Every artifact JSO builds, in one table. Use this page when running procurement, when scoping a JSO rollout into a new team's stack, or when answering "do you have a thing for X?". For deep documentation per artifact follow the linked rows.
Read the status column before planning around a row.
For package rows, only
Shipping means the named package is installable today from its public registry. For hosted features and web tools, Shipping means the linked production surface is available now; it does not imply a separate package.
Unreleased rows are written and tested in our tree but are
not on npm, PyPI, NuGet, RubyGems, Packagist, crates.io, Maven Central, the VS Code
Marketplace or the JetBrains Marketplace — so a package-manager install of them will fail.
If you need one of those languages, contact us and we will prioritise publishing it rather than
leave you to discover the gap. As of this snapshot the published client is Node
(
jso-protector on npm);
the build-tool plugins, CI templates, Kubernetes manifests and CLI tooling below ship inside that
same package, which is why they are marked Shipping.
Language clients
Same protect() shape across every language. See the clients reference for side-by-side code examples.
| Language | Package | Min runtime | HTTP transport | Status |
|---|
| Node | jso-protector (npm) | Node ≥18 | built-in fetch | Shipping |
| Python | jso-protector (PyPI) | Python ≥3.8 | stdlib urllib | Unreleased |
| Go | jso-protector-go | Go ≥1.21 | stdlib net/http | Unreleased |
| .NET | JsoProtector (NuGet) | .NET Standard 2.0 | HttpClient | Unreleased |
| Ruby | jso_protector (RubyGems) | Ruby ≥2.7 | stdlib net/http | Unreleased |
| PHP | javascriptobfuscator/jso-protector (Packagist) | PHP ≥7.4 | ext-curl + stream fallback | Unreleased |
| Rust | jso-protector (crates.io) | Rust ≥1.70 | ureq (sync, rustls) | Unreleased |
| Java | com.javascriptobfuscator:jso-protector (Maven Central) | JDK ≥11 | stdlib java.net.http.HttpClient | Unreleased |
| Kotlin | com.javascriptobfuscator:jso-protector-kotlin (Maven Central) | Kotlin ≥1.9, JDK 11+ | stdlib java.net.http.HttpClient with coroutines | Unreleased |
| Anything else | Wire-format spec + JSON Schema + examples/curl/protect.sh | POSIX shell | curl + jq | Reference |
Windows desktop
| Mode | Boundary | Status |
|---|
| WinUI 3 Local Standard | Offline basic identifier protection for plain ES5 .js; no API credentials. ES2015+ syntax and advanced transforms require Local Advanced or hosted mode. | Shipping |
| WinUI 3 Local Advanced | Paid source-local protection for plain modern .js/.jsx after an online entitlement/option check. Supported advanced transforms and Runtime Defense run on-device; mixed files, VM bytecode, hosted reports, and disconnected licensing are excluded. | Shipping in v3.3.0 |
| WinUI 3 hosted mode | Modern syntax, Standard / Balanced / Maximum presets, mixed files, Runtime Defense, and reports through the hosted service. | Shipping |
| Windows Forms | Lightweight desktop project client using the hosted service. | Shipping |
IDE integrations
Right-click Obfuscate File / Obfuscate Selection from any JS/TS file. Three presets, env-var-first credentials. Same wire format as the CLI.
| Editor family | Package | Status |
|---|
| VS Code, Cursor, VSCodium | javascript-obfuscator-vscode (VS Code Marketplace) | Unreleased |
| WebStorm, IDEA Ultimate, PhpStorm, PyCharm Professional, RubyMine, GoLand, Rider | com.javascriptobfuscator.jetbrains (JetBrains Marketplace) | Unreleased |
Build-tool plugins (via jso-protector npm CLI)
| Bundler / framework | Entry point | Status |
|---|
| Vite | jso-protector/vite | Shipping |
| Webpack / Rspack | jso-protector/webpack, jso-protector/webpack-loader, jso-protector/rspack | Shipping |
| Rollup | jso-protector/rollup | Shipping |
| esbuild | jso-protector/esbuild | Shipping |
| Next.js | jso-protector/next | Shipping |
| Parcel | jso-protector/parcel | Shipping |
| Metro / React Native | jso-protector/metro, jso-protector/react-native | Shipping |
| Bun | jso-protector/bun | Shipping |
| Turbopack | jso-protector/turbopack | Shipping |
| Browserify, Gulp, Grunt | jso-protector/browserify, /gulp, /grunt | Shipping |
CI/CD templates
All thirteen templates ship inside node_modules/jso-protector/ci/. Every one calls --label "$COMMIT_SHA" and archives the API report. Convention enforced by a verify:ci npm script and a verify:polyglot cross-client wire-format check.
