@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/lib/env-encryption/switch-gcm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"switch-gcm.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/switch-gcm.ts"],"names":[],"mappings":";;;;AAAA,mDAA6B;AAI7B,8DAAoE;AACpE,kDAAgE;AAChE,qCAA2D;AAC3D,yCAAoF;AAEpF,MAAM,OAAO,GAAG,6CAA6C,CAAC;AAC9D,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,iEAAiE;AACjE,SAAS,YAAY,CAAC,GAAW,EAAE,QAAiB,EAAE,KAAK,GAAG,EAAE;IAC9D,MAAM,IAAI,GAAG,QAAQ,IAAI,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,YAAY,GAAG,oBAAoB,IAAI,GAAG,KAAK,KAAK,CAAC;AAC9D,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa,CAAC,QAAiB;IAC7C,OAAO,CACL,sEAAsE;QACtE,KAAK,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,4BAA4B,CAAC,gBAAgB;QACxF,2BAA2B,CAC5B,CAAC;AACJ,CAAC;AAND,sCAMC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAA,wBAAa,EAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;KAC9E;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,EAAE;QAChF,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YACnC,MAAM,KAAK,GAAG,KAAK;iBAChB,IAAI,EAAE;iBACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;iBACvB,KAAK,CAAC,UAAU,CAAC;iBACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa;gBAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;SAC7D;KACF;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,SAAiB,EACjB,QAAiB;IAEjB,IAAI,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,EAAE,GAAG,iEAAiE,CAAC;IAC7E,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;QAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAA,yBAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;IACpB,IAAI,OAA2B,CAAC;IAChC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE;QACL,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAA,yBAAc,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC;KAClB;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI;QAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GACR,GAAG,YAAY,CAAC,KAAK,IAAI,aAAa,EAAE,QAAQ,CAAC,IAAI;QACrD,0DAA0D,IAAI,IAAI;QAClE,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAC9D,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAa,CAAC,6BAA6B,OAAO,IAAI,CAAC,CAAC;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,gCAAgC,SAAS,IAAI,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChE,IAAI,UAAU,EAAE;QACd,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;KACpE;SAAM;QACL,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;KACzC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA3CD,8CA2CC;AASD;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,IAAY,EAAE,UAAoB;IACpE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,GAAY,EAAE;QACjC,IAAI,UAAU,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,IAAK,GAAG,CAAC,GAA6B,CAAC,QAAQ,CAAC;IAC7D,CAAC,CAAC;IACF,MAAM,EAAE,GACN,gJAAgJ,CAAC;IACnJ,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE;YACtB,IAAI,CAAC,YAAY,EAAE;gBAAE,SAAS;YAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aACrE;SACF;aAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE;YAC7B,IAAI,YAAY,EAAE;gBAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/B;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE;YACzB,IAAI,GAAG,EAAE,EAAE,GAAG;gBAAG,GAAG,EAAE,CAAC,GAA6B,CAAC,QAAQ,GAAG,IAAI,CAAC;SACtE;aAAM,IAAI,CAAC,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC;gBAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;SAC3F;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;SAC9B;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBACvC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;aACxD;iBAAM;gBACL,MAAM,KAAK,GAAG,2DAA2D,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvF,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;aACvB;SACF;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YAC9C,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM;gBAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,EAAE,GAAG;gBAAG,GAAG,EAAE,CAAC,GAA6B,CAAC,QAAQ,GAAG,KAAK,CAAC;SACpF;aAAM;YACL,SAAS;YACT,IAAI,UAAU,KAAK,KAAK,CAAC,MAAM;gBAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,EAAE,GAAG;gBAAG,GAAG,EAAE,CAAC,GAA6B,CAAC,QAAQ,GAAG,KAAK,CAAC;SACpF;KACF;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AApDD,kDAoDC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,IAAY;IAClD,MAAM,IAAI,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,4BAA4B,CAAC;IACxC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;QAC1B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,yBAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI;aACb,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC;aACtB,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACvC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAlBD,0DAkBC;AAED,MAAM,aAAa,GAAG;;;;;;;;CAQrB,CAAC;AAEF,kFAAkF;AAClF,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;AACtD,CAAC;AAFD,8CAEC;AAED,8EAA8E;AAC9E,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAC7C,KAAK;KACF,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;KACvB,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KACpB,IAAI,EAAE,CAAC;AAEZ;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,4CAA4C,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CACpF,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,EAAE;QACnD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,SAAS;QAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;KACrF;IACD,MAAM,OAAO,GAAG,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,OAAO,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC;AACxD,CAAC;AAvBD,oDAuBC;AAED,SAAS,OAAO,CAAC,IAAU,EAAE,GAAW,EAAE,MAAgB,EAAE;IAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QAClC,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAClB,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACvF;aAAM,IAAI,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;YACtE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;SACvB;KACF;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID,MAAM,WAAW,GAAG,CAAC,CAAe,EAAU,EAAE,CAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEhG,MAAM,YAAY,GAAG,CAAC,CAAe,EAAU,EAAE,CAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAQvF;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,IAAU,EACV,UAAoB,EACpB,OAAsB,EAAE;IAExB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,SAAS,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACjE,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAyB,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,KAAe,EAAE,UAAmB,EAAY,EAAE;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,IAAI,GACR,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YACpC,CAAC,CAAC,IAAA,mBAAU,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,UAAmB,EAAE,EAAE;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YACxB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,eAAe,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE;gBAC5E,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,IAAI,KAAK,SAAS,EAAE;oBACtB,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,8EAA8E;wBACnF,IAAI,OAAO,2DAA2D,CACzE,CAAC;iBACH;qBAAM,IAAI,IAAI,KAAK,IAAI,EAAE;oBACxB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACvB,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,4EAA4E;wBACjF,oBAAoB,CACvB,CAAC;iBACH;gBACD,SAAS;aACV;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,UAAU,EAAE,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC7F,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBACpB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;aACxF;YACD,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE;gBAC/C,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,wBAAwB,GAAG,oDAAoD;oBACpF,+DAA+D,GAAG,MAAM,CAC3E,CAAC;aACH;SACF;IACH,CAAC,CAAC;IAEF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,IAAA,wBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE;QAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAY,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,0CAAwB,CAAC,CAAC;QAC5F,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,WAAW,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAuB,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EACxB,gBAAgB,UAAU,cAAc,CACzC,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5F,IAAI,IAAI,KAAK,SAAS,EAAE;gBACtB,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,KAAK,IAAI,kDAAkD;oBAChE,KAAK,SAAS,6BAA6B,OAAO,KAAK,CAC1D,CAAC;aACH;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE;gBACxB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,wCAAwC,CAAC,CAAC;aACtE;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAChD;aAAM;YACL,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,SAAS,oBAAoB,CAAC,CAAC;SACzE;QACD,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;KACzB;IACD,IAAI,WAAW,KAAK,CAAC,EAAE;QACrB,KAAK,CAAC,IAAI,CACR,4CAA4C,0CAAwB,oBAAoB;YACtF,0CAA0C,SAAS,oBAAoB,CAC1E,CAAC;KACH;IACD,KAAK,MAAM,CAAC,IAAI,IAAA,wBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AA9FD,0CA8FC"}

