@guardbee/mcp-reverse-shield 0.1.1 → 0.2.0

package/README.md

@@ -8,7 +8,7 @@
 
 An MCP server that tells you **how much your shipped app gives a reverse engineer for free**.
 
-Reverse-engineering MCPs now let an agent take an app it has no source for — a web bundle, an Electron app, an APK, a native or .NET binary — and explain how a feature works, down to the binary. This package is the other side of that: point it at *your own* build artifact and it reports what such a tool (or a person with jadx, ILSpy, Hopper or the browser's devtools) would get without any effort, with the fix for each.
+Reverse-engineering MCPs now let an agent take an app it has no source for — a web bundle, an Electron app, an APK, an iOS app, a game, a native or .NET binary — and explain how a feature works, down to the binary. This package is the other side of that: point it at *your own* build artifact and it reports what such a tool (or a person with jadx, ILSpy, Il2CppDumper, Hopper or the browser's devtools) would get without any effort, with the fix for each — and `suggest_fixes` turns those fixes into a diff against your build config.
 
 > Telemetry is **off** by default. With `GUARDBEE_TELEMETRY=1` it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like `content`, `token` or `password` are replaced with a placeholder. See [`@guardbee/mcp-telemetry`](https://github.com/GuardBee/guardbee-mcp/blob/main/packages/telemetry/README.md).
 
@@ -17,7 +17,9 @@ Claude ──► reverse-shield ──► your build artifact / live site
               │
               ├─ web       source maps (shipped, inline, publicly reachable), unminified / dev bundles, keys, internal hosts
               ├─ electron  fuses (RunAsNode, --inspect, NODE_OPTIONS, ASAR integrity), unpacked app code, code inside app.asar
-              ├─ android   debuggable, R8/ProGuard missing, signing scheme, backup, plain React Native bundle, unstripped .so
+              ├─ android   APK and AAB: debuggable, R8/ProGuard missing, signing scheme, backup, plain React Native bundle, unstripped .so
+              ├─ ios       IPA and .app: Debug-configuration builds, development profiles, plain React Native bundle, the executable
+              ├─ engines   Unity (IL2CPP metadata, Mono assemblies), PyInstaller, Java/Spring Boot JARs, Flutter
               ├─ native    debug info, symbols, get-task-allow, hardened runtime, signing, PIE/NX/RELRO/canary (ELF, Mach-O, PE)
               └─ .NET      obfuscation missing, embedded PDB, leaked build paths
 ```
@@ -44,6 +46,10 @@ Everything runs locally and offline (except `scan_url`), with its own parsers fo
 | `native_symbols_not_stripped` / `native_no_hardened_runtime` / `native_injection_entitlement` / `native_unsigned` | medium | native | Named functions / dylib injection / patched copies run |
 | `native_no_pie` / `native_no_nx` | medium | native | Exploit-friendly fixed addresses / executable stack |
 | `native_no_relro` / `native_no_stack_canary` / `native_adhoc_signed` / `native_build_path_leak` | low | native | Hardening gaps and build-host details |
+| `ios_debug_build` / `ios_js_bundle_plaintext` | high | ios | Unoptimised code with full symbols and preview stubs / readable RN bundle |
+| `ios_development_profile` | medium | ios | Debugger attach on registered devices |
+| `unity_il2cpp_metadata` / `unity_mono_assemblies` | high | engines | Every class, method and string of the game / C# scripts via dnSpy |
+| `python_pyinstaller_bundle` / `java_not_obfuscated` | high | engines | Decompilable `.pyc` files / Java classes with original names |
 | `dotnet_not_obfuscated` / `dotnet_embedded_pdb` | high | .NET | ILSpy/dnSpy output close to the original source |
 
 `list_checks` returns the full catalog with fixes. Every result carries an **A–F grade**: F when anything critical (or several high findings) is exposed, A when nothing is.
@@ -54,6 +60,10 @@ Everything runs locally and offline (except `scan_url`), with its own parsers fo
 - **.NET obfuscation**: reads the metadata `#Strings` heap. Known obfuscator markers (ConfuserEx, Dotfuscator, SmartAssembly, …) pass immediately; otherwise an assembly passes when at least 10% of its identifiers are one- or two-letter names, bare numbers or non-ASCII junk. Checked against an Obfuscar build (21%, passes) and 400 unobfuscated NuGet assemblies (383 flagged; the other 17 are resource-only assemblies with too few names to judge).
 - **Private keys**: only reported when base64 key material follows the PEM header — crypto libraries bundled into apps carry the header as a string constant.
 - **Repeats**: one key in 30 chunks is one finding (“also in 29 other files”), and long lists of unminified files collapse into one.
+- **iOS Debug builds**: Xcode 16 puts a Debug build's code in `<App>.debug.dylib` next to `__preview.dylib`; either one in a bundle means the Debug configuration was shipped.
+- **Unity**: IL2CPP's `global-metadata.dat` is flagged only when its standard header is intact (protected builds encrypt it); a Mono `Assembly-CSharp.dll` goes through the .NET name check.
+- **PyInstaller**: the CArchive cookie is searched across the whole file (on macOS the archive sits in its own section before the code signature); PyArmor and Nuitka builds are noted, not flagged.
+- **Flutter** apps are recognised, but Dart obfuscation is not measured — the note gives the build flags instead.
 
 ## Quick start
 
@@ -75,13 +85,16 @@ npx @guardbee/mcp-reverse-shield scan ./dist --fail-on=high
 npx @guardbee/mcp-reverse-shield scan ./app/build/outputs/apk/release/app-release.apk
 npx @guardbee/mcp-reverse-shield scan "/Applications/My App.app" --format=json
 npx @guardbee/mcp-reverse-shield scan https://app.example.com --format=sarif > reverse-shield.sarif
+npx @guardbee/mcp-reverse-shield scan ./build/MyApp.ipa
+npx @guardbee/mcp-reverse-shield suggest . --format=patch | git apply   # review first: suggest . prints the same as text
 ```
 
