@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/cli/run-tree.d.ts

@@ -0,0 +1,9 @@
+import { Tree } from '@nx/devkit';
+export interface RunTreeOptions {
+    dryRun: boolean;
+    verbose: boolean;
+    /** Don't print "Nothing to generate." when nothing changed (the caller reports it). */
+    quietWhenUnchanged?: boolean;
+}
+/** Run `fn` against an FsTree rooted at `root`, print changes, then flush unless dry-run. Returns change count. */
+export declare function runInTree(root: string, opts: RunTreeOptions, fn: (tree: Tree) => unknown): Promise<number>;

package/dist/src/cli/run-tree.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInTree = void 0;
+const devkit_1 = require("@nx/devkit");
+const tree_1 = require("nx/src/generators/tree");
+/** Run `fn` against an FsTree rooted at `root`, print changes, then flush unless dry-run. Returns change count. */
+async function runInTree(root, opts, fn) {
+    const tree = new tree_1.FsTree(root, opts.verbose);
+    const callback = await fn(tree);
+    const changes = tree.listChanges();
+    if (changes.length === 0) {
+        if (!opts.quietWhenUnchanged)
+            devkit_1.logger.info('Nothing to generate.');
+        if (!opts.dryRun && typeof callback === 'function')
+            await callback();
+        return 0;
+    }
+    (0, tree_1.printChanges)(changes);
+    if (opts.dryRun) {
+        devkit_1.logger.info('\nDry run complete — no files written.');
+    }
+    else {
+        (0, tree_1.flushChanges)(root, changes);
+        devkit_1.logger.info(`\nDone. ${changes.length} file(s) written.`);
+        // Nx GeneratorCallback (e.g. install packages): runs only after files are on disk.
+        if (typeof callback === 'function')
+            await callback();
+    }
+    return changes.length;
+}
+exports.runInTree = runInTree;
+//# sourceMappingURL=run-tree.js.map

package/dist/src/cli/run-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-tree.js","sourceRoot":"","sources":["../../../src/cli/run-tree.ts"],"names":[],"mappings":";;;AAAA,uCAA0C;AAC1C,iDAA4E;AAS5E,mHAAmH;AAC5G,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,IAAoB,EACpB,EAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,aAAM,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;QACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,eAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,QAAQ,KAAK,UAAU;YAAE,MAAM,QAAQ,EAAE,CAAC;QACrE,OAAO,CAAC,CAAC;KACV;IAED,IAAA,mBAAY,EAAC,OAAO,CAAC,CAAC;IAEtB,IAAI,IAAI,CAAC,MAAM,EAAE;QACf,eAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;KACvD;SAAM;QACL,IAAA,mBAAY,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,eAAM,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAC1D,mFAAmF;QACnF,IAAI,OAAO,QAAQ,KAAK,UAAU;YAAE,MAAM,QAAQ,EAAE,CAAC;KACtD;IACD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AA1BD,8BA0BC"}

package/dist/src/cli/types.d.ts

@@ -0,0 +1,18 @@
+import type { Flags } from './args';
+export interface CommandContext {
+    /** Directory pstack was invoked from. */
+    cwd: string;
+    /** Non-flag arguments after the command name. */
+    positionals: string[];
+    flags: Flags;
+    dryRun: boolean;
+    verbose: boolean;
+    /** Version of the running pstack package. */
+    selfVersion: string;
+    /** Root directory (contains package.json) of the running pstack package. */
+    selfRoot: string;
+}
+/** An expected, user-facing failure. Printed as "Error: <message>" without a stack trace. */
+export declare class CliError extends Error {
+    constructor(message: string);
+}

package/dist/src/cli/types.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliError = void 0;
+/** An expected, user-facing failure. Printed as "Error: <message>" without a stack trace. */
+class CliError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CliError';
+    }
+}
+exports.CliError = CliError;
+//# sourceMappingURL=types.js.map

package/dist/src/cli/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/cli/types.ts"],"names":[],"mappings":";;;AAgBA,6FAA6F;AAC7F,MAAa,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AALD,4BAKC"}

package/dist/src/cli/update-plan.d.ts

@@ -0,0 +1,15 @@
+export type DepField = 'devDependencies' | 'dependencies';
+export interface PluginPin {
+    field: DepField;
+    version: string;
+    /** The spec as written in package.json. */
+    spec: string;
+    /** An npm range (^x.y.z, ~x.y.z): the installed version may be newer than `version`. */
+    range: boolean;
+}
+export interface UpdateTarget {
+    action: 'noop' | 'upgrade' | 'downgrade';
+    to: string;
+}
+export declare function findPluginPin(pkg: any, example?: string): PluginPin;
+export declare function resolveTarget(from: string, toFlag: string | undefined, selfVersion: string, force: boolean): UpdateTarget;

