@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/lib/env-encryption/sensitive.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveKey = exports.wordsOf = void 0;
+/**
+ * Whether a field name looks like it holds a secret (used for profile files, where only such
+ * fields are encrypted). A name is split into words (camelCase, snake_case, kebab-case); it is
+ * sensitive when a word is a credential, token or crypto-material word, or it is `<qualifier> key`
+ * (apiKey, aesKey, clientKey). Names of things rather than the things themselves are not: a first
+ * word that is a verb or flag prefix (getOtp, isPinSet) or a last word such as field, label,
+ * route, url, code (otpField, loginRoute). A bare `key` (cacheKey, pincodeKey) is an identifier.
+ */
+const SENSITIVE_WORDS = new Set([
+    // credentials
+    'pass',
+    'password',
+    'passwd',
+    'passphrase',
+    'pwd',
+    'passcode',
+    'pin',
+    'mpin',
+    'tpin',
+    'otp',
+    'cvv',
+    'secret',
+    'secrets',
+    'cred',
+    'creds',
+    'credential',
+    'credentials',
+    'uname',
+    'username',
+    'user',
+    'userid',
+    'login',
+    'loginid',
+    // tokens and auth material
+    'token',
+    'tokens',
+    'jwt',
+    'bearer',
+    'authorization',
+    'auth',
+    'apikey',
+    'cookie',
+    'session',
+    'sessionid',
+    // crypto material
+    'salt',
+    'iv',
+    'nonce',
+    'hmac',
+    'signature',
+    'cipher',
+    'ciphertext',
+    'privatekey',
+    'private',
+    'cert',
+    'certificate',
+    'keystore',
+    // client registration
+    'clientsecret',
+    'clientid',
+]);
+const KEY_QUALIFIERS = new Set([
+    'api',
+    'aes',
+    'rsa',
+    'des',
+    'hmac',
+    'jwt',
+    'auth',
+    'access',
+    'app',
+    'client',
+    'master',
+    'secret',
+    'private',
+    'public',
+    'session',
+    'encryption',
+    'encrypt',
+    'decryption',
+    'decrypt',
+    'crypto',
+    'cipher',
+    'signing',
+    'sign',
+    'license',
+    'licence',
+    'customer',
+    'internal',
+    'service',
+    'merchant',
+    'partner',
+    'subscription',
+]);
+const NON_SECRET_FIRST_WORDS = new Set([
+    'get',
+    'send',
+    'resend',
+    'verify',
+    'validate',
+    'save',
+    'fetch',
+    'generate',
+    'check',
+    'update',
+    'create',
+    'delete',
+    'submit',
+    'call',
+    'load',
+    'is',
+    'has',
+    'show',
+    'hide',
+    'enable',
+    'disable',
+    'use',
+    'allow',
+    'on',
+]);
+const NON_SECRET_LAST_WORDS = new Set([
+    'field',
+    'fields',
+    'label',
+    'labels',
+    'placeholder',
+    'route',
+    'routes',
+    'url',
+    'urls',
+    'path',
+    'endpoint',
+    'api',
+    'type',
+    'types',
+    'mode',
+    'code',
+    'codes',
+    'length',
+    'max',
+    'min',
+    'regex',
+    'pattern',
+    'message',
+    'msg',
+    'text',
+    'title',
+    'enabled',
+    'required',
+    'flag',
+    'template',
+]);
+function wordsOf(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[\s_\-$]+/)
+        .filter(Boolean);
+}
+exports.wordsOf = wordsOf;
+function isSensitiveKey(name) {
+    const words = wordsOf(name);
+    if (words.length === 0)
+        return false;
+    if (NON_SECRET_FIRST_WORDS.has(words[0]))
+        return false;
+    if (NON_SECRET_LAST_WORDS.has(words[words.length - 1]))
+        return false;
+    if (words.some((w) => SENSITIVE_WORDS.has(w)))
+        return true;
+    if (words.some((w, i) => w === 'id' && words[i - 1] === 'client'))
+        return true;
+    return words.some((w, i) => w === 'key' && i > 0 && KEY_QUALIFIERS.has(words[i - 1]));
+}
+exports.isSensitiveKey = isSensitiveKey;
+//# sourceMappingURL=sensitive.js.map

package/dist/src/lib/env-encryption/sensitive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/sensitive.ts"],"names":[],"mappings":";;;AAAA;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,cAAc;IACd,MAAM;IACN,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,UAAU;IACV,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;IACP,YAAY;IACZ,aAAa;IACb,OAAO;IACP,UAAU;IACV,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,2BAA2B;IAC3B,OAAO;IACP,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,eAAe;IACf,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,MAAM;IACN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,MAAM;IACN,aAAa;IACb,UAAU;IACV,sBAAsB;IACtB,cAAc;IACd,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,KAAK;IACL,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,UAAU;IACV,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,KAAK;IACL,OAAO;IACP,SAAS;IACT,SAAS;IACT,KAAK;IACL,MAAM;IACN,OAAO;IACP,SAAS;IACT,UAAU;IACV,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AAEH,SAAgB,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,WAAW,EAAE;SACb,KAAK,CAAC,WAAW,CAAC;SAClB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAPD,0BAOC;AAED,SAAgB,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AARD,wCAQC"}