 ## Tools
 
 | Tool | Purpose |
 |---|---|
-| `scan_artifact` | Scan a file or directory: APK, `.app`, Electron folder, `app.asar`, ELF/Mach-O/PE/.NET binary, JS bundle, source map, or a build output folder |
+| `scan_artifact` | Scan a file or directory: APK, AAB, IPA, iOS or macOS `.app`, Electron folder, `app.asar`, JAR, ELF/Mach-O/PE/.NET binary, JS bundle, source map, or a build output folder (Unity and Python builds included). Optional `ignore` and `baseline` |
+| `suggest_fixes` | Read the project's build config (Vite, webpack, Next.js, Angular, CRA, Android Gradle and manifest, React Native, electron-builder / Forge, .NET project files, Flutter) and return the changes as unified diffs. Never writes files |
 | `scan_url` | Fetch a live page, check its same-site bundles, follow `sourceMappingURL` and probe `<bundle>.map` (third-party scripts are not fetched) |
 | `list_checks` | The check catalog with what each finding gives away and how to fix it |
 
@@ -93,25 +106,42 @@ Directories are walked including `dist/`, `build/` and `out/` (that is the point
 reverse-shield:
   fail-on: high
   max-files: 5000
+  baseline: .reverse-shield-baseline.json
   exclude:
     - "vendor/"
+  ignore:                       # accepted exposures: a rule id, or rule:path-substring
+    - bundle_secret:firebase-config.js
 ```
 
-## CI
+## CI and baselines
+
+Record what the current release exposes, then let CI fail only on what a change adds:
+
+```bash
+npx @guardbee/mcp-reverse-shield scan ./dist --update-baseline          # writes .reverse-shield-baseline.json
+npx @guardbee/mcp-reverse-shield scan ./dist --baseline=.reverse-shield-baseline.json --fail-on=high
+# Compared to baseline (grade C → D): 1 new, 2 fixed, 4 unchanged
+```
+
+Findings are matched by check and location, with bundler content hashes (`index-BvL4J5f8.js`, `7321-dd7cb90a7de65945.js`) normalised, so a rebuild does not make old findings look new. SARIF results carry `baselineState` (`new` / `unchanged`).
+
+The repository ships a composite action that scans, uploads SARIF, writes a job summary and exposes `grade` / `new-findings` outputs:
 
 ```yaml
-- run: npx @guardbee/mcp-reverse-shield scan ./dist --fail-on=high --format=sarif > reverse-shield.sarif
-- uses: github/codeql-action/upload-sarif@v3
+- uses: GuardBee/guardbee-mcp/.github/actions/reverse-shield@main
   with:
-    sarif_file: reverse-shield.sarif
+    target: dist
+    fail-on: high
+    baseline: .reverse-shield-baseline.json
 ```
 
 ## Limits
 
 - Obfuscation is judged from names, not control flow: a build that only renames passes, and string encryption or control-flow flattening is not measured.
-- Web checks look at what is shipped; they cannot tell whether a key is meant to be public (some, like Firebase web keys, are restricted server-side). Rotate or restrict, then add the path to `exclude`.
+- Web checks look at what is shipped; they cannot tell whether a key is meant to be public (some, like Firebase web keys, are restricted server-side). Rotate or restrict it, then accept it with an `ignore` entry (`bundle_secret:firebase-config.js`).
 - Native hardening checks (PIE/NX/RELRO/canary) are exploit-mitigation signals rather than reverse-engineering ones; they are reported low/medium for that reason.
-- iOS `.ipa` and Android App Bundles (`.aab`) are not unpacked yet; scan the `.app` inside the `.ipa`, or a universal APK built from the bundle.
+- App Store IPAs are FairPlay-encrypted on distribution; the scanner reads the IPA you export (development, ad hoc or App Store export before Apple encrypts it), which is what a jailbroken device would also yield.
+- `suggest_fixes` edits the common shapes of each config; unusual layouts (computed webpack configs, Gradle convention plugins) get no diff, and Forge and Flutter get instructions rather than a patch. Always review before applying.
 
 ## License
 

package/TR.md

@@ -4,7 +4,7 @@
 
 Yayınladığın uygulamanın bir tersine mühendise **neyi bedavaya verdiğini** söyleyen bir MCP server.
 
-Tersine mühendislik MCP'leri artık bir agent'ın kaynak kodu olmayan bir uygulamayı (web bundle, Electron uygulaması, APK, native ya da .NET binary) alıp bir özelliğin nasıl çalıştığını binary seviyesine kadar açıklamasına izin veriyor. Bu paket madalyonun öbür yüzü: onu *kendi* build artifact'ına yönelt; böyle bir aracın (ya da jadx, ILSpy, Hopper veya tarayıcı devtools'u kullanan birinin) hiç uğraşmadan neler elde edeceğini, her biri için düzeltmesiyle birlikte raporlar.
+Tersine mühendislik MCP'leri artık bir agent'ın kaynak kodu olmayan bir uygulamayı (web bundle, Electron uygulaması, APK, iOS uygulaması, oyun, native ya da .NET binary) alıp bir özelliğin nasıl çalıştığını binary seviyesine kadar açıklamasına izin veriyor. Bu paket madalyonun öbür yüzü: onu *kendi* build artifact'ına yönelt; böyle bir aracın (ya da jadx, ILSpy, Il2CppDumper, Hopper veya tarayıcı devtools'u kullanan birinin) hiç uğraşmadan neler elde edeceğini her biri için düzeltmesiyle birlikte raporlar; `suggest_fixes` de bu düzeltmeleri build config'ine karşı bir diff'e çevirir.
 
 > Telemetri varsayılan olarak **kapalıdır**. `GUARDBEE_TELEMETRY=1` ile açılırsa sunucu, tool, başarı, süre ve dosya yolu gibi kısa parametre değerleri gönderilir; daha uzun metinler ve `content`, `token`, `password` gibi alanlar yer tutucuyla değiştirilir. Bkz. [`@guardbee/mcp-telemetry`](../telemetry/TR.md).
 
@@ -13,7 +13,9 @@ Claude ──► reverse-shield ──► build artifact'ın / canlı site
               │
               ├─ web       source map'ler (paketlenmiş, inline, herkese açık), minify edilmemiş / dev bundle, anahtarlar, iç host'lar
               ├─ electron  fuse'lar (RunAsNode, --inspect, NODE_OPTIONS, ASAR integrity), açık uygulama kodu, app.asar içindeki kod
-              ├─ android   debuggable, R8/ProGuard yok, imza şeması, backup, düz React Native bundle, strip edilmemiş .so
+              ├─ android   APK ve AAB: debuggable, R8/ProGuard yok, imza şeması, backup, düz React Native bundle, strip edilmemiş .so
+              ├─ ios       IPA ve .app: Debug yapılandırmasıyla derlenmiş build, development profili, düz React Native bundle, executable
+              ├─ motorlar  Unity (IL2CPP metadata, Mono assembly'leri), PyInstaller, Java/Spring Boot JAR, Flutter
               ├─ native    debug bilgisi, semboller, get-task-allow, hardened runtime, imza, PIE/NX/RELRO/canary (ELF, Mach-O, PE)
               └─ .NET      obfuscation yok, gömülü PDB, sızan build yolları
 ```
@@ -40,6 +42,10 @@ Claude ──► reverse-shield ──► build artifact'ın / canlı site
 | `native_symbols_not_stripped` / `native_no_hardened_runtime` / `native_injection_entitlement` / `native_unsigned` | medium | native | İsimli fonksiyonlar / dylib enjeksiyonu / yamalı kopyaların çalışması |
 | `native_no_pie` / `native_no_nx` | medium | native | Exploit'e elverişli sabit adresler / çalıştırılabilir stack |
 | `native_no_relro` / `native_no_stack_canary` / `native_adhoc_signed` / `native_build_path_leak` | low | native | Sertleştirme boşlukları ve build makinesi ayrıntıları |
+| `ios_debug_build` / `ios_js_bundle_plaintext` | high | ios | Tam sembollü, optimize edilmemiş kod ve preview stub'ları / okunabilir RN bundle |
+| `ios_development_profile` | medium | ios | Kayıtlı cihazlarda debugger bağlama |
+| `unity_il2cpp_metadata` / `unity_mono_assemblies` | high | motorlar | Oyunun tüm sınıf, metot ve string'leri / dnSpy ile C# script'leri |
+| `python_pyinstaller_bundle` / `java_not_obfuscated` | high | motorlar | Decompile edilebilir `.pyc` dosyaları / orijinal isimleriyle Java sınıfları |
 | `dotnet_not_obfuscated` / `dotnet_embedded_pdb` | high | .NET | Orijinal kaynağa çok yakın ILSpy/dnSpy çıktısı |
 
