# Obfuscate plain JavaScript

Point npx afterpack@latest at any directory of emitted JavaScript. No bundler, no plugin, no config file required.

Source: https://www.afterpack.dev/docs/frameworks/plain

No plugin, no framework, no bundler hook. Give the CLI a directory and it obfuscates every `.js`, `.mjs` and `.cjs` inside it, in place. Use it for a hand-built CDN bundle, a `tsc` output tree, vanilla ESM, a require.js/AMD app, or any `dist/` from a tool with no AfterPack package.

## Install

There is nothing to install: run the CLI directly against your output directory.

```bash
npx afterpack@latest
```

## Build

The [path is required](https://www.afterpack.dev/docs/cli#usage). There is no auto-detection, no zero-argument form. It takes a directory to walk, or a single `.js`/`.mjs`/`.cjs` file. If the directory doesn't exist, or holds no `.js`/`.mjs`/`.cjs`, the CLI says so and [exits `1`](https://www.afterpack.dev/docs/diagnostics#exit-codes).

If it does spot [`next`](https://www.afterpack.dev/docs/frameworks/nextjs), [`vite`](https://www.afterpack.dev/docs/frameworks/vite), [`webpack`](https://www.afterpack.dev/docs/frameworks/webpack), [`rollup`](https://www.afterpack.dev/docs/frameworks/rollup) or [`esbuild`](https://www.afterpack.dev/docs/frameworks/esbuild) in your `package.json`, it prints a one-line nudge toward the matching plugin **after** the run.

See [Configuration](https://www.afterpack.dev/docs/config) for every key. On this path you set one in `afterpack.json` in your project root, a CLI flag, or an environment variable. For `complexity`, pick one:

```bash
npx afterpack@latest dist/ --complexity=40
```

```bash
AFTERPACK_complexity=40 npx afterpack@latest dist/
```

```json
{ "complexity": 40 }
```

Value flags take `=` (`--preset=hard`, `--seed=git`); a boolean flag is bare for true and `=false` for off (`--build.backup`, `--directives.enabled=false`). `-h`/`--help` and `-v`/`--version` print usage. [CLI reference](https://www.afterpack.dev/docs/cli) has the full command shape; [Configuration](https://www.afterpack.dev/docs/config) has every key. Exit code is `0` on success and `1` on any failure. There are no other codes to branch on in CI.

The run writes:

- **[`.afterpack/protectionMap.html`](https://www.afterpack.dev/docs/protection-map)**: one combined map for the run, written when a [source map](https://www.afterpack.dev/docs/config#sourceMap-enabled) was discoverable and the build isn't running under [`NODE_ENV=production` / `CI=true`](https://www.afterpack.dev/docs/config#build-mode). It embeds your original source, so it always lands in the gitignored `.afterpack/`, never in the directory you obfuscated.
- **`foo.js.map`**: a `.map` sibling, when maps are on.
- **`.afterpack/backup/`**: your originals, mirrored under the project root with a manifest, on every run. [`--build.backup=false`](https://www.afterpack.dev/docs/config#build-backup) opts out; `npx afterpack@latest restore` undoes the run from it.

AfterPack also appends its guard globs (`.afterpack/`, `protectionMap.html`, `*.protectionMap.html`, `*.backup.*`, `*.map`) to your `.gitignore`.

## Verify

Turn on a [source map](https://www.afterpack.dev/docs/config#sourceMap-enabled) for the build you want to inspect (`tsc --sourceMap`, a bundler flag), then open the gitignored [`.afterpack/protectionMap.html`](https://www.afterpack.dev/docs/protection-map). It contains your full source. Never commit it or serve it.

## Options

Every [configuration key](https://www.afterpack.dev/docs/config) works through this path too; see [Configuration](https://www.afterpack.dev/docs/config) for every key and every place it can be set.

## Directives

The CLI reads directives when the input carries a source map. See [Directives](https://www.afterpack.dev/docs/directives).

## Edge cases

- **No source map, less to see.** Without a discoverable map, the Protection Map has no original source to render, and the run's report is thin. If your build can emit maps (`tsc --sourceMap`, a bundler flag), turn them on for the build you want to inspect, then keep them out of your release.
- **Nothing framework-aware.** AfterPack sees files.

## Next

- [Frameworks](https://www.afterpack.dev/docs/frameworks): the full matrix.
- [CLI reference](https://www.afterpack.dev/docs/cli): the flags above in full.
- [Builds & CI](https://www.afterpack.dev/docs/builds): seeds, dev-vs-prod, promoting the same bytes.
- [Protection Map](https://www.afterpack.dev/docs/protection-map): reading the report.
- [Configuration](https://www.afterpack.dev/docs/config): every option, and which surface can set it.
- [Presets](https://www.afterpack.dev/docs/presets): the five-rung ladder.