package/dist/src/lib/env-encryption/stamp.d.ts

@@ -0,0 +1,2 @@
+export declare function isValidTimezone(tz: string): boolean;
+export declare function formatStamp(date: Date, timezone: string, format: string, label?: string): string;

package/dist/src/lib/env-encryption/stamp.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatStamp = exports.isValidTimezone = void 0;
+/**
+ * Build time formatting without a date library. Tokens: YYYY, MMM (Jan), MM, DD, HH (00–23),
+ * hh (01–12), mm, ss, A (AM/PM), z (short zone name, or `label`); `[text]` is literal text.
+ * Other characters are kept.
+ */
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+function isValidTimezone(tz) {
+    try {
+        new Intl.DateTimeFormat('en-US', { timeZone: tz });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+exports.isValidTimezone = isValidTimezone;
+function formatStamp(date, timezone, format, label) {
+    const parts = Object.fromEntries(new Intl.DateTimeFormat('en-US', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: 'numeric',
+        day: 'numeric',
+        hour: 'numeric',
+        minute: 'numeric',
+        second: 'numeric',
+        hourCycle: 'h23',
+        timeZoneName: 'short',
+    })
+        .formatToParts(date)
+        .map((p) => [p.type, p.value]));
+    const pad = (v) => String(v).padStart(2, '0');
+    const hour = Number(parts['hour']) % 24;
+    const values = {
+        YYYY: parts['year'],
+        MMM: MONTHS[Number(parts['month']) - 1],
+        MM: pad(parts['month']),
+        DD: pad(parts['day']),
+        HH: pad(hour),
+        hh: pad(hour % 12 === 0 ? 12 : hour % 12),
+        mm: pad(parts['minute']),
+        ss: pad(parts['second']),
+        A: hour < 12 ? 'AM' : 'PM',
+        z: label ?? parts['timeZoneName'] ?? timezone,
+    };
+    // `[text]` is kept as is (e.g. `[at] HH:mm`).
+    return format.replace(/\[([^\]]*)\]|YYYY|MMM|MM|DD|HH|hh|mm|ss|A|z/g, (t, lit) => lit !== undefined ? lit : values[t]);
+}
+exports.formatStamp = formatStamp;
+//# sourceMappingURL=stamp.js.map

package/dist/src/lib/env-encryption/stamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stamp.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/stamp.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAEpG,SAAgB,eAAe,CAAC,EAAU;IACxC,IAAI;QACF,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;KACb;IAAC,MAAM;QACN,OAAO,KAAK,CAAC;KACd;AACH,CAAC;AAPD,0CAOC;AAED,SAAgB,WAAW,CAAC,IAAU,EAAE,QAAgB,EAAE,MAAc,EAAE,KAAc;IACtF,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QAC/B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,OAAO;KACtB,CAAC;SACC,aAAa,CAAC,IAAI,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CACjC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,MAAM,GAA2B;QACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC;QACb,EAAE,EAAE,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACzC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC1B,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,QAAQ;KAC9C,CAAC;IACF,8CAA8C;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,8CAA8C,EAAE,CAAC,CAAC,EAAE,GAAY,EAAE,EAAE,CACxF,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CACpC,CAAC;AACJ,CAAC;AAlCD,kCAkCC"}

package/dist/src/lib/env-encryption/switch-gcm.d.ts

@@ -0,0 +1,43 @@
+import { Tree } from '@nx/devkit';
+import { EnvEncryptionConfig } from './config';
+/** Note for keySources custom under aes-gcm (no values). */
+export declare function customKeyNote(metaName?: string): string;
+/**
+ * main.ts awaiting envReady before bootstrap; undefined for an unknown shape (no
+ * `platformBrowserDynamic().bootstrapModule(…)`, unbalanced brackets, or another chained call);
+ * the same text when it already calls envReady. The bootstrap arguments and the catch handler are
+ * kept as written.
