apphx 1.0.0 → 2.0.0

package/dist/vendor/obfuscator/dist/cli.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import { FRAMEWORKS, deriveHash } from "./common.js";
+import { ObfuscatorConfigSchema } from "./config.js";
+import { applyObfuscation } from "./obfuscate.js";
+import { parseArgs } from "node:util";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+// src/cli.ts
+const help = `obfuscator --project <dir> [--config <config.json>] [--framework <stack>] [--seed <text>]
+  Deterministically obfuscates an owned app project in place.
+  --project <dir>      Existing project directory to transform (required)
+  --config <file>      Obfuscator options as JSON; defaults to all features off
+  --framework <stack>  flutter|android-java|swift|react-native|expo|uni-app|mygo (required unless set in config)
+  --seed <text>        Determinism seed; defaults to config.seed, then a hash of the config file
+  --version            Print the package version
+Exit codes: 0 transformed; 1 transform failure; 2 configuration or usage error.
+Report is printed to stdout as JSON: { changedFiles, transforms, skipped }`;
+function usageError(message) {
+	console.error(JSON.stringify({ error: message }));
+	console.error(help);
+	process.exitCode = 2;
+	throw new Error(message);
+}
+async function main() {
+	const { values } = parseArgs({
+		allowPositionals: false,
+		options: {
+			project: { type: "string" },
+			config: { type: "string" },
+			framework: { type: "string" },
+			seed: { type: "string" },
+			version: {
+				type: "boolean",
+				short: "v"
+			},
+			help: {
+				type: "boolean",
+				short: "h"
+			}
+		}
+	});
+	if (values.version) {
+		const metadata = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+		console.log(metadata.version);
+		return;
+	}
+	if (values.help || !values.project) {
+		console.log(help);
+		if (!values.project) process.exitCode = 2;
+		return;
+	}
+	const configPath = values.config ? resolve(values.config) : void 0;
+	const raw = configPath ? readFileSync(configPath, "utf8") : "{}";
+	const parsed = ObfuscatorConfigSchema.safeParse(JSON.parse(raw));
+	if (!parsed.success) usageError(`Invalid obfuscator configuration: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`);
+	const config = parsed.data;
+	const frameworkValue = values.framework ?? config.framework;
+	if (!frameworkValue || !FRAMEWORKS.includes(frameworkValue)) usageError(`--framework must be one of ${FRAMEWORKS.join("|")}`);
+	const framework = frameworkValue;
+	if (values.seed !== void 0 && values.seed.trim().length === 0) usageError("--seed must be a non-empty string");
+	const seed = values.seed ?? config.seed ?? deriveHash(JSON.stringify(config)).slice(0, 16);
+	const report = applyObfuscation(resolve(values.project), config, seed, framework);
+	console.log(JSON.stringify(report, null, 2));
+}
+main().catch((error) => {
+	const message = error instanceof Error ? error.message : String(error);
+	console.error(JSON.stringify({ error: message }));
+	process.exitCode = process.exitCode === 2 ? 2 : 1;
+});
+export {};
+
+//# sourceMappingURL=cli.js.map

