@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/lib/hardening/obfuscate.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadObfuscator = exports.obfuscateOutput = exports.obfuscatorOptions = exports.isSkippedChunk = exports.DECRYPT_MARKER = void 0;
+const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const files_1 = require("./files");
+const strip_1 = require("./strip");
+/** A string only the env-secret runtime holds (the aes-gcm HKDF info prefix). */
+exports.DECRYPT_MARKER = 'pstack-env-v2|';
+const SKIP_DIRS = ['assets'];
+/**
+ * Chunks left alone: webpack `name.js` / `name.<hash>.js`, esbuild `name-<HASH>.js`. Vendor code
+ * and the webpack runtime gain nothing from obfuscation and the runtime holds the SRI hashes.
+ */
+const SKIPPED_CHUNK = /^(?:runtime|polyfills|vendor|scripts|styles)(?:\.[a-z0-9]+|-[A-Z0-9]+)?\.m?js$/;
+function isSkippedChunk(fileName) {
+    return SKIPPED_CHUNK.test(fileName);
+}
+exports.isSkippedChunk = isSkippedChunk;
+/** Options every preset shares; never overridable (CSP-safe, chunks keep finding each other). */
+const FIXED = {
+    compact: true,
+    renameGlobals: false,
+    renameProperties: false,
+    selfDefending: false,
+    debugProtection: false,
+    disableConsoleOutput: false,
+    sourceMap: false,
+    target: 'browser-no-eval',
+};
+/**
+ * Presets, measured on a 2.8 MB Angular chunk (gzip growth): light ≈ +20% (short names, half the
+ * strings in a rotated, shuffled array, no wrappers), medium ≈ +67% (hexadecimal names, three
+ * quarters of the strings, wrappers), strong = medium plus, for the chunk holding the decrypt
+ * code, rc4 string encoding and light control-flow flattening (≈ +210% on that chunk).
+ */
+const PRESETS = {
+    light: {
+        stringArray: true,
+        stringArrayThreshold: 0.5,
+        stringArrayRotate: true,
+        stringArrayShuffle: true,
+        stringArrayEncoding: [],
+        stringArrayWrappersCount: 0,
+        identifierNamesGenerator: 'mangled',
+        transformObjectKeys: false,
+        controlFlowFlattening: false,
+        deadCodeInjection: false,
+        unicodeEscapeSequence: false,
+    },
+    medium: {
+        stringArray: true,
+        stringArrayThreshold: 0.75,
+        stringArrayRotate: true,
+        stringArrayShuffle: true,
+        stringArrayEncoding: [],
+        identifierNamesGenerator: 'hexadecimal',
+        transformObjectKeys: false,
+        controlFlowFlattening: false,
+        deadCodeInjection: false,
+        unicodeEscapeSequence: false,
+    },
+};
+const STRONG_DECRYPT = {
+    stringArrayEncoding: ['rc4'],
+    controlFlowFlattening: true,
+    controlFlowFlatteningThreshold: 0.1,
+};
+/**
+ * javascript-obfuscator options for one file: the preset, the app's overrides, then the fixed
+ * CSP-safe settings. strong adds rc4 and control-flow flattening to the chunk holding the decrypt
+ * code (before the overrides, so they can still tune it).
+ */
+function obfuscatorOptions(mode, kind, module, overrides = {}) {
+    return {
+        ...PRESETS[mode === 'strong' ? 'medium' : mode],
+        ...(mode === 'strong' && kind === 'decrypt' ? STRONG_DECRYPT : {}),
+        ...overrides,
+        ...FIXED,
+        sourceType: module ? 'module' : 'script',
+    };
+}
+exports.obfuscatorOptions = obfuscatorOptions;
+/**
+ * Obfuscates main and the lazy chunks under the served root (assets/ and the skipped chunks
+ * untouched). The obfuscator is only loaded when there is a file to process.
+ */
+async function obfuscateOutput(served, o) {
+    const result = { files: 0, bytesBefore: 0, bytesAfter: 0 };
+    if (o.mode === 'off')
+        return result;
+    const root = path.resolve(served);
+    const files = (0, files_1.listFiles)(root, ['js', 'mjs'], { skipDirs: SKIP_DIRS }).filter((f) => !isSkippedChunk(path.basename(f)));
+    if (files.length === 0)
+        return result;
+    const obfuscator = o.obfuscator ?? loadObfuscator(o.repoRoot);
+    for (const file of files) {
+        const code = fs.readFileSync(file, 'utf8');
+        const out = obfuscateFile(obfuscator, code, file, root, o.mode, o.overrides ?? {});
+        result.bytesBefore += Buffer.byteLength(code);
+        result.bytesAfter += Buffer.byteLength(out);
+        if (out !== code) {
+            fs.writeFileSync(file, out);
+            result.files++;
+        }
+    }
+    return result;
+}
+exports.obfuscateOutput = obfuscateOutput;
+/** A file guessed to be an ES module that does not parse as one is tried once more as a script. */
+function obfuscateFile(obfuscator, code, file, root, mode, overrides) {
+    const kind = code.includes(exports.DECRYPT_MARKER) ? 'decrypt' : 'base';
+    const module = (0, strip_1.isModuleCode)(file, code, root);
+    // Classic-script chunks share window: a per-file prefix keeps their string-array helpers apart;
+    // a seed from the content makes the output reproducible.
