@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/migrate/package.json

@@ -0,0 +1,5 @@
+{
+  "private": true,
+  "main": "../dist/src/migrate-sdk.js",
+  "types": "../dist/src/migrate-sdk.d.ts"
+}

package/package.json

@@ -1,6 +1,122 @@
 {
   "name": "@mouryaamit/nx-polystack",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Nx plugin and pstack CLI that scaffold and build multi-tech monorepos (Angular, Ionic, Flutter) with a hardened release pipeline.",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./migrate": {
+      "types": "./dist/src/migrate-sdk.d.ts",
+      "default": "./dist/src/migrate-sdk.js"
+    },
+    "./runtime/csp-nonce": "./runtime/csp-nonce.js",
+    "./runtime/env-secret": {
+      "types": "./runtime/env-secret.d.ts",
+      "import": "./runtime/env-secret.mjs",
+      "require": "./dist/runtime/env-secret.cjs",
+      "default": "./runtime/env-secret.mjs"
+    },
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
+  "typesVersions": {
+    "*": {
+      "migrate": [
+        "dist/src/migrate-sdk.d.ts"
+      ]
+    }
+  },
+  "bin": {
+    "pstack": "dist/bin/cli.js"
+  },
+  "generators": "./dist/generators.json",
+  "executors": "./dist/executors.json",
+  "pstack": {
+    "installSource": "npm"
+  },
+  "nx-migrations": {
+    "migrations": "./dist/migrations.json"
+  },
+  "files": [
+    "dist",
+    "migrate",
+    "runtime",
+    "README.md",
+    "USER-MANUAL.md"
+  ],
+  "scripts": {
+    "build": "node scripts/build.js",
+    "prepare": "npm run build",
+    "test": "jest",
+    "test:ci": "jest --ci --coverage",
+    "lint": "eslint \"src/**/*.ts\" \"bin/**/*.ts\" \"tests/**/*.ts\"",
+    "format": "prettier --write \"**/*.{ts,js,json,md}\"",
+    "format:check": "prettier --check \"**/*.{ts,js,json,md}\""
+  },
+  "engines": {
+    "node": ">=20.0.0",
+    "npm": ">=7.0.0"
+  },
+  "peerDependencies": {
+    "@nx/devkit": "^17.0.0",
+    "crypto-js": "^4.2.0",
+    "nx": "^17.0.0",
+    "sharp": "^0.33.0 || ^0.34.0 || ^0.35.0"
+  },
+  "peerDependenciesMeta": {
+    "crypto-js": {
+      "optional": true
+    },
+    "sharp": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "tslib": "^2.6.0"
+  },
+  "devDependencies": {
+    "@nx/devkit": "17.0.6",
+    "@types/crypto-js": "^4.2.2",
+    "@types/jest": "^29.5.0",
+    "@types/node": "^20.10.0",
+    "@typescript-eslint/eslint-plugin": "^5.62.0",
+    "@typescript-eslint/parser": "^5.62.0",
+    "crypto-js": "^4.2.0",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-import": "^2.29.1",
+    "eslint-plugin-unused-imports": "^3.2.0",
+    "javascript-obfuscator": "^4.2.2",
+    "jest": "^29.7.0",
+    "nx": "17.0.6",
+    "prettier": "^2.8.8",
+    "sharp": "^0.35.5",
+    "terser": "^5.51.2",
+    "ts-jest": "^29.1.0",
+    "ts-node": "10.9.1",
+    "typescript": "~4.9.5"
+  },
+  "overrides": {
+    "minimatch@^3": "^3.1.4",
+    "js-yaml@^4": "^4.3.2"
+  },
+  "author": "mouryaamit",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mouryaamit/nx-polystack.git"
+  },
+  "homepage": "https://github.com/mouryaamit/nx-polystack#readme",
+  "bugs": {
+    "url": "https://github.com/mouryaamit/nx-polystack/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/runtime/csp-nonce.js

