vanilla-builder 0.0.0-stage → 0.1.0

package/src/jsinfo.js

@@ -0,0 +1,290 @@
+// Análisis estático de JavaScript con acorn: nivel de sintaxis, globales, workers y rutas.
+import * as acorn from 'acorn';
+import * as walk from 'acorn-walk';
+
+const VERSIONS = [5, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025, 2026];
+const LATEST = 'latest';
+
+function parse(code, sourceType, ecmaVersion) {
+  return acorn.parse(code, { ecmaVersion, sourceType, allowHashBang: true });
+}
+
+function tryParse(code, sourceType, ecmaVersion) {
+  try {
+    return parse(code, sourceType, ecmaVersion);
+  } catch {
+    return null;
+  }
+}
+
+/** Nivel ES mínimo con el que el código se puede leer (búsqueda binaria). */
+function detectLevel(code, sourceType) {
+  const list = sourceType === 'module' ? VERSIONS.slice(1) : VERSIONS;
+  let lo = 0;
+  let hi = list.length - 1;
+  if (!tryParse(code, sourceType, list[hi])) return null;
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1;
+    if (tryParse(code, sourceType, list[mid])) hi = mid;
+    else lo = mid + 1;
+  }
+  return list[lo];
+}
+
+const isStr = (n) => n && ((n.type === 'Literal' && typeof n.value === 'string') || (n.type === 'TemplateLiteral' && n.expressions.length === 0));
+const strVal = (n) => (n.type === 'Literal' ? n.value : n.quasis[0].value.cooked);
+const isImportMetaUrl = (n) =>
+  n?.type === 'MemberExpression' && n.object.type === 'MetaProperty' && n.object.meta.name === 'import' && !n.computed && n.property.name === 'url';
+const propName = (n) => (n.type === 'MemberExpression' && !n.computed ? n.property.name : n.type === 'Identifier' ? n.name : null);
+const PATHLIKE = /^[^\s<>"'`]{1,260}\.[a-z0-9]{1,10}(?:[?#][^\s]*)?$/i;
+
+/** Texto fijo con el que empieza una expresión de ruta ('./a/' + x → './a/'). */
+function fixedPrefix(n) {
+  if (isStr(n)) return strVal(n);
+  if (n.type === 'TemplateLiteral') return n.quasis[0].value.cooked ?? '';
+  if (n.type === 'BinaryExpression' && n.operator === '+') return fixedPrefix(n.left);
+  return '';
+}
+
+function patternNames(node, out) {
+  if (!node) return;
+  switch (node.type) {
+    case 'Identifier':
+      out.push(node.name);
+      break;
+    case 'ObjectPattern':
+      for (const p of node.properties) patternNames(p.type === 'RestElement' ? p.argument : p.value, out);
+      break;
+    case 'ArrayPattern':
+      for (const e of node.elements) patternNames(e, out);
+      break;
+    case 'RestElement':
+      patternNames(node.argument, out);
+      break;
+    case 'AssignmentPattern':
+      patternNames(node.left, out);
+      break;
+  }
+}
+
+/** Nombres que un script clásico crea en el ámbito global, con su tipo (var | lex). */
+function globalBindings(ast, strict) {
+  const top = new Map();
+  for (const stmt of ast.body) {
+    if (stmt.type === 'VariableDeclaration' && stmt.kind !== 'var') {
+      const names = [];
+      for (const d of stmt.declarations) patternNames(d.id, names);
+      for (const n of names) top.set(n, 'lex');
+    } else if (stmt.type === 'ClassDeclaration') top.set(stmt.id.name, 'lex');
+  }
+  // var y function se elevan al ámbito global desde cualquier bloque (sin cruzar funciones).
+  walk.recursive(ast, null, {
+    Function() {},
+    StaticBlock() {},
+    FunctionDeclaration(node) {
+      // En modo estricto las funciones dentro de bloques no son globales.
+      if (!top.has(node.id.name) && (!strict || ast.body.includes(node))) top.set(node.id.name, 'var');
+    },
+    VariableDeclaration(node, st, c) {
+      if (node.kind === 'var') {
+        const names = [];
+        for (const d of node.declarations) patternNames(d.id, names);
+        for (const n of names) if (!top.has(n)) top.set(n, 'var');
+      }
+      for (const d of node.declarations) if (d.init) c(d.init, st);
+    },
+  });
+  return top;
+}
+
+/**
+ * Analiza un archivo JS.
