Documentation

Guides for protecting production JavaScript

Reference guides for release workflows, command-line usage, cross-file protections, and the desktop app.

Inside The Docs

Practical guides, not placeholder pages.

How-to guides Start with release sequencing and command-line usage, then move into feature-specific references.
Advanced protection Browse cross-file controls like Replace Globals and Protect Members when a build spans multiple scripts.

npm CLI Presets and Options

  • npm CLI, Node API, build plugins

Use presets for a quick start, then override individual HTTP API options from config or CI when a release needs tighter behavior.

Inspect presets from the CLI

jso-protector --list-presets
jso-protector --list-presets --json
standard
Core string encoding, string movement, name replacement, and compression. balanced
Adds short local names, deep obfuscation, code transposition, string encryption, and flat transform. maximum
Adds member/global renaming, member movement, and low dead-code insertion.

Inspect option names

jso-protector --list-options
jso-protector --list-options --json

The JSON output is useful for internal release tooling that wants to render approved option choices or validate CI overrides.

Inspect resolved config

Use --validate-config --json to catch malformed fields, missing credentials, invalid endpoint URLs, bad size budgets, and likely option-name typos before a release job runs.

jso-protector --config jso.config.json --validate-config --json

Use --print-config --json to see merged settings without leaking dashboard credentials.

jso-protector --config jso.config.json --print-config --json

Common option groups

Strings
EncodeStrings, MoveStrings, EncryptStrings Names
ReplaceNames, RenameGlobals, RenameMembers, VariableExclusion, IdentityStyle
Compression
SelfCompression, SelfCompressionMinSize, CompressionRatio Control flow
DeepObfuscate, ReorderCode, FlatTransform, AddDeadCode, DeadcodeLevel
Locks
LockDomain, LockDomainList, LockDomainMsg, LockDate, LockDateValue, LockDateMsg Output and runtime
OptimizationMode, WriteFormats, WriteFormats_KeepIndent, WriteFormats_LineNumbers
Runtime defense
DebugProtection, SelfDefending, RuntimeDefenseAction, RuntimeDefenseCallback, RuntimeDefenseBeaconUrl, DetectHeadlessBrowser Runtime locks
RuntimeSessionToken, RuntimeSessionVariable, RuntimeFingerprintAllow, RuntimeChallengeVariable, RuntimeSignedEnvelopeVariable

See Runtime Defense for callback, beacon, fingerprint, challenge, and signed-envelope examples.

Override from CI

jso-protector --config jso.config.json --option LockDomain=true --option LockDomainList=example.com

Repeat --reserved-name to preserve public entry points without editing shared config.

jso-protector --config jso.config.json --reserved-name "^PublicApi$" --reserved-name "^renderWidget$"