 `list_checks` tüm kataloğu düzeltmeleriyle döndürür. Her sonuç bir **A–F notu** taşır: kritik bir şey (ya da birden fazla high bulgu) açıktaysa F, hiçbir şey yoksa A.
@@ -50,6 +56,10 @@ Claude ──► reverse-shield ──► build artifact'ın / canlı site
 - **.NET obfuscation**: metadata `#Strings` heap'ini okur. Bilinen obfuscator işaretleri (ConfuserEx, Dotfuscator, SmartAssembly, …) doğrudan geçer; aksi halde tanımlayıcıların en az %10'u bir-iki harfli isim, sadece rakam ya da ASCII dışı çöp karakterse assembly geçer. Bir Obfuscar build'ine (%21, geçer) ve obfuscate edilmemiş 400 NuGet assembly'sine (383'ü işaretlendi; kalan 17'si karar verilemeyecek kadar az isim içeren kaynak assembly'leri) karşı doğrulandı.
 - **Private key'ler**: sadece PEM başlığından sonra base64 anahtar verisi geliyorsa raporlanır; uygulamalara gömülen kripto kütüphaneleri bu başlığı string sabiti olarak taşır.
 - **Tekrarlar**: 30 chunk'taki aynı anahtar tek bulgudur ("also in 29 other files"); uzun minify edilmemiş dosya listeleri tek bulguda toplanır.
+- **iOS Debug build'leri**: Xcode 16, Debug build'in kodunu `<App>.debug.dylib` içine koyar ve yanına `__preview.dylib` ekler; paketteki ikisinden biri Debug yapılandırmasının yayınlandığını gösterir.
+- **Unity**: IL2CPP `global-metadata.dat` sadece standart başlığı bozulmamışsa işaretlenir (korumalı build'ler şifreler); Mono `Assembly-CSharp.dll` .NET isim kontrolünden geçer.
+- **PyInstaller**: CArchive işaretçisi dosyanın tamamında aranır (macOS'te arşiv kod imzasından önce kendi bölümündedir); PyArmor ve Nuitka build'leri işaretlenmez, not düşülür.
+- **Flutter** uygulamaları tanınır ama Dart obfuscation ölçülmez; not, bunun yerine build bayraklarını verir.
 
 ## Hızlı başlangıç
 
@@ -71,13 +81,16 @@ npx @guardbee/mcp-reverse-shield scan ./dist --fail-on=high
 npx @guardbee/mcp-reverse-shield scan ./app/build/outputs/apk/release/app-release.apk
 npx @guardbee/mcp-reverse-shield scan "/Applications/My App.app" --format=json
 npx @guardbee/mcp-reverse-shield scan https://app.example.com --format=sarif > reverse-shield.sarif
+npx @guardbee/mcp-reverse-shield scan ./build/MyApp.ipa
+npx @guardbee/mcp-reverse-shield suggest . --format=patch | git apply   # önce gözden geçir: suggest . aynısını metin olarak basar
 ```
 
 ## Tool'lar
 
 | Tool | Amaç |
 |---|---|
-| `scan_artifact` | Bir dosya ya da dizini tarar: APK, `.app`, Electron klasörü, `app.asar`, ELF/Mach-O/PE/.NET binary, JS bundle, source map ya da build çıktı klasörü |
+| `scan_artifact` | Bir dosya ya da dizini tarar: APK, AAB, IPA, iOS ya da macOS `.app`, Electron klasörü, `app.asar`, JAR, ELF/Mach-O/PE/.NET binary, JS bundle, source map ya da build çıktı klasörü (Unity ve Python build'leri dahil). İsteğe bağlı `ignore` ve `baseline` |
+| `suggest_fixes` | Projenin build config'ini (Vite, webpack, Next.js, Angular, CRA, Android Gradle ve manifest, React Native, electron-builder / Forge, .NET proje dosyaları, Flutter) okur ve değişiklikleri unified diff olarak döndürür. Dosya yazmaz |
 | `scan_url` | Canlı bir sayfayı çeker, aynı siteye ait bundle'ları kontrol eder, `sourceMappingURL`'i takip eder ve `<bundle>.map`'i dener (üçüncü taraf script'ler çekilmez) |
 | `list_checks` | Her bulgunun neyi ele verdiği ve nasıl düzeltileceğiyle kontrol kataloğu |
 
@@ -89,25 +102,42 @@ Dizinler `dist/`, `build/` ve `out/` dahil yürünür (amaç zaten bu); `node_mo
 reverse-shield:
   fail-on: high
   max-files: 5000
+  baseline: .reverse-shield-baseline.json
   exclude:
     - "vendor/"
+  ignore:                       # kabul edilen bulgular: kural id'si ya da kural:yol-parçası
+    - bundle_secret:firebase-config.js
 ```
 
