else if (isApk(full) || /\.asar$/i.test(full)) {
+            scanFile(full, c);
+        }
+        else {
+            analyzeNativeFile(full, c);
+        }
+    });
+    c.truncated = truncated;
+    if (web.length > 0) {
+        c.scannedFiles += web.length;
+        c.add(analyzeWebFiles(web), "web");
+    }
+}
+/**
+ * Scans a build artifact for what it gives away to a reverse engineer: a file
+ * (APK, ASAR, bundle, source map, ELF/Mach-O/PE/.NET binary), a macOS .app,
+ * an Electron app folder, or a build output directory containing any of them.
+ */
+export function scanPath(target, options = {}) {
+    const start = Date.now();
+    const c = new Collector();
+    const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
+    if (!existsSync(target))
+        throw new Error(`Path not found: ${target}`);
+    // "Foo.app/" from shell completion must still be recognised as a bundle.
+    let path = target;
+    while (path.length > 1 && (path.endsWith("/") || path.endsWith("\\")))
+        path = path.slice(0, -1);
+    if (statSync(path).isDirectory())
+        scanDir(path, c, options, maxFiles);
+    else
+        scanFile(path, c);
+    if (c.truncated)
+        c.notes.push(`Stopped after ${maxFiles} files; raise maxFiles to scan the rest.`);
+    const findings = c.findings.sort(bySeverity);
+    return {
+        target,
+        kinds: [...c.kinds],
+        grade: grade(findings),
+        scannedFiles: c.scannedFiles,
+        totalFindings: findings.length,
+        findings,
+        notes: c.notes,
+        truncated: c.truncated,
+        durationMs: Date.now() - start,
+    };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAuBvD,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3I,MAAM,SAAS;IACb,QAAQ,GAAc,EAAE,CAAC;IACzB,KAAK,GAAa,EAAE,CAAC;IACrB,KAAK,GAAG,IAAI,GAAG,EAAc,CAAC;IAC9B,YAAY,GAAG,CAAC,CAAC;IACjB,SAAS,GAAG,KAAK,CAAC;IAElB,GAAG,CAAC,QAAmB,EAAE,IAAiB;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAChC,IAAI,IAAI;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,CAAY;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC5B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,uBAAuB,gBAAgB,GAAG,IAAI,GAAG,IAAI,kBAAkB,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,CAAC,CAAC,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,CAAY,EAAE,QAAgB;IAChE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,gGAAgG;IAChG,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,CAAY;IAC1C,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/B,CAAC,CAAC,YAAY,EAAE,CAAC;QACjB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnI,OAAO;IACT,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,oFAAoF,CAAC,CAAC;AAC7I,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,CAAY,EAAE,OAAoB,EAAE,QAAgB;IACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,CAC7B,IAAI,EACJ;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChE,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;KACF,EACD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CACF,CAAC;IACF,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC;IACxB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,UAAuB,EAAE;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACtE,yEAAyE;IACzE,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;;QACjE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvB,IAAI,CAAC,CAAC,SAAS;QAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,0CAA0C,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM;QACN,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,7 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ScanResult } from "./scanner.js";
+export declare function formatResult(result: ScanResult): string;
+export declare function startServer(): Promise<void>;
+/** The package's tools, also served by @guardbee/security-suite under its own prefix. */
+export declare function registerTools(server: McpServer): void;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAOpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAyBvD;AAED,wBAAsB,WAAW,kBAShC;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAoDrD"}

package/dist/server.js

@@ -0,0 +1,88 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { instrumentServer } from "@guardbee/mcp-telemetry";
+import { z } from "zod";
+import { scanUrl } from "./live.js";
+import { RULES } from "./rules.js";
+import { scanPath } from "./scanner.js";
+export function formatResult(result) {
+    const lines = [];