package/dist/vendor/obfuscator/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from 'node:util';\nimport { readFileSync } from 'node:fs';\nimport { resolve } from 'node:path';\nimport { deriveHash, FRAMEWORKS } from './common.js';\nimport type { Framework } from './common.js';\nimport { ObfuscatorConfigSchema } from './config.js';\nimport { applyObfuscation } from './obfuscate.js';\n\nconst help = `obfuscator --project <dir> [--config <config.json>] [--framework <stack>] [--seed <text>]\n  Deterministically obfuscates an owned app project in place.\n  --project <dir>      Existing project directory to transform (required)\n  --config <file>      Obfuscator options as JSON; defaults to all features off\n  --framework <stack>  flutter|android-java|swift|react-native|expo|uni-app|mygo (required unless set in config)\n  --seed <text>        Determinism seed; defaults to config.seed, then a hash of the config file\n  --version            Print the package version\nExit codes: 0 transformed; 1 transform failure; 2 configuration or usage error.\nReport is printed to stdout as JSON: { changedFiles, transforms, skipped }`;\n\nfunction usageError(message: string): never {\n  console.error(JSON.stringify({ error: message }));\n  console.error(help);\n  process.exitCode = 2;\n  throw new Error(message);\n}\n\nasync function main(): Promise<void> {\n  const { values } = parseArgs({\n    allowPositionals: false,\n    options: {\n      project: { type: 'string' },\n      config: { type: 'string' },\n      framework: { type: 'string' },\n      seed: { type: 'string' },\n      version: { type: 'boolean', short: 'v' },\n      help: { type: 'boolean', short: 'h' },\n    },\n  });\n  if (values.version) {\n    const metadata = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version: string };\n    console.log(metadata.version);\n    return;\n  }\n  if (values.help || !values.project) { console.log(help); if (!values.project) process.exitCode = 2; return; }\n  const configPath = values.config ? resolve(values.config) : undefined;\n  const raw = configPath ? readFileSync(configPath, 'utf8') : '{}';\n  const parsed = ObfuscatorConfigSchema.safeParse(JSON.parse(raw));\n  if (!parsed.success) usageError(`Invalid obfuscator configuration: ${parsed.error.issues.map(issue => `${issue.path.join('.') || '<root>'}: ${issue.message}`).join('; ')}`);\n  const config = parsed.data;\n  const frameworkValue = values.framework ?? config.framework;\n  if (!frameworkValue || !FRAMEWORKS.includes(frameworkValue as Framework)) usageError(`--framework must be one of ${FRAMEWORKS.join('|')}`);\n  const framework = frameworkValue as Framework;\n  // The config schema enforces non-empty seeds; keep the CLI flag path consistent with it.\n  if (values.seed !== undefined && values.seed.trim().length === 0) usageError('--seed must be a non-empty string');\n  const seed = values.seed ?? config.seed ?? deriveHash(JSON.stringify(config)).slice(0, 16);\n  const report = applyObfuscation(resolve(values.project), config, seed, framework);\n  console.log(JSON.stringify(report, null, 2));\n}\n\nmain().catch(error => {\n  const message = error instanceof Error ? error.message : String(error);\n  console.error(JSON.stringify({ error: message }));\n  process.exitCode = process.exitCode === 2 ? 2 : 1;\n});\n"],"mappings":";;;;;;;;AASA,MAAM,OAAO;;;;;;;;;AAUb,SAAS,WAAW,SAAwB;CAC1C,QAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,CAAC;CAChD,QAAQ,MAAM,IAAI;CAClB,QAAQ,WAAW;CACnB,MAAM,IAAI,MAAM,OAAO;AACzB;AAEA,eAAe,OAAsB;CACnC,MAAM,EAAE,WAAW,UAAU;EAC3B,kBAAkB;EAClB,SAAS;GACP,SAAS,EAAE,MAAM,SAAS;GAC1B,QAAQ,EAAE,MAAM,SAAS;GACzB,WAAW,EAAE,MAAM,SAAS;GAC5B,MAAM,EAAE,MAAM,SAAS;GACvB,SAAS;IAAE,MAAM;IAAW,OAAO;GAAI;GACvC,MAAM;IAAE,MAAM;IAAW,OAAO;GAAI;EACtC;CACF,CAAC;CACD,IAAI,OAAO,SAAS;EAClB,MAAM,WAAW,KAAK,MAAM,aAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,MAAM,CAAC;EAC7F,QAAQ,IAAI,SAAS,OAAO;EAC5B;CACF;CACA,IAAI,OAAO,QAAQ,CAAC,OAAO,SAAS;EAAE,QAAQ,IAAI,IAAI;EAAG,IAAI,CAAC,OAAO,SAAS,QAAQ,WAAW;EAAG;CAAQ;CAC5G,MAAM,aAAa,OAAO,SAAS,QAAQ,OAAO,MAAM,IAAI,KAAA;CAC5D,MAAM,MAAM,aAAa,aAAa,YAAY,MAAM,IAAI;CAC5D,MAAM,SAAS,uBAAuB,UAAU,KAAK,MAAM,GAAG,CAAC;CAC/D,IAAI,CAAC,OAAO,SAAS,WAAW,qCAAqC,OAAO,MAAM,OAAO,KAAI,UAAS,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,SAAS,IAAI,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,GAAG;CAC3K,MAAM,SAAS,OAAO;CACtB,MAAM,iBAAiB,OAAO,aAAa,OAAO;CAClD,IAAI,CAAC,kBAAkB,CAAC,WAAW,SAAS,cAA2B,GAAG,WAAW,8BAA8B,WAAW,KAAK,GAAG,GAAG;CACzI,MAAM,YAAY;CAElB,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG,WAAW,mCAAmC;CAChH,MAAM,OAAO,OAAO,QAAQ,OAAO,QAAQ,WAAW,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;CACzF,MAAM,SAAS,iBAAiB,QAAQ,OAAO,OAAO,GAAG,QAAQ,MAAM,SAAS;CAChF,QAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;AAEA,KAAK,CAAC,CAAC,OAAM,UAAS;CACpB,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACrE,QAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,CAAC;CAChD,QAAQ,WAAW,QAAQ,aAAa,IAAI,IAAI;AAClD,CAAC"}

package/dist/vendor/obfuscator/dist/code.js

@@ -0,0 +1,585 @@
+import { deriveHash, deriveToken, replaceWholeWords, seededInt } from "./common.js";
+// src/code.ts
+/** Control characters are illegal inside real identifiers/expressions, so they cannot collide with code. */
+const SEPARATOR_CANDIDATES = [
+	"",
+	"",
+	"",
+	"",
+	"",
+	"\x07",
+	"\b",
+	"",
+	""
+];
+/** Pick two placeholder characters that do not occur anywhere in the content. */
+function pickSeparators(content) {
+	let first;
+	let second;
+	for (const candidate of SEPARATOR_CANDIDATES) {
+		if (content.includes(candidate)) continue;
+		if (first === void 0) {
+			first = candidate;
+			continue;
+		}
+		second = candidate;
+		break;
+	}
+	if (first === void 0 || second === void 0) return {
+		stringSep: "",
+		commentSep: ""
+	};
+	return {
+		stringSep: first,
+		commentSep: second
+	};
+}
+/** Index of the first '\n' or '\r' at or after `start` (content length when absent). */
+function lineEnd(content, start) {
+	const nextLf = content.indexOf("\n", start);
+	const nextCr = content.indexOf("\r", start);
+	if (nextLf === -1) return nextCr === -1 ? content.length : nextCr;
+	if (nextCr === -1) return nextLf;
+	return Math.min(nextLf, nextCr);
+}
+/** Scan a quoted literal body. Raw literals have no escapes; single-line literals end at a newline. */
+function scanQuoted(content, start, quote, isRaw, multiline) {
+	let index = start;
+	while (index < content.length) {
+		const char = content[index];
+		if (!multiline && (char === "\n" || char === "\r")) return index;
+		if (!isRaw && char === "\\") {
+			index += 2;
+			continue;
+		}
+		if (char === quote) return index + 1;
+		index += 1;
+	}
+	return content.length;
+}
+/** Scan a triple-quoted literal body: closes only at the full delimiter, never at a lone quote. */
+function scanTripleQuoted(content, start, quote, isRaw) {
+	const delimiter = quote.repeat(3);
+	let index = start;
+	while (index < content.length) {
+		if (!isRaw && content[index] === "\\") {
+			index += 2;
+			continue;
+		}
+		if (content.startsWith(delimiter, index)) return index + 3;
+		index += 1;
+	}
+	return content.length;
+}
+/**
+* Mask every string literal and comment with inert placeholders, left to right, so later
+* replacement passes can never touch literal/comment text. The scanner recognizes, per language:
+* - comments: `//` to end of line, `/* ... *\/` blocks (non-nesting);
+* - strings: 'single' and "double" everywhere; JavaScript backtick templates with `${}`;
+*   Dart raw `r'...'`/`r"..."` and triple-quoted `'''...'''`/`"""..."""` (with `$` interpolation);
+*   Kotlin `"""..."""`; Swift raw `#"..."#` (and deeper `##`/`###` nesting).