package/dist/src/lib/env-encryption/workspace.d.ts

@@ -0,0 +1,10 @@
+import { Tree } from '@nx/devkit';
+import { EnvEncryptionConfig } from './config';
+/** The raw `pstack.envEncryption` block of nx.json (undefined when absent). */
+export declare function readEnvEncryptionBlock(tree: Tree): unknown;
+/** Writes a validated config into nx.json `pstack.envEncryption` (other pstack keys kept). */
+export declare function writeEnvEncryptionBlock(tree: Tree, cfg: EnvEncryptionConfig): void;
+/** The block a workspace gets: defaults, with keys from the legacy file when it exists. */
+export declare function initialEnvEncryption(tree: Tree): EnvEncryptionConfig;
+/** Adds `.env.local` to the root .gitignore (creates it when missing). Returns true when added. */
+export declare function ignoreDotEnvLocal(tree: Tree): boolean;

package/dist/src/lib/env-encryption/workspace.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ignoreDotEnvLocal = exports.initialEnvEncryption = exports.writeEnvEncryptionBlock = exports.readEnvEncryptionBlock = void 0;
+const devkit_1 = require("@nx/devkit");
+const config_1 = require("./config");
+const placeholders_1 = require("./placeholders");
+/** The raw `pstack.envEncryption` block of nx.json (undefined when absent). */
+function readEnvEncryptionBlock(tree) {
+    if (!tree.exists('nx.json'))
+        return undefined;
+    return (0, devkit_1.readJson)(tree, 'nx.json')?.pstack?.envEncryption;
+}
+exports.readEnvEncryptionBlock = readEnvEncryptionBlock;
+/** Writes a validated config into nx.json `pstack.envEncryption` (other pstack keys kept). */
+function writeEnvEncryptionBlock(tree, cfg) {
+    const block = (0, config_1.normalizeEnvEncryption)(cfg);
+    (0, devkit_1.updateJson)(tree, 'nx.json', (json) => {
+        json.pstack = { ...(json.pstack ?? {}), envEncryption: block };
+        return json;
+    });
+}
+exports.writeEnvEncryptionBlock = writeEnvEncryptionBlock;
+/** The block a workspace gets: defaults, with keys from the legacy file when it exists. */
+function initialEnvEncryption(tree) {
+    const cfg = (0, config_1.defaultEnvEncryptionConfig)();
+    if (tree.exists(config_1.LEGACY_KEYS_FILE)) {
+        try {
+            cfg.keys = (0, config_1.keysFromLegacy)((0, devkit_1.readJson)(tree, config_1.LEGACY_KEYS_FILE));
+        }
+        catch {
+            // A malformed legacy file keeps the default keys; the migration reports it.
+        }
+    }
+    return cfg;
+}
+exports.initialEnvEncryption = initialEnvEncryption;
+/** Adds `.env.local` to the root .gitignore (creates it when missing). Returns true when added. */
+function ignoreDotEnvLocal(tree) {
+    const text = tree.exists('.gitignore') ? tree.read('.gitignore', 'utf8') ?? '' : '';
+    const lines = text.split(/\r?\n/).map((l) => l.trim());
+    if (lines.includes(placeholders_1.DOT_ENV_LOCAL) || lines.includes(`/${placeholders_1.DOT_ENV_LOCAL}`))
+        return false;
+    const sep = text === '' || text.endsWith('\n') ? '' : '\n';
+    tree.write('.gitignore', `${text}${sep}${placeholders_1.DOT_ENV_LOCAL}\n`);
+    return true;
+}
+exports.ignoreDotEnvLocal = ignoreDotEnvLocal;
+//# sourceMappingURL=workspace.js.map

package/dist/src/lib/env-encryption/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/workspace.ts"],"names":[],"mappings":";;;AAAA,uCAAwD;AAExD,qCAMkB;AAClB,iDAA+C;AAE/C,+EAA+E;AAC/E,SAAgB,sBAAsB,CAAC,IAAU;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,IAAA,iBAAQ,EAAC,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC;AAC1D,CAAC;AAHD,wDAGC;AAED,8FAA8F;AAC9F,SAAgB,uBAAuB,CAAC,IAAU,EAAE,GAAwB;IAC1E,MAAM,KAAK,GAAG,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;IAC1C,IAAA,mBAAU,EAAC,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAND,0DAMC;AAED,2FAA2F;AAC3F,SAAgB,oBAAoB,CAAC,IAAU;IAC7C,MAAM,GAAG,GAAG,IAAA,mCAA0B,GAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,CAAC,yBAAgB,CAAC,EAAE;QACjC,IAAI;YACF,GAAG,CAAC,IAAI,GAAG,IAAA,uBAAc,EAAC,IAAA,iBAAQ,EAAC,IAAI,EAAE,yBAAgB,CAAC,CAAC,CAAC;SAC7D;QAAC,MAAM;YACN,4EAA4E;SAC7E;KACF;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAVD,oDAUC;AAED,mGAAmG;AACnG,SAAgB,iBAAiB,CAAC,IAAU;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,4BAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,4BAAa,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,GAAG,GAAG,GAAG,4BAAa,IAAI,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAPD,8CAOC"}

package/dist/src/lib/hardening/files.d.ts

@@ -0,0 +1,17 @@
+/** Messages from a post-build check: errors fail the build, warnings are only listed. */
+export interface CheckResult {
+    errors: string[];
+    warnings: string[];
+}
+/**
+ * Folder holding the served index.html: the output folder, else its browser/ subfolder (Angular
+ * application builder), else the output folder itself.
+ */
+export declare function servedRoot(distDir: string): string;
+/**
+ * Files under root whose extension (without the dot, case-insensitive) is in exts. skipDirs are
+ * folders relative to root that are not entered. Absolute paths, sorted.
+ */
+export declare function listFiles(root: string, exts: string[], opts?: {
+    skipDirs?: string[];
+}): string[];