+    const digest = (0, crypto_1.createHash)('sha1')
+        .update(path.relative(root, file))
+        .update('\0')
+        .update(code)
+        .digest('hex');
+    const perFile = {
+        identifiersPrefix: `_p${digest.slice(0, 6)}`,
+        seed: parseInt(digest.slice(6, 14), 16),
+    };
+    const attempts = module ? [true, false] : [false];
+    let firstError;
+    for (const asModule of attempts) {
+        try {
+            return obfuscator
+                .obfuscate(code, { ...obfuscatorOptions(mode, kind, asModule, overrides), ...perFile })
+                .getObfuscatedCode();
+        }
+        catch (err) {
+            firstError ??= err;
+        }
+    }
+    throw new Error(`obfuscate: ${path.relative(root, file)}: ${firstError?.message}`);
+}
+function loadObfuscator(repoRoot) {
+    let resolved;
+    try {
+        resolved = require.resolve('javascript-obfuscator', { paths: [repoRoot] });
+    }
+    catch {
+        throw new Error('obfuscate: add javascript-obfuscator to devDependencies (npm i -D javascript-obfuscator@4)');
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(resolved);
+}
+exports.loadObfuscator = loadObfuscator;
+//# sourceMappingURL=obfuscate.js.map

package/dist/src/lib/hardening/obfuscate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obfuscate.js","sourceRoot":"","sources":["../../../../src/lib/hardening/obfuscate.ts"],"names":[],"mappings":";;;;AAAA,mCAAoC;AACpC,+CAAyB;AACzB,mDAA6B;AAE7B,mCAAoC;AAEpC,mCAAuC;AAuBvC,iFAAiF;AACpE,QAAA,cAAc,GAAG,gBAAgB,CAAC;AAE/C,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7B;;;GAGG;AACH,MAAM,aAAa,GACjB,gFAAgF,CAAC;AAEnF,SAAgB,cAAc,CAAC,QAAgB;IAC7C,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAFD,wCAEC;AAED,iGAAiG;AACjG,MAAM,KAAK,GAA4B;IACrC,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,KAAK;IACpB,gBAAgB,EAAE,KAAK;IACvB,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,KAAK;IAC3B,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,GAAwD;IACnE,KAAK,EAAE;QACL,WAAW,EAAE,IAAI;QACjB,oBAAoB,EAAE,GAAG;QACzB,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,mBAAmB,EAAE,EAAE;QACvB,wBAAwB,EAAE,CAAC;QAC3B,wBAAwB,EAAE,SAAS;QACnC,mBAAmB,EAAE,KAAK;QAC1B,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,KAAK;QACxB,qBAAqB,EAAE,KAAK;KAC7B;IACD,MAAM,EAAE;QACN,WAAW,EAAE,IAAI;QACjB,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,mBAAmB,EAAE,EAAE;QACvB,wBAAwB,EAAE,aAAa;QACvC,mBAAmB,EAAE,KAAK;QAC1B,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,KAAK;QACxB,qBAAqB,EAAE,KAAK;KAC7B;CACF,CAAC;AACF,MAAM,cAAc,GAAG;IACrB,mBAAmB,EAAE,CAAC,KAAK,CAAC;IAC5B,qBAAqB,EAAE,IAAI;IAC3B,8BAA8B,EAAE,GAAG;CACpC,CAAC;AAEF;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,IAAmC,EACnC,IAAwB,EACxB,MAAe,EACf,YAAqC,EAAE;IAEvC,OAAO;QACL,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,SAAS;QACZ,GAAG,KAAK;QACR,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACzC,CAAC;AACJ,CAAC;AAbD,8CAaC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,CAAmB;IAEnB,MAAM,MAAM,GAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEtC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;QACxB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,IAAI,EAAE;YAChB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;SAChB;KACF;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAzBD,0CAyBC;AAED,mGAAmG;AACnG,SAAS,aAAa,CACpB,UAAsB,EACtB,IAAY,EACZ,IAAY,EACZ,IAAY,EACZ,IAAmC,EACnC,SAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,MAAM,GAAG,IAAA,oBAAY,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,gGAAgG;IAChG,yDAAyD;IACzD,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,MAAM,CAAC;SAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACjC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,OAAO,GAAG;QACd,iBAAiB,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QAC5C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,UAA6B,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE;QAC/B,IAAI;YACF,OAAO,UAAU;iBACd,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;iBACtF,iBAAiB,EAAE,CAAC;SACxB;QAAC,OAAO,GAAG,EAAE;YACZ,UAAU,KAAK,GAAY,CAAC;SAC7B;KACF;IACD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,SAAgB,cAAc,CAAC,QAAgB;IAC7C,IAAI,QAAgB,CAAC;IACrB,IAAI;QACF,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;KAC5E;IAAC,MAAM;QACN,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;KACH;IACD,8DAA8D;IAC9D,OAAO,OAAO,CAAC,QAAQ,CAAe,CAAC;AACzC,CAAC;AAXD,wCAWC"}

package/dist/src/lib/hardening/options.d.ts

@@ -0,0 +1,36 @@
+export type CheckMode = 'fail' | 'warn' | 'off';
+export declare const CHECK_MODES: readonly CheckMode[];
+export type ObfuscateMode = 'off' | 'light' | 'medium' | 'strong';
+export declare const OBFUSCATE_MODES: readonly ObfuscateMode[];
+export declare const OBFUSCATE_OVERRIDES: Readonly<Record<string, [(v: unknown) => boolean, string]>>;
+export declare const CONSOLE_METHODS: readonly ["log", "debug", "warn", "info", "error", "trace"];
+export declare const DEFAULT_DROP_CONSOLE: string[];
+/** Release-target options that drive the post-build hardening steps. */
+export interface HardeningOptions {
+    leakCheck?: CheckMode;
+    sourceMaps?: CheckMode;
+    stripComments?: boolean;
+    dropConsole?: string[];
+    /** Obfuscate the app's own JS (main and lazy chunks). */
+    obfuscate?: ObfuscateMode;
+    /** javascript-obfuscator overrides on top of the preset (OBFUSCATE_OVERRIDES keys only). */
+    obfuscateOptions?: Record<string, unknown>;
+    /** Deprecated: read as stripComments + the default dropConsole when those are unset. */
+    harden?: boolean;
+}
+export interface ResolvedHardening {
+    leakCheck: CheckMode;
+    sourceMaps: CheckMode;
+    stripComments: boolean;
+    dropConsole: string[];
+    obfuscate: ObfuscateMode;
+    obfuscateOptions: Record<string, unknown>;
+    warnings: string[];
+}
+/**
+ * Effective hardening settings for one build. DEV turns every step off; absent options are off;
+ * the LEAK_CHECK environment variable overrides leakCheck for one run.
+ */
+export declare function resolveHardening(o: HardeningOptions, env: string, vars?: Record<string, string | undefined>): ResolvedHardening;
+/** Throws on a key outside OBFUSCATE_OVERRIDES or a value of the wrong kind. */
+export declare function checkObfuscateOptions(value: unknown): Record<string, unknown>;

package/dist/src/lib/hardening/options.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkObfuscateOptions = exports.resolveHardening = exports.DEFAULT_DROP_CONSOLE = exports.CONSOLE_METHODS = exports.OBFUSCATE_OVERRIDES = exports.OBFUSCATE_MODES = exports.CHECK_MODES = void 0;
+exports.CHECK_MODES = ['fail', 'warn', 'off'];
+exports.OBFUSCATE_MODES = ['off', 'light', 'medium', 'strong'];
+/**
+ * javascript-obfuscator options an app may override on top of its preset, with their checks.
+ * Anything that needs eval/Function, locks domains, renames globals or properties, or changes the
+ * output target is not in the list.
