afterpack 0.2.1 → 0.2.3

package/README.md

@@ -105,7 +105,6 @@ the [configuration reference](https://www.afterpack.dev/docs/config). The
 [build.backup]: https://www.afterpack.dev/docs/config#build-backup
 [protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
 [diagnostics.format]: https://www.afterpack.dev/docs/config#diagnostics-format
-[allowUnobfuscated]: https://www.afterpack.dev/docs/config#allowUnobfuscated
 [inflation.max]: https://www.afterpack.dev/docs/config#inflation-max
 [key]: https://www.afterpack.dev/docs/config#key
 
@@ -136,8 +135,10 @@ Pro](https://www.afterpack.dev/docs/pro).
 | --- | --- |
 | `0` | Success. |
 | `1` | Failure. Nothing was changed, or `verify`, `restore` or `audit` failed. |
-| `2` | Some files shipped unobfuscated. Only possible with [`allowUnobfuscated`][allowUnobfuscated]. |
+| `2` | Partial. Reserved for a quota-exhausted build; no build returns it today. |
 | `3` | The size limit ([`inflation.max`][inflation.max]) stopped AfterPack before it reached the protection level. |
+| `4` | A region directive that raises protection needs a Pro key. |
+| `5` | A runtime-reflection pattern was not acknowledged. |
 | `6` | An update is required. The CLI prints the install command to run. |
 | `64` | Misuse: an unknown option or command, or a malformed value. |
 

package/SKILL.md

@@ -107,7 +107,6 @@ minification.
 | [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when an input map exists |
 | [`diagnostics.format`][diagnostics.format] | `text` or `json` | `text` |
 | [`diagnostics.level`][diagnostics.level] | `summary`, `all` or `none` (errors still print) | `summary` |
-| [`allowUnobfuscated`][allowUnobfuscated] | ship a file that could not be processed, instead of failing (exit `2`) | `false` |
 | [`build.autorun`][build.autorun] | `false` turns AfterPack off for the project, CLI and plugins alike | `true` |
 | [`telemetry.enabled`][telemetry.enabled] | anonymous diagnostics, sent only when a build is refused or partial | `true` |
 
@@ -126,7 +125,6 @@ https://www.afterpack.dev/docs/config
 [protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
 [diagnostics.format]: https://www.afterpack.dev/docs/config#diagnostics-format
 [diagnostics.level]: https://www.afterpack.dev/docs/config#diagnostics-level
-[allowUnobfuscated]: https://www.afterpack.dev/docs/config#allowUnobfuscated
 [build.autorun]: https://www.afterpack.dev/docs/config#build-autorun
 [telemetry.enabled]: https://www.afterpack.dev/docs/config#telemetry-enabled
 [inflation.max]: https://www.afterpack.dev/docs/config#inflation-max
@@ -164,7 +162,7 @@ it too. Add `--diagnostics.level=none` for a run that prints nothing else.
 }
 ```
 
-`status` is `obfuscated`, `unchanged`, `unobfuscated` or `failed`. A failure is a document too,
+`status` is `obfuscated`, `unchanged` or `failed`. A failure is a document too,
 with the same exit code and a `fix` field to act on:
 
 ```json
@@ -231,8 +229,10 @@ exits `1`. Anonymous use is rate-limited per 24 hours. Docs: https://www.afterpa
 | --- | --- |
 | `0` | Success. Also `--help` and `--version`. |
 | `1` | Failure: bad path, no JavaScript found, an engine error, an already-obfuscated tree, a failed `verify`, `restore` or scan, or an unreachable cloud on a Pro build. |
-| `2` | Partial: some files shipped unobfuscated. Only with [`allowUnobfuscated`][allowUnobfuscated]. |
+| `2` | Partial. Reserved for a quota-exhausted build; no build returns it today. |
 | `3` | Size cap: [`inflation.max`][inflation.max] stopped the run before it reached the protection level. |
+| `4` | Pro required: a region directive that raises protection needs a Pro key (`DIAG_PRO_DIRECTIVE_REQUIRES_KEY`). |
+| `5` | Reflection: a runtime-reflection pattern was not acknowledged (`DIAG_REFLECTION_NOT_ACKNOWLEDGED`). |
 | `6` | Update required. Run the install command it prints, for example `npm install afterpack@latest @afterpack/core@<version>`. Nothing was written. |
 | `64` | Misuse: unknown flag or command, malformed value, or two path arguments. |
 