+ * @param {string} code
+ * @param {{module?: boolean|'auto'}} [opts]
+ */
+export function analyzeJs(code, opts = {}) {
+  const want = opts.module ?? 'auto';
+  let sourceType = want === true ? 'module' : 'script';
+  let ast = tryParse(code, sourceType, LATEST);
+  if (!ast && want === 'auto') {
+    sourceType = 'module';
+    ast = tryParse(code, 'module', LATEST);
+  }
+  if (!ast) {
+    let error;
+    try {
+      parse(code, sourceType, LATEST);
+    } catch (err) {
+      error = err.message;
+    }
+    return { ok: false, error, isModule: sourceType === 'module' };
+  }
+  const isModule = sourceType === 'module';
+  const strict = isModule || ast.body.some((s) => s.directive === 'use strict');
+  const info = {
+    ok: true,
+    isModule,
+    level: detectLevel(code, sourceType),
+    strict,
+    top: isModule ? new Map() : globalBindings(ast, strict),
+    imports: [],
+    workers: [],
+    urls: [],
+    unsafeUrls: [],
+    unsafeImports: [],
+    dynamicImports: 0,
+    strings: new Set(),
+    usesCurrentScript: false,
+    usesDocumentWrite: false,
+    hasImportMeta: false,
+    hasModuleSyntax: false,
+  };
+  const addWorker = (arg, kind, optsNode) => {
+    if (!arg) return;
+    let spec = null;
+    let viaUrl = false;
+    handled.add(arg);
+    if (isStr(arg)) spec = strVal(arg);
+    else if (arg.type === 'NewExpression' && propName(arg.callee) === 'URL' && isStr(arg.arguments[0]) && isImportMetaUrl(arg.arguments[1])) {
+      spec = strVal(arg.arguments[0]);
+      viaUrl = true;
+    }
+    const module =
+      optsNode?.type === 'ObjectExpression' &&
+      optsNode.properties.some(
+        (p) => p.type === 'Property' && (p.key.name === 'type' || p.key.value === 'type') && isStr(p.value) && strVal(p.value) === 'module',
+      );
+    info.workers.push({ spec, kind, module: !!module, viaUrl });
+  };
+  // Textos que ya son rutas de import/worker/new URL: no cuentan como "mencionados".
+  const handled = new Set();
+  const candidates = [];
+  walk.full(ast, (node) => {
+    switch (node.type) {
+      case 'ImportDeclaration':
+      case 'ExportAllDeclaration':
+      case 'ExportNamedDeclaration':
+        info.hasModuleSyntax = true;
+        if (node.source) {
+          handled.add(node.source);
+          info.imports.push({ spec: node.source.value, kind: 'static' });
+        }
+        break;
+      case 'ExportDefaultDeclaration':
+        info.hasModuleSyntax = true;
+        break;
+      case 'ImportExpression':
+        info.dynamicImports++;
+        handled.add(node.source);
+        if (isStr(node.source)) info.imports.push({ spec: strVal(node.source), kind: 'dynamic' });
+        else {
+          info.imports.push({ spec: null, kind: 'dynamic' });
+          // esbuild sabe seguir `./pag/${x}.js` o './pag/' + x (prefijo fijo); una ruta calculada sin prefijo, no.