+ */
+const unit = (v) => typeof v === 'number' && v >= 0 && v <= 1;
+const bool = (v) => typeof v === 'boolean';
+const count = (v) => Number.isInteger(v) && v >= 0 && v <= 10;
+const strings = (v) => Array.isArray(v) && v.every((s) => typeof s === 'string');
+exports.OBFUSCATE_OVERRIDES = {
+    stringArray: [bool, 'true or false'],
+    stringArrayThreshold: [unit, 'a number from 0 to 1'],
+    stringArrayRotate: [bool, 'true or false'],
+    stringArrayShuffle: [bool, 'true or false'],
+    stringArrayEncoding: [
+        (v) => Array.isArray(v) && v.every((e) => ['none', 'base64', 'rc4'].includes(e)),
+        'a list of none, base64, rc4',
+    ],
+    stringArrayIndexShift: [bool, 'true or false'],
+    stringArrayWrappersCount: [count, 'a whole number from 0 to 10'],
+    stringArrayWrappersType: [(v) => v === 'variable' || v === 'function', 'variable or function'],
+    stringArrayWrappersChainedCalls: [bool, 'true or false'],
+    identifierNamesGenerator: [
+        (v) => ['hexadecimal', 'mangled', 'mangled-shuffled'].includes(v),
+        'hexadecimal, mangled or mangled-shuffled',
+    ],
+    controlFlowFlattening: [bool, 'true or false'],
+    controlFlowFlatteningThreshold: [unit, 'a number from 0 to 1'],
+    deadCodeInjection: [bool, 'true or false'],
+    deadCodeInjectionThreshold: [unit, 'a number from 0 to 1'],
+    numbersToExpressions: [bool, 'true or false'],
+    simplify: [bool, 'true or false'],
+    splitStrings: [bool, 'true or false'],
+    splitStringsChunkLength: [(v) => Number.isInteger(v) && v >= 1, 'a whole number ≥ 1'],
+    transformObjectKeys: [bool, 'true or false'],
+    unicodeEscapeSequence: [bool, 'true or false'],
+    reservedNames: [strings, 'a list of strings (regular expressions)'],
+    reservedStrings: [strings, 'a list of strings (regular expressions)'],
+};
+exports.CONSOLE_METHODS = ['log', 'debug', 'warn', 'info', 'error', 'trace'];
+exports.DEFAULT_DROP_CONSOLE = ['log', 'debug', 'warn'];
+const HARDEN_WARNING = 'harden is replaced by stripComments and dropConsole (and leakCheck, sourceMaps); set those instead';
+/**
+ * Effective hardening settings for one build. DEV turns every step off; absent options are off;
+ * the LEAK_CHECK environment variable overrides leakCheck for one run.
+ */
+function resolveHardening(o, env, vars = process.env) {
+    if (env === 'DEV') {
+        return {
+            leakCheck: 'off',
+            sourceMaps: 'off',
+            stripComments: false,
+            dropConsole: [],
+            obfuscate: 'off',
+            obfuscateOptions: {},
+            warnings: [],
+        };
+    }
+    const warnings = [];
+    let stripComments = o.stripComments;
+    let dropConsole = o.dropConsole;
+    if (o.harden) {
+        warnings.push(HARDEN_WARNING);
+        stripComments ??= true;
+        dropConsole ??= exports.DEFAULT_DROP_CONSOLE;
+    }
+    return {
+        leakCheck: leakCheckOverride(vars.LEAK_CHECK) ?? checkMode('leakCheck', o.leakCheck),
+        sourceMaps: checkMode('sourceMaps', o.sourceMaps),
+        stripComments: stripComments ?? false,
+        dropConsole: consoleMethods(dropConsole ?? []),
+        obfuscate: obfuscateMode(o.obfuscate),
+        obfuscateOptions: checkObfuscateOptions(o.obfuscateOptions),
+        warnings,
+    };
+}
+exports.resolveHardening = resolveHardening;
+function checkMode(option, value) {
+    if (value === undefined)
+        return 'off';
+    if (!isCheckMode(value)) {
+        throw new Error(`${option} must be one of ${exports.CHECK_MODES.join(', ')} (got "${value}")`);
+    }
+    return value;
+}
+function obfuscateMode(value) {
+    if (value === undefined)
+        return 'off';
+    if (!exports.OBFUSCATE_MODES.includes(value)) {
+        throw new Error(`obfuscate must be one of ${exports.OBFUSCATE_MODES.join(', ')} (got "${value}")`);
+    }
+    return value;
+}
+/** Throws on a key outside OBFUSCATE_OVERRIDES or a value of the wrong kind. */
+function checkObfuscateOptions(value) {
+    if (value === undefined)
+        return {};
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('obfuscateOptions must be an object of javascript-obfuscator options');
+    }
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+        const rule = exports.OBFUSCATE_OVERRIDES[key];
+        if (!rule) {
+            throw new Error(`obfuscateOptions.${key} cannot be set (allowed: ${Object.keys(exports.OBFUSCATE_OVERRIDES).join(', ')})`);
+        }
+        if (!rule[0](v))
+            throw new Error(`obfuscateOptions.${key} must be ${rule[1]}`);
+        out[key] = v;
+    }
+    return out;
+}
+exports.checkObfuscateOptions = checkObfuscateOptions;
+function leakCheckOverride(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const value = raw.trim().toLowerCase();
+    if (!isCheckMode(value)) {
+        throw new Error(`LEAK_CHECK must be one of ${exports.CHECK_MODES.join(', ')}`);
+    }
+    return value;
+}
+function consoleMethods(methods) {
+    if (!Array.isArray(methods)) {
+        throw new Error(`dropConsole must be a list of console methods (e.g. ["log", "debug", "warn"])`);
+    }
+    const allowed = exports.CONSOLE_METHODS;
+    const unknown = methods.filter((m) => !allowed.includes(m));
+    if (unknown.length) {
+        const list = allowed.join(', ');
+        throw new Error(`dropConsole: unknown console method(s) ${unknown.join(', ')}; allowed: ${list}`);
+    }
+    return [...new Set(methods)];
+}