-## CI
+## CI ve baseline
+
+Mevcut sürümün neyi açık bıraktığını kaydet, sonra CI sadece bir değişikliğin eklediklerinde başarısız olsun:
+
+```bash
+npx @guardbee/mcp-reverse-shield scan ./dist --update-baseline          # .reverse-shield-baseline.json yazar
+npx @guardbee/mcp-reverse-shield scan ./dist --baseline=.reverse-shield-baseline.json --fail-on=high
+# Compared to baseline (grade C → D): 1 new, 2 fixed, 4 unchanged
+```
+
+Bulgular kontrol ve konuma göre eşleştirilir; bundler hash'leri (`index-BvL4J5f8.js`, `7321-dd7cb90a7de65945.js`) normalize edildiği için yeniden build almak eski bulguları yeni göstermez. SARIF sonuçları `baselineState` (`new` / `unchanged`) taşır.
+
+Repoda tarayan, SARIF yükleyen, job özeti yazan ve `grade` / `new-findings` çıktıları veren bir composite action var:
 
 ```yaml
-- run: npx @guardbee/mcp-reverse-shield scan ./dist --fail-on=high --format=sarif > reverse-shield.sarif
-- uses: github/codeql-action/upload-sarif@v3
+- uses: GuardBee/guardbee-mcp/.github/actions/reverse-shield@main
   with:
-    sarif_file: reverse-shield.sarif
+    target: dist
+    fail-on: high
+    baseline: .reverse-shield-baseline.json
 ```
 
 ## Sınırlar
 
 - Obfuscation kontrol akışından değil isimlerden değerlendirilir: sadece yeniden adlandıran bir build geçer; string şifreleme ya da control-flow flattening ölçülmez.
-- Web kontrolleri gönderileni inceler; bir anahtarın herkese açık olmak üzere tasarlanıp tasarlanmadığını bilemez (Firebase web anahtarları gibi bazıları sunucu tarafında kısıtlanır). Döndür ya da kısıtla, sonra yolu `exclude`'a ekle.
+- Web kontrolleri gönderileni inceler; bir anahtarın herkese açık olmak üzere tasarlanıp tasarlanmadığını bilemez (Firebase web anahtarları gibi bazıları sunucu tarafında kısıtlanır). Döndür ya da kısıtla, sonra bir `ignore` girdisiyle kabul et (`bundle_secret:firebase-config.js`).
 - Native sertleştirme kontrolleri (PIE/NX/RELRO/canary) tersine mühendislikten çok exploit önleme sinyalidir; bu yüzden low/medium raporlanır.
-- iOS `.ipa` ve Android App Bundle (`.aab`) henüz açılmıyor; `.ipa` içindeki `.app`'i ya da bundle'dan üretilmiş universal APK'yı tara.
+- App Store IPA'ları dağıtımda FairPlay ile şifrelenir; tarayıcı senin dışa aktardığın IPA'yı okur (development, ad hoc ya da Apple şifrelemeden önceki App Store export'u), ki jailbreak'li bir cihazdan da aynısı elde edilir.
+- `suggest_fixes` her config'in yaygın biçimlerini düzenler; alışılmadık yapılar (hesaplanan webpack config'leri, Gradle convention plugin'leri) diff almaz, Forge ve Flutter için patch yerine talimat verilir. Uygulamadan önce mutlaka gözden geçir.
 
 ## Lisans
 

package/ZH.md

@@ -13,7 +13,9 @@ Claude ──► reverse-shield ──► 你的构建产物 / 线上站点
               │
               ├─ web       source map（随包发布、内联、可公开下载）、未压缩 / 开发版打包、密钥、内部主机
               ├─ electron  fuse（RunAsNode、--inspect、NODE_OPTIONS、ASAR 完整性）、未打包的应用代码、app.asar 内的代码
-              ├─ android   debuggable、未启用 R8/ProGuard、签名方案、备份、明文 React Native 包、未剥离符号的 .so
+              ├─ android   APK 与 AAB：debuggable、未启用 R8/ProGuard、签名方案、备份、明文 React Native 包、未剥离符号的 .so
+              ├─ ios       IPA 与 .app：以 Debug 配置构建、开发描述文件、明文 React Native 包、可执行文件
+              ├─ 引擎      Unity（IL2CPP 元数据、Mono 程序集）、PyInstaller、Java/Spring Boot JAR、Flutter
               ├─ native    调试信息、符号、get-task-allow、hardened runtime、签名、PIE/NX/RELRO/canary（ELF、Mach-O、PE）
               └─ .NET      未混淆、内嵌 PDB、泄露的构建路径
 ```
@@ -24,7 +26,8 @@ Claude ──► reverse-shield ──► 你的构建产物 / 线上站点
 
 | 工具 | 用途 |
 |---|---|
-| `scan_artifact` | 扫描文件或目录：APK、`.app`、Electron 目录、`app.asar`、ELF/Mach-O/PE/.NET 二进制、JS 打包文件、source map 或构建输出目录 |
+| `scan_artifact` | 扫描文件或目录：APK、AAB、IPA、iOS 或 macOS `.app`、Electron 目录、`app.asar`、JAR、ELF/Mach-O/PE/.NET 二进制、JS 打包文件、source map 或构建输出目录（含 Unity 与 Python 构建）。可选 `ignore` 与 `baseline` |
+| `suggest_fixes` | 读取项目构建配置（Vite、webpack、Next.js、Angular、CRA、Android Gradle 与清单、React Native、electron-builder / Forge、.NET 项目文件、Flutter），以 unified diff 形式返回修改建议，不写入任何文件 |
 | `scan_url` | 抓取线上页面，检查同站点的打包脚本，跟随 `sourceMappingURL` 并尝试 `<bundle>.map`（不抓取第三方脚本） |
 | `list_checks` | 检查项目录，包括每项泄露了什么以及如何修复 |
 
@@ -47,6 +50,8 @@ Claude ──► reverse-shield ──► 你的构建产物 / 线上站点
 npx @guardbee/mcp-reverse-shield scan ./dist --fail-on=high
 npx @guardbee/mcp-reverse-shield scan ./app/build/outputs/apk/release/app-release.apk
 npx @guardbee/mcp-reverse-shield scan https://app.example.com --format=sarif > reverse-shield.sarif
+npx @guardbee/mcp-reverse-shield scan ./dist --update-baseline        # 记录基线，之后用 --baseline=… 只对新增问题报错
+npx @guardbee/mcp-reverse-shield suggest . --format=patch | git apply  # 应用前请先审阅
 ```
 