+ */
+export declare function rewriteMainForGcm(text: string, envImport: string, metaName?: string): string | undefined;
+/**
+ * Non-public `environment.<key>` reads that run at import, before envReady: outside functions,
+ * method bodies, instance fields and arrow expression bodies; static fields, template literals
+ * and `const { a } = environment` count. Heuristic: a `{` preceded by `)`, `=>` or a word other
+ * than `return` / `default` opens a block (after `class …` a class body); one preceded by `=`,
+ * `:`, `(`, `,`, `[`, `?` or `return` is an object literal.
+ */
+export declare function moduleScopeEnvReads(text: string, publicKeys: string[]): string[];
+/**
+ * Arguments of `decryptEnvironment(<arg>)` calls on objects outside environment (calls without an
+ * argument, or on `environment` or a part of it, are left out; so is the function's declaration).
+ */
+export declare function decryptEnvironmentCalls(text: string): string[];
+/** Whether `text` is an env-secret wrapper written by pstack migrate (NX-39b). */
+export declare function isMigratedWrapper(text: string): boolean;
+/**
+ * A migrated env-secret wrapper with `decryptEnvironmentAsync` (and the runtime imports it needs);
+ * the same text when it has it; undefined when it is not a wrapper of the known shape.
+ */
+export declare function rewriteWrapperForGcm(text: string): string | undefined;
+export interface SwitchOptions extends Partial<Pick<EnvEncryptionConfig, 'mode' | 'keys'>> {
+    keySources?: string[];
+    /** Meta tag of the build info; passed to envReady when it is not x-build. */
+    metaName?: string;
+}
+/**
+ * Rewrites main.ts of every release app and the migrated env-secret wrappers; returns report
+ * lines (by file and key, no values). Apps and libraries are found by walking apps/ and libs/
+ * (getProjects needs Nx's native file globbing). main.ts is scanned too (production excluded).
+ * In listed mode only listed keys are reported.
+ */
+export declare function switchAppsToGcm(tree: Tree, publicKeys: string[], opts?: SwitchOptions): string[];

package/dist/src/lib/env-encryption/switch-gcm.js

@@ -0,0 +1,371 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.switchAppsToGcm = exports.rewriteWrapperForGcm = exports.isMigratedWrapper = exports.decryptEnvironmentCalls = exports.moduleScopeEnvReads = exports.rewriteMainForGcm = exports.customKeyNote = void 0;
+const tslib_1 = require("tslib");
+const path = tslib_1.__importStar(require("path"));
+const angular_project_1 = require("../utils/angular-project");
+const llm_block_1 = require("../utils/llm-block");
+const config_1 = require("./config");
+const env_file_1 = require("./env-file");
+const RUNTIME = '@mouryaamit/nx-polystack/runtime/env-secret';
+const DEFAULT_META = 'x-build';
+/** `envReady(<env>, { inPlace: true[, metaName][, extra] })`. */
+function envReadyCall(env, metaName, extra = '') {
+    const meta = metaName && metaName !== DEFAULT_META ? `, metaName: '${metaName}'` : '';
+    return `envReady(${env}, { inPlace: true${meta}${extra} })`;
+}
+/** Note for keySources custom under aes-gcm (no values). */
+function customKeyNote(metaName) {
+    return ('keySources lists custom: main.ts must pass getKey to envReady, e.g. ' +
+        `\`${envReadyCall('environment', metaName, ', getKey: () => fetchKey()')}\` (the build ` +
+        'reads PSTACK_CUSTOM_KEY).');
+}
+exports.customKeyNote = customKeyNote;
+/** `code` with every single- or double-quoted string blanked (offsets kept). */
+function blankStrings(code) {
+    let out = code;