+* A backslash skips the next character inside a normal string; a newline before the closing
+* quote ends a single-line string. The `#!` shebang on line 1 of javascript files is treated
+* as a comment so transforms leave it alone.
+*/
+function maskContent(content, language) {
+	const { stringSep, commentSep } = pickSeparators(content);
+	const parts = [];
+	const strings = [];
+	const stringKinds = [];
+	const comments = [];
+	const commentKinds = [];
+	const javascript = language === "javascript";
+	let index = 0;
+	while (index < content.length) {
+		if (javascript && index === 0 && content.startsWith("#!")) {
+			const end = lineEnd(content, index);
+			parts.push({
+				text: content.slice(index, end),
+				isPlaceholder: true,
+				placeholderIndex: comments.length,
+				placeholderKind: "comment"
+			});
+			comments.push(content.slice(index, end));
+			commentKinds.push(true);
+			index = end;
+			continue;
+		}
+		if (content.startsWith("//", index)) {
+			const end = lineEnd(content, index);
+			parts.push({
+				text: content.slice(index, end),
+				isPlaceholder: true,
+				placeholderIndex: comments.length,
+				placeholderKind: "comment"
+			});
+			comments.push(content.slice(index, end));
+			commentKinds.push(false);
+			index = end;
+			continue;
+		}
+		if (content.startsWith("/*", index)) {
+			const close = content.indexOf("*/", index + 2);
+			const end = close === -1 ? content.length : close + 2;
+			parts.push({
+				text: content.slice(index, end),
+				isPlaceholder: true,
+				placeholderIndex: comments.length,
+				placeholderKind: "comment"
+			});
+			comments.push(content.slice(index, end));
+			commentKinds.push(false);
+			index = end;
+			continue;
+		}
+		if (language === "dart" && (content.startsWith("r'''", index) || content.startsWith("r\"\"\"", index))) {
+			const quote = content[index + 1];
+			const end = scanTripleQuoted(content, index + 4, quote, true);
+			const text = content.slice(index, end);
+			parts.push({
+				text,
+				isPlaceholder: true,
+				placeholderIndex: strings.length,
+				placeholderKind: "string"
+			});
+			strings.push(text);
+			stringKinds.push("other");
+			index = end;
+			continue;
+		}
+		if (language === "dart" && (content.startsWith("r'", index) || content.startsWith("r\"", index))) {
+			const quote = content[index + 1];
+			const end = scanQuoted(content, index + 2, quote, true, false);
+			const text = content.slice(index, end);
+			parts.push({
+				text,
+				isPlaceholder: true,
+				placeholderIndex: strings.length,
+				placeholderKind: "string"
+			});
+			strings.push(text);
+			stringKinds.push("other");
+			index = end;
+			continue;
+		}
+		if ((language === "dart" || language === "kotlin") && content.startsWith("\"\"\"", index)) {
+			const end = scanTripleQuoted(content, index + 3, "\"", false);
+			const text = content.slice(index, end);
+			parts.push({
+				text,
+				isPlaceholder: true,
+				placeholderIndex: strings.length,
+				placeholderKind: "string"
+			});
+			strings.push(text);
+			stringKinds.push("other");
+			index = end;
+			continue;
+		}
+		if (language === "dart" && content.startsWith("'''", index)) {
+			const end = scanTripleQuoted(content, index + 3, "'", false);
+			const text = content.slice(index, end);
+			parts.push({
+				text,
+				isPlaceholder: true,
+				placeholderIndex: strings.length,
+				placeholderKind: "string"
+			});
+			strings.push(text);
+			stringKinds.push("other");
+			index = end;
+			continue;
+		}
+		if (javascript && content[index] === "`") {
+			const end = scanQuoted(content, index + 1, "`", false, true);
+			const text = content.slice(index, end);
+			parts.push({
+				text,
+				isPlaceholder: true,
+				placeholderIndex: strings.length,
+				placeholderKind: "string"
+			});
+			strings.push(text);
+			stringKinds.push("other");
+			index = end;
+			continue;
+		}
+		if (language === "swift" && content[index] === "#") {
+			let hashEnd = index;