 ## 限制
@@ -54,7 +59,7 @@ npx @guardbee/mcp-reverse-shield scan https://app.example.com --format=sarif > r
 - 混淆仅根据名称判断，不分析控制流：只做重命名的构建会通过，字符串加密或控制流平坦化不在衡量范围内。
 - Web 检查只看发布出去的内容，无法判断某个密钥是否本就应当公开（例如 Firebase Web 密钥在服务端受限）。
 - 原生加固检查（PIE/NX/RELRO/canary）更多是漏洞利用缓解信号，因此以 low/medium 报告。
-- 暂不解包 iOS `.ipa` 和 Android App Bundle（`.aab`）。
+- `suggest_fixes` 只处理各配置的常见写法；非常规结构不会生成 diff，Forge 与 Flutter 给出说明而非补丁。应用前务必审阅。
 
 ## 许可证
 

package/dist/__tests__/baseline.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=baseline.test.d.ts.map

package/dist/__tests__/baseline.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/baseline.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/baseline.test.js

@@ -0,0 +1,130 @@
+import { execFileSync, spawnSync } from "child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { afterEach, describe, expect, it } from "vitest";
+import { applyIgnores, compareToBaseline, createBaseline, fingerprint, normalizeLocation } from "../baseline.js";
+import { scanPath } from "../scanner.js";
+const dirs = [];
+const tmp = () => {
+    const d = mkdtempSync(join(tmpdir(), "rs-baseline-"));
+    dirs.push(d);
+    return d;
+};
+afterEach(() => {
+    for (const d of dirs.splice(0))
+        rmSync(d, { recursive: true, force: true });
+});
+const minified = Array.from({ length: 300 }, (_, i) => `function a${i}(b){return b+${i}}`).join(";");
+const mapJson = JSON.stringify({ version: 3, mappings: "AAAA", sources: ["src/App.tsx"], sourcesContent: ["x"] });
+function build(root, files) {
+    for (const [p, data] of Object.entries(files)) {
+        const full = join(root, ...p.split("/"));
+        mkdirSync(dirname(full), { recursive: true });
+        writeFileSync(full, data);
+    }
+}
+describe("normalizeLocation", () => {
+    it("replaces bundler content hashes so the next build matches", () => {
+        expect(normalizeLocation("/out/dist/assets/index-BvL4J5f8.js", "/out")).toBe("dist/assets/index-#.js");
+        expect(normalizeLocation("/out/_next/static/chunks/7321-dd7cb90a7de65945.js", "/out")).toBe("_next/static/chunks/7321-#.js");
+        expect(normalizeLocation("/out/chunk-HCOYIBKO.js", "/out/")).toBe("chunk-#.js");
+        expect(normalizeLocation("/out/static/js/main.a1b2c3d4.chunk.js", "/out")).toBe("static/js/main.#.chunk.js");
+    });
+    it("keeps ordinary names and strips query strings", () => {
+        expect(normalizeLocation("/out/src/LicenseValidator.js", "/out")).toBe("src/LicenseValidator.js");
+        expect(normalizeLocation("https://site.test/js/app.js?ver=2.0.21", "https://site.test/")).toBe("js/app.js");
+        expect(normalizeLocation("C:\\build\\out\\app.exe", "C:\\build")).toBe("out/app.exe");
+    });
+});
+describe("compareToBaseline", () => {
+    it("separates new, fixed and unchanged findings across two builds with different hashes", () => {
+        const v1 = tmp();
+        build(v1, {
+            "assets/index-AAAA1111.js": `${minified}\n//# sourceMappingURL=index-AAAA1111.js.map`,
+            "assets/index-AAAA1111.js.map": mapJson,
+            "assets/vendor-BBBB2222.js": 'fetch("http://localhost:3000")',
+        });
+        const baseline = createBaseline(scanPath(v1));
+        const v2 = tmp();
+        build(v2, {
+            "assets/index-CCCC3333.js": `${minified}\n//# sourceMappingURL=index-CCCC3333.js.map`,
+            "assets/index-CCCC3333.js.map": mapJson,
+            "assets/app-DDDD4444.js": 'const k="AKIAQ7XKZP3LMNB2RTUV";',
+        });
+        const diff = compareToBaseline(scanPath(v2), baseline);
+        expect(diff.unchanged.map((f) => f.patternId)).toEqual(["sourcemap_embeds_source"]);
+        expect(diff.added.map((f) => f.patternId)).toEqual(["bundle_secret"]);
+        expect(diff.fixed).toEqual(["internal_endpoint|assets/vendor-#.js"]);
+        expect(diff.previousGrade).toBe("F");
+    });
+    it("keeps two different keys in one file apart", () => {
+        const root = tmp();
+        // Assembled at runtime so the repository's secretlint hook does not read it as a leak.
+        const githubToken = ["ghp", "R8kd2LmQ9xTz4VbN7wPa1sYc6HfJ3uEo5Gi0"].join("_");
+        build(root, { "a.js": `const k="AKIAQ7XKZP3LMNB2RTUV";const g="${githubToken}";` });
+        const r = scanPath(root);
+        const fps = r.findings.map((f) => fingerprint(f, r.target));
+        expect(new Set(fps).size).toBe(2);
+    });
+});
+describe("applyIgnores", () => {
+    it("drops ignored rules, by id or id:path, and re-grades", () => {
+        const root = tmp();
+        build(root, {
+            "public/firebase-config.js": 'const k="AKIAQ7XKZP3LMNB2RTUV";',
+            "public/app.js": 'fetch("http://localhost:1")',
+        });
+        const r = scanPath(root);
+        expect(r.grade).toBe("F");
+        expect(applyIgnores(r, ["bundle_secret:firebase-config.js"])).toBe(1);
+        expect(r.findings.map((f) => f.patternId)).toEqual(["internal_endpoint"]);
+        expect(r.grade).toBe("B");
+        expect(r.notes).toContain("1 finding(s) suppressed by ignore rules");
+        expect(applyIgnores(r, ["internal_endpoint"])).toBe(1);
+        expect(r.grade).toBe("A");
+    });
+    it("does not drop a rule whose path does not match", () => {
+        const root = tmp();
+        build(root, { "app.js": 'const k="AKIAQ7XKZP3LMNB2RTUV";' });
+        const r = scanPath(root);
+        expect(applyIgnores(r, ["bundle_secret:other.js"])).toBe(0);
+    });
+});
+describe("CLI baseline flow", () => {
+    const cli = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "dist", "cli.js");
+    const run = (args, cwd) => spawnSync(process.execPath, [cli, ...args], { cwd, encoding: "utf8" });
+    it("fails only on findings the baseline does not already have", () => {
+        const project = tmp();
+        build(project, { "dist/app-AAAA1111.js": 'fetch("http://localhost:3000");const m=1;' + minified });
+        const write = run(["scan", "dist", "--update-baseline"], project);
+        expect(write.stderr).toContain("Baseline written: .reverse-shield-baseline.json (1 finding(s), grade B)");
+        expect(JSON.parse(readFileSync(join(project, ".reverse-shield-baseline.json"), "utf8")).fingerprints).toEqual(["internal_endpoint|app-#.js"]);
+        // Same exposure, new hash: nothing new, passes even with --fail-on=any.
+        rmSync(join(project, "dist"), { recursive: true });
+        build(project, { "dist/app-BBBB2222.js": 'fetch("http://localhost:3000");const m=2;' + minified });
+        const same = run(["scan", "dist", "--baseline=.reverse-shield-baseline.json", "--fail-on=any"], project);
+        expect(same.status).toBe(0);
+        expect(same.stdout).toContain("0 new, 0 fixed, 1 unchanged");
+        // A new key: fails, and SARIF marks it new while the old one stays unchanged.
+        build(project, { "dist/keys-CCCC3333.js": 'const k="AKIAQ7XKZP3LMNB2RTUV";' });
+        const worse = run(["scan", "dist", "--baseline=.reverse-shield-baseline.json", "--fail-on=high"], project);
+        expect(worse.status).toBe(1);
+        expect(worse.stdout).toContain("1 new, 0 fixed, 1 unchanged");
+        const sarif = JSON.parse(execFileSync(process.execPath, [cli, "scan", "dist", "--baseline=.reverse-shield-baseline.json", "--format=sarif", "--fail-on=none"], { cwd: project, encoding: "utf8" }));
+        const states = sarif.runs[0].results.map((r) => `${r.ruleId}:${r.baselineState}`).sort();
+        expect(states).toEqual(["bundle_secret:new", "internal_endpoint:unchanged"]);
+    }, 30_000); // five CLI processes: ~1 s each on a cold CI runner
+    it("reads ignore and baseline from guardbee.yml", () => {
+        const project = tmp();
+        build(project, {
+            "guardbee.yml": "reverse-shield:\n  fail-on: any\n  ignore:\n    - internal_endpoint\n",
+            "dist/app.js": 'fetch("http://localhost:3000")',
+        });
+        const r = run(["scan", "dist"], project);
+        expect(r.status).toBe(0);
+        expect(r.stdout).toContain("1 finding(s) suppressed by ignore rules");
+    }, 30_000);
+});
+//# sourceMappingURL=baseline.test.js.map