+    const kinds = result.kinds.length > 0 ? result.kinds.join(", ") : "nothing recognised";
+    if (result.findings.length === 0) {
+        lines.push(`✅ Grade ${result.grade} — nothing handed to a reverse engineer for free. ${result.scannedFiles} file(s) checked (${kinds}) in ${result.durationMs}ms.`);
+    }
+    else {
+        const count = { critical: 0, high: 0, medium: 0, low: 0 };
+        for (const f of result.findings)
+            count[f.severity]++;
+        lines.push(`🛡️  Reverse-engineering resistance: grade ${result.grade} — ${result.findings.length} finding(s) in ${result.scannedFiles} file(s) (${kinds}, ${result.durationMs}ms)`);
+        lines.push(`   Critical: ${count.critical}  High: ${count.high}  Medium: ${count.medium}  Low: ${count.low}`);
+        lines.push("");
+        for (const f of result.findings) {
+            lines.push(`[${f.severity.toUpperCase()}] ${f.patternName} (${f.target}/${f.category})`);
+            if (f.file)
+                lines.push(`  Where          : ${f.file}${f.line > 1 ? `:${f.line}:${f.column}` : ""}`);
+            if (f.match)
+                lines.push(`  Evidence       : ${f.match}`);
+            lines.push(`  Gives away     : ${f.context}`);
+            lines.push(`  Fix            : ${f.recommendation}`);
+            lines.push("");
+        }
+    }
+    if (result.notes.length > 0) {
+        lines.push("Notes:");
+        for (const n of result.notes)
+            lines.push(`  • ${n}`);
+    }
+    return lines.join("\n");
+}
+export async function startServer() {
+    const server = new McpServer({
+        name: "guardbee-reverse-shield",
+        version: "0.1.0",
+    });
+    instrumentServer(server, "reverse-shield");
+    registerTools(server);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+/** The package's tools, also served by @guardbee/security-suite under its own prefix. */
+export function registerTools(server) {
+    server.tool("scan_artifact", "Audit a shipped build artifact for how easily it can be reverse engineered — the defensive counterpart to reverse-engineering MCPs. Accepts an APK, an Electron app (.app bundle, app folder or app.asar), a macOS/Linux/Windows binary (Mach-O, ELF, PE, .NET assembly), a JavaScript bundle or source map, or a build output directory containing any of these. Reports shipped source maps and source code, missing minification/R8/.NET obfuscation, debug info and unstripped symbols, debuggable flags and entitlements, Electron fuses that allow Node/inspector/ASAR tampering, missing code signing, embedded credentials and internal hosts, with an A–F grade.", {
+        path: z.string().describe("Absolute or relative path to the artifact or build output directory"),
+        maxFiles: z.number().int().positive().optional().describe("Maximum number of files to check in a directory (default: 5000)"),
+        include: z.array(z.string()).optional().describe("Only check files whose path contains one of these strings"),
+        exclude: z.array(z.string()).optional().describe("Skip files/dirs whose path contains one of these strings"),
+    }, async ({ path, maxFiles, include, exclude }) => {
+        try {
+            return { content: [{ type: "text", text: formatResult(scanPath(path, { maxFiles, include, exclude })) }] };
+        }
+        catch (err) {
+            return { isError: true, content: [{ type: "text", text: err.message }] };
+        }
+    });
+    server.tool("scan_url", "Check a live website the way an analyst starts: fetch the page, read its same-site JavaScript bundles, follow sourceMappingURL comments and try <bundle>.map even when the comment was stripped. Reports publicly downloadable source maps (and whether they embed the original sources), unminified or development bundles, embedded credentials and internal hosts. Third-party scripts are not fetched.", {
+        url: z.string().url().describe("Page URL (http or https)"),
+        maxScripts: z.number().int().positive().max(100).optional().describe("Maximum number of same-site scripts to fetch (default: 25)"),
+    }, async ({ url, maxScripts }) => {
+        try {
+            return { content: [{ type: "text", text: formatResult(await scanUrl(url, { maxScripts })) }] };
+        }
+        catch (err) {
+            return { isError: true, content: [{ type: "text", text: err.message }] };
+        }
+    });
