afterpack 0.2.2 → 0.2.3

package/README.md

@@ -105,7 +105,6 @@ the [configuration reference](https://www.afterpack.dev/docs/config). The
 [build.backup]: https://www.afterpack.dev/docs/config#build-backup
 [protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
 [diagnostics.format]: https://www.afterpack.dev/docs/config#diagnostics-format
-[allowUnobfuscated]: https://www.afterpack.dev/docs/config#allowUnobfuscated
 [inflation.max]: https://www.afterpack.dev/docs/config#inflation-max
 [key]: https://www.afterpack.dev/docs/config#key
 
@@ -136,8 +135,10 @@ Pro](https://www.afterpack.dev/docs/pro).
 | --- | --- |
 | `0` | Success. |
 | `1` | Failure. Nothing was changed, or `verify`, `restore` or `audit` failed. |
-| `2` | Some files shipped unobfuscated. Only possible with [`allowUnobfuscated`][allowUnobfuscated]. |
+| `2` | Partial. Reserved for a quota-exhausted build; no build returns it today. |
 | `3` | The size limit ([`inflation.max`][inflation.max]) stopped AfterPack before it reached the protection level. |
+| `4` | A region directive that raises protection needs a Pro key. |
+| `5` | A runtime-reflection pattern was not acknowledged. |
 | `6` | An update is required. The CLI prints the install command to run. |
 | `64` | Misuse: an unknown option or command, or a malformed value. |
 

package/SKILL.md

@@ -107,7 +107,6 @@ minification.
 | [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when an input map exists |
 | [`diagnostics.format`][diagnostics.format] | `text` or `json` | `text` |
 | [`diagnostics.level`][diagnostics.level] | `summary`, `all` or `none` (errors still print) | `summary` |
-| [`allowUnobfuscated`][allowUnobfuscated] | ship a file that could not be processed, instead of failing (exit `2`) | `false` |
 | [`build.autorun`][build.autorun] | `false` turns AfterPack off for the project, CLI and plugins alike | `true` |
 | [`telemetry.enabled`][telemetry.enabled] | anonymous diagnostics, sent only when a build is refused or partial | `true` |
 
@@ -126,7 +125,6 @@ https://www.afterpack.dev/docs/config
 [protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
 [diagnostics.format]: https://www.afterpack.dev/docs/config#diagnostics-format
 [diagnostics.level]: https://www.afterpack.dev/docs/config#diagnostics-level
-[allowUnobfuscated]: https://www.afterpack.dev/docs/config#allowUnobfuscated
 [build.autorun]: https://www.afterpack.dev/docs/config#build-autorun
 [telemetry.enabled]: https://www.afterpack.dev/docs/config#telemetry-enabled
 [inflation.max]: https://www.afterpack.dev/docs/config#inflation-max
@@ -164,7 +162,7 @@ it too. Add `--diagnostics.level=none` for a run that prints nothing else.
 }
 ```
 
-`status` is `obfuscated`, `unchanged`, `unobfuscated` or `failed`. A failure is a document too,
+`status` is `obfuscated`, `unchanged` or `failed`. A failure is a document too,
 with the same exit code and a `fix` field to act on:
 
 ```json
@@ -231,8 +229,10 @@ exits `1`. Anonymous use is rate-limited per 24 hours. Docs: https://www.afterpa
 | --- | --- |
 | `0` | Success. Also `--help` and `--version`. |
 | `1` | Failure: bad path, no JavaScript found, an engine error, an already-obfuscated tree, a failed `verify`, `restore` or scan, or an unreachable cloud on a Pro build. |
-| `2` | Partial: some files shipped unobfuscated. Only with [`allowUnobfuscated`][allowUnobfuscated]. |
+| `2` | Partial. Reserved for a quota-exhausted build; no build returns it today. |
 | `3` | Size cap: [`inflation.max`][inflation.max] stopped the run before it reached the protection level. |
+| `4` | Pro required: a region directive that raises protection needs a Pro key (`DIAG_PRO_DIRECTIVE_REQUIRES_KEY`). |
+| `5` | Reflection: a runtime-reflection pattern was not acknowledged (`DIAG_REFLECTION_NOT_ACKNOWLEDGED`). |
 | `6` | Update required. Run the install command it prints, for example `npm install afterpack@latest @afterpack/core@<version>`. Nothing was written. |
 | `64` | Misuse: unknown flag or command, malformed value, or two path arguments. |
 