+          if (!/^\.\.?\//.test(fixedPrefix(node.source))) info.unsafeImports.push(code.slice(node.start, Math.min(node.end, node.start + 80)));
+        }
+        break;
+      case 'MetaProperty':
+        if (node.meta.name === 'import') info.hasImportMeta = true;
+        break;
+      case 'MemberExpression':
+        if (node.object.type === 'Identifier' && node.object.name === 'document' && !node.computed) {
+          if (node.property.name === 'currentScript') info.usesCurrentScript = true;
+          if (node.property.name === 'write' || node.property.name === 'writeln') info.usesDocumentWrite = true;
+        }
+        break;
+      case 'NewExpression': {
+        const name = propName(node.callee);
+        if (name === 'Worker' || name === 'SharedWorker')
+          addWorker(node.arguments[0], name === 'Worker' ? 'worker' : 'sharedworker', node.arguments[1]);
+        else if (name === 'URL' && isImportMetaUrl(node.arguments[1])) {
+          const a = node.arguments[0];
+          handled.add(a);
+          if (isStr(a)) info.urls.push({ spec: strVal(a), start: a.start, end: a.end });
+          else info.unsafeUrls.push(code.slice(node.start, Math.min(node.end, node.start + 80)));
+        }
+        break;
+      }
+      case 'CallExpression': {
+        const callee = node.callee;
+        if (callee.type === 'Identifier' && callee.name === 'importScripts') {
+          for (const a of node.arguments) {
+            handled.add(a);
+            if (isStr(a)) info.workers.push({ spec: strVal(a), kind: 'importScripts', module: false, viaUrl: false });
+          }
+        } else if (
+          callee.type === 'MemberExpression' &&
+          propName(callee) === 'register' &&
+          callee.object.type === 'MemberExpression' &&
+          propName(callee.object) === 'serviceWorker'
+        ) {
+          addWorker(node.arguments[0], 'serviceworker', node.arguments[1]);
+        }
+        break;
+      }
+      case 'Literal':
+        if (typeof node.value === 'string' && PATHLIKE.test(node.value)) candidates.push([node, node.value]);
+        break;
+      case 'TemplateLiteral':
+        if (node.expressions.length === 0 && PATHLIKE.test(node.quasis[0].value.cooked ?? '')) candidates.push([node, node.quasis[0].value.cooked]);
+        break;
+    }
+  });
+  for (const [node, value] of candidates) if (!handled.has(node)) info.strings.add(value);
+  if (!info.usesCurrentScript && /document\s*(?:\.\s*currentScript|\[\s*['"`]currentScript)/.test(code)) info.usesCurrentScript = true;
+  return info;
+}
+
+/** Comprueba que el JS de salida sea sintácticamente válido. */
+export function checkSyntax(code, isModule) {
+  try {
+    parse(code, isModule ? 'module' : 'script', LATEST);
+    return null;
+  } catch (err) {
+    return err.message;
+  }
+}
+
+/**
+ * Compara las globales de un script antes y después de transformarlo.
+ * `allowPrefix` permite nombres nuevos con ese prefijo (los que añade el ofuscador).
+ */
+export function compareGlobals(before, afterCode, allowPrefix = null) {
+  const after = analyzeJs(afterCode, { module: false });
+  if (!after.ok) return { ok: false, reason: `el resultado no es JS válido (${after.error})` };
+  for (const [name, kind] of before) {
+    if (!after.top.has(name)) return { ok: false, reason: `desaparece la global "${name}"` };
+    if (after.top.get(name) !== kind) return { ok: false, reason: `la global "${name}" cambia de tipo (${kind} → ${after.top.get(name)})` };
+  }
+  for (const name of after.top.keys()) {
+    if (!before.has(name) && !(allowPrefix && name.startsWith(allowPrefix)))
+      return { ok: false, reason: `aparece una global nueva "${name}" que podría chocar con otros scripts` };
+  }
+  return { ok: true };
+}
+
+/** Exportaciones e importaciones de un módulo, para comparar antes/después de ofuscar. */
+export function moduleShape(code) {
+  const ast = tryParse(code, 'module', LATEST);
+  if (!ast) return null;
+  const exports = [];
+  const imports = [];
+  // Los atributos (with { type: 'css' }) forman parte del import: perderlos cambia cómo se carga.
+  const src = (s) => `${s.source.value}${(s.attributes ?? []).map((a) => `|${a.key.name ?? a.key.value}=${a.value.value}`).join('')}`;
+  for (const s of ast.body) {
+    if (s.type === 'ExportNamedDeclaration') {
+      for (const sp of s.specifiers) exports.push(sp.exported.name ?? sp.exported.value);
+      if (s.declaration) {
+        if (s.declaration.id) exports.push(s.declaration.id.name);
+        else if (s.declaration.declarations) for (const d of s.declaration.declarations) patternNames(d.id, exports);
+      }
+      if (s.source) imports.push(src(s));
+    } else if (s.type === 'ExportDefaultDeclaration') exports.push('default');
+    else if (s.type === 'ExportAllDeclaration') {
+      exports.push(`*${s.exported ? `:${s.exported.name ?? s.exported.value}` : ''}`);
+      imports.push(src(s));
+    } else if (s.type === 'ImportDeclaration') imports.push(src(s));
+  }
+  return { exports: exports.sort().join(','), imports: imports.sort().join(',') };
+}
+
+export { VERSIONS };

package/src/obfuscate.js

@@ -0,0 +1,160 @@
+// Ofuscación con javascript-obfuscator (dependencia opcional), con ajustes seguros y verificación del resultado.