package/dist/src/cli/update-plan.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTarget = exports.findPluginPin = void 0;
+const types_1 = require("./types");
+const versions_1 = require("./versions");
+/** `npm i -D …` command that pins the plugin at `version` the way pstack update does. */
+function pinCommand(version) {
+    return ['npm i -D', `${versions_1.PLUGIN_NAME}@${(0, versions_1.formatPluginSpec)(version)}`, ...(0, versions_1.pinInstallFlags)()].join(' ');
+}
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function findPluginPin(pkg, example = '0.3.0') {
+    for (const field of ['devDependencies', 'dependencies']) {
+        const spec = pkg?.[field]?.[versions_1.PLUGIN_NAME];
+        if (spec === undefined)
+            continue;
+        const version = (0, versions_1.parsePluginSpec)(spec);
+        if (!version) {
+            throw new types_1.CliError(`${versions_1.PLUGIN_NAME} is "${spec}" in ${field}. pstack update needs a pinned version — ` +
+                `pin one first: ${pinCommand(example)}`);
+        }
+        return { field, version, spec, range: /^\s*[\^~]/.test(spec) };
+    }
+    throw new types_1.CliError(`${versions_1.PLUGIN_NAME} is not listed in package.json. Add it first: ${pinCommand(example)}`);
+}
+exports.findPluginPin = findPluginPin;
+function resolveTarget(from, toFlag, selfVersion, force) {
+    const to = (0, versions_1.normalizeVersion)(toFlag ?? selfVersion);
+    const cmp = (0, versions_1.compareVersions)(to, from);
+    if (cmp === 0)
+        return { action: 'noop', to };
+    if (cmp < 0 && !force) {
+        throw new types_1.CliError(toFlag === undefined
+            ? `the global CLI v${to} is older than the workspace's v${from}. Update it with ` +
+                `"${(0, versions_1.globalInstallCommand)(from)}" (or newer), or pass --force to downgrade the workspace.`
+            : `v${to} is older than the installed v${from}. Pass --force to downgrade.`);
+    }
+    return { action: cmp < 0 ? 'downgrade' : 'upgrade', to };
+}
+exports.resolveTarget = resolveTarget;
+//# sourceMappingURL=update-plan.js.map

package/dist/src/cli/update-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-plan.js","sourceRoot":"","sources":["../../../src/cli/update-plan.ts"],"names":[],"mappings":";;;AAAA,mCAAmC;AACnC,yCAQoB;AAEpB,yFAAyF;AACzF,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,CAAC,UAAU,EAAE,GAAG,sBAAW,IAAI,IAAA,2BAAgB,EAAC,OAAO,CAAC,EAAE,EAAE,GAAG,IAAA,0BAAe,GAAE,CAAC,CAAC,IAAI,CAC3F,GAAG,CACJ,CAAC;AACJ,CAAC;AAkBD,8DAA8D;AAC9D,SAAgB,aAAa,CAAC,GAAQ,EAAE,OAAO,GAAG,OAAO;IACvD,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAe,EAAE;QACrE,MAAM,IAAI,GAAuB,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAW,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,IAAA,0BAAe,EAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,IAAI,gBAAQ,CAChB,GAAG,sBAAW,QAAQ,IAAI,QAAQ,KAAK,2CAA2C;gBAChF,kBAAkB,UAAU,CAAC,OAAO,CAAC,EAAE,CAC1C,CAAC;SACH;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KAChE;IACD,MAAM,IAAI,gBAAQ,CAChB,GAAG,sBAAW,iDAAiD,UAAU,CAAC,OAAO,CAAC,EAAE,CACrF,CAAC;AACJ,CAAC;AAhBD,sCAgBC;AAED,SAAgB,aAAa,CAC3B,IAAY,EACZ,MAA0B,EAC1B,WAAmB,EACnB,KAAc;IAEd,MAAM,EAAE,GAAG,IAAA,2BAAgB,EAAC,MAAM,IAAI,WAAW,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAA,0BAAe,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7C,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;QACrB,MAAM,IAAI,gBAAQ,CAChB,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,mBAAmB,EAAE,mCAAmC,IAAI,mBAAmB;gBAC/E,IAAI,IAAA,+BAAoB,EAAC,IAAI,CAAC,2DAA2D;YAC3F,CAAC,CAAC,IAAI,EAAE,iCAAiC,IAAI,8BAA8B,CAC9E,CAAC;KACH;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAlBD,sCAkBC"}

package/dist/src/cli/versions.d.ts

@@ -0,0 +1,26 @@
+export declare const PLUGIN_NAME = "@mouryaamit/nx-polystack";
+/** owner/repo of the private development repo on GitHub. */
+export declare const PLUGIN_GITHUB_REPO = "example-org/private-plugin";
+/** Earlier names of the repo; workspaces pinned to them are still recognised (v0.38.2). */
+export declare const LEGACY_GITHUB_REPOS: string[];
+export declare function normalizeVersion(v: string): string;
+export declare function compareVersions(a: string, b: string): number;
+/** The pin `pstack new` / `pstack update` write: a git tag of the repo, or an exact npm version. */
+export declare function formatPluginSpec(version: string): string;
+/** Extra `npm install` flags for a pin, so npm saves it as formatPluginSpec wrote it. */
+export declare function pinInstallFlags(): string[];
+/**
+ * The pinned version, or null when the spec is neither a tag of the plugin repo (github:,
+ * git+https, git+ssh or owner/repo form; earlier repo names too) nor an npm version (x.y.z,
+ * ^x.y.z, ~x.y.z or =x.y.z).
+ */
+export declare function parsePluginSpec(spec: string): string | null;
+/**
+ * Shell command that installs the global CLI.
+ * - npm source: `npm i -g <package>@<version>`.
+ * - GitHub source: the prebuilt release asset. Not `npm i -g github:…#vX`: npm prepares git deps
+ *   of a global install in global mode, so devDependencies (typescript) are missing and the
+ *   build fails. Not the release download URL: the repo is private, and npm can't authenticate
+ *   to GitHub; `gh` downloads with the user's GitHub login.
+ */
+export declare function globalInstallCommand(version: string): string;