package/dist/cli.js

@@ -170,20 +170,28 @@ const EXIT = {
 	usage: 64
 };
 const SIZE_CAP_CODE = "DIAG_SIZE_CAP_REACHED";
+const PRO_REQUIRED_CODE = "DIAG_PRO_DIRECTIVE_REQUIRES_KEY";
+const REFLECTION_CODE = "DIAG_REFLECTION_NOT_ACKNOWLEDGED";
 const EXIT_CODE_HELP = `Exit codes:
   0   success — every collected file was obfuscated and written
   1   total failure — nothing usable was produced (also: a Pro build whose
       cloud call failed; it never falls back to a local build)
-  2   partial — some files shipped unobfuscated; only reachable with
-      \`--allowUnobfuscated\`
+  2   partial — reserved for a quota-exhausted build; no build returns it today
   3   size cap — \`inflation.max\` could not reach the complexity target
       (${SIZE_CAP_CODE})
+  4   Pro required — a region directive that raises protection needs a Pro key
+      (${PRO_REQUIRED_CODE})
+  5   reflection — a runtime-reflection pattern was not acknowledged
+      (${REFLECTION_CODE})
   6   update required — the AfterPack cloud API, or this afterpack, needs a
       newer @afterpack/core; nothing was written
   64  misuse — an unknown flag or command, or a malformed value`;
 function failureExitCode(diagnostics) {
-	const sizeCap = diagnostics.some((d) => d.code === SIZE_CAP_CODE && d.severity !== "info");
-	return sizeCap ? EXIT.sizeCap : EXIT.failure;
+	const has = (code) => diagnostics.some((d) => d.code === code && d.severity !== "info");
+	if (has(PRO_REQUIRED_CODE)) return EXIT.proRequired;
+	if (has(REFLECTION_CODE)) return EXIT.reflection;
+	if (has(SIZE_CAP_CODE)) return EXIT.sizeCap;
+	return EXIT.failure;
 }
 