package/dist/src/lib/hardening/files.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listFiles = exports.servedRoot = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+/**
+ * Folder holding the served index.html: the output folder, else its browser/ subfolder (Angular
+ * application builder), else the output folder itself.
+ */
+function servedRoot(distDir) {
+    for (const dir of [distDir, path.join(distDir, 'browser')]) {
+        if (fs.existsSync(path.join(dir, 'index.html')))
+            return dir;
+    }
+    return distDir;
+}
+exports.servedRoot = servedRoot;
+/**
+ * Files under root whose extension (without the dot, case-insensitive) is in exts. skipDirs are
+ * folders relative to root that are not entered. Absolute paths, sorted.
+ */
+function listFiles(root, exts, opts = {}) {
+    const wanted = new Set(exts.map((e) => e.toLowerCase()));
+    const skipped = new Set((opts.skipDirs ?? []).map((d) => path.resolve(root, d)));
+    const found = [];
+    const walk = (dir) => {
+        if (skipped.has(dir) || !fs.existsSync(dir))
+            return;
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (entry.isFile() && wanted.has(path.extname(entry.name).slice(1).toLowerCase())) {
+                found.push(full);
+            }
+        }
+    };
+    walk(path.resolve(root));
+    return found.sort();
+}
+exports.listFiles = listFiles;
+//# sourceMappingURL=files.js.map

package/dist/src/lib/hardening/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../../src/lib/hardening/files.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAQ7B;;;GAGG;AACH,SAAgB,UAAU,CAAC,OAAe;IACxC,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE;QAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;KAC7D;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AALD,gCAKC;AAED;;;GAGG;AACH,SAAgB,SAAS,CACvB,IAAY,EACZ,IAAc,EACd,OAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QACpD,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;YAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC/B,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE;gBACtF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAClB;SACF;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AArBD,8BAqBC"}

package/dist/src/lib/hardening/integrity.d.ts

@@ -0,0 +1,24 @@
+/// <reference types="node" />
+/// <reference types="node" />
+export declare function sha384Integrity(buf: Buffer | string): string;
+/** Integrity of every JS/CSS file under the served root (assets/ skipped), keyed by relative path. */
+export declare function recordHashes(served: string): Map<string, string>;
+export interface SwapResult {
+    /** Hash values replaced in at least one file. */
+    swapped: number;
+    /** Rounds run, the last one finding nothing to do. */
+    rounds: number;
+}
+/**
+ * After strip/obfuscate: every recorded hash of a file that changed is replaced by its new value
+ * inside the JS (the webpack runtime holds the lazy chunks' hashes). A file changed by the swap is
+ * hashed again and swapped in turn, until nothing changes.
+ */
+export declare function swapHashes(served: string, before: Map<string, string>): SwapResult;
+/**
+ * Every sha384 value in a file holding webpack's sriHashes must be the hash of a served file:
+ * a value that matches nothing would make the browser refuse that chunk.
+ */
+export declare function verifyRuntimeHashes(served: string): void;
+/** Whether the build has a webpack runtime with per-chunk SRI hashes. */
+export declare function hasWebpackSriRuntime(served: string): boolean;