+import * as acorn from 'acorn';
+import { shortHash } from './util.js';
+import { compareGlobals, moduleShape, checkSyntax } from './jsinfo.js';
+import { importOptional } from './optional.js';
+
+// Nunca se activan solos: cambian el comportamiento o rompen código que comparte globales.
+const FORCED_SAFE = { renameGlobals: false, renameProperties: false, sourceMap: false, target: 'browser' };
+
+const BASE = {
+  compact: true,
+  simplify: true,
+  identifierNamesGenerator: 'hexadecimal',
+  stringArray: true,
+  stringArrayRotate: true,
+  stringArrayShuffle: true,
+  stringArrayIndexShift: true,
+  stringArrayWrappersCount: 1,
+  stringArrayWrappersType: 'variable',
+  stringArrayThreshold: 0.75,
+  stringArrayEncoding: [],
+  controlFlowFlattening: false,
+  deadCodeInjection: false,
+  numbersToExpressions: false,
+  splitStrings: false,
+  transformObjectKeys: false,
+  selfDefending: false,
+  debugProtection: false,
+  disableConsoleOutput: false,
+  unicodeEscapeSequence: false,
+};
+
+export const PRESETS = {
+  // Rápido y casi sin coste de rendimiento.
+  low: { ...BASE },
+  // Equilibrio recomendado.
+  medium: {
+    ...BASE,
+    controlFlowFlattening: true,
+    controlFlowFlatteningThreshold: 0.5,
+    deadCodeInjection: true,
+    deadCodeInjectionThreshold: 0.2,
+    numbersToExpressions: true,
+    splitStrings: true,
+    splitStringsChunkLength: 10,
+    stringArrayEncoding: ['base64'],
+    stringArrayWrappersCount: 2,
+    stringArrayThreshold: 0.8,
+  },
+  high: {
+    ...BASE,
+    controlFlowFlattening: true,
+    controlFlowFlatteningThreshold: 0.75,
+    deadCodeInjection: true,
+    deadCodeInjectionThreshold: 0.4,
+    numbersToExpressions: true,
+    splitStrings: true,
+    splitStringsChunkLength: 5,
+    stringArrayEncoding: ['rc4'],
+    stringArrayWrappersCount: 5,
+    stringArrayWrappersChainedCalls: true,
+    stringArrayWrappersParametersMaxCount: 5,
+    stringArrayWrappersType: 'function',
+    stringArrayThreshold: 1,
+    transformObjectKeys: true,
+  },
+  // Máxima protección: además se defiende de ser formateado o modificado. Más lento y pesado.
+  max: {
+    ...BASE,
+    controlFlowFlattening: true,
+    controlFlowFlatteningThreshold: 1,
+    deadCodeInjection: true,
+    deadCodeInjectionThreshold: 0.5,
+    numbersToExpressions: true,
+    splitStrings: true,
+    splitStringsChunkLength: 3,
+    stringArrayEncoding: ['rc4'],
+    stringArrayWrappersCount: 5,
+    stringArrayWrappersChainedCalls: true,
+    stringArrayWrappersParametersMaxCount: 5,
+    stringArrayWrappersType: 'function',
+    stringArrayCallsTransform: true,
+    stringArrayCallsTransformThreshold: 1,
+    stringArrayThreshold: 1,
+    transformObjectKeys: true,
+    selfDefending: true,
+  },
+};
+
+/** Opciones finales: preset, o preset "low" + opciones del usuario. */
+export function resolveObfuscatorOptions(setting) {
+  if (!setting) return null;
+  if (typeof setting === 'string') return { ...PRESETS[setting], ...FORCED_SAFE };
+  const { preset = 'low', ...custom } = setting;
+  // El usuario puede activar renameGlobals para módulos bajo su responsabilidad; nunca se aplica a scripts clásicos.
