@jshookmcp/jshook 0.1.8 → 0.2.0

package/dist/tests/modules/deobfuscator/Deobfuscator.test.js

@@ -0,0 +1,134 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const promptState = vi.hoisted(() => ({
+    generateDeobfuscationPrompt: vi.fn(() => [{ role: 'user', content: 'analyze' }]),
+}));
+const webcrackState = vi.hoisted(() => ({
+    runWebcrack: vi.fn(async (code) => ({
+        applied: true,
+        code: `decoded:${code}`,
+        optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+    })),
+}));
+vi.mock('@utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@services/prompts/deobfuscation', () => ({
+    generateDeobfuscationPrompt: promptState.generateDeobfuscationPrompt,
+}));
+vi.mock('@modules/deobfuscator/webcrack', () => ({
+    runWebcrack: webcrackState.runWebcrack,
+}));
+import { Deobfuscator } from '../../../src/modules/deobfuscator/Deobfuscator.js';
+describe('Deobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+        promptState.generateDeobfuscationPrompt.mockReset();
+        promptState.generateDeobfuscationPrompt.mockReturnValue([{ role: 'user', content: 'analyze' }]);
+        webcrackState.runWebcrack.mockReset();
+        webcrackState.runWebcrack.mockImplementation(async (code) => ({
+            applied: true,
+            code: `decoded:${code}`,
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+        }));
+    });
+    it('uses webcrack as the only deobfuscation engine', async () => {
+        webcrackState.runWebcrack.mockResolvedValue({
+            applied: true,
+            code: 'const answer = 42;',
+            bundle: {
+                type: 'webpack',
+                entryId: '0',
+                moduleCount: 2,
+                truncated: false,
+                modules: [{ id: '0', path: './index.js', isEntry: true, size: 19 }],
+            },
+            savedTo: 'D:/tmp/webcrack-out',
+            savedArtifacts: [{ kind: 'code', path: 'D:/tmp/webcrack-out/deobfuscated.js' }],
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+        });
+        const result = await new Deobfuscator().deobfuscate({ code: 'obfuscated()' });
+        expect(webcrackState.runWebcrack).toHaveBeenCalledWith('obfuscated()', {
+            unpack: undefined,
+            unminify: undefined,
+            jsx: undefined,
+            mangle: undefined,
+            mappings: undefined,
+            includeModuleCode: undefined,
+            maxBundleModules: undefined,
+            outputDir: undefined,
+            forceOutput: undefined,
+        });
+        expect(result.code).toBe('const answer = 42;');
+        expect(result.bundle?.type).toBe('webpack');
+        expect(result.savedTo).toBe('D:/tmp/webcrack-out');
+        expect(result.engine).toBe('webcrack');
+        expect(result.webcrackApplied).toBe(true);
+        expect(result.transformations.some((t) => t.type === 'webcrack' && t.success)).toBe(true);
+    });
+    it('caches deobfuscation results and avoids repeated webcrack and LLM calls', async () => {
+        const chat = vi.fn(async () => ({ content: 'LLM summary' }));
+        const deobfuscator = new Deobfuscator({ chat });
+        const options = { code: 'var v = 5;', llm: 'provider-a' };
+        const first = await deobfuscator.deobfuscate(options);
+        const second = await deobfuscator.deobfuscate(options);
+        expect(first.analysis).toBe('LLM summary');
+        expect(webcrackState.runWebcrack).toHaveBeenCalledTimes(1);
+        expect(chat).toHaveBeenCalledTimes(1);
+        expect(second).toBe(first);
+    });
+    it('passes webcrack options through and maps renameVariables to mangle', async () => {
+        await new Deobfuscator().deobfuscate({
+            code: 'bundle',
+            renameVariables: true,
+            unpack: false,
+            unminify: false,
+            jsx: false,
+            outputDir: 'artifacts/deobf',
+            forceOutput: true,
+            includeModuleCode: true,
+            maxBundleModules: 10,
+            mappings: [{ path: './main.js', pattern: 'bootstrap', matchType: 'includes', target: 'code' }],
+        });
+        expect(webcrackState.runWebcrack).toHaveBeenCalledWith('bundle', {
+            unpack: false,
+            unminify: false,
+            jsx: false,
+            mangle: true,
+            mappings: [{ path: './main.js', pattern: 'bootstrap', matchType: 'includes', target: 'code' }],
+            includeModuleCode: true,
+            maxBundleModules: 10,
+            outputDir: 'artifacts/deobf',
+            forceOutput: true,
+        });
+    });
+    it('surfaces deprecated legacy flags as warnings instead of running old logic', async () => {
+        const result = await new Deobfuscator().deobfuscate({
+            code: 'legacy()',
+            aggressive: true,
+            preserveLogic: true,
+            inlineFunctions: true,
+        });
+        expect(result.warnings).toEqual([
+            'aggressive is deprecated and ignored; webcrack is now the only deobfuscation engine.',
+            'preserveLogic is deprecated and ignored.',
+            'inlineFunctions is deprecated and ignored.',
+        ]);
+    });
+    it('throws immediately when webcrack does not produce a result', async () => {
+        webcrackState.runWebcrack.mockResolvedValue({
+            applied: false,
+            code: 'raw',
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+            reason: 'mocked failure',
+        });
+        await expect(new Deobfuscator().deobfuscate({ code: 'broken()' })).rejects.toThrow('mocked failure');
+    });
+});