+function isCheckMode(value) {
+    return exports.CHECK_MODES.includes(value);
+}
+//# sourceMappingURL=options.js.map

package/dist/src/lib/hardening/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../../src/lib/hardening/options.ts"],"names":[],"mappings":";;;AAEa,QAAA,WAAW,GAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAI5D,QAAA,eAAe,GAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;AACpD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAK,CAAY,IAAI,CAAC,IAAK,CAAY,IAAI,EAAE,CAAC;AAC/F,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC7E,QAAA,mBAAmB,GAAgE;IAC9F,WAAW,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IACpC,oBAAoB,EAAE,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACpD,iBAAiB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC1C,kBAAkB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC3C,mBAAmB,EAAE;QACnB,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAW,CAAC,CAAC;QAC1F,6BAA6B;KAC9B;IACD,qBAAqB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC9C,wBAAwB,EAAE,CAAC,KAAK,EAAE,6BAA6B,CAAC;IAChE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU,EAAE,sBAAsB,CAAC;IAC9F,+BAA+B,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IACxD,wBAAwB,EAAE;QACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAW,CAAC;QAC3E,0CAA0C;KAC3C;IACD,qBAAqB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC9C,8BAA8B,EAAE,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAC9D,iBAAiB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC1C,0BAA0B,EAAE,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAC1D,oBAAoB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC7C,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IACrC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAK,CAAY,IAAI,CAAC,EAAE,oBAAoB,CAAC;IACjG,mBAAmB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC5C,qBAAqB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;IAC9C,aAAa,EAAE,CAAC,OAAO,EAAE,yCAAyC,CAAC;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,yCAAyC,CAAC;CACtE,CAAC;AACW,QAAA,eAAe,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAC9E,QAAA,oBAAoB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAE7D,MAAM,cAAc,GAClB,oGAAoG,CAAC;AA0BvG;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,CAAmB,EACnB,GAAW,EACX,OAA2C,OAAO,CAAC,GAAG;IAEtD,IAAI,GAAG,KAAK,KAAK,EAAE;QACjB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,KAAK;YAChB,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,EAAE;SACb,CAAC;KACH;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;IACpC,IAAI,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,EAAE;QACZ,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9B,aAAa,KAAK,IAAI,CAAC;QACvB,WAAW,KAAK,4BAAoB,CAAC;KACtC;IAED,OAAO;QACL,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;QACpF,UAAU,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;QACjD,aAAa,EAAE,aAAa,IAAI,KAAK;QACrC,WAAW,EAAE,cAAc,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACrC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC3D,QAAQ;KACT,CAAC;AACJ,CAAC;AAnCD,4CAmCC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,KAAyB;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,mBAAmB,mBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;KACxF;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAE,uBAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC3D,MAAM,IAAI,KAAK,CAAC,4BAA4B,uBAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;KAC5F;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,SAAgB,qBAAqB,CAAC,KAAc;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACvE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;KACxF;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC5C,MAAM,IAAI,GAAG,2BAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE;YACT,MAAM,IAAI,KAAK,CACb,oBAAoB,GAAG,4BAA4B,MAAM,CAAC,IAAI,CAAC,2BAAmB,CAAC,CAAC,IAAI,CACtF,IAAI,CACL,GAAG,CACL,CAAC;SACH;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KACd;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAnBD,sDAmBC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KACxE;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,OAAiB;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;KACH;IACD,MAAM,OAAO,GAAsB,uBAAe,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,EAAE;QAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CACjF,CAAC;KACH;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAQ,mBAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC"}

package/dist/src/lib/hardening/source-maps.d.ts

@@ -0,0 +1,7 @@
+import { CheckResult } from './files';
+import { CheckMode } from './options';
+/**
+ * Source-map guard: *.map files and sourceMappingURL comments (js, mjs, css) under root. One
+ * message per file (relative path) plus a hint; fail → errors, warn → warnings, off → nothing.
+ */
+export declare function checkSourceMaps(root: string, mode: CheckMode): CheckResult;

package/dist/src/lib/hardening/source-maps.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSourceMaps = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const files_1 = require("./files");
+/** A `//# sourceMappingURL=` or `/*# sourceMappingURL=` comment at the start of a line. */
+const SOURCE_MAP_COMMENT = /^[ \t]*(?:\/\/|\/\*)[#@][ \t]*sourceMappingURL=/m;
+/**
+ * Source-map guard: *.map files and sourceMappingURL comments (js, mjs, css) under root. One
+ * message per file (relative path) plus a hint; fail → errors, warn → warnings, off → nothing.