+    server.tool("list_checks", "List every reverse-engineering resistance check, grouped by target (web, electron, android, native, dotnet), with what each finding gives away and how to fix it", {}, async () => {
+        const lines = ["Reverse-engineering resistance checks:\n"];
+        for (const target of ["web", "electron", "android", "native", "dotnet"]) {
+            lines.push(`[${target}]`);
+            for (const r of RULES.filter((rule) => rule.target === target)) {
+                lines.push(`  • ${r.id} (${r.severity}, ${r.category}) — ${r.name}`);
+                lines.push(`      gives away: ${r.exposes}`);
+            }
+            lines.push("");
+        }
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACvF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,qDAAqD,MAAM,CAAC,YAAY,qBAAqB,KAAK,QAAQ,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;IACtK,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;YAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,8CAA8C,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,kBAAkB,MAAM,CAAC,YAAY,aAAa,KAAK,KAAK,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;QACrL,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,QAAQ,WAAW,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9G,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,2oBAA2oB,EAC3oB;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;QAC5H,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QAC7G,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;KAC7G,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,UAAU,EACV,4YAA4Y,EAC5Y;QACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC1D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;KACnI,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,kKAAkK,EAClK,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,KAAK,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;YACjF,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACjE,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/web.d.ts

@@ -0,0 +1,56 @@
+import type { Finding } from "./finding.js";
+/**
+ * The URL of the last `//# sourceMappingURL=` comment that ends its line.
+ * Scanned by hand rather than with a regex: bundles are untrusted input and
+ * inline maps make the comment megabytes long. Only the last occurrence on
+ * each line can end it, so every line is looked at once and the scan stays
+ * linear even for a line made of nothing but the key.
+ */
+export declare function sourceMappingUrl(text: string): string | null;
+export interface SourceMapInfo {
+    sources: number;
+    embedded: number;
+    samplePaths: string[];
+}
+/** Returns null when the text is not a source map (version + mappings). */
+export declare function parseSourceMap(text: string): SourceMapInfo | null;
+export declare function sourceMapFinding(info: SourceMapInfo, file: string, id: "sourcemap_shipped" | "sourcemap_inline" | "sourcemap_publicly_reachable"): Finding;
+export declare function looksUnminified(text: string): {
+    unminified: boolean;
+    avgLineLength: number;
+    indentedRatio: number;
+};
+export interface JsCheckOptions {
+    /** Skip the minification check (e.g. for small inline snippets). */
+    skipMinifyCheck?: boolean;
+}
+/**
+ * Checks one shipped JavaScript file for what it gives away: source maps
+ * (inline or referenced), eval-wrapped dev bundles, missing minification,
+ * framework development builds, embedded credentials and internal hosts.
+ * Source maps that sit next to the file are handled by the caller, which can
+ * see the filesystem or the network.
+ */
+export declare function analyzeJavaScript(text: string, file: string, options?: JsCheckOptions): Finding[];
+export declare const MAX_TEXT_BYTES: number;
+/** A file in a build directory, an ASAR or an APK, keyed by a "/"-separated path. */
+export interface ArtifactFile {
+    key: string;
+    display: string;
+    size: number;
+    read(): Buffer | null;
+}
+export declare function isWebAsset(key: string): boolean;
+/**
+ * Runs the JavaScript and source map checks over a set of shipped files. A
+ * bundle whose sourceMappingURL resolves to a map in the same set is reported
+ * once, through the map, rather than again as a bare reference.
+ */
+export declare function analyzeWebFiles(files: ArtifactFile[]): Finding[];
+/**
+ * A packaged app repeats the same key, host list or build setting across
+ * dozens of chunks. Report each distinct thing once and say how far it
+ * spreads, so the real number of problems stays readable.