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { processBatch, version } from "@afterpack/core";
 import { AlreadyObfuscatedError, CLOUD_REFUSAL_SUMMARY, CONFIG_KEYS, CORE_FLOOR_SUMMARY, CloudApiError, CoreVersionError, DIAG_ALREADY_OBFUSCATED, PROTECTION_RECEIPT_FILE, UnreadableReceiptError, collectJsFiles, createTelemetryReporter, ensureAfterpackGitignore, findUpward, getPath, installedRequiredLine, loadConfigFile, mergeConfig, npxAlternative, parseCliOptions, parseEnvOptions, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, serverAddsInfo, sha256Of, toEngineConfig, toPluginOptions, verifyProtectionReceipt } from "@afterpack/integration-utils";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -170,20 +170,28 @@ const EXIT = {
 	usage: 64
 };
 const SIZE_CAP_CODE = "DIAG_SIZE_CAP_REACHED";
+const PRO_REQUIRED_CODE = "DIAG_PRO_DIRECTIVE_REQUIRES_KEY";
+const REFLECTION_CODE = "DIAG_REFLECTION_NOT_ACKNOWLEDGED";
 const EXIT_CODE_HELP = `Exit codes:
   0   success — every collected file was obfuscated and written
   1   total failure — nothing usable was produced (also: a Pro build whose
       cloud call failed; it never falls back to a local build)
-  2   partial — some files shipped unobfuscated; only reachable with
-      \`--allowUnobfuscated\`
+  2   partial — reserved for a quota-exhausted build; no build returns it today
   3   size cap — \`inflation.max\` could not reach the complexity target
       (${SIZE_CAP_CODE})
+  4   Pro required — a region directive that raises protection needs a Pro key
+      (${PRO_REQUIRED_CODE})
+  5   reflection — a runtime-reflection pattern was not acknowledged
+      (${REFLECTION_CODE})
   6   update required — the AfterPack cloud API, or this afterpack, needs a
       newer @afterpack/core; nothing was written
   64  misuse — an unknown flag or command, or a malformed value`;
 function failureExitCode(diagnostics) {
-	const sizeCap = diagnostics.some((d) => d.code === SIZE_CAP_CODE && d.severity !== "info");
-	return sizeCap ? EXIT.sizeCap : EXIT.failure;
+	const has = (code) => diagnostics.some((d) => d.code === code && d.severity !== "info");
+	if (has(PRO_REQUIRED_CODE)) return EXIT.proRequired;
+	if (has(REFLECTION_CODE)) return EXIT.reflection;
+	if (has(SIZE_CAP_CODE)) return EXIT.sizeCap;
+	return EXIT.failure;
 }
 
 //#endregion
@@ -1230,6 +1238,116 @@ function restore(deps) {
 	return EXIT.ok;
 }
 