package/dist/src/lib/hardening/integrity.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasWebpackSriRuntime = exports.verifyRuntimeHashes = exports.swapHashes = exports.recordHashes = exports.sha384Integrity = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const files_1 = require("./files");
+const SKIP_DIRS = ['assets'];
+/** Rounds of swapping after which hashes that keep changing each other fail the build. */
+const MAX_ROUNDS = 5;
+function sha384Integrity(buf) {
+    return `sha384-${crypto.createHash('sha384').update(buf).digest('base64')}`;
+}
+exports.sha384Integrity = sha384Integrity;
+/** Integrity of every JS/CSS file under the served root (assets/ skipped), keyed by relative path. */
+function recordHashes(served) {
+    const root = path.resolve(served);
+    const hashes = new Map();
+    for (const file of (0, files_1.listFiles)(root, ['js', 'mjs', 'css'], { skipDirs: SKIP_DIRS })) {
+        hashes.set(path.relative(root, file), sha384Integrity(fs.readFileSync(file)));
+    }
+    return hashes;
+}
+exports.recordHashes = recordHashes;
+/**
+ * After strip/obfuscate: every recorded hash of a file that changed is replaced by its new value
+ * inside the JS (the webpack runtime holds the lazy chunks' hashes). A file changed by the swap is
+ * hashed again and swapped in turn, until nothing changes.
+ */
+function swapHashes(served, before) {
+    const root = path.resolve(served);
+    const referenced = new Map(before);
+    const replaced = new Set();
+    let swapped = 0;
+    for (let round = 1;; round++) {
+        const current = recordHashes(root);
+        const changed = [...referenced].filter(([rel, value]) => current.has(rel) && current.get(rel) !== value);
+        if (changed.length === 0) {
+            assertNoOldHashes(root, replaced);
+            verifyRuntimeHashes(root);
+            return { swapped, rounds: round };
+        }
+        if (round > MAX_ROUNDS) {
+            throw new Error(`SRI hashes did not settle after ${MAX_ROUNDS} rounds; files that keep changing: ` +
+                changed.map(([rel]) => rel).join(', '));
+        }
+        const jsFiles = (0, files_1.listFiles)(root, ['js', 'mjs'], { skipDirs: SKIP_DIRS });
+        const texts = new Map(jsFiles.map((f) => [f, fs.readFileSync(f, 'utf8')]));
+        for (const [rel, oldValue] of changed) {
+            const newValue = current.get(rel);
+            let found = false;
+            for (const [file, text] of texts) {
+                if (!text.includes(oldValue))
+                    continue;
+                texts.set(file, text.split(oldValue).join(newValue));
+                found = true;
+            }
+            if (found) {
+                swapped++;
+                replaced.add(oldValue);
+            }
+            referenced.set(rel, newValue);
+        }
+        for (const file of jsFiles) {
+            const text = texts.get(file);
+            if (text !== fs.readFileSync(file, 'utf8'))
+                fs.writeFileSync(file, text);
+        }
+    }
+}
+exports.swapHashes = swapHashes;
+const SHA384_TOKEN = /sha384-[A-Za-z0-9+/]{64}/g;
+/**
+ * Every sha384 value in a file holding webpack's sriHashes must be the hash of a served file:
+ * a value that matches nothing would make the browser refuse that chunk.
+ */
+function verifyRuntimeHashes(served) {
+    const root = path.resolve(served);
+    const current = new Set(recordHashes(root).values());
+    const bad = [];
+    for (const file of (0, files_1.listFiles)(root, ['js', 'mjs'], { skipDirs: SKIP_DIRS })) {
+        const text = fs.readFileSync(file, 'utf8');
+        if (!text.includes('sriHashes'))
+            continue;
+        const stale = (text.match(SHA384_TOKEN) ?? []).filter((t) => !current.has(t));
+        if (stale.length > 0)
+            bad.push(`${path.relative(root, file)} (${stale.length})`);
+    }
+    if (bad.length > 0) {
+        throw new Error(`SRI: chunk hashes that match no output file in ${bad.join(', ')}; the browser would ` +
+            'refuse those chunks');
+    }
+}
+exports.verifyRuntimeHashes = verifyRuntimeHashes;
+function assertNoOldHashes(root, replaced) {
+    if (replaced.size === 0)
+        return;
+    const left = (0, files_1.listFiles)(root, ['js', 'mjs'], { skipDirs: SKIP_DIRS }).filter((file) => {
+        const text = fs.readFileSync(file, 'utf8');
+        return [...replaced].some((v) => text.includes(v));
+    });
+    if (left.length > 0) {
+        throw new Error(`SRI: replaced hashes still present in ${left.map((f) => path.relative(root, f)).join(', ')}`);
+    }
+}
+/** Whether the build has a webpack runtime with per-chunk SRI hashes. */
+function hasWebpackSriRuntime(served) {
+    return (0, files_1.listFiles)(path.resolve(served), ['js', 'mjs'], { skipDirs: SKIP_DIRS }).some((f) => fs.readFileSync(f, 'utf8').includes('sriHashes'));
+}
+exports.hasWebpackSriRuntime = hasWebpackSriRuntime;
+//# sourceMappingURL=integrity.js.map