+ */
+export declare function collapseRepeats(findings: Finding[]): Finding[];
+//# sourceMappingURL=web.d.ts.map

package/dist/web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAuE5C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoB5D;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAcjE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,8BAA8B,GAAG,OAAO,CAQ1J;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAanH;AAED,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,EAAE,CA8DrG;AAID,eAAO,MAAM,cAAc,QAAmB,CAAC;AAE/C,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAWD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,CAwBhE;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAwC9D"}

package/dist/web.js

@@ -0,0 +1,301 @@
+import { SECRET_RULES } from "@guardbee/guard-core";
+import { finding } from "./finding.js";
+const MIN_BYTES_FOR_MINIFY_CHECK = 4096;
+const INLINE_MAP_PREFIX = /^data:application\/json;(?:charset=[^;,]+;)?base64,/;
+const EVAL_SOURCE_URL = /sourceURL=webpack(?:-internal)?:\/\//;
+const DEV_BUILD_MARKERS = [
+    { framework: "React", pattern: /react(?:-dom)?\.development\.js/ },
+    { framework: "Vue", pattern: /You are running (?:a development build of Vue|Vue in development mode)/ },
+    { framework: "Angular", pattern: /Angular is running in development mode/ },
+    { framework: "webpack dev server / HMR", pattern: /\[HMR\] (?:connected|Waiting for update signal)/ },
+];
+const INTERNAL_URL = /\bhttps?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:internal|local|corp|lan)|(?:[a-z0-9-]+\.)*(?:staging|stage|preprod|uat|qa|dev)(?:-[a-z0-9]+)?\.[a-z0-9-]+(?:\.[a-z0-9-]+)*)(?::\d+)?/gi;
+// Fixed-format credentials only: minified code is full of 40-character base64
+// runs and quoted strings next to the word "key", which the broad rules would
+// report by the hundred.
+const BUNDLE_SECRET_RULES = SECRET_RULES.filter((r) => !r.broad);
+// The private-key rules match the PEM header alone. Crypto libraries bundled
+// into an app carry those headers as string constants for their parsers, so a
+// bundle only holds a key when base64 key material follows the header.
+const PEM_HEADER_RULE = /private_key/;
+// Placeholder shapes that never occur in a real credential (same heuristic as
+// secret-scanner): a repeated or sequential run, or an "example" word.
+const PLACEHOLDER_WORDS = /example|placeholder|sample|dummy|fake[_-]?key|change[-_]?me|testkey|yourkey|redacted/i;
+function isPlaceholder(value) {
+    if (/(.)\1{7,}/.test(value) || PLACEHOLDER_WORDS.test(value))
+        return true;
+    let run = 1;
+    for (let i = 1; i < value.length; i++) {
+        run = value.charCodeAt(i) === value.charCodeAt(i - 1) + 1 ? run + 1 : 1;
+        if (run >= 8)
+            return true;
+    }
+    return false;
+}
+// Connection-string rules skip the generic check (a real URL can sit on an
+// example.com host), so judge the parts instead: UI hints and docs use a
+// literal "password" and a literal "host", which a deployed database never has.
+const CONNECTION_RULE = /^db_url_/;
+const PLACEHOLDER_PASSWORD = /^(?:password|passw(?:or)?d|pass|pwd|secret|sifre|şifre|parola|changeme|your[-_]?password|<[^>]*>|\*+|x+|\.{3})$/i;
+const PLACEHOLDER_HOST = /^(?:host|hostname|your[-_]?host|server|db-host)$/i;
+function isPlaceholderConnection(url) {
+    const m = /^[a-z+]+:\/\/[^:/@]*:([^@]*)@([^:/?#]+)/i.exec(url);
+    return m !== null && (PLACEHOLDER_PASSWORD.test(m[1]) || PLACEHOLDER_HOST.test(m[2]));
+}
+const PEM_BODY = /^(?:\s|\\[rn]|["'`+,])*(?:[A-Za-z-]+:[^\n\\]*(?:\\n|\n)(?:\s|\\[rn])*)*[A-Za-z0-9+/]{60,}/;
+function lineCol(text, index) {
+    let line = 1;
+    let last = -1;
+    for (let i = text.indexOf("\n"); i !== -1 && i < index; i = text.indexOf("\n", i + 1)) {
+        line++;
+        last = i;
+    }
+    return { line, column: index - last };
+}
+function mask(value) {
+    return value.length <= 8 ? "****" : `${value.slice(0, 4)}…${value.slice(-2)} (${value.length} chars)`;
+}
+const MAPPING_KEY = "sourceMappingURL=";
+const isSpace = (ch) => ch === " " || ch === "\t" || ch === "\r" || ch === "\n" || ch === "\f" || ch === "\v";
+/**
+ * The URL of the last `//# sourceMappingURL=` comment that ends its line.