+//#endregion
+//#region src/source-type.ts
+const CLASSIC_SCRIPT_TYPES = new Set([
+	"",
+	"application/ecmascript",
+	"application/javascript",
+	"application/x-ecmascript",
+	"application/x-javascript",
+	"text/ecmascript",
+	"text/javascript",
+	"text/javascript1.0",
+	"text/javascript1.1",
+	"text/javascript1.2",
+	"text/javascript1.3",
+	"text/javascript1.4",
+	"text/javascript1.5",
+	"text/jscript",
+	"text/livescript",
+	"text/x-ecmascript",
+	"text/x-javascript"
+]);
+const MAX_HTML_SCAN_DEPTH = 4;
+function endsWith(file, extension) {
+	return file.toLowerCase().endsWith(extension);
+}
+function attribute(tag, name) {
+	const match = new RegExp(`(?:^|\\s)${name}\\s*=\\s*("([^"]*)"|'([^']*)'|([^\\s"'>]+))`, "i").exec(tag);
+	if (!match) return null;
+	return match[2] ?? match[3] ?? match[4] ?? "";
+}
+function htmlScriptRefs(html) {
+	const refs = {
+		module: [],
+		classic: []
+	};
+	for (const match of html.matchAll(/<script\b([^>]*)>/gi)) {
+		const tag = match[1];
+		const src = attribute(tag, "src");
+		if (src === null) continue;
+		const type = (attribute(tag, "type") ?? "").trim().toLowerCase();
+		if (type === "module") refs.module.push(src);
+		else if (CLASSIC_SCRIPT_TYPES.has(type)) refs.classic.push(src);
+	}
+	return refs;
+}
+function htmlFilesUnder(dir, depth) {
+	if (depth > MAX_HTML_SCAN_DEPTH) return [];
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return [];
+	}
+	const out = [];
+	for (const entry of entries) {
+		if (entry === "node_modules" || entry.codePointAt(0) === 46) continue;
+		const full = join(dir, entry);
+		let isDir = false;
+		try {
+			isDir = statSync(full).isDirectory();
+		} catch {
+			continue;
+		}
+		if (isDir) out.push(...htmlFilesUnder(full, depth + 1));
+		else if (endsWith(entry, ".html") || endsWith(entry, ".htm")) out.push(full);
+	}
+	return out;
+}
+function srcFileName(src) {
+	const path = src.split(/[?#]/)[0];
+	return path.slice(path.lastIndexOf("/") + 1);
+}
+function scanBuiltHtml(buildDir) {
+	const module = new Set();
+	const classic = new Set();
+	let sawScript = false;
+	for (const file of htmlFilesUnder(buildDir, 0)) {
+		let html;
+		try {
+			html = readFileSync(file, "utf8");
+		} catch {
+			continue;
+		}
+		const refs = htmlScriptRefs(html);
+		for (const src of refs.module) {
+			module.add(srcFileName(src));
+			sawScript = true;
+		}
+		for (const src of refs.classic) {
+			classic.add(srcFileName(src));
+			sawScript = true;
+		}
+	}
+	return sawScript ? {
+		module,
+		classic
+	} : void 0;
+}
+function detectCliSourceType(input) {
+	if (input.files.length === 0) return void 0;
+	if (input.files.every((file) => endsWith(file, ".mjs"))) return "module";
+	const html = scanBuiltHtml(input.buildDir);
+	if (html === void 0 || html.classic.size > 0) return void 0;
+	for (const file of input.files) {
+		if (endsWith(file, ".mjs")) continue;
+		if (!html.module.has(basename(file))) return void 0;
+	}
+	return "module";
+}
+
 //#endregion
 //#region src/verify.ts
 const VERIFY_USAGE = "usage: afterpack verify [dir] [--diagnostics.format=text|json]";
@@ -1359,7 +1477,6 @@ function captureFile(file, bytesIn) {
 		bytesIn,
 		bytesOut: Buffer.byteLength(file.code),
 		status: file.status,
-		unobfuscated: file.unobfuscated === true,
 		diagnostics: sanitizeEngineDiagnostics(file.diagnostics).map((d) => ({
 			...d,
 			file: d.file ?? file.path
@@ -1371,9 +1488,28 @@ function alignRow(label, value) {
 }
 function fileStatus(file) {
 	if (file.status !== "success") return "failed";
-	if (file.unobfuscated) return "unobfuscated";
 	return file.bytesOut === file.bytesIn && file.diagnostics.length === 0 ? "unchanged" : "obfuscated";
 }
+function failureDetail(exitCode) {
+	switch (exitCode) {
+		case EXIT.sizeCap: return {
+			code: SIZE_CAP_CODE,
+			fix: "Raise --inflation.max, or lower --complexity, so the target fits the size budget."
+		};
+		case EXIT.proRequired: return {
+			code: PRO_REQUIRED_CODE,
+			fix: "A region directive raises protection, which needs a Pro key. Add --key=<ap_live_…>, or remove the directive."
+		};
+		case EXIT.reflection: return {