 //#endregion
@@ -1469,7 +1477,6 @@ function captureFile(file, bytesIn) {
 		bytesIn,
 		bytesOut: Buffer.byteLength(file.code),
 		status: file.status,
-		unobfuscated: file.unobfuscated === true,
 		diagnostics: sanitizeEngineDiagnostics(file.diagnostics).map((d) => ({
 			...d,
 			file: d.file ?? file.path
@@ -1481,9 +1488,28 @@ function alignRow(label, value) {
 }
 function fileStatus(file) {
 	if (file.status !== "success") return "failed";
-	if (file.unobfuscated) return "unobfuscated";
 	return file.bytesOut === file.bytesIn && file.diagnostics.length === 0 ? "unchanged" : "obfuscated";
 }
+function failureDetail(exitCode) {
+	switch (exitCode) {
+		case EXIT.sizeCap: return {
+			code: SIZE_CAP_CODE,
+			fix: "Raise --inflation.max, or lower --complexity, so the target fits the size budget."
+		};
+		case EXIT.proRequired: return {
+			code: PRO_REQUIRED_CODE,
+			fix: "A region directive raises protection, which needs a Pro key. Add --key=<ap_live_…>, or remove the directive."
+		};
+		case EXIT.reflection: return {
+			code: REFLECTION_CODE,
+			fix: "Acknowledge the runtime-reflection pattern with --reflection.allow=<value> (the diagnostic above names the value), carve the file out with --paths.exclude=<glob>, or (Pro) mark it with an @afterpack allow-reflection directive."
+		};
+		default: return {
+			code: "BUILD_FAILED",
+			fix: "Fix the diagnostic(s) above, or carve the file out with --paths.exclude=<glob>. Your build output was left exactly as your bundler wrote it."
+		};
+	}
+}
 function buildDocument(input) {
 	const { cwd, files, result } = input;
 	const asJson = (d) => {
@@ -1512,7 +1538,6 @@ function buildDocument(input) {
 		summary: {
 			files: files.length,
 			transformed: input.transformed.size,
-			unobfuscated: files.filter((f) => f.unobfuscated).length,
 			failed: files.filter((f) => f.status !== "success").length,
 			bytesIn: files.reduce((n, f) => n + f.bytesIn, 0),
 			bytesOut: files.reduce((n, f) => n + f.bytesOut, 0),
@@ -1922,12 +1947,12 @@ async function run(deps) {
 		warn: (m) => logger.warn(m),
 		error: (m) => logger.error(m)
 	};
-	const refuseHere = (exitCode$1, code, message, fix, detail) => refuse({
+	const refuseHere = (exitCode, code, message, fix, detail) => refuse({
 		logger,
 		mode,
 		version: version$1,
 		command: "obfuscate",
-		exitCode: exitCode$1,
+		exitCode,
 		code,
 		message,
 		fix,
@@ -2050,27 +2075,20 @@ async function run(deps) {
 	}
 	const diagnostics = captured.flatMap((f) => f.diagnostics);
 	if (failure !== null) {
-		const exitCode$1 = failureExitCode(diagnostics);
-		return refuseHere(exitCode$1, exitCode$1 === EXIT.sizeCap ? SIZE_CAP_CODE : "BUILD_FAILED", failure, exitCode$1 === EXIT.sizeCap ? "Raise --inflation.max, or lower --complexity, so the target fits the size budget." : "Fix the diagnostic(s) above, or carve the file out with --paths.exclude=<glob>. Your build output was left exactly as your bundler wrote it.");
+		const exitCode = failureExitCode(diagnostics);
+		const { code, fix } = failureDetail(exitCode);
+		return refuseHere(exitCode, code, failure, fix);
 	}
-	const unobfuscated = captured.filter((f) => f.unobfuscated);
-	const exitCode = unobfuscated.length > 0 ? EXIT.partial : EXIT.ok;
 	if (mode.format === "json") {
 		emitJson(logger, buildDocument({
 			version: version$1,
 			cwd,
-			exitCode,
+			exitCode: EXIT.ok,
 			files: captured,
 			result,
 			transformed: new Set(result?.transformedFiles ?? [])
 		}));
-		return exitCode;
-	}
-	if (exitCode === EXIT.partial) {
-		logger.error(`${yellow("⚠")} ${unobfuscated.length} ${unobfuscated.length === 1 ? "file" : "files"} shipped UNOBFUSCATED — drop --allowUnobfuscated to fail closed instead.`);
-		logger.error("");
-		logger.error(dim(CONTACT_FOOTER));
-		return exitCode;
+		return EXIT.ok;
 	}
 	renderNextSteps({
 		report,
@@ -2082,7 +2100,7 @@ async function run(deps) {
 		backupWritten,
 		hasConfiguredKey
 	});
-	return exitCode;
+	return EXIT.ok;
 }
 const SUBCOMMAND_HELP = {
 	verify: VERIFY_HELP,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "afterpack",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "AfterPack CLI: obfuscate the JavaScript in any build output, verify a build before deploy, and scan a live site",
   "type": "module",
   "bin": {
@@ -14,8 +14,8 @@
     "dist"
   ],
   "dependencies": {
-    "@afterpack/core": "~0.2.3",
-    "@afterpack/integration-utils": "0.2.2"
+    "@afterpack/core": "~0.2.4",
+    "@afterpack/integration-utils": "0.2.3"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",