+			while (content[hashEnd] === "#") hashEnd += 1;
+			if (content[hashEnd] === "\"") {
+				let cursor = hashEnd + 1;
+				let end = -1;
+				while (cursor < content.length) {
+					const close = content.indexOf("\"", cursor);
+					if (close === -1) {
+						cursor = content.length;
+						break;
+					}
+					let closeEnd = close + 1;
+					while (content[closeEnd] === "#") closeEnd += 1;
+					if (closeEnd - close - 1 === hashEnd - index) {
+						end = closeEnd;
+						break;
+					}
+					cursor = close + 1;
+				}
+				if (end === -1) end = content.length;
+				const text = content.slice(index, end);
+				parts.push({
+					text,
+					isPlaceholder: true,
+					placeholderIndex: strings.length,
+					placeholderKind: "string"
+				});
+				strings.push(text);
+				stringKinds.push("other");
+				index = end;
+				continue;
+			}
+		}
+		const char = content[index];
+		if (char === "'" || char === "\"") {
+			const end = scanQuoted(content, index + 1, char, false, false);
+			const text = content.slice(index, end);
+			parts.push({
+				text,
+				isPlaceholder: true,
+				placeholderIndex: strings.length,
+				placeholderKind: "string"
+			});
+			strings.push(text);
+			stringKinds.push(char === "'" ? "single" : "double");
+			index = end;
+			continue;
+		}
+		const end = indexOfAnyFrom(content, index + 1, [
+			"'",
+			"\"",
+			"/",
+			"`",
+			"#",
+			"r"
+		]);
+		parts.push({
+			text: content.slice(index, end),
+			isPlaceholder: false,
+			placeholderIndex: -1,
+			placeholderKind: "string"
+		});
+		index = end;
+	}
+	return {
+		masked: parts.map((part) => part.isPlaceholder ? part.placeholderKind === "string" ? `${stringSep}${part.placeholderIndex}${stringSep}` : `${commentSep}${part.placeholderIndex}${commentSep}` : part.text).join(""),
+		strings,
+		stringKinds,
+		comments,
+		commentKinds,
+		stringSep,
+		commentSep
+	};
+}
+/** First index of any search character at or after `start` (content length when absent). */
+function indexOfAnyFrom(content, start, chars) {
+	let best = content.length;
+	for (const char of chars) {
+		const found = content.indexOf(char, start);
+		if (found !== -1 && found < best) best = found;
+	}
+	return best;
+}
+/** Split masked text into alternating code and placeholder parts. */
+function splitMasked(masked) {
+	const separatorPattern = new RegExp(`${escapeRegExpChar(masked.stringSep)}(\\d+)${escapeRegExpChar(masked.stringSep)}|${escapeRegExpChar(masked.commentSep)}(\\d+)${escapeRegExpChar(masked.commentSep)}`, "g");
+	const parts = [];
+	let last = 0;
+	for (const match of masked.masked.matchAll(separatorPattern)) {
+		if (match.index > last) parts.push({
+			text: masked.masked.slice(last, match.index),
+			isPlaceholder: false,
+			placeholderIndex: -1,
+			placeholderKind: "string"
+		});
+		const commentGroup = match[2];
+		const isComment = commentGroup !== void 0;
+		parts.push({
+			text: match[0],
+			isPlaceholder: true,
+			placeholderIndex: Number(isComment ? commentGroup : match[1]),
+			placeholderKind: isComment ? "comment" : "string"
+		});
+		last = match.index + match[0].length;
+	}
+	if (last < masked.masked.length) parts.push({
+		text: masked.masked.slice(last),
+		isPlaceholder: false,
+		placeholderIndex: -1,
+		placeholderKind: "string"
+	});
+	return parts;
+}
+/** Escape a single separator character for interpolation into a RegExp source. */
+function escapeRegExpChar(char) {
+	return /[.*+?^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
+}
+/** Restore placeholders from `rebuiltMasked`, substituting `rebuildString` output for each string. */
+function unmask(rebuiltMasked, masked, rebuildString) {
+	const stringPattern = new RegExp(`${escapeRegExpChar(masked.stringSep)}(\\d+)${escapeRegExpChar(masked.stringSep)}`, "g");
+	return rebuiltMasked.replace(stringPattern, (_whole, digits) => rebuildString(Number(digits)));
+}
+/**
+* Remove comments while keeping every newline they contained, so line numbering stays stable.