package/dist/__tests__/baseline.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.test.js","sourceRoot":"","sources":["../../src/__tests__/baseline.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACjH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,IAAI,GAAa,EAAE,CAAC;AAC1B,MAAM,GAAG,GAAG,GAAG,EAAE;IACf,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACb,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AACF,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrG,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAElH,SAAS,KAAK,CAAC,IAAY,EAAE,KAA6B;IACxD,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,iBAAiB,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvG,MAAM,CAAC,iBAAiB,CAAC,mDAAmD,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7H,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChF,MAAM,CAAC,iBAAiB,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,iBAAiB,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAClG,MAAM,CAAC,iBAAiB,CAAC,wCAAwC,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5G,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,KAAK,CAAC,EAAE,EAAE;YACR,0BAA0B,EAAE,GAAG,QAAQ,8CAA8C;YACrF,8BAA8B,EAAE,OAAO;YACvC,2BAA2B,EAAE,gCAAgC;SAC9D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9C,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,KAAK,CAAC,EAAE,EAAE;YACR,0BAA0B,EAAE,GAAG,QAAQ,8CAA8C;YACrF,8BAA8B,EAAE,OAAO;YACvC,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,uFAAuF;QACvF,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9E,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,2CAA2C,WAAW,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE;YACV,2BAA2B,EAAE,iCAAiC;YAC9D,eAAe,EAAE,6BAA6B;SAC/C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;QACrE,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,KAAK,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,2CAA2C,GAAG,QAAQ,EAAE,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yEAAyE,CAAC,CAAC;QAC1G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,+BAA+B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAE9I,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,2CAA2C,GAAG,QAAQ,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,0CAA0C,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAE7D,8EAA8E;QAC9E,KAAK,CAAC,OAAO,EAAE,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,0CAA0C,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,0CAA0C,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACpM,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAA4C,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpI,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAC/E,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,oDAAoD;IAEhE,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,KAAK,CAAC,OAAO,EAAE;YACb,cAAc,EAAE,uEAAuE;YACvF,aAAa,EAAE,gCAAgC;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACxE,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/__tests__/fixes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fixes.test.d.ts.map

package/dist/__tests__/fixes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixes.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/fixes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/fixes.test.js