+    for (const s of (0, env_file_1.quotedStrings)(out).reverse()) {
+        out = out.slice(0, s.start) + ' '.repeat(s.end - s.start) + out.slice(s.end);
+    }
+    return out;
+}
+/** Local name of the imported `environment` (`environment as env` → env), or undefined. */
+function environmentLocalName(text) {
+    const code = (0, env_file_1.stripComments)(text);
+    for (const m of code.matchAll(/\bimport\s*\{([^}]*)\}\s*from\s*['"][^'"]+['"]/g)) {
+        for (const entry of m[1].split(',')) {
+            const parts = entry
+                .trim()
+                .replace(/^type\s+/, '')
+                .split(/\s+as\s+/)
+                .map((p) => p.trim());
+            if (parts[0] === 'environment')
+                return parts[1] || parts[0];
+        }
+    }
+    return undefined;
+}
+/**
+ * main.ts awaiting envReady before bootstrap; undefined for an unknown shape (no
+ * `platformBrowserDynamic().bootstrapModule(…)`, unbalanced brackets, or another chained call);
+ * the same text when it already calls envReady. The bootstrap arguments and the catch handler are
+ * kept as written.
+ */
+function rewriteMainForGcm(text, envImport, metaName) {
+    if (/\benvReady\s*\(/.test(blankStrings((0, env_file_1.stripComments)(text))))
+        return text;
+    const re = /\bplatformBrowserDynamic\s*\(\s*\)\s*\.\s*bootstrapModule\s*\(/g;
+    let m;
+    while ((m = re.exec(text)) && !(0, env_file_1.isCodeAt)(text, m.index))
+        ;
+    if (!m)
+        return undefined;
+    const open = m.index + m[0].length - 1;
+    const close = (0, env_file_1.closingBracket)(text, open);
+    if (close < 0)
+        return undefined;
+    const args = text.slice(open + 1, close);
+    let end = close + 1;
+    let handler;
+    const c = /^\s*\.\s*catch\s*\(/.exec(text.slice(end));
+    if (c) {
+        const cOpen = end + c[0].length - 1;
+        const cClose = (0, env_file_1.closingBracket)(text, cOpen);
+        if (cClose < 0)
+            return undefined;
+        handler = text.slice(cOpen + 1, cClose);
+        end = cClose + 1;
+    }
+    if (/^\s*\./.test(text.slice(end)))
+        return undefined;
+    const semi = /^\s*;/.exec(text.slice(end));
+    if (semi)
+        end += semi[0].length;
+    const local = environmentLocalName(text);
+    const call = `${envReadyCall(local ?? 'environment', metaName)}\n` +
+        `  .then(() => platformBrowserDynamic().bootstrapModule(${args}))` +
+        `${handler !== undefined ? `\n  .catch(${handler})` : ''};`;
+    let out = text.slice(0, m.index) + call + text.slice(end);
+    const imports = [`import { envReady } from '${RUNTIME}';`];
+    if (local === undefined)
+        imports.push(`import { environment } from '${envImport}';`);
+    const lastImport = [...out.matchAll(/^import\b[^;]*;/gm)].pop();
+    if (lastImport) {
+        const at = (lastImport.index ?? 0) + lastImport[0].length;
+        out = `${out.slice(0, at)}\n${imports.join('\n')}${out.slice(at)}`;
+    }
+    else {
+        out = `${imports.join('\n')}\n\n${out}`;
+    }
+    return out;
+}
+exports.rewriteMainForGcm = rewriteMainForGcm;
+/**
+ * Non-public `environment.<key>` reads that run at import, before envReady: outside functions,
+ * method bodies, instance fields and arrow expression bodies; static fields, template literals
+ * and `const { a } = environment` count. Heuristic: a `{` preceded by `)`, `=>` or a word other
+ * than `return` / `default` opens a block (after `class …` a class body); one preceded by `=`,
+ * `:`, `(`, `,`, `[`, `?` or `return` is an object literal.