+* The `#!` shebang on line 1 of javascript files is preserved verbatim.
+*/
+function stripComments(content, language) {
+	const masked = maskContent(content, language);
+	return unmask(splitMasked(masked).map((part) => {
+		if (!part.isPlaceholder) return part.text;
+		if (part.placeholderKind === "string") return `${masked.stringSep}${part.placeholderIndex}${masked.stringSep}`;
+		const original = masked.comments[part.placeholderIndex];
+		if (masked.commentKinds[part.placeholderIndex]) return original;
+		return original.replace(/[^\r\n]/g, "");
+	}).join(""), masked, (index) => masked.strings[index]);
+}
+/** Whether a quoted literal is eligible for runtime-decode encryption. */
+function isEligible(content, quote, excludes) {
+	const body = content.slice(1, -1);
+	if (body.length === 0) return false;
+	if (body.includes("%") || body.includes("$")) return false;
+	if (body.startsWith("./") || body.startsWith("../") || /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(body)) return false;
+	for (const exclude of excludes) if (new RegExp(exclude).test(body)) return false;
+	let index = 0;
+	while (index < body.length) {
+		if (body[index] === "\\") {
+			const next = body[index + 1];
+			if (next !== "\\" && next !== quote && next !== "n" && next !== "t" && next !== "r") return false;
+			index += 2;
+			continue;
+		}
+		if (body[index] === quote) return false;
+		index += 1;
+	}
+	return true;
+}
+/** UTF-16 code units for dart/javascript decode expressions (surrogate pairs for astral code points). */
+function utf16Units(content) {
+	const units = [];
+	for (const char of content) {
+		const codePoint = char.codePointAt(0);
+		if (codePoint > 65535) {
+			const offset = codePoint - 65536;
+			units.push(55296 + (offset >> 10), 56320 + (offset & 1023));
+		} else units.push(codePoint);
+	}
+	return units;
+}
+/** Runtime-decode expression replacing the literal, per language. */
+function encodeString(content, language) {
+	if (language === "dart") return `String.fromCharCodes(const [${utf16Units(content).join(", ")}])`;
+	if (language === "javascript") return `String.fromCharCode(${utf16Units(content).join(", ")})`;
+	if (language === "java") return `new String(new byte[]{${Array.from(Buffer.from(content, "utf8")).join(",")}}, java.nio.charset.StandardCharsets.UTF_8)`;
+	if (language === "kotlin") return `String(byteArrayOf(${Array.from(Buffer.from(content, "utf8")).join(",")}), Charsets.UTF_8)`;
+	if (language === "swift") return `String(bytes: [${Array.from(Buffer.from(content, "utf8")).map((byte) => `UInt8(${byte})`).join(", ")}], encoding: .utf8)!`;
+	return `string([]byte{${Array.from(Buffer.from(content, "utf8")).join(",")}})`;
+}
+/**
+* Replace each eligible string literal with a deterministic runtime-decode expression.
+* Eligible literals are non-empty, single/double-quoted (templates, raw and triple-quoted
+* literals are never touched), contain no `%`, no `$`, no path/URL prefix, no disallowed
+* backslash escapes, and match none of the `excludes` regexes.
+*/
+function encryptStringLiterals(content, language, excludes, seed) {
+	const masked = maskContent(content, language);
+	const encrypted = /* @__PURE__ */ new Map();
+	masked.strings.forEach((literal, index) => {
+		const kind = masked.stringKinds[index];
+		if (kind === "single" || kind === "double") {
+			if (isEligible(literal, kind === "single" ? "'" : "\"", excludes)) encrypted.set(index, encodeString(literal.slice(1, -1), language));
+		}
+	});
+	return unmask(masked.masked, masked, (index) => encrypted.get(index) ?? masked.strings[index]);
+}
+/**
+* Rename identifiers in one combined pass: whole-word `mappings` (longest key first) run before
+* `patterns` (regular expressions whose replacements may use $1-style group references). Both
+* operate only on code; string literals and comments are masked and restored untouched.