@@ -0,0 +1,163 @@
+import { execFileSync } from "child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join } from "path";
+import { afterEach, describe, expect, it } from "vitest";
+import { patchOf, suggestFixes, unifiedDiff } from "../fixes.js";
+const dirs = [];
+afterEach(() => {
+    for (const d of dirs.splice(0))
+        rmSync(d, { recursive: true, force: true });
+});
+function project(files) {
+    const root = mkdtempSync(join(tmpdir(), "rs-fixes-"));
+    dirs.push(root);
+    for (const [p, data] of Object.entries(files)) {
+        const full = join(root, ...p.split("/"));
+        mkdirSync(dirname(full), { recursive: true });
+        writeFileSync(full, data);
+    }
+    return root;
+}
+/** Applies the suggested patch with real git and returns the resulting files. */
+function applyPatch(root, files) {
+    const git = (...args) => execFileSync("git", args, { cwd: root, stdio: "pipe" });
+    git("init", "-q");
+    git("-c", "user.email=t@t", "-c", "user.name=t", "add", "-A");
+    git("-c", "user.email=t@t", "-c", "user.name=t", "commit", "-qm", "init");
+    writeFileSync(join(root, "fix.patch"), patchOf(suggestFixes(root)));
+    git("apply", "fix.patch");
+    return Object.fromEntries(files.map((f) => [f, readFileSync(join(root, ...f.split("/")), "utf8")]));
+}
+const byFile = (root) => Object.fromEntries(suggestFixes(root).suggestions.map((s) => [s.file, s]));
+describe("unifiedDiff", () => {
+    it("produces one hunk with context", () => {
+        const diff = unifiedDiff("a.txt", "1\n2\n3\n4\n5\n6\n7\n8\n", "1\n2\n3\n4\nfive\n6\n7\n8\n");
+        expect(diff).toBe("--- a/a.txt\n+++ b/a.txt\n@@ -2,7 +2,7 @@\n 2\n 3\n 4\n-5\n+five\n 6\n 7\n 8\n");
+        expect(unifiedDiff("a", "same", "same")).toBe("");
+    });
+    it("does not invent a line for the final newline, and marks a missing one", () => {
+        expect(unifiedDiff("a", "x\ny\n", "x\nz\n")).toBe("--- a/a\n+++ b/a\n@@ -1,2 +1,2 @@\n x\n-y\n+z\n");
+        expect(unifiedDiff("a", "x\ny", "x\nz")).toBe("--- a/a\n+++ b/a\n@@ -1,2 +1,2 @@\n x\n-y\n\\n+z\n\\n");
+    });
+});
+describe("web build configs", () => {
+    it("switches Vite to hidden source maps and turns minification back on", () => {
+        const root = project({ "vite.config.ts": "export default defineConfig({\n  build: {\n    sourcemap: true,\n    minify: false,\n  },\n});\n" });
+        const out = applyPatch(root, ["vite.config.ts"]);
+        expect(out["vite.config.ts"]).toContain("sourcemap: 'hidden',");
+        expect(out["vite.config.ts"]).toContain("minify: 'esbuild',");
+    });
+    it("rewrites webpack devtools that ship maps or eval, and leaves hidden/false alone", () => {
+        const root = project({
+            "webpack.prod.js": "module.exports = { mode: 'production', devtool: 'eval-cheap-module-source-map', optimization: { minimize: false } };\n",
+            "webpack.config.js": "module.exports = { devtool: 'hidden-source-map' };\n",
+            "webpack.dev.js": "module.exports = { devtool: 'eval' };\n",
+        });
+        const s = byFile(root);
+        expect(Object.keys(s)).toEqual(["webpack.prod.js"]);
+        const out = applyPatch(root, ["webpack.prod.js"]);
+        expect(out["webpack.prod.js"]).toBe("module.exports = { mode: 'production', devtool: 'hidden-source-map', optimization: { minimize: true } };\n");
+    });
+    it("turns off Next.js browser source maps and Angular production maps", () => {
+        const root = project({
+            "next.config.mjs": "export default {\n  productionBrowserSourceMaps: true,\n};\n",
+            "angular.json": '{\n  "configurations": {\n    "development": {\n      "sourceMap": true\n    },\n    "production": {\n      "sourceMap": true,\n      "optimization": true\n    }\n  }\n}\n',
+        });
+        const out = applyPatch(root, ["next.config.mjs", "angular.json"]);
+        expect(out["next.config.mjs"]).toContain("productionBrowserSourceMaps: false");
+        expect(out["angular.json"]).toContain('"development": {\n      "sourceMap": true');
+        expect(out["angular.json"]).toContain('"production": {\n      "sourceMap": false');
+    });
+    it("explains the CRA env switch only when it is missing", () => {
+        expect(byFile(project({ "package.json": '{"dependencies":{"react-scripts":"5.0.1"}}' }))["package.json"].note).toContain("GENERATE_SOURCEMAP=false to .env.production");
+        expect(suggestFixes(project({ "package.json": '{"dependencies":{"react-scripts":"5.0.1"}}', ".env.production": "GENERATE_SOURCEMAP=false\n" })).suggestions).toEqual([]);
+    });
+});
+describe("Android", () => {
+    it("edits buildTypes.release in Groovy, not the signing config of the same name", () => {
+        const gradle = [
+            "apply plugin: 'com.android.application'",
+            "android {",
+            "    signingConfigs {",
+            "        release {",
+            "            storeFile file('key.jks')",
+            "        }",
+            "    }",
+            "    buildTypes {",
+            "        release {",
+            "            minifyEnabled false",
+            "            debuggable true",
+            "            signingConfig signingConfigs.release",
+            "        }",
+            "    }",
+            "}",
+            "",
+        ].join("\n");
+        const out = applyPatch(project({ "app/build.gradle": gradle }), ["app/build.gradle"]);
+        expect(out["app/build.gradle"]).toContain("        release {\n            storeFile file('key.jks')\n        }");
+        expect(out["app/build.gradle"]).toContain("        release {\n            minifyEnabled true\n            signingConfig signingConfigs.release\n        }");
+    });
+    it("adds R8 to a Kotlin DSL release block that has none", () => {
+        const gradle = 'plugins { id("com.android.application") }\nandroid {\n    buildTypes {\n        getByName("release") {\n            signingConfig = signingConfigs.getByName("debug")\n        }\n    }\n}\n';
+        const out = applyPatch(project({ "app/build.gradle.kts": gradle }), ["app/build.gradle.kts"]);
+        expect(out["app/build.gradle.kts"]).toContain('getByName("release") {\n            isMinifyEnabled = true\n            isShrinkResources = true\n            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")\n            signingConfig');
+    });
+    it("leaves a release block that already minifies alone", () => {
+        expect(suggestFixes(project({ "app/build.gradle.kts": 'android {\n    buildTypes {\n        release {\n            isMinifyEnabled = true\n        }\n    }\n}\n' })).suggestions).toEqual([]);
+    });
+    it("sets allowBackup in the main manifest, keeping multi-line attribute layout", () => {
+        const manifest = '<manifest xmlns:android="http://schemas.android.com/apk/res/android">\n    <application\n        android:label="Shop"\n        android:debuggable="true">\n    </application>\n</manifest>\n';
+        const root = project({ "app/src/main/AndroidManifest.xml": manifest, "app/src/debug/AndroidManifest.xml": '<manifest><application android:label="dbg" /></manifest>\n' });
+        expect(Object.keys(byFile(root))).toEqual(["app/src/main/AndroidManifest.xml"]);
+        const out = applyPatch(root, ["app/src/main/AndroidManifest.xml"]);
+        expect(out["app/src/main/AndroidManifest.xml"]).toBe('<manifest xmlns:android="http://schemas.android.com/apk/res/android">\n    <application\n        android:allowBackup="false"\n        android:label="Shop">\n    </application>\n</manifest>\n');
+    });
+    it("enables Hermes for React Native", () => {
+        const out = applyPatch(project({ "android/gradle.properties": "org.gradle.jvmargs=-Xmx2048m\nhermesEnabled=false\n" }), ["android/gradle.properties"]);
+        expect(out["android/gradle.properties"]).toContain("hermesEnabled=true");
+    });
+});
+describe("Electron", () => {
+    it("adds asar and fuses to electron-builder config in package.json", () => {
+        const pkg = '{\n  "name": "app",\n  "devDependencies": {\n    "electron-builder": "^25.0.0"\n  },\n  "build": {\n    "appId": "x",\n    "asar": false\n  }\n}\n';
+        const out = applyPatch(project({ "package.json": pkg }), ["package.json"]);
+        const parsed = JSON.parse(out["package.json"]);
+        expect(parsed.build.asar).toBe(true);
+        expect(parsed.build.electronFuses).toMatchObject({ runAsNode: false, enableNodeCliInspectArguments: false, onlyLoadAppFromAsar: true });
+    });
+    it("appends fuses to electron-builder.yml and points Forge users at the plugin", () => {
+        const root = project({ "electron-builder.yml": "appId: x\nasar: false\n", "forge.config.js": "module.exports = { plugins: [] };\n" });
+        const out = applyPatch(root, ["electron-builder.yml"]);
+        expect(out["electron-builder.yml"]).toBe("appId: x\nasar: true\nelectronFuses:\n  runAsNode: false\n  enableCookieEncryption: true\n  enableNodeOptionsEnvironmentVariable: false\n  enableNodeCliInspectArguments: false\n  enableEmbeddedAsarIntegrityValidation: true\n  onlyLoadAppFromAsar: true\n");
+        expect(byFile(root)["forge.config.js"]).toMatchObject({ diff: "" });
+        expect(byFile(root)["forge.config.js"].note).toContain("new FusesPlugin");
+    });
+});
+describe(".NET and Flutter", () => {
+    it("stops embedding the PDB and sources", () => {
+        const out = applyPatch(project({ "src/App/App.csproj": "<Project>\n  <PropertyGroup>\n    <DebugType>embedded</DebugType>\n    <EmbedAllSources>true</EmbedAllSources>\n  </PropertyGroup>\n</Project>\n" }), ["src/App/App.csproj"]);
+        expect(out["src/App/App.csproj"]).toContain("<DebugType>portable</DebugType>");
+        expect(out["src/App/App.csproj"]).toContain("<EmbedAllSources>false</EmbedAllSources>");
+    });
+    it("gives Flutter build flags as a note", () => {
+        const [s] = suggestFixes(project({ "pubspec.yaml": "name: shop\nflutter:\n  uses-material-design: true\n" })).suggestions;
+        expect(s.note).toContain("--obfuscate --split-debug-info");
+    });
+});
+describe("suggestFixes", () => {
+    it("skips build output and dependencies, and lists what it read", () => {
+        const root = project({
+            "node_modules/x/vite.config.js": "export default { build: { sourcemap: true } }",
+            "dist/next.config.js": "module.exports = { productionBrowserSourceMaps: true }",
+            "vite.config.js": "export default { build: { sourcemap: 'hidden' } }",
+        });
+        const report = suggestFixes(root);
+        expect(report.suggestions).toEqual([]);
+        expect(report.inspected).toEqual(["vite.config.js"]);
+    });
+    it("rejects a path that is not a directory", () => {
+        expect(() => suggestFixes(join(tmpdir(), "definitely-missing-rs-dir"))).toThrow(/Not a project directory/);
+    });
+});
+//# sourceMappingURL=fixes.test.js.map