+ */
+function checkSourceMaps(root, mode) {
+    const result = { errors: [], warnings: [] };
+    if (mode === 'off')
+        return result;
+    const hits = [
+        ...(0, files_1.listFiles)(root, ['map']).map((f) => `source map file: ${path.relative(root, f)}`),
+        ...(0, files_1.listFiles)(root, ['js', 'mjs', 'css'])
+            .filter((f) => SOURCE_MAP_COMMENT.test(fs.readFileSync(f, 'utf8')))
+            .map((f) => `sourceMappingURL comment: ${path.relative(root, f)}`),
+    ];
+    if (!hits.length)
+        return result;
+    const messages = [
+        ...hits,
+        `${hits.length} source map reference(s) in the output; set "sourceMap": false in the Angular build configuration`,
+    ];
+    if (mode === 'fail')
+        result.errors.push(...messages);
+    else
+        result.warnings.push(...messages);
+    return result;
+}
+exports.checkSourceMaps = checkSourceMaps;
+//# sourceMappingURL=source-maps.js.map

package/dist/src/lib/hardening/source-maps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-maps.js","sourceRoot":"","sources":["../../../../src/lib/hardening/source-maps.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,mCAAiD;AAGjD,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,kDAAkD,CAAC;AAE9E;;;GAGG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,IAAe;IAC3D,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,IAAI,GAAG;QACX,GAAG,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;aAClE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEhC,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI;QACP,GAAG,IAAI,CAAC,MAAM,mGAAmG;KAClH,CAAC;IACF,IAAI,IAAI,KAAK,MAAM;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;;QAChD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAnBD,0CAmBC"}

package/dist/src/lib/hardening/strip.d.ts

@@ -0,0 +1,55 @@
+export interface StripOptions {
+    stripComments: boolean;
+    /** Console methods whose calls are removed (e.g. log, debug, warn). */
+    dropConsole: string[];
+    /** Workspace root: terser is loaded from its node_modules. */
+    repoRoot: string;
+}
+/** Files changed per kind, and notes on what was left alone. */
+export interface StripResult {
+    js: number;
+    css: number;
+    html: number;
+    notes: string[];
+}
+export interface Terser {
+    minify(code: string, options: object): Promise<{
+        code?: string;
+    }>;
+}
+/** The terser options pass uses (a subset of terser's MinifyOptions). */
+export interface MinifyOptions {
+    compress: false | {
+        defaults: boolean;
+        pure_funcs: string[];
+        side_effects: boolean;
+    };
+    mangle: false;
+    format: {
+        comments: false | 'some';
+        ascii_only: boolean;
+    };
+    module: boolean;
+}
+/**
+ * Strips comments from the JS, CSS and served-root HTML under root and removes the listed console
+ * calls from the JS (one terser pass per file). assets/ is never touched; files are rewritten only
+ * when they change.
+ */
+export declare function stripOutput(served: string, o: StripOptions): Promise<StripResult>;
+/** Removes `/* … *\/` blocks (license ones too) outside quoted strings and unquoted url(…). */
+export declare function stripCssComments(css: string): string;
+export declare function stripHtmlComments(html: string): string;
+/**
+ * One terser pass over a file. A file guessed to be an ES module that terser cannot parse as one
+ * is tried once more as a script; when neither parses, the error names the file.
+ */
+export declare function minifyFile(terser: Terser, code: string, file: string, root: string, o: StripOptions): Promise<string>;
+/**
+ * terser options for one file: only the listed console calls are removed (no other compression),
+ * no mangling, ASCII-only output. ES modules: .mjs, files with top-level import/export, and
+ * everything the application builder writes (served from browser/).
+ */
+export declare function minifyOptions(file: string, code: string, root: string, o: StripOptions): MinifyOptions;
+/** .mjs, files with top-level import/export, and everything served from browser/ (application builder). */
+export declare function isModuleCode(file: string, code: string, root: string): boolean;

package/dist/src/lib/hardening/strip.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isModuleCode = exports.minifyOptions = exports.minifyFile = exports.stripHtmlComments = exports.stripCssComments = exports.stripOutput = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const files_1 = require("./files");
+const SKIP_DIRS = ['assets'];
+/** Plain comments; SSI (`<!--#…`) and IE conditionals (`<!--[if …`, `<!--<![endif]`) stay. */
+const HTML_COMMENT = /<!--(?!#|\[if|<!\[endif)[\s\S]*?-->/g;
+/** A tag with Angular's hydration attribute `ngh`. */
+const NGH_ATTRIBUTE = /<[^>]*\sngh(?:\s*=|[\s/>])/;
+const TOP_LEVEL_MODULE_SYNTAX = /^\s*(import|export)\b/m;
+const HYDRATION_NOTE = 'html comments kept (SSR hydration needs them)';
+/**
+ * Strips comments from the JS, CSS and served-root HTML under root and removes the listed console
+ * calls from the JS (one terser pass per file). assets/ is never touched; files are rewritten only
+ * when they change.