+ * Scanned by hand rather than with a regex: bundles are untrusted input and
+ * inline maps make the comment megabytes long. Only the last occurrence on
+ * each line can end it, so every line is looked at once and the scan stays
+ * linear even for a line made of nothing but the key.
+ */
+export function sourceMappingUrl(text) {
+    let i = text.lastIndexOf(MAPPING_KEY);
+    while (i !== -1) {
+        const lineStart = text.lastIndexOf("\n", i) + 1;
+        const nl = text.indexOf("\n", i);
+        const lineEnd = nl === -1 ? text.length : nl;
+        let j = i - 1;
+        while (j >= lineStart && isSpace(text[j]))
+            j--;
+        if (j - 2 >= lineStart && (text[j] === "#" || text[j] === "@") && text[j - 1] === "/" && text[j - 2] === "/") {
+            const start = i + MAPPING_KEY.length;
+            let end = start;
+            while (end < lineEnd && !isSpace(text[end]) && text[end] !== "'" && text[end] !== '"')
+                end++;
+            let k = end;
+            while (k < lineEnd && isSpace(text[k]))
+                k++;
+            if (end > start && k === lineEnd)
+                return text.slice(start, end);
+        }
+        i = lineStart >= 2 ? text.lastIndexOf(MAPPING_KEY, lineStart - 2) : -1;
+    }
+    return null;
+}
+/** Returns null when the text is not a source map (version + mappings). */
+export function parseSourceMap(text) {
+    let map;
+    try {
+        map = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!map || typeof map !== "object")
+        return null;
+    const m = map;
+    if (m.version === undefined || (typeof m.mappings !== "string" && !Array.isArray(m.sections)))
+        return null;
+    const sources = Array.isArray(m.sources) ? m.sources.filter((s) => typeof s === "string") : [];
+    const embedded = Array.isArray(m.sourcesContent) ? m.sourcesContent.filter((c) => typeof c === "string" && c.length > 0).length : 0;
+    const own = sources.filter((s) => !s.includes("node_modules"));
+    return { sources: sources.length, embedded, samplePaths: (own.length > 0 ? own : sources).slice(0, 3) };
+}
+export function sourceMapFinding(info, file, id) {
+    const paths = info.samplePaths.length > 0 ? ` e.g. ${info.samplePaths.join(", ")}` : "";
+    if (info.embedded > 0) {
+        return finding("sourcemap_embeds_source", file, {
+            match: `${info.embedded} of ${info.sources} source file(s) embedded in sourcesContent${paths}`,
+        });
+    }
+    return finding(id, file, { match: `${info.sources} original source path(s) mapped${paths}` });
+}
+export function looksUnminified(text) {
+    let nonEmpty = 0;
+    let chars = 0;
+    let indented = 0;
+    for (const line of text.split("\n")) {
+        if (line.trim() === "")
+            continue;
+        nonEmpty++;
+        chars += line.length;
+        if (/^(?: {2,}|\t)\S/.test(line))
+            indented++;
+    }
+    const avgLineLength = nonEmpty === 0 ? 0 : chars / nonEmpty;
+    const indentedRatio = nonEmpty === 0 ? 0 : indented / nonEmpty;
+    return { unminified: nonEmpty >= 40 && avgLineLength < 100 && indentedRatio > 0.3, avgLineLength, indentedRatio };
+}
+/**
+ * Checks one shipped JavaScript file for what it gives away: source maps
+ * (inline or referenced), eval-wrapped dev bundles, missing minification,
+ * framework development builds, embedded credentials and internal hosts.