package/dist/src/cli/versions.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalInstallCommand = exports.parsePluginSpec = exports.pinInstallFlags = exports.formatPluginSpec = exports.compareVersions = exports.normalizeVersion = exports.LEGACY_GITHUB_REPOS = exports.PLUGIN_GITHUB_REPO = exports.PLUGIN_NAME = void 0;
+const install_source_1 = require("./install-source");
+const types_1 = require("./types");
+exports.PLUGIN_NAME = '@mouryaamit/nx-polystack';
+/** owner/repo of the private development repo on GitHub. */
+exports.PLUGIN_GITHUB_REPO = install_source_1.DEV_GITHUB_REPO;
+/** Earlier names of the repo; workspaces pinned to them are still recognised (v0.38.2). */
+exports.LEGACY_GITHUB_REPOS = ['mouryaamit/nx-polystack'];
+const SEMVER = /^v?(\d+)\.(\d+)\.(\d+)$/;
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+/** npm forms of a version pin: exact, ^, ~ or = (the lower bound is the pinned version). */
+const NPM_SPEC = /^[\^~=]?v?(\d+\.\d+\.\d+)$/;
+/** Git-tag specs npm may save for the plugin's repos (".git" optional). */
+function gitSpec() {
+    const source = (0, install_source_1.installSource)();
+    const repos = new Set([exports.PLUGIN_GITHUB_REPO, ...exports.LEGACY_GITHUB_REPOS]);
+    if (source.kind === 'github')
+        repos.add(source.repo);
+    const path = `(?:${[...repos].map(escapeRegExp).join('|')})`;
+    return new RegExp(`^(?:github:|git\\+https://github\\.com/|git\\+ssh://git@github\\.com/)?${path}(?:\\.git)?#v(\\d+\\.\\d+\\.\\d+)$`);
+}
+function normalizeVersion(v) {
+    const m = SEMVER.exec(v.trim());
+    if (!m) {
+        throw new types_1.CliError(`"${v}" is not a valid version (expected x.y.z).`);
+    }
+    return `${m[1]}.${m[2]}.${m[3]}`;
+}
+exports.normalizeVersion = normalizeVersion;
+function compareVersions(a, b) {
+    const pa = normalizeVersion(a).split('.').map(Number);
+    const pb = normalizeVersion(b).split('.').map(Number);
+    for (let i = 0; i < 3; i++) {
+        if (pa[i] !== pb[i])
+            return pa[i] > pb[i] ? 1 : -1;
+    }
+    return 0;
+}
+exports.compareVersions = compareVersions;
+/** The pin `pstack new` / `pstack update` write: a git tag of the repo, or an exact npm version. */
+function formatPluginSpec(version) {
+    const v = normalizeVersion(version);
+    const source = (0, install_source_1.installSource)();
+    return source.kind === 'npm' ? v : `github:${source.repo}#v${v}`;
+}
+exports.formatPluginSpec = formatPluginSpec;
+/** Extra `npm install` flags for a pin, so npm saves it as formatPluginSpec wrote it. */
+function pinInstallFlags() {
+    return (0, install_source_1.installSource)().kind === 'npm' ? ['--save-exact'] : [];
+}
+exports.pinInstallFlags = pinInstallFlags;
+/**
+ * The pinned version, or null when the spec is neither a tag of the plugin repo (github:,
+ * git+https, git+ssh or owner/repo form; earlier repo names too) nor an npm version (x.y.z,
+ * ^x.y.z, ~x.y.z or =x.y.z).
+ */
+function parsePluginSpec(spec) {
+    const s = spec.trim();
+    const m = gitSpec().exec(s) ?? NPM_SPEC.exec(s);
+    return m ? m[1] : null;
+}
+exports.parsePluginSpec = parsePluginSpec;
+/**
+ * Shell command that installs the global CLI.
+ * - npm source: `npm i -g <package>@<version>`.
+ * - GitHub source: the prebuilt release asset. Not `npm i -g github:…#vX`: npm prepares git deps
+ *   of a global install in global mode, so devDependencies (typescript) are missing and the
+ *   build fails. Not the release download URL: the repo is private, and npm can't authenticate
+ *   to GitHub; `gh` downloads with the user's GitHub login.
+ */
+function globalInstallCommand(version) {
+    const v = normalizeVersion(version);
+    const source = (0, install_source_1.installSource)();
+    if (source.kind === 'npm')
+        return `npm i -g ${exports.PLUGIN_NAME}@${v}`;
+    const asset = `mouryaamit-nx-polystack-v${v}.tgz`;
+    return (`gh release download v${v} -R ${source.repo} -p ${asset} -D /tmp --clobber` +
+        ` && npm i -g /tmp/${asset}`);
+}
+exports.globalInstallCommand = globalInstallCommand;
+//# sourceMappingURL=versions.js.map