package/dist/src/lib/hardening/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../../../src/lib/hardening/integrity.ts"],"names":[],"mappings":";;;;AAAA,uDAAiC;AACjC,+CAAyB;AACzB,mDAA6B;AAE7B,mCAAoC;AAEpC,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7B,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,SAAgB,eAAe,CAAC,GAAoB;IAClD,OAAO,UAAU,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC9E,CAAC;AAFD,0CAEC;AAED,sGAAsG;AACtG,SAAgB,YAAY,CAAC,MAAc;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;QACjF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC/E;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAPD,oCAOC;AASD;;;;GAIG;AACH,SAAgB,UAAU,CAAC,MAAc,EAAE,MAA2B;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CACpC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CACjE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAClC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACnC;QACD,IAAI,KAAK,GAAG,UAAU,EAAE;YACtB,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,qCAAqC;gBAChF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzC,CAAC;SACH;QACD,MAAM,OAAO,GAAG,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE;YACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW,CAAC;YAC5C,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE;gBAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACvC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACrD,KAAK,GAAG,IAAI,CAAC;aACd;YACD,IAAI,KAAK,EAAE;gBACT,OAAO,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;aACxB;YACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;SAC/B;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC;YACvC,IAAI,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SAC1E;KACF;AACH,CAAC;AA3CD,gCA2CC;AAED,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAc;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;QAC1E,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;KAClF;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;QAClB,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;YACpF,qBAAqB,CACxB,CAAC;KACH;AACH,CAAC;AAhBD,kDAgBC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAqB;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,GAAG,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACnF,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;QACnB,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9F,CAAC;KACH;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,oBAAoB,CAAC,MAAc;IACjD,OAAO,IAAA,iBAAS,EAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACxF,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CACjD,CAAC;AACJ,CAAC;AAJD,oDAIC"}

package/dist/src/lib/hardening/leak-check.d.ts

@@ -0,0 +1,15 @@
+import { CheckResult } from './files';
+import { CheckMode } from './options';
+/** A plaintext encrypted in this build, with the env key holding it. Never logged or written. */
+export interface Secret {
+    key: string;
+    value: string;
+    /** Declared by a profile under a non-sensitive key: public by the app's own configuration. */
+    public?: boolean;
+}
+/**
+ * Leak check: plaintexts of encrypted values found (as whole tokens, raw or JSON-escaped) in the
+ * output under root. Messages name the file and the key(s), never the value. A value public in
+ * every place it is declared is only a warning; fail → errors, warn → warnings, off → nothing.
+ */
+export declare function checkLeaks(root: string, secrets: Secret[], mode: CheckMode): CheckResult;