package/dist/tests/modules/deobfuscator/JSVMPDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/JSVMPDeobfuscator.test.js

@@ -0,0 +1,109 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as parser from '@babel/parser';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const promptState = vi.hoisted(() => ({
+    generateVMAnalysisMessages: vi.fn(() => [{ role: 'user', content: 'vm' }]),
+}));
+const sandboxState = vi.hoisted(() => ({
+    instances: [],
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@src/services/prompts/deobfuscation', () => ({
+    generateVMAnalysisMessages: promptState.generateVMAnalysisMessages,
+}));
+vi.mock('@src/modules/security/ExecutionSandbox', () => {
+    class ExecutionSandbox {
+        execute = vi.fn(async () => ({ ok: true, output: 'sandbox-output' }));
+        constructor() {
+            sandboxState.instances.push(this);
+        }
+    }
+    return { ExecutionSandbox };
+});
+import { JSVMPDeobfuscator } from '../../../src/modules/deobfuscator/JSVMPDeobfuscator.js';
+describe('JSVMPDeobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        sandboxState.instances.length = 0;
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+        promptState.generateVMAnalysisMessages.mockClear();
+    });
+    it('returns non-JSVMP result when VM patterns are not detected', async () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        vi.spyOn(deobfuscator, 'detectJSVMP').mockReturnValue(null);
+        const result = await deobfuscator.deobfuscate({ code: 'const x = 1;' });
+        expect(result.isJSVMP).toBe(false);
+        expect(result.confidence).toBe(0);
+        expect(result.warnings[0]).toContain('JSVMP');
+    });
+    it('returns full deobfuscation payload for detected VM code', async () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        vi.spyOn(deobfuscator, 'detectJSVMP').mockReturnValue({
+            instructionCount: 15,
+            interpreterLocation: 'Line 1',
+            complexity: 'medium',
+            hasSwitch: true,
+            hasInstructionArray: true,
+            hasProgramCounter: true,
+        });
+        vi.spyOn(deobfuscator, 'identifyVMType').mockReturnValue('custom');
+        vi.spyOn(deobfuscator, 'extractInstructions').mockReturnValue([
+            { opcode: 1, name: 'INST_1', type: 'load', description: 'x' },
+        ]);
+        vi.spyOn(deobfuscator, 'restoreCode').mockResolvedValue({
+            code: 'decoded-code',
+            confidence: 0.77,
+            warnings: ['partial'],
+            unresolvedParts: [{ location: 'x', reason: 'y', suggestion: 'z' }],
+        });
+        const result = await deobfuscator.deobfuscate({
+            code: 'vm-code',
+            extractInstructions: true,
+        });
+        expect(result.isJSVMP).toBe(true);
+        expect(result.vmType).toBe('custom');
+        expect(result.instructions).toHaveLength(1);
+        expect(result.deobfuscatedCode).toBe('decoded-code');
+        expect(result.stats?.originalSize).toBe('vm-code'.length);
+    });
+    it('handles unexpected errors and returns safe failure payload', async () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        vi.spyOn(deobfuscator, 'detectJSVMP').mockImplementation(() => {
+            throw new Error('boom');
+        });
+        const result = await deobfuscator.deobfuscate({ code: 'x' });
+        expect(result.isJSVMP).toBe(false);
+        expect(result.warnings[0]).toContain('boom');
+    });
+    it('detects VM hints using regex fallback', () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        const result = deobfuscator.detectJSVMPWithRegex('while(true){switch(i){case 1:break;} a.apply(b,c); parseInt("" + arr[i],16);}');
+        expect(result).not.toBeNull();
+        expect(result.hasSwitch).toBe(true);
+    });
+    it('applies basic custom VM restoration cleanup heuristics', () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        const warnings = [];
+        const unresolved = [];
+        const output = deobfuscator.restoreCustomVMBasic('debugger; if(a){}; "" + value; cond ? same : same;', true, warnings, unresolved);
+        expect(output.code).not.toContain('debugger');
+        expect(output.warnings.length).toBeGreaterThan(0);
+        expect(output.unresolvedParts?.length).toBeGreaterThan(0);
+    });
+    it('infers arithmetic opcode type from switch case content', () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        const ast = parser.parse('switch(x){case 1: a + b; break;}', { sourceType: 'script' });
+        const switchNode = ast.program.body[0];
+        const caseNode = switchNode.cases[0];
+        const type = deobfuscator.inferInstructionType(caseNode);
+        expect(type).toBe('arithmetic');
+    });
+});