package/dist/src/cli/versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.js","sourceRoot":"","sources":["../../../src/cli/versions.ts"],"names":[],"mappings":";;;AAAA,qDAAkE;AAClE,mCAAmC;AAEtB,QAAA,WAAW,GAAG,0BAA0B,CAAC;AACtD,4DAA4D;AAC/C,QAAA,kBAAkB,GAAG,gCAAe,CAAC;AAClD,2FAA2F;AAC9E,QAAA,mBAAmB,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAE/D,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,YAAY,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;AACtF,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C,2EAA2E;AAC3E,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,IAAA,8BAAa,GAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,0BAAkB,EAAE,GAAG,2BAAmB,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,OAAO,IAAI,MAAM,CACf,0EAA0E,IAAI,oCAAoC,CACnH,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,CAAS;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,EAAE;QACN,MAAM,IAAI,gBAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;KACvE;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC;AAND,4CAMC;AAED,SAAgB,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpD;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAPD,0CAOC;AAED,oGAAoG;AACpG,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAA,8BAAa,GAAE,CAAC;IAC/B,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AAJD,4CAIC;AAED,yFAAyF;AACzF,SAAgB,eAAe;IAC7B,OAAO,IAAA,8BAAa,GAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAFD,0CAEC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAJD,0CAIC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,OAAe;IAClD,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAA,8BAAa,GAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,YAAY,mBAAW,IAAI,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,4BAA4B,CAAC,MAAM,CAAC;IAClD,OAAO,CACL,wBAAwB,CAAC,OAAO,MAAM,CAAC,IAAI,OAAO,KAAK,oBAAoB;QAC3E,qBAAqB,KAAK,EAAE,CAC7B,CAAC;AACJ,CAAC;AATD,oDASC"}

package/dist/src/executors/build/executor.d.ts

@@ -0,0 +1,19 @@
+/// <reference types="node" />
+import { ExecSyncOptions } from 'child_process';
+import { ExecutorContext } from '@nx/devkit';
+import { Obfuscator } from '../../lib/hardening/obfuscate';
+import { BuildExecutorSchema } from './schema.d';
+export type Runner = (cmd: string, opts: ExecSyncOptions) => void;
+/** Test seams. */
+export interface BuildSeams {
+    /** Used instead of the workspace's javascript-obfuscator. */
+    obfuscator?: Obfuscator;
+}
+export default function buildExecutor(options: BuildExecutorSchema, context: ExecutorContext, runner?: Runner, seams?: BuildSeams): Promise<{
+    success: boolean;
+}>;
+/**
+ * environments/<envProject>/environment.<env>.ts. DEV uses environment.ts, or environment.dev.ts
+ * in the per-env layout (no environment.ts in the folder).
+ */
+export declare function envFileFor(repoRoot: string, envProject: string, env: string): string;