+ */
+function moduleScopeEnvReads(text, publicKeys) {
+    const code = blankStrings((0, env_file_1.stripComments)(text));
+    const stack = [];
+    let deferDepth = -1;
+    const out = [];
+    const add = (k) => {
+        if (!publicKeys.includes(k) && !out.includes(k))
+            out.push(k);
+    };
+    const top = () => stack[stack.length - 1];
+    const runsAtImport = () => {
+        if (deferDepth >= 0 || stack.some((f) => f.block))
+            return false;
+        const cls = [...stack].reverse().find((f) => f.cls);
+        return !cls || cls.cls.isStatic;
+    };
+    const re = /\b(?:const|let|var)\s*\{([^{}]*)\}\s*=\s*environment\b(?!\s*[.\w$])|(?<![\w$.])environment\.([A-Za-z_$][\w$]*)|\bstatic\b|=>|\$\{|[{}()[\],;]/g;
+    let m;
+    while ((m = re.exec(code))) {
+        const t = m[0];
+        if (m[1] !== undefined) {
+            if (!runsAtImport())
+                continue;
+            for (const part of m[1].split(',')) {
+                const key = part.trim();
+                if (key && !key.startsWith('...'))
+                    add(key.split(/[:=]/)[0].trim());
+            }
+        }
+        else if (m[2] !== undefined) {
+            if (runsAtImport())
+                add(m[2]);
+        }
+        else if (t === 'static') {
+            if (top()?.cls)
+                top().cls.isStatic = true;
+        }
+        else if (t === '=>') {
+            if (!/^\s*\{/.test(code.slice(re.lastIndex)) && deferDepth < 0)
+                deferDepth = stack.length;
+        }
+        else if (t === '${' || t === '(' || t === '[') {
+            stack.push({ block: false });
+        }
+        else if (t === '{') {
+            const before = code.slice(0, m.index).trimEnd();
+            if (/\bclass\b[^{};=()]*$/.test(before)) {
+                stack.push({ block: false, cls: { isStatic: false } });
+            }
+            else {
+                const block = /(\)|=>|(?:^|[^\w$])(?!return$|default$)[A-Za-z_$][\w$]*)$/.test(before);
+                stack.push({ block });
+            }
+        }
+        else if (t === '}' || t === ')' || t === ']') {
+            stack.pop();
+            if (deferDepth > stack.length)
+                deferDepth = -1;
+            if (t === '}' && top()?.cls)
+                top().cls.isStatic = false;
+        }
+        else {
+            // , or ;
+            if (deferDepth === stack.length)
+                deferDepth = -1;
+            if (t === ';' && top()?.cls)
+                top().cls.isStatic = false;
+        }
+    }
+    return out;
+}
+exports.moduleScopeEnvReads = moduleScopeEnvReads;
+/**
+ * Arguments of `decryptEnvironment(<arg>)` calls on objects outside environment (calls without an
+ * argument, or on `environment` or a part of it, are left out; so is the function's declaration).
+ */
+function decryptEnvironmentCalls(text) {
+    const code = (0, env_file_1.stripComments)(text);
+    const out = [];
+    const re = /\bdecryptEnvironment\s*\(/g;
+    let m;
+    while ((m = re.exec(code))) {
+        if (/\bfunction\s*$/.test(code.slice(0, m.index)))
+            continue;
+        const open = m.index + m[0].length - 1;
+        const close = (0, env_file_1.closingBracket)(code, open);
+        if (close < 0)
+            continue;
+        const arg = code
+            .slice(open + 1, close)
+            .trim()
+            .replace(/\s+/g, ' ');
+        if (arg === '' || /^environment\b/.test(arg))
+            continue;
+        if (!out.includes(arg))
+            out.push(arg);
+    }
+    return out;
+}
+exports.decryptEnvironmentCalls = decryptEnvironmentCalls;
+const WRAPPER_ASYNC = `
+/**
+ * Decrypts every encrypted value in place (aes-gcm ENC2 too) with the key registered by envReady:
+ * the environment without an argument, else that object; returns the dotted paths decrypted.