package/dist/tests/modules/deobfuscator/JScramblerDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/JScramblerDeobfuscator.test.js

@@ -0,0 +1,74 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+import { JScramberDeobfuscator } from '../../../src/modules/deobfuscator/JScramblerDeobfuscator.js';
+describe('JScramberDeobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+    });
+    it('removes self-defending debugger statements', async () => {
+        const code = `
+      function guard(){ debugger; return 1; }
+      setInterval(function(){ debugger; }, 1000);
+      guard();
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code });
+        expect(result.success).toBe(true);
+        expect(result.code).not.toContain('debugger');
+        expect(result.transformations.length).toBeGreaterThan(0);
+    });
+    it('replaces decrypt-function calls with placeholder strings', async () => {
+        const code = `
+      function dec(s){ return s.split('').map(c=>String.fromCharCode(c.charCodeAt(0))).join(''); }
+      const value = dec("abc");
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code, decryptStrings: true });
+        expect(result.code).toContain('[DECRYPTED_STRING]');
+    });
+    it('restores flattened control-flow while-switch pattern', async () => {
+        const code = `
+      while (true) {
+        switch (state) {
+          case 0: a(); break;
+          case 1: b(); break;
+        }
+      }
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code, restoreControlFlow: true });
+        expect(result.success).toBe(true);
+        expect(result.code).toContain('a();');
+        expect(result.code).toContain('b();');
+    });
+    it('removes dead branches and simplifies arithmetic expressions', async () => {
+        const code = `
+      if (false) { drop(); } else { keep(); }
+      const n = 2 + 3;
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code });
+        expect(result.code).toContain('keep();');
+        expect(result.code).toContain('const n = 5');
+    });
+    it('calculates confidence from transformation count', () => {
+        const deobfuscator = new JScramberDeobfuscator();
+        expect(deobfuscator.calculateConfidence(0)).toBe(0);
+        expect(deobfuscator.calculateConfidence(3)).toBeCloseTo(0.6);
+        expect(deobfuscator.calculateConfidence(9)).toBe(1);
+    });
+    it('returns failure payload when parse pipeline throws', async () => {
+        const result = await new JScramberDeobfuscator().deobfuscate({
+            code: 'function broken( {',
+        });
+        expect(result.success).toBe(false);
+        expect(result.confidence).toBe(0);
+        expect(result.warnings.length).toBeGreaterThan(0);
+    });
+});

package/dist/tests/modules/deobfuscator/PackerDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/PackerDeobfuscator.test.js