package/dist/src/executors/build/executor.js

@@ -0,0 +1,251 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.envFileFor = void 0;
+const tslib_1 = require("tslib");
+const child_process_1 = require("child_process");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const prepare_1 = require("../../lib/env-encryption/prepare");
+const files_1 = require("../../lib/hardening/files");
+const integrity_1 = require("../../lib/hardening/integrity");
+const leak_check_1 = require("../../lib/hardening/leak-check");
+const ngsw_1 = require("../../lib/hardening/ngsw");
+const obfuscate_1 = require("../../lib/hardening/obfuscate");
+const options_1 = require("../../lib/hardening/options");
+const source_maps_1 = require("../../lib/hardening/source-maps");
+const strip_1 = require("../../lib/hardening/strip");
+const inject_meta_1 = require("../../lib/helpers/inject-meta");
+const inject_nonce_1 = require("../../lib/helpers/inject-nonce");
+const inject_sri_1 = require("../../lib/helpers/inject-sri");
+const strip_exif_1 = require("../../lib/helpers/strip-exif");
+const ci_resolve_1 = require("../../lib/utils/ci-resolve");
+const defaultRunner = (cmd, opts) => {
+    console.log(`▶ ${cmd}`);
+    (0, child_process_1.execSync)(cmd, opts);
+};
+async function buildExecutor(options, context, runner = defaultRunner, seams = {}) {
+    const { type, outputPath, envProject, env, buildTarget, buildConfiguration, secure = false, sri = false, baseHref, keySplit, domains, includeWww, onMismatch, } = options;
+    if (!env) {
+        throw new Error('build executor: "env" is required — set it via Nx configurations (e.g. dev / uat / prod)');
+    }
+    const projectName = context.projectName;
+    const repoRoot = context.root;
+    const target = buildTarget ?? `${projectName}:build`;
+    if (!/^[^:\s]+:[^:\s]+$/.test(target)) {
+        throw new Error(`build executor: buildTarget "${target}" must be exactly "<project>:<target>".`);
+    }
+    if (context.targetName && target === `${projectName}:${context.targetName}`) {
+        throw new Error(`build executor: buildTarget "${target}" points at this target. ` +
+            'Run "pstack update" (migration angular-release-target) or set buildTarget to the Angular build target.');
+    }
+    // Invalid hardening options fail before the env files are touched or anything is built.
+    const hardening = (0, options_1.resolveHardening)(options, env);
+    hardening.warnings.forEach((w) => console.warn(`⚠ ${w}`));
+    const ciCtx = (0, ci_resolve_1.resolveCiContext)();
+    // SRI for every chunk: Angular hashes them (the webpack runtime holds the lazy ones), the hashes
+    // are swapped after strip/obfuscate, and aes-gcm builds require integrity at runtime.
+    const chunkSri = sri && env !== 'DEV';
+    const envFilePath = envFileFor(repoRoot, envProject, env);
+    // One instant for the env stamp, the aes-gcm key (HKDF) and the meta timestamp_utc.
+    const now = new Date();
+    const prepared = (0, prepare_1.prepareEnvFile)({
+        repoRoot,
+        envProject,
+        env,
+        envFile: envFilePath,
+        commit: ciCtx.commit,
+        branch: ciCtx.branch,
+        now,
+        keySplit,
+        domains,
+        includeWww,
+        onMismatch,
+        requireIntegrity: chunkSri,
+    });
+    if (chunkSri && !prepared.keyParts) {
+        console.log('ℹ sri: the runtime integrity check (decrypt nothing without SRI) needs cipher aes-gcm');
+    }
+    try {
+        const angularConfig = buildConfiguration ?? (env === 'PROD' ? 'production' : env === 'UAT' ? 'uat' : 'development');
+        const outputArg = `--outputPath=${outputPath}`;
+        const baseHrefArg = baseHref ? `--baseHref=${baseHref}` : '';
+        // The env file changes per build (encryption, stamp), so the Angular build is never cached.
+        const cacheArg = env === 'DEV' ? '' : '--skip-nx-cache';
+        const sriArg = chunkSri ? '--subresourceIntegrity' : '';
+        const cmd = `npx nx run ${target}:${angularConfig} ${outputArg} ${baseHrefArg} ${sriArg} ${cacheArg}`
+            .replace(/\s+/g, ' ')
+            .trim();
+        runner(cmd, { stdio: 'inherit', cwd: repoRoot });
+    }
+    catch (err) {
+        try {
+            prepared.restore();
+        }
+        catch (restoreErr) {
+            // Keep the build error; the next release build of this env file repairs it.
+            console.error(`✖ env file not restored: ${restoreErr.message}`);
+        }
+        throw err;
+    }
+    prepared.restore();
+    const distDir = path.resolve(repoRoot, outputPath);
+    // Release checks see what the Angular build produced; stripping comes before the files are
+    // hashed (SRI) and stamped.
+    const checkRoot = (0, files_1.servedRoot)(distDir);
+    reportChecks([
+        (0, leak_check_1.checkLeaks)(checkRoot, prepared.secrets, hardening.leakCheck),
+        (0, source_maps_1.checkSourceMaps)(checkRoot, hardening.sourceMaps),
+    ]);
+    // Integrity Angular already wrote (sri, or subresourceIntegrity set in angular.json) must follow
+    // every rewrite below, else the browser refuses the rewritten files.
+    const builtWithIntegrity = env !== 'DEV' && (chunkSri || hasIntegrity(checkRoot) || (0, integrity_1.hasWebpackSriRuntime)(checkRoot));
+    const originalHashes = builtWithIntegrity ? (0, integrity_1.recordHashes)(checkRoot) : undefined;
+    const stripped = await (0, strip_1.stripOutput)(checkRoot, { ...hardening, repoRoot });
+    stripped.notes.forEach((n) => console.log(`ℹ ${n}`));
+    const obfuscated = await (0, obfuscate_1.obfuscateOutput)(checkRoot, {
+        repoRoot,
+        mode: hardening.obfuscate,
+        overrides: hardening.obfuscateOptions,
+        obfuscator: seams.obfuscator,
+    });
+    if (obfuscated.files > 0) {
+        console.log(`🔒 obfuscated ${obfuscated.files} file(s): ${kb(obfuscated.bytesBefore)} → ${kb(obfuscated.bytesAfter)}`);
+    }
+    if (originalHashes) {
