afterpack 0.1.0 → 0.2.0

package/README.md

@@ -17,8 +17,9 @@ Use `afterpack@latest` so `npx` does not pick up an old cached copy. `afterpack
 common options and `afterpack --help --all` lists every one.
 
 If your project uses a framework with an AfterPack plugin (Vite, Next.js, webpack, Nuxt, Astro and
-others), the plugin is the better fit: it obfuscates inside the build, so the readable bundle never
-reaches disk. Run `afterpack` with no path and it tells you which plugin to install.
+others), the plugin is the better fit. Most plugins obfuscate inside the build, so the readable
+bundle never reaches disk; the Next.js, esbuild and Angular integrations run right after the tool
+writes its output. Run `afterpack` with no path and it tells you which plugin to install.
 
 ## `afterpack [path]`
 
@@ -38,8 +39,8 @@ Each run writes:
 - `.map` files next to the output, when your build has source maps and the run is not a production
   build.
 
-The backup and the Protection Map contain your original source. AfterPack adds `.afterpack/` to the
-nearest `.gitignore`. Never deploy or commit them.
+The backup and the Protection Map contain your original source. `.afterpack/` carries its own
+`.gitignore` and self-ignores. Never deploy or commit them.
 
 With no path, `afterpack` looks at your project first. If it finds a framework, it prints the plugin
 to install (or tells you the one you have already covers the build) and exits `1`. Otherwise it
@@ -122,11 +123,12 @@ and sends everything else to stderr. Use it in CI and scripts. `verify` and `aud
 
 ## Pro
 
-Without a key, AfterPack runs on your machine and applies basic protection. Set
+Without a key, AfterPack runs on your machine with the full pipeline at any preset. Set
 [`AFTERPACK_KEY`][key] in your environment (or [`key`][key] in `afterpack.json`) and the same
-command sends the build to AfterPack's cloud, which applies much stronger protection. If the cloud
-cannot be reached, the run fails; it never quietly ships weaker output. Never commit the key. See
-[AfterPack Pro](https://www.afterpack.dev/docs/pro).
+command builds in AfterPack's cloud instead, which adds two hardening transforms you can turn on:
+self-integrity (anti-tamper) and comparison hardening. If the cloud cannot be reached, the run
+fails; it never falls back to a local build. Never commit the key. See [AfterPack
+Pro](https://www.afterpack.dev/docs/pro).
 
 ## Exit codes
 

package/SKILL.md

@@ -11,8 +11,8 @@ the bundler. Never run it on source.
 ## Pick the right tool first
 
 If the project uses a framework or bundler with an AfterPack plugin, install the plugin instead of
-adding a CLI step. The plugin obfuscates inside the build, so the readable bundle never reaches
-disk:
+adding a CLI step. Most plugins obfuscate inside the build, so the readable bundle never reaches
+disk; the Next.js, esbuild and Angular ones run right after the tool writes its output:
 
 | Project uses | Install |
 | --- | --- |
@@ -73,24 +73,27 @@ Rules:
 - `.afterpack/protectionMap.html`: the Protection Map report, when the build has source maps.
 - `.map` files beside the output, when an input map exists and the run is not a production build.
 
-The backup and the Protection Map contain the original source. AfterPack adds `.afterpack/` to the
-nearest `.gitignore`. Never deploy, publish or commit them.
+The backup and the Protection Map contain the original source. `.afterpack/` carries its own
+`.gitignore` and self-ignores. Never deploy, publish or commit them.
 
 ## Configuration
 
 Every option has one dot-delimited camelCase name, used the same way in every place:
 
-1. `/* @afterpack key=value */` in source, for region-scoped keys such as `preset` and `complexity`
-2. `--key=value` on the command line
-3. `AFTERPACK_<key with dots as underscores>` in the environment, for example
+1. `--key=value` on the command line
+2. `AFTERPACK_<key with dots as underscores>` in the environment, for example
    `AFTERPACK_diagnostics_format=json`
-4. `afterpack.json`, the nearest one at or above the working directory
+3. `afterpack.json`, the nearest one at or above the working directory
 
 Higher in the list wins. A boolean flag on its own means `true`; `=false` turns it off. There is
 no `--no-` form and no space-separated value (`--seed git` is wrong, `--seed=git` is right). The
 only short flags are `-h` and `-v`. An unknown, kebab-cased or malformed key fails the run with
 exit `64` and names the right spelling.
 