+ * Source maps that sit next to the file are handled by the caller, which can
+ * see the filesystem or the network.
+ */
+export function analyzeJavaScript(text, file, options = {}) {
+    const findings = [];
+    const mapUrl = sourceMappingUrl(text);
+    if (mapUrl && INLINE_MAP_PREFIX.test(mapUrl)) {
+        const info = parseSourceMap(Buffer.from(mapUrl.replace(INLINE_MAP_PREFIX, ""), "base64").toString("utf8"));
+        findings.push(info ? sourceMapFinding(info, file, "sourcemap_inline") : finding("sourcemap_inline", file, { match: "inline data: source map (not parseable)" }));
+    }
+    else if (mapUrl) {
+        findings.push(finding("sourcemap_reference", file, { match: `//# sourceMappingURL=${mapUrl}` }));
+    }
+    const isEvalBundle = text.includes("eval(") && EVAL_SOURCE_URL.test(text);
+    if (isEvalBundle) {
+        const idx = text.search(EVAL_SOURCE_URL);
+        findings.push(finding("eval_devtool_bundle", file, { match: text.slice(idx, idx + 80).split("\\n")[0], ...lineCol(text, idx) }));
+    }
+    if (!options.skipMinifyCheck && !isEvalBundle && Buffer.byteLength(text) >= MIN_BYTES_FOR_MINIFY_CHECK) {
+        const m = looksUnminified(text);
+        if (m.unminified) {
+            findings.push(finding("unminified_bundle", file, {
+                match: `average line ${m.avgLineLength.toFixed(0)} chars, ${(m.indentedRatio * 100).toFixed(0)}% indented lines`,
+            }));
+        }
+    }
+    for (const marker of DEV_BUILD_MARKERS) {
+        const idx = text.search(marker.pattern);
+        if (idx !== -1) {
+            findings.push(finding("dev_build_framework", file, { match: `${marker.framework}: ${text.slice(idx, idx + 60).trim()}`, ...lineCol(text, idx) }));
+        }
+    }
+    for (const rule of BUNDLE_SECRET_RULES) {
+        rule.pattern.lastIndex = 0;
+        const re = new RegExp(rule.pattern.source, rule.pattern.flags.includes("g") ? rule.pattern.flags : `${rule.pattern.flags}g`);
+        for (const m of text.matchAll(re)) {
+            const value = m[0];
+            if (rule.allowlist?.some((a) => a.test(value)))
+                continue;
+            if (CONNECTION_RULE.test(rule.id) ? isPlaceholderConnection(value) : !rule.skipPlaceholderCheck && isPlaceholder(value))
+                continue;
+            if (PEM_HEADER_RULE.test(rule.id) && !PEM_BODY.test(text.slice((m.index ?? 0) + value.length, (m.index ?? 0) + value.length + 160)))
+                continue;
+            findings.push(finding("bundle_secret", file, {
+                severity: rule.severity === "low" ? "medium" : rule.severity,
+                match: `${rule.name}: ${mask(value)}`,
+                ...lineCol(text, m.index ?? 0),
+            }));
+            break; // one per rule per file is enough to act on
+        }
+    }
+    const hosts = new Set();
+    let firstHostIndex = -1;
+    for (const m of text.matchAll(INTERNAL_URL)) {
+        hosts.add(m[0]);
+        if (firstHostIndex === -1)
+            firstHostIndex = m.index ?? 0;
+        if (hosts.size >= 5)
+            break;
+    }
+    if (hosts.size > 0) {
+        findings.push(finding("internal_endpoint", file, { match: [...hosts].join(", "), ...lineCol(text, firstHostIndex) }));
+    }
+    return findings;
+}
+const JS_EXT = /\.(?:m|c)?js$/i;
+const MAP_EXT = /\.map$/i;
+export const MAX_TEXT_BYTES = 20 * 1024 * 1024;
+export function isWebAsset(key) {
+    return (JS_EXT.test(key) || MAP_EXT.test(key)) && !key.split("/").includes("node_modules");
+}
+function resolveKey(fromKey, ref) {
+    const parts = fromKey.split("/").slice(0, -1);
+    for (const seg of ref.split(/[?#]/)[0].split("/")) {
+        if (seg === "..")