+        (0, integrity_1.swapHashes)(checkRoot, originalHashes);
+        warnUncoveredLazyChunks(checkRoot);
+    }
+    // aes-gcm: the meta key share (and the asset share) must reach the served index.html, else the
+    // app cannot decrypt. cryptojs builds keep the meta in <outputPath>/index.html when present.
+    const servedDir = prepared.keyParts ? gcmServedRoot(distDir, outputPath) : distDir;
+    const metaHtml = path.join(servedDir, 'index.html');
+    const asset = prepared.keyParts?.asset;
+    if (asset) {
+        fs.mkdirSync(path.join(servedDir, 'assets'), { recursive: true });
+        fs.writeFileSync(path.join(servedDir, 'assets', asset.name), asset.bytes);
+    }
+    if (env === 'PROD' && fs.existsSync(distDir)) {
+        await (0, strip_exif_1.stripExif)({ rootDir: distDir });
+    }
+    if (fs.existsSync(metaHtml)) {
+        (0, inject_meta_1.injectBuildMeta)({
+            indexHtmlPath: metaHtml,
+            env,
+            branch: ciCtx.branch,
+            commit: ciCtx.commit,
+            buildNumber: ciCtx.buildNumber,
+            metaName: prepared.config.metaName,
+            now,
+            extra: prepared.keyParts ? { k: prepared.keyParts.share } : undefined,
+        });
+    }
+    // The served index.html: <outputPath>, or <outputPath>/browser for the application builder.
+    if (fs.existsSync(path.join(checkRoot, 'index.html'))) {
+        if (secure) {
+            (0, inject_nonce_1.injectCspNonce)({ distDir });
+        }
+        if (sri || builtWithIntegrity) {
+            (0, inject_sri_1.injectSri)({ distDir, cdnAllowlist: readSriAllowlist(repoRoot), refresh: true });
+        }
+        if (chunkSri && prepared.keyParts) {
+            noteExternalScripts(path.join(checkRoot, 'index.html'));
+        }
+    }
+    // Last: every rewrite above (strip, obfuscate, hashes, meta, nonce, SRI) changes files the
+    // service worker hashed.
+    const ngswUpdated = (0, ngsw_1.refreshNgswHashes)(checkRoot);
+    if (ngswUpdated > 0)
+        console.log(`ℹ ngsw.json: ${ngswUpdated} hash(es) updated`);
+    console.log(`✅ Build complete — type:${type}, env:${env}, output:${outputPath}`);
+    return { success: true };
+}
+exports.default = buildExecutor;
+/**
+ * The runtime integrity check covers same-origin scripts only; third-party ones without integrity
+ * (tag managers, chat widgets) rely on the CSP allowlist. Lists their hosts.
+ */
+function noteExternalScripts(indexHtml) {
+    const html = fs.readFileSync(indexHtml, 'utf8');
+    const hosts = new Set();
+    for (const tag of html.match(/<script\b[^>]*>/gi) ?? []) {
+        if (/\bintegrity\s*=/i.test(tag))
+            continue;
+        const src = /\bsrc\s*=\s*["']((?:https?:)?\/\/[^"']+)["']/i.exec(tag)?.[1];
+        if (!src)
+            continue;
+        try {
+            hosts.add(new URL(src, 'https://x.invalid').host);
+        }
+        catch {
+            // unreadable URL: not listed
+        }
+    }
+    if (hosts.size > 0) {
+        console.log(`ℹ sri: third-party scripts without integrity (${[...hosts].join(', ')}) are not checked ` +
+            'by the runtime; keep them in your CSP allowlist');
+    }
+}
+/** Whether the served index.html already carries integrity attributes. */
+function hasIntegrity(root) {
+    const index = path.join(root, 'index.html');
+    return fs.existsSync(index) && /\bintegrity\s*=/i.test(fs.readFileSync(index, 'utf8'));
+}
+const kb = (bytes) => `${Math.round(bytes / 1024)} kB`;
+/**
+ * esbuild (application builder): lazy chunks are loaded by import(), which carries no hash; only
+ * the webpack runtime checks lazy chunks.
+ */
+function warnUncoveredLazyChunks(root) {
+    if ((0, integrity_1.hasWebpackSriRuntime)(root))
+        return;
+    const lazy = (0, files_1.listFiles)(root, ['js', 'mjs'], { skipDirs: ['assets'] }).some((f) => /^chunk-[A-Z0-9]+\.m?js$/.test(path.basename(f)));
+    if (lazy) {
+        console.warn('⚠ sri: lazy chunks are not covered (the application builder loads them with import(), ' +
+            'which carries no hash); scripts in index.html are');
+    }
+}
+/** Prints every warning, then fails with every error of the release checks. */
+function reportChecks(results) {
+    const warnings = results.flatMap((r) => r.warnings);
+    const errors = results.flatMap((r) => r.errors);
+    warnings.forEach((w) => console.warn(`⚠ ${w}`));
+    if (errors.length > 0) {
+        throw new Error(`release checks failed:\n${errors.map((e) => `  ✖ ${e}`).join('\n')}`);
+    }
+}
+/** servedRoot for aes-gcm builds, which cannot run without an index.html for the meta key share. */
+function gcmServedRoot(distDir, outputPath) {
+    const dir = (0, files_1.servedRoot)(distDir);
+    if (!fs.existsSync(path.join(dir, 'index.html'))) {
+        throw new Error(`aes-gcm build: index.html not found under ${outputPath}; the key share could not be written`);
+    }
+    return dir;
+}
+/**
+ * environments/<envProject>/environment.<env>.ts. DEV uses environment.ts, or environment.dev.ts
+ * in the per-env layout (no environment.ts in the folder).
+ */
+function envFileFor(repoRoot, envProject, env) {
+    const dir = path.join(repoRoot, 'environments', envProject);
+    if (env !== 'DEV')
+        return path.join(dir, `environment.${env.toLowerCase()}.ts`);
+    const base = path.join(dir, 'environment.ts');
+    const perEnv = path.join(dir, 'environment.dev.ts');
+    return !fs.existsSync(base) && fs.existsSync(perEnv) ? perEnv : base;
+}
+exports.envFileFor = envFileFor;
+function readSriAllowlist(repoRoot) {
+    const allowlistFile = path.join(repoRoot, 'tools', 'config', 'sri-cdn-allowlist.json');
+    if (!fs.existsSync(allowlistFile))
+        return [];
+    try {
+        const raw = JSON.parse(fs.readFileSync(allowlistFile, 'utf8'));
+        if (Array.isArray(raw.allow))
+            return raw.allow;
+    }
+    catch {
+        // ignore malformed config
+    }
+    return [];
+}
+//# sourceMappingURL=executor.js.map