@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const sandboxState = vi.hoisted(() => ({
+    executeImpl: vi.fn(async () => ({ ok: false, output: null })),
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@src/modules/security/ExecutionSandbox', () => {
+    class ExecutionSandbox {
+        execute = vi.fn((...args) => sandboxState.executeImpl(...args));
+    }
+    return { ExecutionSandbox };
+});
+import { AAEncodeDeobfuscator, PackerDeobfuscator, URLEncodeDeobfuscator, UniversalUnpacker, } from '../../../src/modules/deobfuscator/PackerDeobfuscator.js';
+const PACKER_LIKE = "eval(function(p,a,c,k,e,d){return p;}('0',62,1,'x'.split('|'),0,{}))";
+describe('Packer-family deobfuscators', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        sandboxState.executeImpl.mockReset();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+    });
+    it('detects packer signature via static helper', () => {
+        expect(PackerDeobfuscator.detect(PACKER_LIKE)).toBe(true);
+        expect(PackerDeobfuscator.detect('const x = 1;')).toBe(false);
+    });
+    it('iterates unpacking until code stops changing', async () => {
+        const deobfuscator = new PackerDeobfuscator();
+        vi.spyOn(deobfuscator, 'unpack')
+            .mockResolvedValueOnce(PACKER_LIKE + ';')
+            .mockResolvedValueOnce(PACKER_LIKE + ';');
+        const result = await deobfuscator.deobfuscate({ code: PACKER_LIKE, maxIterations: 3 });
+        expect(result.success).toBe(true);
+        expect(result.iterations).toBe(1);
+        expect(result.warnings.length).toBeGreaterThan(0);
+    });
+    it('parses packer params from sandbox output', async () => {
+        const deobfuscator = new PackerDeobfuscator();
+        sandboxState.executeImpl.mockResolvedValue({
+            ok: true,
+            output: ['payload', 62, 2, 'foo|bar'],
+        });
+        const parsed = await deobfuscator.parsePackerParams("'payload',62,2,'foo|bar'");
+        expect(parsed.p).toBe('payload');
+        expect(parsed.a).toBe(62);
+        expect(parsed.k).toEqual(['foo', 'bar']);
+    });
+    it('decodes AAEncode payload through sandbox execution', async () => {
+        const aa = new AAEncodeDeobfuscator();
+        sandboxState.executeImpl.mockResolvedValue({ ok: true, output: 'decoded-aa' });
+        const output = await aa.deobfuscate('ω゜)');
+        expect(output).toBe('decoded-aa');
+    });
+    it('detects and decodes URL encoded content with safe fallback', async () => {
+        const urlDeobfuscator = new URLEncodeDeobfuscator();
+        const encoded = '%41%42%43%44%45%46%47%48%49%4A%4B';
+        expect(URLEncodeDeobfuscator.detect(encoded)).toBe(true);
+        expect(await urlDeobfuscator.deobfuscate(encoded)).toBe('ABCDEFGHIJK');
+        expect(await urlDeobfuscator.deobfuscate('%E0%A4%A')).toBe('%E0%A4%A');
+    });
+    it('dispatches through UniversalUnpacker by detected obfuscation type', async () => {
+        const unpacker = new UniversalUnpacker();
+        vi.spyOn(unpacker.packerDeobfuscator, 'deobfuscate').mockResolvedValue({
+            code: 'decoded-packer',
+            success: true,
+            iterations: 1,
+            warnings: [],
+        });
+        const packerResult = await unpacker.deobfuscate(PACKER_LIKE);
+        const unknownResult = await unpacker.deobfuscate('plain-code');
+        expect(packerResult.type).toBe('Packer');
+        expect(packerResult.code).toBe('decoded-packer');
+        expect(unknownResult).toEqual({ code: 'plain-code', type: 'Unknown', success: false });
+    });
+});

package/dist/tests/modules/deobfuscator/VMDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/VMDeobfuscator.test.js

