# jso-protector Examples

These examples show the common release patterns:

- `cli-basic`: protect a generated `dist/` folder after any build tool, with JSON and CommonJS config examples.
- `node-api`: protect a generated `dist/` folder from custom Node.js release scripts, including a typed release-summary script.
- `electron-app` scaffold: run `jso-protector --init --init-template electron-app` when an Electron packager writes a release folder that mixes Node-oriented JavaScript with copied app assets.
- `browserify`: protect selected Browserify modules through a transform.
- `metro.config.js`: wrap Metro or Expo serializer output so React Native release bundles are protected.
- `react-native/metro.config.js`: use the React Native alias entrypoint when project docs or templates expect a dedicated React Native package path.
- `nextjs`: wrap `next.config.js` so production client bundles are protected automatically.
- `rspack`: protect emitted Rspack assets or selected modules through the Rspack loader alias.
- `vite`: protect emitted Vite chunks.
- `rollup`: protect emitted Rollup chunks.
- `esbuild`: protect esbuild output.
- `webpack`: protect emitted Webpack assets.
- `webpack-loader`: protect selected Webpack modules through a loader.
- `gulp`: protect files in a legacy Gulp release task.
- `grunt`: protect file mappings in a legacy Grunt release task.

Install this package from the local workspace path or an internal tarball before running examples. It is intentionally not published to npm:

```bash
npm install --save-dev ../packages/jso-protector
```

All examples expect API credentials in environment variables:

```bash
set JSO_API_KEY=base64-api-key-from-dashboard
set JSO_API_PASSWORD=base64-api-password-from-dashboard
```

Use CI secrets for shared pipelines.

Run `npm run preflight` in `examples/cli-basic` before protection when you want one offline release check that validates config, confirms matched files/assets, and runs doctor checks without sending source code to the API.

Use `jso.config.json` for schema-friendly static config. Use `jso.config.cjs` when CI needs environment-aware inputs, outputs, presets, or release domain settings. JavaScript config files execute as Node.js code, so only load them from trusted repositories.

## Protected regions

Projects migrating from `javascript-obfuscator` can preserve source regions marked with conditional comments by setting `honorConditionalComments: true` in CLI, Node API, or build-plugin config. The protector sends only enabled regions to the hosted API and recomposes the original file afterward.

```js
jsoProtector({
  apiKey: process.env.JSO_API_KEY,
  apiPassword: process.env.JSO_API_PASSWORD,
  preset: "balanced",
  honorConditionalComments: true
});
```

```js
console.log("protect this");
// javascript-obfuscator:disable
console.log("leave this exact code alone");
// javascript-obfuscator:enable
```