package/dist/src/executors/build/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../src/executors/build/executor.ts"],"names":[],"mappings":";;;;AAAA,iDAA0D;AAC1D,+CAAyB;AACzB,mDAA6B;AAI7B,8DAAkE;AAClE,qDAA+E;AAC/E,6DAA+F;AAC/F,+DAA4D;AAC5D,mDAA6D;AAC7D,6DAA4E;AAC5E,yDAA+D;AAC/D,iEAAkE;AAClE,qDAAwD;AACxD,+DAAgE;AAChE,iEAAgE;AAChE,6DAAyD;AACzD,6DAAyD;AACzD,2DAA8D;AAW9D,MAAM,aAAa,GAAW,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACxB,IAAA,wBAAQ,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC,CAAC;AAEa,KAAK,UAAU,aAAa,CACzC,OAA4B,EAC5B,OAAwB,EACxB,SAAiB,aAAa,EAC9B,QAAoB,EAAE;IAEtB,MAAM,EACJ,IAAI,EACJ,UAAU,EACV,UAAU,EACV,GAAG,EACH,WAAW,EACX,kBAAkB,EAClB,MAAM,GAAG,KAAK,EACd,GAAG,GAAG,KAAK,EACX,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,UAAU,EACV,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;KACH;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAY,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9B,MAAM,MAAM,GAAG,WAAW,IAAI,GAAG,WAAW,QAAQ,CAAC;IACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACrC,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,yCAAyC,CAChF,CAAC;KACH;IACD,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,KAAK,GAAG,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE;QAC3E,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,2BAA2B;YAC/D,wGAAwG,CAC3G,CAAC;KACH;IAED,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAA,0BAAgB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjD,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,IAAA,6BAAgB,GAAE,CAAC;IACjC,iGAAiG;IACjG,sFAAsF;IACtF,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,KAAK,KAAK,CAAC;IAEtC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC1D,oFAAoF;IACpF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAA,wBAAc,EAAC;QAC9B,QAAQ;QACR,UAAU;QACV,GAAG;QACH,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG;QACH,QAAQ;QACR,OAAO;QACP,UAAU;QACV,UAAU;QACV,gBAAgB,EAAE,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAClC,OAAO,CAAC,GAAG,CACT,uFAAuF,CACxF,CAAC;KACH;IACD,IAAI;QACF,MAAM,aAAa,GACjB,kBAAkB,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GACP,cAAc,MAAM,IAAI,aAAa,IAAI,SAAS,IAAI,WAAW,IAAI,MAAM,IAAI,QAAQ,EAAE;aACtF,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QAEZ,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;KAClD;IAAC,OAAO,GAAG,EAAE;QACZ,IAAI;YACF,QAAQ,CAAC,OAAO,EAAE,CAAC;SACpB;QAAC,OAAO,UAAU,EAAE;YACnB,4EAA4E;YAC5E,OAAO,CAAC,KAAK,CAAC,4BAA6B,UAAoB,CAAC,OAAO,EAAE,CAAC,CAAC;SAC5E;QACD,MAAM,GAAG,CAAC;KACX;IACD,QAAQ,CAAC,OAAO,EAAE,CAAC;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnD,2FAA2F;IAC3F,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAA,kBAAU,EAAC,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC;QACX,IAAA,uBAAU,EAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;QAC5D,IAAA,6BAAe,EAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;KACjD,CAAC,CAAC;IACH,iGAAiG;IACjG,qEAAqE;IACrE,MAAM,kBAAkB,GACtB,GAAG,KAAK,KAAK,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,SAAS,CAAC,IAAI,IAAA,gCAAoB,EAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAA,wBAAY,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAW,EAAC,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,IAAA,2BAAe,EAAC,SAAS,EAAE;QAClD,QAAQ;QACR,IAAI,EAAE,SAAS,CAAC,SAAS;QACzB,SAAS,EAAE,SAAS,CAAC,gBAAgB;QACrC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,KAAK,GAAG,CAAC,EAAE;QACxB,OAAO,CAAC,GAAG,CACT,iBAAiB,UAAU,CAAC,KAAK,aAAa,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,CAC9E,UAAU,CAAC,UAAU,CACtB,EAAE,CACJ,CAAC;KACH;IACD,IAAI,cAAc,EAAE;QAClB,IAAA,sBAAU,EAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACtC,uBAAuB,CAAC,SAAS,CAAC,CAAC;KACpC;IAED,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACvC,IAAI,KAAK,EAAE;QACT,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;KAC3E;IAED,IAAI,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QAC5C,MAAM,IAAA,sBAAS,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;KACvC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QAC3B,IAAA,6BAAe,EAAC;YACd,aAAa,EAAE,QAAQ;YACvB,GAAG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;YAClC,GAAG;YACH,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;SACtE,CAAC,CAAC;KACJ;IAED,4FAA4F;IAC5F,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,EAAE;QACrD,IAAI,MAAM,EAAE;YACV,IAAA,6BAAc,EAAC,EAAE,OAAO,EAAE,CAAC,CAAC;SAC7B;QAED,IAAI,GAAG,IAAI,kBAAkB,EAAE;YAC7B,IAAA,sBAAS,EAAC,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SACjF;QACD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE;YACjC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;SACzD;KACF;IAED,2FAA2F;IAC3F,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,CAAC;IACjD,IAAI,WAAW,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,WAAW,mBAAmB,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,SAAS,GAAG,YAAY,UAAU,EAAE,CAAC,CAAC;IACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAtLD,gCAsLC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE;QACvD,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC3C,MAAM,GAAG,GAAG,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI;YACF,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC;SACnD;QAAC,MAAM;YACN,6BAA6B;SAC9B;KACF;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE;QAClB,OAAO,CAAC,GAAG,CACT,iDAAiD,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACxF,iDAAiD,CACpD,CAAC;KACH;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;AAE/D;;;GAGG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,IAAA,gCAAoB,EAAC,IAAI,CAAC;QAAE,OAAO;IACvC,MAAM,IAAI,GAAG,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/E,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;IACF,IAAI,IAAI,EAAE;QACR,OAAO,CAAC,IAAI,CACV,wFAAwF;YACtF,mDAAmD,CACtD,CAAC;KACH;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,OAAsB;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KACxF;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CAAC,OAAe,EAAE,UAAkB;IACxD,MAAM,GAAG,GAAG,IAAA,kBAAU,EAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,EAAE;QAChD,MAAM,IAAI,KAAK,CACb,6CAA6C,UAAU,sCAAsC,CAC9F,CAAC;KACH;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,QAAgB,EAAE,UAAkB,EAAE,GAAW;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAND,gCAMC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACvF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,KAAiB,CAAC;KAC5D;IAAC,MAAM;QACN,0BAA0B;KAC3B;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/src/executors/build/schema.d.ts