@@ -0,0 +1,78 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const promptState = vi.hoisted(() => ({
+    generateVMDeobfuscationMessages: vi.fn((prompt) => [{ role: 'user', content: prompt }]),
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@src/services/prompts/deobfuscation', () => ({
+    generateVMDeobfuscationMessages: promptState.generateVMDeobfuscationMessages,
+}));
+import { VMDeobfuscator } from '../../../src/modules/deobfuscator/VMDeobfuscator.js';
+describe('VMDeobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+        promptState.generateVMDeobfuscationMessages.mockClear();
+    });
+    it('detects VM protection based on structural signatures', () => {
+        const code = `
+      while (true) { switch(pc) { case 1: stack.push(1); break; case 2: stack.pop(); break; } }
+      var arr = [1,2,3,4,5,6,7,8,9,10,11];
+    `;
+        const result = new VMDeobfuscator().detectVMProtection(code);
+        expect(result.detected).toBe(true);
+        expect(result.type).toMatch(/vm/);
+    });
+    it('counts instruction cases accurately', () => {
+        const code = 'switch(x){case 1:break;case 2:break;case 3:break;}';
+        expect(new VMDeobfuscator().countVMInstructions(code)).toBe(3);
+    });
+    it('uses LLM output when deobfuscated code is valid JavaScript', async () => {
+        const llm = { chat: vi.fn(async () => ({ content: '```js\nconst restored = 1;\n```' })) };
+        const deobfuscator = new VMDeobfuscator(llm);
+        const result = await deobfuscator.deobfuscateVM('while(true){switch(pc){case 1:break;}}', { type: 'custom-vm', instructionCount: 1 });
+        expect(result.success).toBe(true);
+        expect(result.code).toContain('const restored = 1;');
+        expect(llm.chat).toHaveBeenCalledTimes(1);
+    });
+    it('falls back to simplified code when LLM output is invalid', async () => {
+        const llm = { chat: vi.fn(async () => ({ content: '```js\nfunction {' })) };
+        const deobfuscator = new VMDeobfuscator(llm);
+        vi.spyOn(deobfuscator, 'simplifyVMCode').mockReturnValue('simplified-code');
+        const result = await deobfuscator.deobfuscateVM('function interp(){switch(x){case 1:break;}}', { type: 'custom-vm', instructionCount: 1 });
+        expect(result).toEqual({ success: true, code: 'simplified-code' });
+    });
+    it('builds VM prompt with profile and component sections', () => {
+        const prompt = new VMDeobfuscator().buildVMDeobfuscationPrompt('const code = 1;', { type: 'custom-vm', instructionCount: 12 }, { hasInterpreter: true, hasStack: true, hasRegisters: false, instructionTypes: ['01'] }, { instructionArray: 'arr', interpreterFunction: 'run' });
+        expect(prompt).toContain('Architecture');
+        expect(prompt).toContain('Instruction Count');
+        expect(prompt).toContain('arr');
+        expect(prompt).toContain('run');
+    });
+    it('strips markdown code fences from LLM response', () => {
+        const output = new VMDeobfuscator().extractCodeFromLLMResponse('```javascript\nconst x = 1;\n```');
+        expect(output).toBe('const x = 1;');
+    });
+    it('simplifies interpreter and instruction array declarations', () => {
+        const code = `
+      var data = [1,2,3];
+      var vmIns = [1,2,3,4];
+      function runVm(a){ return a; }
+      runVm(vmIns);
+    `;
+        const out = new VMDeobfuscator().simplifyVMCode(code, {
+            interpreterFunction: 'runVm',
+            instructionArray: 'vmIns',
+        });
+        expect(out).toContain('vm interpreter removed');
+        expect(out).toContain('vm instruction array removed');
+    });
+});

