AfterPack configuration reference

A named level of protection. Sets complexity, the output size multiplier and the inflation budget together. Setting complexity explicitly overrides only that.

How much protection the engine applies. 0 applies none; higher values let it negotiate more and heavier transformations per build, with no fixed feature-per-level schedule. There is no upper bound, and output size grows with the value.

The maximum output size as a multiple of the input size. A build that would exceed a value you set fails; left unset, a build that reaches the preset's ladder stops growing and still emits.

Encodes every string literal so that none remains readable in the output.

The shortest string strings.encode encodes. Shorter strings stay readable. Raising it reduces output size at the cost of leaving short literals in the clear.

Fails the build when more than this many readable string literals remain in the output. Unset never fails.

Enables or disables one kind of transformation. false reliably removes that kind at any complexity; true permits it, and the engine still decides per build whether to apply it. comparisonHardening and selfIntegrity are Pro.

Region overrides supplied by a build tool instead of source comments. Each entry names a span of your original source and the keys to override inside it.

Drops the region to complexity 0, so no transformation is applied inside it and its string literals stay readable. Identifiers inside it are still renamed.

Identifier renaming applies to the whole program and has no per-region form. To keep a name, list it in identifiers.reserved.

Globs that re-admit what the CLI's directory walk skips. Nested node_modules/ is skipped by default; **/node_modules/** walks it and takes every .js/.mjs/.cjs inside. It only ever adds files, and paths.exclude still wins over it.

A walk-only key: it does nothing in a bundled build, where the bundler has already inlined your dependencies into the chunks and no node_modules path is left to match. Same glob grammar as paths.exclude, which means an unanchored pattern is tried at every path segment, so any non-empty value lets the walk descend into node_modules/ and ["src/**"] matches dependency files under node_modules/*/src/ too. Lead with / to anchor a pattern to one absolute location. Quote the glob on a command line or the shell expands it first.

Files to leave untouched, as globs. A matching file is copied to the output unchanged. Applies to files, not to code a bundler has already merged into your bundle.

Renames identifiers. false keeps every name and is meant for debugging; use identifiers.reserved to keep specific names. Exported and reflected names are never renamed.

Also renames the top-level names of a classic script. Safe only for a script nothing else calls into, in a single-file build.

Obfuscates class method names, including what Function.prototype.name returns. false keeps them, for code that reads fn.name, such as a dependency-injection container or a serializer.

Identifier names that are never renamed. A plain name applies to the whole build. Use it for names other code expects, such as a bundled library's public API.

An item can also be { "glob": "src/legacy/**", "names": ["jQuery"] }, which applies only inside matching files. That form is afterpack.json and plugin options only; a flag or a variable carries plain names.

Runtime reflection patterns your code relies on. AfterPack fails the build when it detects a pattern you have not listed. angular and nestjs expand to the patterns those frameworks need.

Writes a source map next to the output. A published map reverses the obfuscation. Never deploy it.

Embeds your original source in the map. Never publish a map with this on.

Appends the //# sourceMappingURL= comment to the output. The map file is written regardless.

Writes the Protection Map, an HTML report of what was applied to each part of your source, into .afterpack/. The report contains your full source. Never publish it.

Lists, for every region of the Protection Map, the transformations applied to it. false makes the report smaller.

The random seed for the build. Unset, every build gets a new seed and different output. Set a number, any string, or "git" for the current commit to reproduce a build.

Selects production or development defaults for output settings such as source maps and backups.

Runs AfterPack automatically at the end of your bundler's build. With false the plugin only reads directives, and you run the engine yourself.

Keeps a verbatim copy of every original file, so a run can be undone. The CLI writes a backup DIRECTORY, .afterpack/backup/ at your project root, with a manifest.json recording what each file became, and afterpack restore puts the originals back; it is on there by default. A framework plugin writes a .backup.<hash> sibling beside each output file instead, and only when you set this to true.

Either form is your source verbatim. The plugin's sibling lands inside the tree you deploy; the CLI's directory sits outside it, gitignored. Never deploy either.

Reads @afterpack comments in your source and applies them as region overrides.

How much a build prints. summary prints errors in full and counts the rest. all prints everything. none silences the progress and summary lines; errors still print.

Switches the CLI's own output between human-readable text and one JSON document on stdout, with every human-readable line moved to stderr. This is the shape a CI step or an AI agent should read.

CLI only; a plugin build accepts and ignores it, since a bundler owns its own build output, not stdout.

Ships a file the engine could not obfuscate as cleartext instead of failing the build. The run still exits 2 so a script can detect it. Off by default: AfterPack fails closed, and turning this on ships less protection than you asked for on the affected file.

Sends an anonymous report when a build reports an error-level diagnostic (a refused or partial build): the diagnostic code, byte offsets, and the tool, OS and architecture versions. Never source, paths or file names. A clean build sends nothing.

Your Pro API key. With a key, builds run on the Pro engine. Set it through the environment or a CI secret rather than a committed file.