+The CLI does not read `/* @afterpack */` source directives, and setting `directives.enabled` fails
+the run: built output no longer carries the comments. A bundler plugin reads them before
+minification.
+
 | Key | Meaning | Default |
 | --- | --- | --- |
 | [`preset`][preset] | `minify`, `light`, `medium`, `hard` or `extreme` | `light` |
@@ -178,15 +181,16 @@ Lists are sorted and there are no timestamps, so two runs of one build give iden
 
 ## The Pro key
 
-Without a key, builds run locally with basic protection. With a Pro key, the same command sends the
-build to AfterPack's cloud, which applies much stronger protection.
+Without a key, builds run locally with the full pipeline at any preset. With a Pro key, the same
+command builds in AfterPack's cloud instead, which adds two hardening transforms you can turn on:
+self-integrity (anti-tamper) and comparison hardening.
 
 - Set it as `AFTERPACK_KEY` in the environment (a CI secret), or [`key`][key] in an uncommitted
   `afterpack.json`.
 - Never put it in a plugin's options object. Plugins reject it there, because a bundler config is
   committed source.
 - Never commit it.
-- If the cloud cannot be reached, the run fails with exit `1`. It never falls back to weaker output.
+- If the cloud cannot be reached, the run fails with exit `1`. It never falls back to a local build.
 
 Details: https://www.afterpack.dev/docs/pro
 

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { processBatch, version } from "@afterpack/core";
-import { AlreadyObfuscatedError, CLOUD_REFUSAL_SUMMARY, CONFIG_KEYS, CORE_FLOOR_SUMMARY, CloudApiError, CoreVersionError, DIAG_ALREADY_OBFUSCATED, PROTECTION_RECEIPT_FILE, UnreadableReceiptError, collectJsFiles, createTelemetryReporter, findUpward, getPath, installedRequiredLine, loadConfigFile, mergeConfig, npxAlternative, parseCliOptions, parseEnvOptions, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, serverAddsInfo, sha256Of, toEngineConfig, toPluginOptions, verifyProtectionReceipt } from "@afterpack/integration-utils";
+import { AlreadyObfuscatedError, CLOUD_REFUSAL_SUMMARY, CONFIG_KEYS, CORE_FLOOR_SUMMARY, CloudApiError, CoreVersionError, DIAG_ALREADY_OBFUSCATED, PROTECTION_RECEIPT_FILE, UnreadableReceiptError, collectJsFiles, createTelemetryReporter, ensureAfterpackGitignore, findUpward, getPath, installedRequiredLine, loadConfigFile, mergeConfig, npxAlternative, parseCliOptions, parseEnvOptions, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, serverAddsInfo, sha256Of, toEngineConfig, toPluginOptions, verifyProtectionReceipt } from "@afterpack/integration-utils";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
 
@@ -933,6 +933,7 @@ function writeBackups(input) {
 		force: true
 	});
 	mkdirSync(dir, { recursive: true });
+	ensureAfterpackGitignore(dir);
 	const files = [];
 	for (const pending of input.pending) {
 		const dest = absoluteFilePath(dir, pending.relPath);
@@ -1578,7 +1579,7 @@ async function runObfuscationAndBackup(input) {
 				files: input.files,
 				engine: observeEngine(input.engine, captured),
 				label: "afterpack",
-				gitignoreDir: input.cwd,
+				cwd: input.cwd,
 				startedAt: input.startedAt,
 				combinedProtectionMap: {
 					buildDir: input.buildDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "afterpack",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "AfterPack CLI: obfuscate the JavaScript in any build output, verify a build before deploy, and scan a live site",
   "type": "module",
   "bin": {
@@ -14,8 +14,8 @@
     "dist"
   ],
   "dependencies": {
-    "@afterpack/core": "~0.1.0",
-    "@afterpack/integration-utils": "0.1.0"
+    "@afterpack/core": "~0.2.0",
+    "@afterpack/integration-utils": "0.2.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",