| System | Template file | Status |
|---|
| GitHub Actions | ci/github-actions.yml ships in the npm package. The separate composite Action is not published to the GitHub Marketplace yet — use the workflow YAML. | Shipping composite Action Unreleased |
| GitLab CI | ci/gitlab-ci.yml | Shipping |
| CircleCI | ci/circleci.yml | Shipping |
| Jenkins | ci/Jenkinsfile | Shipping |
| Azure Pipelines | ci/azure-pipelines.yml | Shipping |
| Bitbucket Pipelines | ci/bitbucket-pipelines.yml | Shipping |
| Drone CI | ci/drone.yml | Shipping |
| Buildkite | ci/buildkite.yml | Shipping |
| Woodpecker CI | ci/woodpecker.yml | Shipping |
| Tekton Pipelines | ci/tekton.yaml | Shipping |
| TeamCity Kotlin DSL | ci/teamcity.kts | Shipping |
| GoCD | ci/gocd.yaml | Shipping |
| Argo Workflows | ci/argo-workflows.yaml | Shipping |
Kubernetes-native deployment
| Pattern | Where | Status |
|---|
| Standalone Job manifest | packages/jso-protector/examples/kubernetes/job.yaml | Shipping |
Helm chart (Job or CronJob via cron.schedule) | packages/jso-protector/examples/helm/ | Shipping |
| Tekton Task + Pipeline | ci/tekton.yaml | Shipping |
| Argo Workflows | ci/argo-workflows.yaml | Shipping |
Stack-trace symbolication
Local demangling of obfuscated stack traces. Maps stay on the customer machine. See the symbolication doc.
| Component | Detail | Status |
|---|
jso-symbolicate CLI | Versioned direct-download package; not currently published on npm. | Direct download |
| Interactive web demo | /symbolicate-demo.aspx — paste a stack + map, browser-only demangling | Shipping |
| Sentry / Bugsnag / Rollbar / Datadog / Honeybadger / Raygun / Airbrake / AppSignal | beforeSend adapters included in the direct-download jso-symbolicate package. | Direct download |
Credential hygiene tools
| Tool | What it does | Status |
|---|
eslint-plugin-jso-protector | Implemented ESLint rules for credential hygiene; not currently published on npm. | Unreleased |
| pre-commit hooks | jso-release-check + jso-dry-run catch config drift before commit. Ship via packages/jso-protector/.pre-commit-hooks.yaml. | Shipping |
| Polyglot CI smoke harness | packages/polyglot-smoke/smoke.js — spins up a mock server, round-trips a fixture against every available language client, asserts cross-client wire-format consistency. Wired into verify:polyglot + prepublishOnly. | Shipping |
Supply-chain integrity
| Capability | Where | Status |
|---|
| HMAC-SHA256 watermark embedding + verifier | jso-protector --watermark / --verify-watermark / --scan-watermarks. Wire format mirrored in Python (jso_protector.watermark) and .NET (JsoProtector.Watermark). Spec: WireFormat.aspx. | Shipping |
| Ed25519-signed release attestation (SLSA-style) | jso-protector --sign-release / --verify-release with two-stage verify (signature + on-disk re-hash). --genkey-release mints fresh keypairs. Spec: WireFormat.aspx. | Shipping |
| Pre-flight quota gate | jso-protector --estimate walks input files + reads /v1/ai/usage; three gate states (OK / WARN / FAIL). | Shipping |
| Migration review assistant | jso-protector --migration-review emits one source-free owner packet with a Migration Review Assistant for BYO AI or internal reviewers, covering manual review tracks, source-map policy, identifier-cache replacement, runtime-defense behavior, source-reading command boundaries, release metadata, and protected-build smoke. The unpublished composite Action exposes the opt-in migration-review input and migration-review-report output; use the shipping workflow template for source-free preflight and migration-review reports today. | Shipping |
| Identifier-cache review assistant | jso-protector --identifier-cache-review turns deterministic cache and custom dictionary migration assumptions into a source-free Identifier Cache Review Assistant for BYO AI or internal reviewers, covering reserved-name coverage, release metadata, and protected-build smoke. | Shipping |