+            parts.pop();
+        else if (seg !== "." && seg !== "")
+            parts.push(seg);
+    }
+    return parts.join("/");
+}
+/**
+ * Runs the JavaScript and source map checks over a set of shipped files. A
+ * bundle whose sourceMappingURL resolves to a map in the same set is reported
+ * once, through the map, rather than again as a bare reference.
+ */
+export function analyzeWebFiles(files) {
+    const findings = [];
+    const keys = new Set(files.map((f) => f.key));
+    for (const file of files) {
+        if (file.size > MAX_TEXT_BYTES)
+            continue;
+        if (MAP_EXT.test(file.key)) {
+            const buf = file.read();
+            const info = buf ? parseSourceMap(buf.toString("utf8")) : null;
+            if (info)
+                findings.push(sourceMapFinding(info, file.display, "sourcemap_shipped"));
+            continue;
+        }
+        if (!JS_EXT.test(file.key))
+            continue;
+        const buf = file.read();
+        if (!buf)
+            continue;
+        const text = buf.toString("utf8");
+        const mapUrl = sourceMappingUrl(text);
+        const mapShipped = mapUrl !== null && !INLINE_MAP_PREFIX.test(mapUrl) && keys.has(resolveKey(file.key, mapUrl));
+        for (const f of analyzeJavaScript(text, file.display)) {
+            if (mapShipped && f.patternId === "sourcemap_reference")
+                continue;
+            findings.push(f);
+        }
+    }
+    return collapseRepeats(findings);
+}
+const COLLAPSE_AFTER = 5;
+/**
+ * A packaged app repeats the same key, host list or build setting across
+ * dozens of chunks. Report each distinct thing once and say how far it
+ * spreads, so the real number of problems stays readable.
+ */
+export function collapseRepeats(findings) {
+    const out = [];
+    const secrets = new Map();
+    const hosts = [];
+    const perFile = new Map();
+    for (const f of findings) {
+        if (f.patternId === "bundle_secret") {
+            const seen = secrets.get(f.match);
+            if (seen)
+                seen.files++;
+            else
+                secrets.set(f.match, { first: f, files: 1 });
+        }
+        else if (f.patternId === "internal_endpoint") {
+            hosts.push(f);
+        }
+        else if (f.patternId === "unminified_bundle" || f.patternId === "sourcemap_reference") {
+            perFile.set(f.patternId, [...(perFile.get(f.patternId) ?? []), f]);
+        }
+        else {
+            out.push(f);
+        }
+    }
+    for (const { first, files } of secrets.values()) {
+        out.push(files > 1 ? { ...first, match: `${first.match} — also in ${files - 1} other file(s)` } : first);
+    }
+    if (hosts.length > 0) {
+        const all = new Set(hosts.flatMap((h) => h.match.split(", ")));
+        const list = [...all].slice(0, 8).join(", ") + (all.size > 8 ? `, … (${all.size} hosts)` : "");
+        out.push({ ...hosts[0], match: hosts.length > 1 ? `${list} — in ${hosts.length} files` : list });
+    }
+    for (const group of perFile.values()) {
+        if (group.length <= COLLAPSE_AFTER) {
+            out.push(...group);
+            continue;
+        }
+        const names = group.slice(0, 3).map((g) => (g.file ?? "").split(/[/\\]/).pop());
+        out.push({ ...group[0], line: 1, column: 1, match: `${group.length} files, e.g. ${names.join(", ")}` });
+    }
+    return out;
+}
+//# sourceMappingURL=web.js.map