Miasma/scripts/scramble-shared.ts

import { randomBytes } from "crypto";
import { promises as fs } from "fs";

import type { StringScrambler } from "../src/utils/stringtool";

/**
 * Sentinel string in `src/utils/runtimeDecoder.ts` that the build
 * pipelines rewrite with the freshly-generated passphrase for the
 * current build.
 *
 * Keep this in sync with the literal in `runtimeDecoder.ts`.
 */
export const RUNTIME_PASSPHRASE_PLACEHOLDER =
  "__SCRAMBLE_BUILD_PASSPHRASE__";

/**
 * Sentinel string for the per-build salt injected into the runtime
 * decoder. Same mechanism as the passphrase placeholder.
 */
export const RUNTIME_SALT_PLACEHOLDER = "__SCRAMBLE_BUILD_SALT__";

export const RUNTIME_FN_NAME_PLACEHOLDER = "__SCRAMBLE_FN_NAME__";

export const RUNTIME_DECODER_PATH = "src/utils/runtimeDecoder.ts";

/**
 * Regex used to find `scramble(...)` calls in source code.
 *
 * Accepts either a double-quoted or backtick-quoted single string
 * literal as the only argument. Single-quoted strings, concatenations,
 * and template interpolations are intentionally not supported — those
 * would not survive the textual transform safely.
 */
export const SCRAMBLE_CALL_REGEX =
  /scramble\(\s*(`[\s\S]*?`|"[\s\S]*?")\s*,?\s*\)/g;

/**
 * Regex used to strip out `declare function scramble(...)` lines from
 * the transformed source. The runtime has no `scramble` symbol — only
 * `beautify` — so the declaration is dead weight at runtime.
 */
export const SCRAMBLE_DECLARE_REGEX =
  /declare\s+function\s+scramble[^;]*;\s*\n?/g;

/**
 * Generates a fresh random passphrase to be used for this build.
 *
 * The passphrase is 64 hex characters (32 random bytes). It is meant to
 * be ephemeral: it is generated once per build, used to encode every
 * `scramble(...)` call site, and then baked into the runtime decoder so
 * that decoding works at runtime without any environment variables.
 */
export function generateBuildPassphrase(): string {
  return randomBytes(32).toString("hex");
}

export function generateBuildSalt(): string {
  return randomBytes(16).toString("hex");
}

export function generateFunctionName(): string {
  return "f" + randomBytes(4).toString("hex");
}

/**
 * Transforms a single source file's text by replacing every
 * `scramble("...")` / `` scramble(`...`) `` call with a
 * `beautify("<base64>")` call encoded with the supplied
 * scrambler, and stripping out the matching `declare function scramble`
 * statements.
 *
 * The transform is purely textual; it makes no attempt to parse the
 * source. The constraints documented on `SCRAMBLE_CALL_REGEX` apply.
 *
 * @param code         The original source code.
 * @param scrambler    The `StringScrambler` to use for encoding.
 * @param logPrefix    Optional log prefix for build output (e.g. "[BUILD]").
 * @param sourceLabel  Optional label (filename) included in log output.
 */
export function transformSource(
  code: string,
  scrambler: StringScrambler,
  fnName: string,
  logPrefix = "[SCRAMBLE]",
  sourceLabel?: string,
): { code: string; replacements: number } {
  let replacements = 0;

  const transformed = code.replace(
    SCRAMBLE_CALL_REGEX,
    (_match, str: string) => {
      const inner = str.slice(1, -1);
      const encoded = scrambler.encode(inner);
      replacements++;
      const where = sourceLabel ? ` in ${sourceLabel}` : "";
      console.log(
        `${logPrefix} scramble(${str.slice(0, 32)}...) -> ${fnName}("${encoded.slice(0, 16)}...")${where}`,
      );
      return `${fnName}(${JSON.stringify(encoded)})`;
    },
  );

  const stripped = transformed.replace(SCRAMBLE_DECLARE_REGEX, "");

  return { code: stripped, replacements };
}

/**
 * Reads the runtime decoder source, replaces the build-time placeholder
 * passphrase with the supplied real passphrase, and returns the new
 * contents. The original file on disk is NOT modified — callers are
 * expected to write the rewritten contents to a temp/output location.
 *
 * Throws if the placeholder cannot be found, which would otherwise
 * silently produce a bundle that decodes to garbage at runtime.
 */
export async function rewriteRuntimeDecoder(
  decoderPath: string,
  passphrase: string,
  salt: string,
  fnName: string,
): Promise<string> {
  const original = await fs.readFile(decoderPath, "utf-8");

  let code = original;

  for (const [placeholder, value] of [
    [RUNTIME_PASSPHRASE_PLACEHOLDER, passphrase],
    [RUNTIME_SALT_PLACEHOLDER, salt],
    [RUNTIME_FN_NAME_PLACEHOLDER, fnName],
  ] as const) {
    if (!code.includes(placeholder)) {
      throw new Error(
        `[SCRAMBLE] Could not find placeholder "${placeholder}" in ${decoderPath}.`,
      );
    }
    const quoted = `"${placeholder}"`;
    code = code.split(quoted).join(JSON.stringify(value));
  }

  return code;
}