@@ -0,0 +1,109 @@
+/* eslint-env browser */
+/**
+ * @mouryaamit/nx-polystack/runtime/csp-nonce
+ *
+ * Import first in an Angular app's main.ts:
+ *   import '@mouryaamit/nx-polystack/runtime/csp-nonce';
+ *
+ * Under a strict Content-Security-Policy (script/style elements need a nonce), Angular 15 and
+ * webpack add <style>, <script> and <link rel="stylesheet"> elements at runtime without one, so
+ * the browser blocks them. This patch gives every such element the page's nonce when it is
+ * inserted: Node appendChild/insertBefore/replaceChild (document, elements, shadow roots) and the
+ * append/prepend/before/after/insertAdjacentElement methods.
+ *
+ * The nonce is read from `window.__cspNonce`, else from <meta property="csp-nonce" content="…">
+ * (written by the pstack release build) or <meta name="csp-nonce">. A value the server did not
+ * fill in (an SSI directive left as is, or a placeholder such as "random-csp-nonce") counts as no
+ * nonce: nothing is patched.
+ *
+ * Plain browser JavaScript with no imports, safe to load more than once.
+ */
+(function pstackCspNonce() {
+  if (typeof window === 'undefined' || typeof document === 'undefined') return;
+  if (window.__pstackCspNoncePatched) return;
+
+  var PLACEHOLDER = /^(random-csp-nonce|nonce|csp-nonce|\{\{.*\}\}|\$\{.*\}|%.*%)$/i;
+
+  function fromMeta() {
+    if (typeof document.querySelector !== 'function') return undefined;
+    var meta =
+      document.querySelector('meta[property="csp-nonce"]') ||
+      document.querySelector('meta[name="csp-nonce"]') ||
+      document.querySelector('meta[name="CSP-NONCE"]');
+    return meta && typeof meta.getAttribute === 'function'
+      ? meta.getAttribute('content')
+      : undefined;
+  }
+
+  /** Anything that looks like a filled-in nonce: no markup, quotes or spaces, not a placeholder. */
+  function valid(value) {
+    return (
+      typeof value === 'string' &&
+      value.length >= 8 &&
+      !/[\s<>"'`]/.test(value) &&
+      !PLACEHOLDER.test(value)
+    );
+  }
+
+  var raw = window.__cspNonce;
+  var nonce = valid(raw) ? raw : undefined;
+  if (!nonce) {
+    var meta = fromMeta();
+    nonce = valid(meta) ? meta : undefined;
+  }
+  if (!nonce) {
+    window.__cspNonce = '';
+    return;
+  }
+  window.__cspNonce = nonce;
+  window.__pstackCspNoncePatched = true;
+
+  function needsNonce(node) {
+    if (!node || node.nodeType !== 1 || typeof node.getAttribute !== 'function') return false;
+    if (node.getAttribute('nonce')) return false;
+    var name = String(node.localName || node.nodeName || '').toLowerCase();
+    if (name === 'script' || name === 'style') return true;
+    return name === 'link' && /(^|\s)stylesheet(\s|$)/i.test(node.getAttribute('rel') || '');
+  }
+
+  function stamp(node, depth) {
+    if (needsNonce(node)) node.setAttribute('nonce', nonce);
+    // A fragment carries its descendants in (walked a few levels deep; elements alone are not
+    // walked, so moving a large subtree stays cheap).
+    var walk = depth === 0 ? node && node.nodeType === 11 : depth < 8;
+    if (walk && node.childNodes) {
+      for (var i = 0; i < node.childNodes.length; i++) stamp(node.childNodes[i], depth + 1);
+    }
+  }
+
+  function wrap(proto, method, nodeArgs) {
+    if (!proto || typeof proto[method] !== 'function') return;
+    var original = proto[method];
+    proto[method] = function () {
+      for (var i = 0; i < arguments.length; i++) {
+        if (nodeArgs === 'all' || nodeArgs.indexOf(i) !== -1) stamp(arguments[i], 0);
+      }
+      return original.apply(this, arguments);
+    };
+  }
+
+  var nodeProto = typeof Node !== 'undefined' ? Node.prototype : undefined;
+  wrap(nodeProto, 'appendChild', [0]);
+  wrap(nodeProto, 'insertBefore', [0]);
+  wrap(nodeProto, 'replaceChild', [0]);
+
+  var parents = [];
+  if (typeof Element !== 'undefined') parents.push(Element.prototype);
+  if (typeof DocumentFragment !== 'undefined') parents.push(DocumentFragment.prototype);
+  if (typeof Document !== 'undefined') parents.push(Document.prototype);
+  for (var p = 0; p < parents.length; p++) {
+    wrap(parents[p], 'append', 'all');
+    wrap(parents[p], 'prepend', 'all');
+  }
+  if (typeof Element !== 'undefined') {
+    wrap(Element.prototype, 'before', 'all');
+    wrap(Element.prototype, 'after', 'all');
+    wrap(Element.prototype, 'replaceWith', 'all');
+    wrap(Element.prototype, 'insertAdjacentElement', [1]);
+  }
+})();