+  return { ...(PRESETS[preset] ?? PRESETS.low), ...FORCED_SAFE, ...custom, sourceMap: false };
+}
+
+let engine = null;
+
+/** Carga javascript-obfuscator (instalado junto a Builder o en el proyecto). */
+export async function ensureObfuscator(projectRoot) {
+  if (!engine) {
+    const mod = await importOptional('javascript-obfuscator', projectRoot, 'para ofuscar el JavaScript');
+    engine = mod.default ?? mod;
+  }
+  return engine;
+}
+
+/** Comentarios legales (/*! ... *\/, @license, @preserve): el ofuscador los borra y se reponen al final. */
+function legalComments(code, isModule) {
+  const found = [];
+  try {
+    acorn.parse(code, {
+      ecmaVersion: 'latest',
+      sourceType: isModule ? 'module' : 'script',
+      allowHashBang: true,
+      onComment: (block, text) => {
+        if (/^!|@license|@preserve/.test(text)) found.push(block ? `/*${text}*/` : `//${text}`);
+      },
+    });
+  } catch {
+    return '';
+  }
+  return [...new Set(found)].join('\n');
+}
+
+/**
+ * Ofusca un archivo y verifica que siga siendo equivalente en lo que se puede comprobar:
+ * - scripts clásicos: mismas globales (más las del ofuscador, con prefijo propio);
+ * - módulos: mismas exportaciones, importaciones y atributos de import.
+ * Si algo no cuadra devuelve {code: null, reason} y se conserva la versión sin ofuscar.
+ */
+export function obfuscateSafe(code, { isModule, options, id, globals }) {
+  if (!engine) throw new Error('javascript-obfuscator no está cargado (llama antes a ensureObfuscator)');
+  const body = code;
+  const legal = legalComments(code, isModule);
+  const prefix = `_${shortHash(id, 6)}`;
+  // Semilla derivada del contenido: la misma entrada produce siempre la misma salida (caché y diffs estables).
+  const opts = { ...options, seed: shortHash(`${id}\0${body}`, 12), identifiersPrefix: prefix };
+  if (!isModule) opts.renameGlobals = false;
+  let out;
+  try {
+    out = engine.obfuscate(body, opts).getObfuscatedCode();
+  } catch (err) {
+    return { code: null, reason: `el ofuscador falló (${String(err.message).split('\n')[0]})` };
+  }
+  if (isModule) {
+    const err = checkSyntax(out, true);
+    if (err) return { code: null, reason: `resultado inválido (${err})` };
+    const a = moduleShape(body);
+    const b = moduleShape(out);
+    if (!a || !b || a.exports !== b.exports || a.imports !== b.imports)
+      return { code: null, reason: 'cambiaron las exportaciones o importaciones del módulo' };
+  } else {
+    const cmp = compareGlobals(globals, out, prefix);
+    if (!cmp.ok) return { code: null, reason: cmp.reason };
+  }
+  return { code: legal ? `${out}\n${legal}\n` : out };
+}

package/src/optional.js

@@ -0,0 +1,38 @@
+// Carga de dependencias opcionales (ofuscador, terser): solo se instalan si se usan.
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { BuildError } from './util.js';
+
+const cache = new Map();
+
+/**
+ * Importa un paquete opcional buscándolo primero junto a Builder y después en el proyecto
+ * (útil si Builder está instalado de forma global).
+ */
+export async function importOptional(name, projectRoot, purpose) {
+  if (cache.has(name)) return cache.get(name);
+  let mod = null;
+  try {
+    mod = await import(name);
+  } catch (err) {
+    if (!isNotFound(err, name)) throw err;
+    try {
+      const req = createRequire(path.join(projectRoot ?? process.cwd(), 'package.json'));
+      mod = await import(pathToFileURL(req.resolve(name)).href);
+    } catch (err2) {
+      if (!isNotFound(err2, name)) throw err2;
+    }
+  }
+  if (!mod)
+    throw new BuildError(`Falta el paquete opcional "${name}" ${purpose}.`, [
+      `Instálalo una vez con:  npm install --save-dev ${name}`,
+      'Builder lo carga solo cuando hace falta, por eso no viene incluido (así la instalación base es ligera).',
+    ]);
+  cache.set(name, mod);
+  return mod;
+}
+
+function isNotFound(err, name) {
+  return (err?.code === 'ERR_MODULE_NOT_FOUND' || err?.code === 'MODULE_NOT_FOUND') && String(err.message).includes(name);
+}

package/src/output.js

@@ -0,0 +1,100 @@
+// Salida: se escribe primero en una carpeta temporal y solo se reemplaza dist/ si todo salió bien.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { BuildError, isInside, retryFs, copyDir } from './util.js';