+ */
+async function stripOutput(served, o) {
+    const root = path.resolve(served);
+    const counts = { js: 0, css: 0, html: 0, notes: [] };
+    if (!o.stripComments && o.dropConsole.length === 0)
+        return counts;
+    const jsFiles = (0, files_1.listFiles)(root, ['js', 'mjs'], { skipDirs: SKIP_DIRS });
+    // terser is only loaded (and only has to be installed) when there is JS to process.
+    if (jsFiles.length > 0) {
+        const terser = loadTerser(o.repoRoot);
+        for (const file of jsFiles) {
+            const code = fs.readFileSync(file, 'utf8');
+            const out = await minifyFile(terser, code, file, root, o);
+            if (rewrite(file, code, out))
+                counts.js++;
+        }
+    }
+    if (!o.stripComments)
+        return counts;
+    for (const file of (0, files_1.listFiles)(root, ['css'], { skipDirs: SKIP_DIRS })) {
+        const css = fs.readFileSync(file, 'utf8');
+        if (rewrite(file, css, stripCssComments(css)))
+            counts.css++;
+    }
+    if (fs.existsSync(path.join(root, 'index.csr.html'))) {
+        counts.notes.push(`index.csr.html found: ${HYDRATION_NOTE}`);
+        return counts;
+    }
+    for (const file of (0, files_1.listFiles)(root, ['html']).filter((f) => path.dirname(f) === root)) {
+        const html = fs.readFileSync(file, 'utf8');
+        if (NGH_ATTRIBUTE.test(html)) {
+            counts.notes.push(`${path.basename(file)} has ngh attributes: ${HYDRATION_NOTE}`);
+        }
+        else if (rewrite(file, html, stripHtmlComments(html))) {
+            counts.html++;
+        }
+    }
+    return counts;
+}
+exports.stripOutput = stripOutput;
+/** Removes `/* … *\/` blocks (license ones too) outside quoted strings and unquoted url(…). */
+function stripCssComments(css) {
+    let out = '';
+    let i = 0;
+    while (i < css.length) {
+        const c = css[i];
+        const url = unquotedUrlEnd(css, i);
+        if (url > i) {
+            out += css.slice(i, url);
+            i = url;
+        }
+        else if (c === '"' || c === "'") {
+            const end = stringEnd(css, i);
+            out += css.slice(i, end);
+            i = end;
+        }
+        else if (c === '/' && css[i + 1] === '*') {
+            const close = css.indexOf('*/', i + 2);
+            i = close < 0 ? css.length : close + 2;
+        }
+        else {
+            out += c;
+            i++;
+        }
+    }
+    return out;
+}
+exports.stripCssComments = stripCssComments;
+function stripHtmlComments(html) {
+    return html.replace(HTML_COMMENT, '');
+}
+exports.stripHtmlComments = stripHtmlComments;
+/**
+ * Index just past an unquoted `url(…)` starting at `start` (its content may hold `/*`, e.g. a raw
+ * SVG data URI); `start` when there is none there. A quoted url is left to the string handling.
+ */
+function unquotedUrlEnd(css, start) {
+    if (css.slice(start, start + 4).toLowerCase() !== 'url(')
+        return start;
+    if (start > 0 && /[\w-]/.test(css[start - 1]))
+        return start;
+    let i = start + 4;
+    while (/\s/.test(css[i] ?? ''))
+        i++;
+    if (css[i] === '"' || css[i] === "'")
+        return start;
+    const close = css.indexOf(')', i);
+    return close < 0 ? css.length : close + 1;
+}
+/** Index just past the string starting at `start` (escapes skipped; unterminated: the end). */
+function stringEnd(text, start) {
+    const quote = text[start];
+    let i = start + 1;
+    while (i < text.length && text[i] !== quote)
+        i += text[i] === '\\' ? 2 : 1;
+    return Math.min(i + 1, text.length);
+}
+/**
+ * One terser pass over a file. A file guessed to be an ES module that terser cannot parse as one
+ * is tried once more as a script; when neither parses, the error names the file.