+ */
+export function decryptEnvironmentAsync(obj?: object): Promise<string[]> {
+  return obj ? decryptTreeAsync(obj) : envReady(environment, { inPlace: true });
+}
+`;
+/** Whether `text` is an env-secret wrapper written by pstack migrate (NX-39b). */
+function isMigratedWrapper(text) {
+    return text.includes('rewritten by pstack migrate');
+}
+exports.isMigratedWrapper = isMigratedWrapper;
+/** The imported name of an import list entry (`a as b` → a, `type T` → T). */
+const importedName = (entry) => entry
+    .replace(/^type\s+/, '')
+    .split(/\s+as\s+/)[0]
+    .trim();
+/**
+ * A migrated env-secret wrapper with `decryptEnvironmentAsync` (and the runtime imports it needs);
+ * the same text when it has it; undefined when it is not a wrapper of the known shape.
+ */
+function rewriteWrapperForGcm(text) {
+    if (!isMigratedWrapper(text))
+        return undefined;
+    if (/\bexport\s+(?:async\s+)?function\s+decryptEnvironmentAsync\b/.test(text))
+        return text;
+    if (!/\bexport\s+function\s+decryptEnvironment\b/.test(text))
+        return undefined;
+    if (!/import\s*\{\s*environment\s*\}\s*from/.test(text))
+        return undefined;
+    const importRe = new RegExp(`import\\s*\\{([^}]*)\\}\\s*from\\s*(['"])${RUNTIME.replace(/[/.-]/g, '\\$&')}\\2;`);
+    const im = importRe.exec(text);
+    if (!im)
+        return undefined;
+    const entries = im[1]
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    for (const name of ['decryptTreeAsync', 'envReady']) {
+        if (entries.some((e) => importedName(e) === name))
+            continue;
+        const at = entries.findIndex((e) => !e.startsWith('type ') && importedName(e) > name);
+        const firstType = entries.findIndex((e) => e.startsWith('type '));
+        entries.splice(at >= 0 ? at : firstType >= 0 ? firstType : entries.length, 0, name);
+    }
+    const imports = `import {\n${entries.map((e) => `  ${e},`).join('\n')}\n} from '${RUNTIME}';`;
+    const out = text.slice(0, im.index) + imports + text.slice(im.index + im[0].length);
+    return `${out.replace(/\s*$/, '\n')}${WRAPPER_ASYNC}`;
+}
+exports.rewriteWrapperForGcm = rewriteWrapperForGcm;
+function tsFiles(tree, dir, out = []) {
+    if (!tree.exists(dir) || tree.isFile(dir))
+        return out;
+    for (const c of tree.children(dir)) {
+        const p = `${dir}/${c}`;
+        if (tree.isFile(p)) {
+            if (p.endsWith('.ts') && !p.endsWith('.spec.ts') && !p.endsWith('.d.ts'))
+                out.push(p);
+        }
+        else if (!['node_modules', 'dist'].includes(c) && !c.startsWith('.')) {
+            tsFiles(tree, p, out);
+        }
+    }
+    return out;
+}
+const projectName = (p) => typeof p.json['name'] === 'string' ? p.json['name'] : path.posix.basename(p.root);
+const sourceRootOf = (p) => typeof p.json['sourceRoot'] === 'string' ? p.json['sourceRoot'] : p.root;
+/**
+ * Rewrites main.ts of every release app and the migrated env-secret wrappers; returns report
+ * lines (by file and key, no values). Apps and libraries are found by walking apps/ and libs/
+ * (getProjects needs Nx's native file globbing). main.ts is scanned too (production excluded).
+ * In listed mode only listed keys are reported.