+
+export const MANIFEST = '.builder-manifest.json';
+
+/** Comprueba que outDir sea un destino seguro antes de tocar nada. */
+export function assertSafeOutDir(cfg, { force = false } = {}) {
+  const out = path.resolve(cfg.outDir);
+  const root = path.resolve(cfg.root);
+  const parsed = path.parse(out);
+  const same = (a, b) => path.relative(a, b) === '';
+  if (same(out, root)) throw new BuildError('"outDir" no puede ser la propia carpeta del proyecto: se borraría el código fuente.');
+  if (isInside(out, root)) throw new BuildError(`"outDir" (${out}) contiene al proyecto; se borraría el código fuente.`);
+  if (same(out, parsed.root)) throw new BuildError('"outDir" no puede ser la raíz de una unidad.');
+  if (same(out, os.homedir())) throw new BuildError('"outDir" no puede ser tu carpeta de usuario.');
+  if (!cfg.clean || force) return;
+  if (fs.existsSync(out)) {
+    if (!fs.statSync(out).isDirectory()) throw new BuildError(`"outDir" existe y no es una carpeta: ${out}`);
+    const entries = fs.readdirSync(out);
+    if (entries.length && !entries.includes(MANIFEST))
+      throw new BuildError(`La carpeta de salida ${out} ya tiene archivos y no la creó Builder. No la borro para no perder datos.`, [
+        'Elige otra carpeta con --out, vacíala tú mismo o usa --force si estás seguro.',
+      ]);
+  }
+}
+
+/** Escribe todos los archivos en una carpeta temporal junto a outDir. */
+export async function writeStaging(cfg, outputs) {
+  const out = path.resolve(cfg.outDir);
+  const staging = path.join(path.dirname(out), `.${path.basename(out)}.builder-tmp-${process.pid}-${Date.now().toString(36)}`);
+  await fs.promises.mkdir(staging, { recursive: true });
+  const dirs = new Set();
+  for (const rel of outputs.keys()) dirs.add(path.dirname(path.join(staging, rel)));
+  for (const d of [...dirs].sort()) await fs.promises.mkdir(d, { recursive: true });
+  const list = [...outputs.entries()];
+  const CONCURRENCY = 16;
+  for (let i = 0; i < list.length; i += CONCURRENCY) {
+    await Promise.all(
+      list.slice(i, i + CONCURRENCY).map(async ([rel, o]) => {
+        const dest = path.join(staging, rel);
+        if (o.copyFrom) await retryFs(() => fs.promises.copyFile(o.copyFrom, dest));
+        else await retryFs(() => fs.promises.writeFile(dest, o.data));
+      }),
+    );
+  }
+  return staging;
+}
+
+export async function writeManifest(dir, manifest) {
+  await fs.promises.writeFile(path.join(dir, MANIFEST), `${JSON.stringify(manifest, null, 2)}\n`);
+}
+
+async function rmrf(dir) {
+  await retryFs(() => fs.promises.rm(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }));
+}
+
+/**
+ * Sustituye outDir por la carpeta temporal. Si outDir no se puede renombrar (bloqueos de OneDrive/antivirus),
+ * se vacía su contenido y se copia el nuevo.
+ */
+export async function swapIntoPlace(cfg, staging) {
+  const out = path.resolve(cfg.outDir);
+  const old = path.join(path.dirname(out), `.${path.basename(out)}.builder-old-${process.pid}-${Date.now().toString(36)}`);
+  const exists = fs.existsSync(out);
+  if (exists && !cfg.clean) {
+    // Sin limpiar: se copian encima los archivos nuevos y se conserva lo demás.
+    await copyDir(staging, out);
+    await rmrf(staging);
+    return;
+  }
+  if (exists) {
+    try {
+      await retryFs(() => fs.promises.rename(out, old));
+    } catch {
+      for (const name of await fs.promises.readdir(out)) await rmrf(path.join(out, name));
+      await copyDir(staging, out);
+      await rmrf(staging);
+      return;
+    }
+  }
+  try {
+    await retryFs(() => fs.promises.rename(staging, out));
+  } catch (err) {
+    try {
+      await copyDir(staging, out);
+      await rmrf(staging);
+    } catch (copyErr) {
+      if (exists) await retryFs(() => fs.promises.rename(old, out)).catch(() => {});
+      throw new BuildError(`No pude colocar la salida en ${out}: ${copyErr.message ?? err.message}`);
+    }
+  }
+  if (exists) await rmrf(old).catch(() => {});
+}
+
+export async function discardStaging(staging) {
+  if (staging) await rmrf(staging).catch(() => {});
+}

package/src/report.js

@@ -0,0 +1,79 @@
+// Informe de tamaños (original, final, gzip y brotli) por archivo y totales.