+			code: REFLECTION_CODE,
+			fix: "Acknowledge the runtime-reflection pattern with --reflection.allow=<value> (the diagnostic above names the value), carve the file out with --paths.exclude=<glob>, or (Pro) mark it with an @afterpack allow-reflection directive."
+		};
+		default: return {
+			code: "BUILD_FAILED",
+			fix: "Fix the diagnostic(s) above, or carve the file out with --paths.exclude=<glob>. Your build output was left exactly as your bundler wrote it."
+		};
+	}
+}
 function buildDocument(input) {
 	const { cwd, files, result } = input;
 	const asJson = (d) => {
@@ -1402,7 +1538,6 @@ function buildDocument(input) {
 		summary: {
 			files: files.length,
 			transformed: input.transformed.size,
-			unobfuscated: files.filter((f) => f.unobfuscated).length,
 			failed: files.filter((f) => f.status !== "success").length,
 			bytesIn: files.reduce((n, f) => n + f.bytesIn, 0),
 			bytesOut: files.reduce((n, f) => n + f.bytesOut, 0),
@@ -1600,6 +1735,7 @@ async function runObfuscationAndBackup(input) {
 				complexity: input.parsed.complexity,
 				diagnostics: input.parsed.diagnostics?.level,
 				engineConfig: input.parsed.engineConfig,
+				sourceType: input.sourceType,
 				directivesEnabled: false,
 				receipt: { buildId: readBuildId(input.buildDir) },
 				logger: input.report,
@@ -1811,12 +1947,12 @@ async function run(deps) {
 		warn: (m) => logger.warn(m),
 		error: (m) => logger.error(m)
 	};
-	const refuseHere = (exitCode$1, code, message, fix, detail) => refuse({
+	const refuseHere = (exitCode, code, message, fix, detail) => refuse({
 		logger,
 		mode,
 		version: version$1,
 		command: "obfuscate",
-		exitCode: exitCode$1,
+		exitCode,
 		code,
 		message,
 		fix,
@@ -1904,6 +2040,10 @@ async function run(deps) {
 		engine,
 		cwd,
 		buildDir,
+		sourceType: detectCliSourceType({
+			files,
+			buildDir
+		}),
 		startedAt,
 		version: version$1,
 		parsed,
@@ -1935,27 +2075,20 @@ async function run(deps) {
 	}
 	const diagnostics = captured.flatMap((f) => f.diagnostics);
 	if (failure !== null) {
-		const exitCode$1 = failureExitCode(diagnostics);
-		return refuseHere(exitCode$1, exitCode$1 === EXIT.sizeCap ? SIZE_CAP_CODE : "BUILD_FAILED", failure, exitCode$1 === EXIT.sizeCap ? "Raise --inflation.max, or lower --complexity, so the target fits the size budget." : "Fix the diagnostic(s) above, or carve the file out with --paths.exclude=<glob>. Your build output was left exactly as your bundler wrote it.");
+		const exitCode = failureExitCode(diagnostics);
+		const { code, fix } = failureDetail(exitCode);
+		return refuseHere(exitCode, code, failure, fix);
 	}
-	const unobfuscated = captured.filter((f) => f.unobfuscated);
-	const exitCode = unobfuscated.length > 0 ? EXIT.partial : EXIT.ok;
 	if (mode.format === "json") {
 		emitJson(logger, buildDocument({
 			version: version$1,
 			cwd,
-			exitCode,
+			exitCode: EXIT.ok,
 			files: captured,
 			result,
 			transformed: new Set(result?.transformedFiles ?? [])
 		}));
-		return exitCode;
-	}
-	if (exitCode === EXIT.partial) {
-		logger.error(`${yellow("⚠")} ${unobfuscated.length} ${unobfuscated.length === 1 ? "file" : "files"} shipped UNOBFUSCATED — drop --allowUnobfuscated to fail closed instead.`);
-		logger.error("");
-		logger.error(dim(CONTACT_FOOTER));
-		return exitCode;
+		return EXIT.ok;
 	}
 	renderNextSteps({
 		report,
@@ -1967,7 +2100,7 @@ async function run(deps) {
 		backupWritten,
 		hasConfiguredKey
 	});
-	return exitCode;
+	return EXIT.ok;
 }
 const SUBCOMMAND_HELP = {
 	verify: VERIFY_HELP,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "afterpack",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "AfterPack CLI: obfuscate the JavaScript in any build output, verify a build before deploy, and scan a live site",
   "type": "module",
   "bin": {
@@ -14,8 +14,8 @@
     "dist"
   ],
   "dependencies": {
-    "@afterpack/core": "~0.2.2",
-    "@afterpack/integration-utils": "0.2.1"
+    "@afterpack/core": "~0.2.4",
+    "@afterpack/integration-utils": "0.2.3"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",