+ */
+function switchAppsToGcm(tree, publicKeys, opts = {}) {
+    const notes = [];
+    const awaitCall = `await ${envReadyCall('environment', opts.metaName)}`;
+    const listed = opts.mode === 'listed' && opts.keys !== undefined;
+    const cfgKeys = { keys: opts.keys ?? {} };
+    const reported = (reads, envProject) => {
+        if (!listed)
+            return reads;
+        const keys = envProject === undefined
+            ? Object.values(cfgKeys.keys).flat()
+            : (0, config_1.listedKeys)(cfgKeys, envProject);
+        return reads.filter((k) => keys.includes(k));
+    };
+    const scanned = new Set();
+    const scan = (files, envProject) => {
+        for (const file of files) {
+            if (scanned.has(file))
+                continue;
+            scanned.add(file);
+            const text = tree.read(file, 'utf8') ?? '';
+            if (path.posix.basename(file) === 'env-secret.ts' && isMigratedWrapper(text)) {
+                const next = rewriteWrapperForGcm(text);
+                if (next === undefined) {
+                    notes.push(`${file}: add \`decryptEnvironmentAsync\` by hand (decryptTreeAsync / envReady from ` +
+                        `'${RUNTIME}'); decryptEnvironment() leaves aes-gcm values encrypted.`);
+                }
+                else if (next !== text) {
+                    tree.write(file, next);
+                    notes.push(`${file} now exports decryptEnvironmentAsync (decryptEnvironment() leaves aes-gcm ` +
+                        'values encrypted).');
+                }
+                continue;
+            }
+            const reads = reported(moduleScopeEnvReads(text, [...publicKeys, 'production']), envProject);
+            if (reads.length > 0) {
+                notes.push(`${file}: ${reads.join(', ')} read at import time (still encrypted then).`);
+            }
+            for (const arg of decryptEnvironmentCalls(text)) {
+                notes.push(`${file}: decryptEnvironment(${arg}) stays encrypted under aes-gcm unless the object ` +
+                    `is part of environment; use \`await decryptEnvironmentAsync(${arg})\`.`);
+            }
+        }
+    };
+    let releaseApps = 0;
+    for (const p of (0, llm_block_1.findProjects)(tree, 'apps')) {
+        const targets = (p.json['targets'] ?? {});
+        const release = Object.values(targets).find((t) => t.executor === angular_project_1.POLYSTACK_BUILD_EXECUTOR);
+        if (!release)
+            continue;
+        releaseApps++;
+        const name = projectName(p);
+        const buildTarget = String(release.options?.['buildTarget'] ?? `${name}:build`).split(':')[1];
+        const main = targets[buildTarget]?.options?.['main'];
+        const envProject = String(release.options?.['envProject'] ?? name);
+        const files = tsFiles(tree, sourceRootOf(p));
+        if (main && tree.exists(main)) {
+            const rel = path.posix.relative(path.posix.dirname(main), `environments/${envProject}/environment`);
+            const text = tree.read(main, 'utf8') ?? '';
+            const next = rewriteMainForGcm(text, rel.startsWith('.') ? rel : `./${rel}`, opts.metaName);
+            if (next === undefined) {
+                notes.push(`${name}: ${main} has an unknown shape; before bootstrapping add ` +
+                    `\`${awaitCall}\` (import envReady from '${RUNTIME}').`);
+            }
+            else if (next !== text) {
+                tree.write(main, next);
+                notes.push(`${name}: ${main} now awaits envReady before bootstrap.`);
+            }
+            if (!files.includes(main))
+                files.unshift(main);
+        }
+        else {
+            notes.push(`${name}: no main.ts found; ${awaitCall} before bootstrap.`);
+        }
+        scan(files, envProject);
+    }
+    if (releaseApps === 0) {
+        notes.push(`No app under apps/ has a release target (${angular_project_1.POLYSTACK_BUILD_EXECUTOR}); no main.ts was ` +
+            `rewritten. Apps built another way must ${awaitCall} before bootstrap.`);
+    }
+    for (const p of (0, llm_block_1.findProjects)(tree, 'libs'))
+        scan(tsFiles(tree, sourceRootOf(p)));
+    if (opts.keySources?.includes('custom'))
+        notes.push(customKeyNote(opts.metaName));
+    return notes;
+}
+exports.switchAppsToGcm = switchAppsToGcm;
+//# sourceMappingURL=switch-gcm.js.map