+ */
+async function minifyFile(terser, code, file, root, o) {
+    const options = minifyOptions(file, code, root, o);
+    const attempts = options.module ? [options, { ...options, module: false }] : [options];
+    let firstError;
+    for (const attempt of attempts) {
+        try {
+            const result = await terser.minify(code, attempt);
+            return result.code ?? code;
+        }
+        catch (err) {
+            firstError ??= err;
+        }
+    }
+    throw new Error(`${path.relative(root, file)}: terser could not parse it (${firstError?.message})`);
+}
+exports.minifyFile = minifyFile;
+/**
+ * terser options for one file: only the listed console calls are removed (no other compression),
+ * no mangling, ASCII-only output. ES modules: .mjs, files with top-level import/export, and
+ * everything the application builder writes (served from browser/).
+ */
+function minifyOptions(file, code, root, o) {
+    return {
+        compress: o.dropConsole.length
+            ? {
+                defaults: false,
+                pure_funcs: o.dropConsole.map((m) => `console.${m}`),
+                side_effects: true,
+            }
+            : false,
+        mangle: false,
+        format: { comments: o.stripComments ? false : 'some', ascii_only: true },
+        module: isModuleCode(file, code, root),
+    };
+}
+exports.minifyOptions = minifyOptions;
+/** .mjs, files with top-level import/export, and everything served from browser/ (application builder). */
+function isModuleCode(file, code, root) {
+    return (file.endsWith('.mjs') || path.basename(root) === 'browser' || TOP_LEVEL_MODULE_SYNTAX.test(code));
+}
+exports.isModuleCode = isModuleCode;
+function loadTerser(repoRoot) {
+    let resolved;
+    try {
+        resolved = require.resolve('terser', { paths: [repoRoot, __dirname] });
+    }
+    catch {
+        throw new Error('stripComments/dropConsole need terser in the workspace devDependencies (npm i -D terser)');
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(resolved);
+}
+function rewrite(file, before, after) {
+    if (after === before)
+        return false;
+    fs.writeFileSync(file, after);
+    return true;
+}
+//# sourceMappingURL=strip.js.map

package/dist/src/lib/hardening/strip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../../../src/lib/hardening/strip.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,mCAAoC;AA8BpC,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7B,8FAA8F;AAC9F,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAC5D,sDAAsD;AACtD,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AACzD,MAAM,cAAc,GAAG,+CAA+C,CAAC;AAEvE;;;;GAIG;AACI,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,CAAe;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAClE,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAElE,MAAM,OAAO,GAAG,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACxE,oFAAoF;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;QACtB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;YAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;gBAAE,MAAM,CAAC,EAAE,EAAE,CAAC;SAC3C;KACF;IACD,IAAI,CAAC,CAAC,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;QACpE,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC;KAC7D;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE;QACpD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;KACf;IACD,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAS,EAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE;QACpF,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,cAAc,EAAE,CAAC,CAAC;SACnF;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE;YACvD,MAAM,CAAC,IAAI,EAAE,CAAC;SACf;KACF;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAlCD,kCAkCC;AAED,+FAA+F;AAC/F,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,CAAC,EAAE;YACX,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzB,CAAC,GAAG,GAAG,CAAC;SACT;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9B,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzB,CAAC,GAAG,GAAG,CAAC;SACT;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;SACxC;aAAM;YACL,GAAG,IAAI,CAAC,CAAC;YACT,CAAC,EAAE,CAAC;SACL;KACF;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAtBD,4CAsBC;AAED,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAFD,8CAEC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,KAAa;IAChD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,IAAY,EACZ,CAAe;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvF,IAAI,UAA6B,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;QAC9B,IAAI;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;SAC5B;QAAC,OAAO,GAAG,EAAE;YACZ,UAAU,KAAK,GAAY,CAAC;SAC7B;KACF;IACD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,gCAAgC,UAAU,EAAE,OAAO,GAAG,CACnF,CAAC;AACJ,CAAC;AArBD,gCAqBC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,IAAY,EACZ,IAAY,EACZ,IAAY,EACZ,CAAe;IAEf,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM;YAC5B,CAAC,CAAC;gBACE,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,YAAY,EAAE,IAAI;aACnB;YACH,CAAC,CAAC,KAAK;QACT,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;QACxE,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;KACvC,CAAC;AACJ,CAAC;AAlBD,sCAkBC;AAED,2GAA2G;AAC3G,SAAgB,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACnE,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CACjG,CAAC;AACJ,CAAC;AAJD,oCAIC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,QAAgB,CAAC;IACrB,IAAI;QACF,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;KACxE;IAAC,MAAM;QACN,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;KACH;IACD,8DAA8D;IAC9D,OAAO,OAAO,CAAC,QAAQ,CAAW,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,KAAa;IAC1D,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC"}