+*/
+function renameIdentifiers(content, language, mappings = {}, patterns = []) {
+	const masked = maskContent(content, language);
+	const parts = splitMasked(masked);
+	let rebuilt = "";
+	for (const part of parts) if (!part.isPlaceholder) {
+		let text = replaceWholeWords(part.text, mappings).text;
+		for (const pattern of patterns) text = text.replace(new RegExp(pattern.match, "g"), pattern.replacement);
+		rebuilt += text;
+	} else if (part.placeholderKind === "string") rebuilt += `${masked.stringSep}${part.placeholderIndex}${masked.stringSep}`;
+	else rebuilt += `${masked.commentSep}${part.placeholderIndex}${masked.commentSep}`;
+	return unmask(rebuilt, masked, (index) => masked.strings[index]);
+}
+/**
+* Whole-word replacement of every `keywords` mapping. Applies inside code and inside string
+* literals, but never inside comments.
+*/
+function obfuscateKeywords(content, language, keywords) {
+	const masked = maskContent(content, language);
+	const replaced = replaceWholeWords(masked.masked, keywords).text;
+	return unmask(replaced, masked, (index) => masked.strings[index]);
+}
+const JUNK_FORMATS = {
+	dart: (name, value) => `final ${name} = ${value};`,
+	java: (name, value) => `class ${name.charAt(0).toUpperCase()}${name.slice(1)} { static { int j = ${value}; } }`,
+	kotlin: (name, value) => `val ${name} = ${value}`,
+	swift: (name, value) => `private enum ${name.charAt(0).toUpperCase()}${name.slice(1)} { static let j = ${value} }`,
+	javascript: (name, value) => `const ${name} = ${value}; void ${name};`,
+	go: (name, value) => `var ${name} = ${value}`
+};
+/**
+* Conservative per-language declaration scanners for seed-generated renames. Every pattern
+* anchors at a line start so indented methods (framework callbacks like Flutter's `build`)
+* are never mistaken for declarations; statement call sites such as `return foo(` are
+* filtered out afterwards.
+*/
+const TYPE_DECLARATION = /(?:^|\n)(?:(?:abstract|base|final|interface|sealed|open|data|public|private|protected|internal|static)\s+)*(?:class|interface|enum|struct|object|union|mixin|extension|protocol|record)\s+([A-Za-z_$][\w$]*)/g;
+const TOP_LEVEL_FUNCTION = /(?:^|\n)(?:[A-Za-z_$][\w$<>.,?\[\]]*\s+)+([A-Za-z_$][\w$]*)\s*\(/g;
+const STATEMENT_PREFIXES = {
+	return: true,
+	throw: true,
+	case: true,
+	yield: true,
+	await: true,
+	else: true,
+	do: true,
+	goto: true
+};
+/** Names that must never be generated as rename targets (entrypoints, keywords, common false positives). */
+const NEVER_RENAME = {
+	main: true,
+	init: true,
+	on: true,
+	get: true,
+	set: true,
+	build: true,
+	new: true,
+	if: true,
+	else: true,
+	for: true,
+	while: true,
+	do: true,
+	switch: true,
+	return: true,
+	class: true,
+	struct: true,
+	enum: true,
+	func: true,
+	fun: true,
+	function: true,
+	void: true,
+	var: true,
+	val: true,
+	let: true,
+	const: true,
+	final: true,
+	static: true,
+	import: true,
+	export: true,
+	package: true,
+	type: true,
+	case: true,
+	default: true,
+	break: true,
+	continue: true,
+	try: true,
+	catch: true,
+	throw: true,
+	async: true,
+	await: true,
+	in: true,
+	is: true,
+	as: true,
+	of: true,
+	to: true,
+	from: true,
+	this: true,
+	super: true,
+	null: true,
+	true: true,
+	false: true
+};
+const DECLARATION_PATTERNS = {
+	dart: [TYPE_DECLARATION, TOP_LEVEL_FUNCTION],
+	java: [TYPE_DECLARATION],
+	kotlin: [TYPE_DECLARATION, /(?:^|\n)fun\s+(?:<[^>\n]*>\s*)?([A-Za-z_$][\w$]*)\s*\(/g],
+	swift: [TYPE_DECLARATION, /(?:^|\n)func\s+([A-Za-z_$][\w$]*)\s*\(/g],
+	javascript: [
+		TYPE_DECLARATION,
+		/(?:^|\n)(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\s*\(/g,