@@ -0,0 +1,42 @@
+export interface BuildExecutorSchema {
+  type: 'angular' | 'ionic';
+  outputPath: string;
+  envProject: string;
+  /** Pipeline env, set via Nx configurations: DEV, UAT, PROD or a custom one such as QA. */
+  env?: string;
+  /** Angular build target to run, "<project>:<target>". Default: "<this project>:build". */
+  buildTarget?: string;
+  /** Configuration of buildTarget. Default: PROD → production, UAT → uat, otherwise development. */
+  buildConfiguration?: string;
+  secure?: boolean;
+  /**
+   * Integrity for every chunk: passed to the Angular build as --subresource-integrity, hashes
+   * refreshed after strip/obfuscate. With cipher aes-gcm the runtime refuses to decrypt when a
+   * script has no integrity attribute.
+   */
+  sri?: boolean;
+  /** Replaced by stripComments and dropConsole (read as those when they are unset). */
+  harden?: boolean;
+  /** non-DEV: plaintext of encrypted env values in the output. */
+  leakCheck?: 'fail' | 'warn' | 'off';
+  /** non-DEV: .map files or sourceMappingURL comments in the output. */
+  sourceMaps?: 'fail' | 'warn' | 'off';
+  /** non-DEV: remove comments from the built JS, CSS and served index.html. */
+  stripComments?: boolean;
+  /** non-DEV: console methods whose calls are removed from the built JS. */
+  dropConsole?: ('log' | 'debug' | 'warn' | 'info' | 'error' | 'trace')[];
+  /**
+   * non-DEV: obfuscate the app's own JS (main and lazy chunks; runtime, polyfills, vendor, scripts
+   * and styles are skipped). Needs javascript-obfuscator in the workspace. Default: off.
+   */
+  obfuscate?: 'off' | 'light' | 'medium' | 'strong';
+  /** non-DEV: javascript-obfuscator options on top of the preset (a CSP-safe subset). */
+  obfuscateOptions?: Record<string, unknown>;
+  baseHref?: string;
+  /** aes-gcm: where the per-build key's shares go. */
+  keySplit?: 'meta-bundle' | 'meta-bundle-asset';
+  /** aes-gcm: hosts this build may run on (set per configuration). */
+  domains?: string[];
+  includeWww?: boolean;
+  onMismatch?: 'block' | 'warn';
+}