| HMAC-SHA256 watermark embedding + verifier | jso-protector --watermark / --verify-watermark / --scan-watermarks. Wire format mirrored in Python (jso_protector.watermark) and .NET (JsoProtector.Watermark). Spec: WireFormat.aspx. | Shipping |
| Ed25519-signed release attestation (SLSA-style) | jso-protector --sign-release / --verify-release with two-stage verify (signature + on-disk re-hash). --genkey-release mints fresh keypairs. Spec: WireFormat.aspx. | Shipping |
| Pre-flight quota gate | jso-protector --estimate walks input files + reads /v1/ai/usage; three gate states (OK / WARN / FAIL). | Shipping |
| Migration review assistant | jso-protector --migration-review emits one source-free owner packet with a Migration Review Assistant for BYO AI or internal reviewers, covering manual review tracks, source-map policy, identifier-cache replacement, runtime-defense behavior, source-reading command boundaries, release metadata, and protected-build smoke. | Shipping |
| Identifier-cache review assistant | jso-protector --identifier-cache-review turns deterministic cache and custom dictionary migration assumptions into a source-free Identifier Cache Review Assistant for BYO AI or internal reviewers, covering reserved-name coverage, release metadata, and protected-build smoke. | Shipping |
| Runtime-defense review assistant | jso-protector --runtime-defense-review turns anti-debug, self-defending, runtime lock, console, and countermeasure migration assumptions into a source-free Runtime Defense Review Assistant for BYO AI or internal reviewers, covering runtime behavior scope, monitoring handoff, countermeasure policy, domain/date lock smoke, source-reading compatibility scan, release metadata, and protected-build smoke. | Shipping |
| Competitor gap review assistant | jso-protector --competitor-gap-report --json groups covered, partial, and gap areas, pins the public-source snapshot date, lists follow-up reviewer artifacts, and emits a source-free Competitor Gap Review Assistant for BYO AI or internal reviewers. | Shipping |
| Source-map evidence assistant | jso-protector --source-map-evidence verifies the protected manifest, audits .map files and sourceMappingURL comments, then emits a source-free Source Map Review Assistant for BYO AI or internal reviewers without sharing raw maps, original source paths, source code, protected output, customer data, or secrets. | Shipping |
| Deployment hygiene evidence | jso-protector --deployment-hygiene-evidence turns the tools/Build-UpdatedArchives.ps1 -ReportPath archive hygiene JSON into a source-free reviewer packet with blocked-entry status, required-entry gaps, operator checklist, rotation triggers, SHA-256, and Review Assistant boundaries. | Shipping |
| GitHub Action opt-in inputs | javascriptobfuscator/[email protected] exposes release-check, competitor-gap-report, migration-review, migration-review-report, payment-script-inventory, runtime-inventory-snapshot, script-inventory-audit-report, payment-page-har, payment-page-headers-baseline, payment-page-url-pattern, payment-page-headers-report, pci-dss-v4-evidence, pci-dss-v4-report, pci-dss-v4-json-report, source-map-evidence, source-map-evidence-report, runtime-incident-export, runtime-incident-evidence-report, vm-proof-pack, vm-proof-pack-report, ai-resistance-evidence, ai-resistance-evidence-report, watermark, watermark-key, sign-release-key, ai-precheck, estimate as inputs; outputs source-free preflight and migration-review reports, source-map evidence, runtime incident evidence, VM proof, AI-resistance evidence, payment-page audit report paths, payment-page security-header report paths, and PCI DSS v4 report paths plus the .sig path for downstream upload-artifact steps. | Shipping |
| Cross-language conformance vectors | Eight pinned wire-format vectors in packages/jso-protector/test/wire-format-vectors.test.js. Reference for any new language port. | Shipping |