混淆

使用 javascript-obfuscator 做标识符重命名、字符串数组编码和常量拆分。
在 vite build 后增加生产环境混淆步骤，开发环境保持源码可读。
关闭 sourcemap，避免直接暴露原始源码。
当前主包约 1.7 MB，建议先拆出第三方依赖，再只混淆应用自身代码，而不是整个 dist。

scripts/obfuscate-build.mjs

@@ -0,0 +1,38 @@
+import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { basename, resolve } from 'node:path'
+import JavaScriptObfuscator from 'javascript-obfuscator'
+
+const assetsDirectory = resolve('dist/assets')
+const appChunks = readdirSync(assetsDirectory)
+  .filter((file) => file.endsWith('.js') && !file.startsWith('vendor-'))
+  .map((file) => resolve(assetsDirectory, file))
+
+if (!appChunks.length) throw new Error('No application chunks found to obfuscate')
+
+const options = {
+  identifierNamesGenerator: 'hexadecimal',
+  stringArray: true,
+  stringArrayEncoding: ['base64'],
+  stringArrayThreshold: 0.75,
+  splitStrings: true,
+  splitStringsChunkLength: 8,
+  controlFlowFlattening: false,
+  deadCodeInjection: false,
+  selfDefending: false,
+  debugProtection: false,
+  renameGlobals: false,
+  sourceMap: false,
+}
+
+let originalBytes = 0
+let obfuscatedBytes = 0
+for (const file of appChunks) {
+  const source = readFileSync(file, 'utf8')
+  const output = JavaScriptObfuscator.obfuscate(source, options).getObfuscatedCode()
+  writeFileSync(file, output)
+  originalBytes += Buffer.byteLength(source)
+  obfuscatedBytes += Buffer.byteLength(output)
+  console.log(`obfuscated ${basename(file)}`)
+}
+
+console.log(`application chunks: +${((obfuscatedBytes / originalBytes - 1) * 100).toFixed(1)}% raw size`)