+		/(?:^|\n)const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\(|function)/g
+	],
+	go: [/(?:^|\n)type\s+([A-Za-z_]\w*)\s+(?:struct|interface)\b/g, /(?:^|\n)func\s+([A-Za-z_]\w*)\s*\(/g]
+};
+/** Extract declared type/function names worth renaming; methods and statement sites stay untouched. */
+function extractDeclaredIdentifiers(content, language) {
+	const names = [];
+	for (const pattern of DECLARATION_PATTERNS[language]) {
+		pattern.lastIndex = 0;
+		for (const match of content.matchAll(pattern)) {
+			const name = match[1];
+			if (name in NEVER_RENAME) continue;
+			if (pattern === TOP_LEVEL_FUNCTION) {
+				const lineStart = content.lastIndexOf("\n", match.index) + 1;
+				const prefix = content.slice(lineStart, match.index).trim().split(/\s+/).pop();
+				if (prefix && prefix in STATEMENT_PREFIXES) continue;
+			}
+			names.push(name);
+		}
+	}
+	return names;
+}
+/**
+* Deterministically pick `count` of the declared names (seeded hash ordering) and map each
+* to a seed-derived token. Identical (declared, count, seed) always yields the same mapping;
+* a different seed yields a different selection and different tokens.
+*/
+function generateIdentifierMappings(declared, count, seed) {
+	const selected = [...new Set(declared)].filter((name) => !(name in NEVER_RENAME)).map((name) => ({
+		name,
+		score: deriveHash(seed, "identifier-select", name)
+	})).sort((a, b) => a.score < b.score ? -1 : a.score > b.score ? 1 : 0).slice(0, Math.max(0, count));
+	const mappings = {};
+	for (const { name } of selected) mappings[name] = deriveToken(seed, "identifier", name);
+	return mappings;
+}
+/**
+* Append `lines` deterministic junk statements at end of file, ensuring exactly one trailing
+* newline before them. Names and values derive from the seed and the project-relative file
+* path, so two files never share junk names. Non-positive `lines` returns the input unchanged.
+*/
+function insertJunkCode(content, language, lines, seed, filePath) {
+	if (content.length === 0 || lines <= 0) return content;
+	const base = content.replace(/[\t \r\n]+$/, "");
+	const statements = [];
+	for (let i = 0; i < lines; i += 1) {
+		const name = deriveToken(seed, filePath, "junk", `${i}`);
+		const value = seededInt(seed, `${filePath}:junk:${i}`, 0, 2147483647);
+		statements.push(JUNK_FORMATS[language](name, value));
+	}
+	return `${base}\n${statements.join("\n")}\n`;
+}
+/**
+* Apply the code transforms in fixed order — stripComments, encryptStringLiterals,
+* renameIdentifiers, obfuscateKeywords, insertJunkCode — each only when enabled in `options`.
+* Deterministic: identical arguments yield byte-identical output. Idempotence is not a
+* contract; the orchestrator restores pristine sources between runs.
+*/
+function transformCode(content, language, options, seed, filePath) {
+	let result = content;
+	if (options.removeComments === true) result = stripComments(result, language);
+	if (options.encryptStrings) result = encryptStringLiterals(result, language, options.encryptStrings.excludes, seed);
+	if (options.renameIdentifiers) result = renameIdentifiers(result, language, options.renameIdentifiers.mappings, options.renameIdentifiers.patterns);
+	if (options.keywords && Object.keys(options.keywords).length > 0) result = obfuscateKeywords(result, language, options.keywords);
+	if (options.junkCode) result = insertJunkCode(result, language, options.junkCode.lines, seed, filePath);
+	return result;
+}
+export { encryptStringLiterals, extractDeclaredIdentifiers, generateIdentifierMappings, insertJunkCode, obfuscateKeywords, renameIdentifiers, stripComments, transformCode };
+
+//# sourceMappingURL=code.js.map