package/runtime/env-secret.d.ts

@@ -0,0 +1,63 @@
+/** Build info written into the meta tag by the release build. */
+export interface BuildMeta {
+  env?: string;
+  branch?: string;
+  commit?: string;
+  build?: string;
+  [key: string]: unknown;
+}
+
+export interface EnvReadyOptions {
+  /** Decrypt every encrypted value of the environment (nested too) in place. */
+  inPlace?: boolean;
+  /** Top-level fields (or 'all') decrypted at startup into a private cache for envSecret(). */
+  sync?: string[] | 'all';
+  /** Meta tag with the build info (default x-build; the same environment object keeps its name). */
+  metaName?: string;
+  /**
+   * Key source custom (aes-gcm, envReady only): returns the custom key factor, e.g. fetched from
+   * your server. Required when the build lists custom in keySources.
+   */
+  getKey?: () => string | Promise<string>;
+}
+
+/** The build info from the meta tag (without the aes-gcm key share), or null (dev server, tests). */
+export function getBuildMeta(metaName?: string): BuildMeta | null;
+
+/** True for ENC(...) and ENC2(...) values and bare CryptoJS passphrase ciphertext. */
+export function isEncryptedValue(value: unknown): value is string;
+
+/** Plaintext of an encrypted value, or the value unchanged (always for aes-gcm ENC2 values). */
+export function decryptEnvValue(value: string, commit?: string | null): string;
+
+/** Decrypts every encrypted value of any object tree in place (not registered); returns the paths. */
+export function decryptTree(obj: object, commit?: string | null): string[];
+
+/**
+ * Decrypts every encrypted value (aes-gcm ENC2 and CryptoJS) of any object tree in place with the
+ * key registered by envReady; returns the paths. Rejects before envReady or when the domain lock
+ * refused this host.
+ */
+export function decryptTreeAsync(obj: object): Promise<string[]>;
+
+/**
+ * Registers and prepares the environment object; returns the dotted paths decrypted. Leaves
+ * aes-gcm ENC2(...) values alone: use envReady.
+ */
+export function envReadySync(environment: object, options?: EnvReadyOptions): string[];
+
+/**
+ * envReadySync as a Promise; also decrypts aes-gcm ENC2(...) values (Web Crypto), so aes-gcm apps
+ * must await it in main.ts before bootstrap. Applies the build's domain lock. Values that fail
+ * authentication stay encrypted and are reported by path.
+ */
+export function envReady(environment: object, options?: EnvReadyOptions): Promise<string[]>;
+
+/** Plaintext of a top-level env field ('' when it is not a string); cached. Throws on an ENC2 value. */
+export function envSecret(key: string): string;
+
+/** Plaintext of a top-level env field, decrypted on every call; nothing is kept. */
+export function envSecretAsync(key: string): Promise<string>;
+
+/** True when `host` is listed (`*.x` = any subdomain of x; `x` also allows www.x when www). */
+export function isHostAllowed(host: string, hosts: string[], www: boolean): boolean;