+import zlib from 'node:zlib';
+import { formatBytes } from './util.js';
+
+const COMPRESSIBLE = new Set(['html', 'css', 'js', 'json', 'svg', 'text']);
+
+export function sizesOf(buf, type) {
+  const size = buf.length;
+  if (!COMPRESSIBLE.has(type) || size === 0) return { size, gzip: null, brotli: null };
+  return {
+    size,
+    gzip: zlib.gzipSync(buf, { level: 9 }).length,
+    brotli: zlib.brotliCompressSync(buf, { params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 11 } }).length,
+  };
+}
+
+/** Filas del informe a partir de las salidas. */
+export function buildReport(outputs) {
+  const rows = [];
+  let compressed = 0;
+  for (const [rel, o] of outputs) {
+    if (o.type === 'compressed') {
+      compressed++;
+      continue;
+    }
+    if (o.copyFrom) {
+      rows.push({ file: rel, type: o.type, action: o.action, sources: o.sources, before: o.size, size: o.size, gzip: null, brotli: null });
+      continue;
+    }
+    const s = sizesOf(o.data, o.type);
+    rows.push({ file: rel, type: o.type, action: o.action, sources: o.sources, before: o.before ?? s.size, ...s });
+  }
+  rows.sort((a, b) => (a.type === b.type ? a.file.localeCompare(b.file) : order(a.type) - order(b.type)));
+  const totals = { before: 0, size: 0, gzip: 0, brotli: 0, files: rows.length };
+  const byType = {};
+  for (const r of rows) {
+    totals.before += r.before;
+    totals.size += r.size;
+    totals.gzip += r.gzip ?? r.size;
+    totals.brotli += r.brotli ?? r.size;
+    const t = (byType[r.type] ??= { files: 0, before: 0, size: 0 });
+    t.files++;
+    t.before += r.before;
+    t.size += r.size;
+  }
+  return { rows, totals, byType, compressed };
+}
+
+const ORDER = ['html', 'js', 'css', 'json', 'svg', 'text', 'asset'];
+const order = (t) => (ORDER.includes(t) ? ORDER.indexOf(t) : ORDER.length);
+
+const pct = (before, after) => (before > 0 ? `${(((before - after) / before) * 100).toFixed(1)}%` : '—');
+
+/** Tabla para la terminal. Los recursos copiados sin cambios se resumen en una línea. */
+export function renderReport(report, C, { verbose = false } = {}) {
+  const lines = [];
+  const shown = report.rows.filter((r) => verbose || r.action !== 'copy');
+  const hidden = report.rows.filter((r) => !verbose && r.action === 'copy');
+  const hiddenLabel = `+ ${hidden.length} recursos copiados sin cambios`;
+  const w = Math.min(60, Math.max(20, ...shown.map((r) => r.file.length), hidden.length ? hiddenLabel.length : 0));
+  const pad = (s, n) => (s.length > n ? `…${s.slice(-(n - 1))}` : s.padEnd(n));
+  const num = (n) => (n == null ? '—' : formatBytes(n)).padStart(10);
+  lines.push(
+    C.gray(`${'Archivo'.padEnd(w)}  ${'Antes'.padStart(10)}  ${'Después'.padStart(10)}  ${'gzip'.padStart(10)}  ${'brotli'.padStart(10)}  Ahorro`),
+  );
+  for (const r of shown) {
+    const src = r.sources && r.sources.length > 1 ? C.gray(` (${r.sources.length} archivos)`) : '';
+    lines.push(`${pad(r.file, w)}  ${num(r.before)}  ${num(r.size)}  ${num(r.gzip)}  ${num(r.brotli)}  ${pct(r.before, r.size).padStart(6)}${src}`);
+  }
+  if (hidden.length) {
+    const size = hidden.reduce((a, r) => a + r.size, 0);
+    lines.push(C.gray(`${pad(hiddenLabel, w)}  ${num(size)}  ${num(size)}`));
+  }
+  const t = report.totals;
+  lines.push(
+    C.bold(`${'Total'.padEnd(w)}  ${num(t.before)}  ${num(t.size)}  ${num(t.gzip)}  ${num(t.brotli)}  ${pct(t.before, t.size).padStart(6)}`),
+  );
+  return lines.join('\n');
+}