package/dist/src/lib/hardening/leak-check.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkLeaks = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const files_1 = require("./files");
+const SCANNED_EXTS = ['js', 'mjs', 'cjs', 'html', 'css', 'json', 'txt', 'map'];
+const SKIPPED_FILES = new Set(['3rdpartylicenses.txt']);
+const MIN_LENGTH = 4;
+const HINT = 'LEAK_CHECK=warn or "leakCheck": "warn" to report only';
+/**
+ * Leak check: plaintexts of encrypted values found (as whole tokens, raw or JSON-escaped) in the
+ * output under root. Messages name the file and the key(s), never the value. A value public in
+ * every place it is declared is only a warning; fail → errors, warn → warnings, off → nothing.
+ */
+function checkLeaks(root, secrets, mode) {
+    const result = { errors: [], warnings: [] };
+    const needles = needlesFor(secrets);
+    if (mode === 'off' || needles.length === 0)
+        return result;
+    const hits = [];
+    for (const file of (0, files_1.listFiles)(root, SCANNED_EXTS)) {
+        if (SKIPPED_FILES.has(path.basename(file)))
+            continue;
+        const text = fs.readFileSync(file, 'utf8');
+        const shown = path.relative(root, file);
+        const html = path.extname(file).toLowerCase() === '.html';
+        const found = (n) => [...n.patterns, ...(html ? n.htmlPatterns : [])].some((p) => p.test(text));
+        for (const n of needles.filter(found)) {
+            const message = `${shown}: plaintext of ${n.keys.join(', ')} (encrypted in the env files)`;
+            if (n.public) {
+                result.warnings.push(`${message}; a profile declares it under a non-sensitive key`);
+            }
+            else {
+                hits.push(message);
+            }
+        }
+    }
+    if (hits.length === 0)
+        return result;
+    const messages = [...hits, `${hits.length} leak(s) of encrypted values in the output; ${HINT}`];
+    if (mode === 'fail')
+        result.errors.push(...messages);
+    else
+        result.warnings.push(...messages);
+    return result;
+}
+exports.checkLeaks = checkLeaks;
+/** One needle per distinct value (4+ characters), with every key holding it. */
+function needlesFor(secrets) {
+    const byValue = new Map();
+    for (const s of secrets) {
+        if (s.value.length < MIN_LENGTH)
+            continue;
+        byValue.set(s.value, [...(byValue.get(s.value) ?? []), s]);
+    }
+    return [...byValue].map(([value, holders]) => ({
+        keys: [...new Set(holders.map((h) => h.key))],
+        public: holders.every((h) => h.public),
+        patterns: patternsFor(textForms(value)),
+        htmlPatterns: patternsFor([htmlEscape(value)].filter((f) => f !== value)),
+    }));
+}
+/**
+ * How a value can appear in built JS/JSON: raw, JSON-escaped and, when it has non-ASCII
+ * characters, \uXXXX-escaped (either hex case) and terser's ascii_only form (\xXX up to 0xff).
+ */
+function textForms(value) {
+    const json = JSON.stringify(value).slice(1, -1);
+    const forms = [value, json];
+    if (/[\u0080-\uffff]/.test(value)) {
+        const hex = (c, width) => c.toString(16).padStart(width, '0');
+        const escapes = [
+            (c) => `\\u${hex(c, 4)}`,
+            (c) => `\\u${hex(c, 4).toUpperCase()}`,
+            (c) => (c <= 0xff ? `\\x${hex(c, 2)}` : `\\u${hex(c, 4)}`),
+        ];
+        for (const escape of escapes) {
+            forms.push(json.replace(/[\u0080-\uffff]/g, (ch) => escape(ch.charCodeAt(0))));
+        }
+    }
+    return forms;
+}
+function htmlEscape(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+function patternsFor(forms) {
+    return [...new Set(forms)].map(wholeToken);
+}
+function wholeToken(text) {
+    const escaped = text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`(?<![\\w$])${escaped}(?![\\w$])`);
+}
+//# sourceMappingURL=leak-check.js.map

package/dist/src/lib/hardening/leak-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leak-check.js","sourceRoot":"","sources":["../../../../src/lib/hardening/leak-check.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,mCAAiD;AAWjD,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC/E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,IAAI,GAAG,uDAAuD,CAAC;AAWrE;;;;GAIG;AACH,SAAgB,UAAU,CAAC,IAAY,EAAE,OAAiB,EAAE,IAAe;IACzE,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAE1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAS,EAAC,IAAI,EAAE,YAAY,CAAC,EAAE;QAChD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACrD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAC1D,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAC1B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACrC,MAAM,OAAO,GAAG,GAAG,KAAK,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,EAAE;gBACZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,mDAAmD,CAAC,CAAC;aACrF;iBAAM;gBACL,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aACpB;SACF;KACF;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAErC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,+CAA+C,IAAI,EAAE,CAAC,CAAC;IAChG,IAAI,IAAI,KAAK,MAAM;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;;QAChD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AA5BD,gCA4BC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,OAAiB;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;QACvB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU;YAAE,SAAS;QAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KAC5D;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,YAAY,EAAE,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;KAC1E,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACjC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG;YACd,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YAChC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE;YAC9C,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChF;KACF;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,IAAI,MAAM,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC;AACvD,CAAC"}

package/dist/src/lib/hardening/ngsw.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Recomputes the Angular service worker's hashTable (sha1 hex) for files under the served root, so
+ * rewritten files (strip, obfuscate, SRI, meta, nonce) are not rejected. Keys are URLs below the
+ * directory of the manifest's index URL; entries without a file are left alone. Returns the number
+ * of entries updated; ngsw.json is only written when one changed.
+ */
+export declare function refreshNgswHashes(served: string): number;