package/dist/tests/modules/deobfuscator/webcrack.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/webcrack.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it } from 'vitest';
+import { runWebcrack } from '../../../src/modules/deobfuscator/webcrack.js';
+describe('runWebcrack', () => {
+    const DEFAULT_OPTIONS = { jsx: true, mangle: false, unminify: true, unpack: true };
+    it('returns normalized optionsUsed with defaults when options are empty', async () => {
+        const result = await runWebcrack('var a = 1;', {});
+        expect(result.optionsUsed).toEqual(DEFAULT_OPTIONS);
+    });
+    it('respects explicit boolean overrides for all options', async () => {
+        const result = await runWebcrack('var a = 1;', {
+            jsx: false,
+            mangle: true,
+            unminify: false,
+            unpack: false,
+        });
+        expect(result.optionsUsed).toEqual({ jsx: false, mangle: true, unminify: false, unpack: false });
+    });
+    it('returns applied: true for trivial valid JS', async () => {
+        const result = await runWebcrack('var x = 1 + 2;', {});
+        expect(result.applied).toBe(true);
+        expect(typeof result.code).toBe('string');
+        expect(result.code.length).toBeGreaterThan(0);
+    });
+    it('returns applied: false with reason for unparseable input', async () => {
+        const result = await runWebcrack('{{{{not valid javascript at all!!!!', {});
+        expect(result.applied).toBe(false);
+        expect(result.reason).toBeDefined();
+        expect(typeof result.reason).toBe('string');
+        expect(result.reason.length).toBeGreaterThan(0);
+    });
+    it('deobfuscates a simple obfuscated pattern', async () => {
+        const obfuscated = `var a = "hel" + "lo" + " " + "wor" + "ld";`;
+        const result = await runWebcrack(obfuscated, { unminify: true });
+        expect(result.applied).toBe(true);
+        expect(typeof result.code).toBe('string');
+    });
+    it('handles webpack-like bundle and returns bundle summary', async () => {
+        const webpackBundle = `
+      (function(modules) {
+        function __webpack_require__(moduleId) {
+          var module = { exports: {} };
+          modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
+          return module.exports;
+        }
+        return __webpack_require__(0);
+      })([
+        function(module, exports, __webpack_require__) {
+          var dep = __webpack_require__(1);
+          module.exports = function() { return dep.hello(); };
+        },
+        function(module, exports) {
+          module.exports = { hello: function() { return "world"; } };
+        }
+      ]);
+    `;
+        const result = await runWebcrack(webpackBundle, { unpack: true });
+        expect(result.applied).toBe(true);
+        if (result.bundle) {
+            expect(result.bundle.type).toBe('webpack');
+            expect(result.bundle.moduleCount).toBeGreaterThan(0);
+            expect(result.bundle.modules.length).toBeGreaterThan(0);
+        }
+    });
+    it('includes module code in bundle summary when includeModuleCode is true', async () => {
+        const webpackBundle = `
+      (function(modules) {
+        function __webpack_require__(moduleId) {
+          var module = { exports: {} };
+          modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
+          return module.exports;
+        }
+        return __webpack_require__(0);
+      })([
+        function(module, exports) {
+          module.exports = "hello";
+        }
+      ]);
+    `;
+        const result = await runWebcrack(webpackBundle, { unpack: true, includeModuleCode: true });
+        expect(result.applied).toBe(true);
+        if (result.bundle && result.bundle.modules.length > 0) {
+            expect(result.bundle.modules[0].code).toBeDefined();
+            expect(typeof result.bundle.modules[0].code).toBe('string');
+        }
+    });
+    it('respects maxBundleModules limit', async () => {
+        const webpackBundle = `
+      (function(modules) {
+        function __webpack_require__(moduleId) {
+          var module = { exports: {} };
+          modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
+          return module.exports;
+        }
+        return __webpack_require__(0);
+      })([
+        function(module, exports, __webpack_require__) { module.exports = __webpack_require__(1); },
+        function(module, exports, __webpack_require__) { module.exports = __webpack_require__(2); },
+        function(module, exports, __webpack_require__) { module.exports = __webpack_require__(3); },
+        function(module, exports) { module.exports = "end"; }
+      ]);
+    `;
+        const result = await runWebcrack(webpackBundle, { unpack: true, maxBundleModules: 2 });
+        expect(result.applied).toBe(true);
+        if (result.bundle) {
+            expect(result.bundle.modules.length).toBeLessThanOrEqual(2);
+            if (result.bundle.moduleCount > 2) {
+                expect(result.bundle.truncated).toBe(true);
+            }
+        }
+    });
+});

package/dist/tests/modules/detector/ObfuscationDetector.test.d.ts

@@ -0,0 +1 @@
+export {};