| Runtime-defense review assistant | jso-protector --runtime-defense-review turns anti-debug, self-defending, runtime lock, console, and countermeasure migration assumptions into a source-free Runtime Defense Review Assistant for BYO AI or internal reviewers, covering runtime behavior scope, monitoring handoff, countermeasure policy, domain/date lock smoke, source-reading compatibility scan, release metadata, and protected-build smoke. | Shipping |
| Competitor gap review assistant | jso-protector --competitor-gap-report --json groups covered, partial, and gap areas, pins the public-source snapshot date, lists follow-up reviewer artifacts, and emits a source-free Competitor Gap Review Assistant for BYO AI or internal reviewers. | Shipping |
| Source-map evidence assistant | jso-protector --source-map-evidence verifies the protected manifest, audits .map files and sourceMappingURL comments, then emits a source-free Source Map Review Assistant for BYO AI or internal reviewers without sharing raw maps, original source paths, source code, protected output, customer data, or secrets. The unpublished composite Action accepts source-map-evidence and exposes source-map-evidence-report for source-map evidence artifacts; use the shipping workflow template today. | Shipping |
| Deployment hygiene evidence | jso-protector --deployment-hygiene-evidence turns the tools/Build-UpdatedArchives.ps1 -ReportPath archive hygiene JSON into a source-free reviewer packet with blocked-entry status, required-entry gaps, operator checklist, rotation triggers, SHA-256, and Review Assistant boundaries. | Shipping |
| GitHub Action opt-in inputs | javascriptobfuscator/[email protected] is implemented but not yet published to GitHub. Its source contract includes script-inventory-audit-report, payment-page-headers-baseline, payment-page-headers-report, and pci-dss-v4-report payment-page audit report paths. Use the shipping workflow template in jso-protector/ci/github-actions.yml today; do not reference the unpublished Marketplace action in production workflows. | Unreleased |
| Cross-language conformance vectors | Eight pinned wire-format vectors in packages/jso-protector/test/wire-format-vectors.test.js. Reference for any new language port. | Shipping |
Runtime defense + ops integration
| Capability | Where | Status |
|---|
| Debug protection, console suppression, devtools-key blocking, headless detection, session lock, fingerprint lock, challenge freshness check, self-defending integrity heartbeat, anti-monkey-patching API checks, asynchronous signed RSA envelope monitoring, beacon callback | API options and trust boundaries documented at /docs/runtimedefense.aspx | Shipping |
jso-beacon-slack | Direct-download, customer-operated Runtime Defense collector for Slack, Discord, Splunk HEC, Elasticsearch, and signed webhooks. It is not an npm-registry package or a staffed monitoring service. | Direct download |
| Runtime incident dashboard | Token-based hosted intake at /v1/runtime/beacon.ashx, with recent incidents, severity, BuildID, URL, collector-token status, first-triage status actions, source-free routing recommendations, response targets, CSV/JSON evidence exports in Dashboard Monitoring, and jso-protector --runtime-incident-evidence handoff packets for support or reviewer workflows. | Beta |
| Payment-page protection playbook | Checkout script inventory, security-header snapshots, runtime alerts, signed release evidence, PCI DSS v4 report workflow, and source-free PCI DSS Review Assistant for BYO AI or internal reviewers. | Shipping |
| VM bytecode protection | Per-function virtualization marked by @virtualize comments (//, block, or JSDoc form). Corporate+ plan eligibility plus beta enrollment during staged rollout. The GitHub Action can emit the source-free vm-proof-pack-report reviewer artifact. Docs: option reference and public proof pack. | Beta |
Migration guides
Don't see a tool you need? The JSO HTTP API is small and stable; every artifact above is built on top of it. Write a thin client in your language by following the
wire-format spec or generate one from the
JSON Schema. Recipes for common build-and-release patterns live in the
Cookbook.