package/dist/src/lib/hardening/ngsw.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshNgswHashes = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+/**
+ * Recomputes the Angular service worker's hashTable (sha1 hex) for files under the served root, so
+ * rewritten files (strip, obfuscate, SRI, meta, nonce) are not rejected. Keys are URLs below the
+ * directory of the manifest's index URL; entries without a file are left alone. Returns the number
+ * of entries updated; ngsw.json is only written when one changed.
+ */
+function refreshNgswHashes(served) {
+    const root = path.resolve(served);
+    const file = path.join(root, 'ngsw.json');
+    if (!fs.existsSync(file))
+        return 0;
+    const text = fs.readFileSync(file, 'utf8');
+    const manifest = JSON.parse(text);
+    const table = manifest.hashTable;
+    if (!table)
+        return 0;
+    const index = manifest.index ?? '/index.html';
+    const base = index.slice(0, index.lastIndexOf('/') + 1) || '/';
+    let updated = 0;
+    for (const url of Object.keys(table)) {
+        if (!url.startsWith(base))
+            continue;
+        let rel;
+        try {
+            rel = decodeURIComponent(url.slice(base.length).split(/[?#]/)[0]);
+        }
+        catch {
+            continue;
+        }
+        const target = path.resolve(root, rel);
+        if (!target.startsWith(root + path.sep) || !fs.existsSync(target))
+            continue;
+        if (!fs.statSync(target).isFile())
+            continue;
+        const hash = crypto.createHash('sha1').update(fs.readFileSync(target)).digest('hex');
+        if (table[url] !== hash) {
+            table[url] = hash;
+            updated++;
+        }
+    }
+    if (updated > 0) {
+        const trailing = text.endsWith('\n') ? '\n' : '';
+        fs.writeFileSync(file, JSON.stringify(manifest, null, 2) + trailing);
+    }
+    return updated;
+}
+exports.refreshNgswHashes = refreshNgswHashes;
+//# sourceMappingURL=ngsw.js.map

package/dist/src/lib/hardening/ngsw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ngsw.js","sourceRoot":"","sources":["../../../../src/lib/hardening/ngsw.ts"],"names":[],"mappings":";;;;AAAA,uDAAiC;AACjC,+CAAyB;AACzB,mDAA6B;AAO7B;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IAErB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IAC/D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACpC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,IAAI,GAAW,CAAC;QAChB,IAAI;YACF,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnE;QAAC,MAAM;YACN,SAAS;SACV;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5E,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACvB,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,OAAO,EAAE,CAAC;SACX;KACF;IACD,IAAI,OAAO,GAAG,CAAC,EAAE;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;KACtE;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAlCD,8CAkCC"}

package/dist/src/lib/hardening/obfuscate.d.ts

@@ -0,0 +1,36 @@
+import { ObfuscateMode } from './options';
+/** The part of javascript-obfuscator's API this step uses. */
+export interface Obfuscator {
+    obfuscate(code: string, options: object): {
+        getObfuscatedCode(): string;
+    };
+}
+export interface ObfuscateOptions {
+    /** Workspace root: javascript-obfuscator is loaded from its node_modules. */
+    repoRoot: string;
+    mode: ObfuscateMode;
+    /** Overrides on top of the preset (validated by checkObfuscateOptions). */
+    overrides?: Record<string, unknown>;
+    /** Test seam; loaded from the workspace when absent. */
+    obfuscator?: Obfuscator;
+}
+export interface ObfuscateResult {
+    files: number;
+    bytesBefore: number;
+    bytesAfter: number;
+}
+/** A string only the env-secret runtime holds (the aes-gcm HKDF info prefix). */
+export declare const DECRYPT_MARKER = "pstack-env-v2|";
+export declare function isSkippedChunk(fileName: string): boolean;
+/**
+ * javascript-obfuscator options for one file: the preset, the app's overrides, then the fixed
+ * CSP-safe settings. strong adds rc4 and control-flow flattening to the chunk holding the decrypt
+ * code (before the overrides, so they can still tune it).
+ */
+export declare function obfuscatorOptions(mode: Exclude<ObfuscateMode, 'off'>, kind: 'base' | 'decrypt', module: boolean, overrides?: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Obfuscates main and the lazy chunks under the served root (assets/ and the skipped chunks
+ * untouched). The obfuscator is only loaded when there is a file to process.
+ */
+export declare function obfuscateOutput(served: string, o: ObfuscateOptions): Promise<ObfuscateResult>;
+export declare function loadObfuscator(repoRoot: string): Obfuscator;