package/dist/__tests__/fixes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixes.test.js","sourceRoot":"","sources":["../../src/__tests__/fixes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,IAAI,GAAa,EAAE,CAAC;AAC1B,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,KAA6B;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY,EAAE,KAAe;IAC/C,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClB,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1E,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5G,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,CAAC,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QACpG,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACrG,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAC;IAC/J,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,kGAAkG,EAAE,CAAC,CAAC;QAC/I,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,IAAI,GAAG,OAAO,CAAC;YACnB,iBAAiB,EAAE,wHAAwH;YAC3I,mBAAmB,EAAE,sDAAsD;YAC3E,gBAAgB,EAAE,yCAAyC;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;IACpJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC;YACnB,iBAAiB,EAAE,8DAA8D;YACjF,cAAc,EAAE,6KAA6K;SAC9L,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACxK,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,4CAA4C,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3K,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,MAAM,GAAG;YACb,yCAAyC;YACzC,WAAW;YACX,sBAAsB;YACtB,mBAAmB;YACnB,uCAAuC;YACvC,WAAW;YACX,OAAO;YACP,kBAAkB;YAClB,mBAAmB;YACnB,iCAAiC;YACjC,6BAA6B;YAC7B,kDAAkD;YAClD,WAAW;YACX,OAAO;YACP,GAAG;YACH,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;QACjH,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,gHAAgH,CAAC,CAAC;IAC9J,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,8LAA8L,CAAC;QAC9M,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,uOAAuO,CAAC,CAAC;IACzR,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,2GAA2G,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjM,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,QAAQ,GAAG,8LAA8L,CAAC;QAChN,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,kCAAkC,EAAE,QAAQ,EAAE,mCAAmC,EAAE,4DAA4D,EAAE,CAAC,CAAC;QAC1K,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,gMAAgM,CAAC,CAAC;IACzP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,2BAA2B,EAAE,qDAAqD,EAAE,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACvJ,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,GAAG,GAAG,oJAAoJ,CAAC;QACjK,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1I,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACtI,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,+PAA+P,CAAC,CAAC;QAC1S,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,kJAAkJ,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACtO,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,sDAAsD,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1H,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC;YACnB,+BAA+B,EAAE,+CAA+C;YAChF,qBAAqB,EAAE,wDAAwD;YAC/E,gBAAgB,EAAE,mDAAmD;SACtE,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}