Drop JS obfuscation — Phase 1 (behavioral); resolves #188, #191 Phase 1

[kennethphough]

Drop JS obfuscation — Phase 1 (behavioral, no schema change)

Resolves #188 (version-bloat) and is Phase 1 of #191 (drop JS obfuscation). Pairs with kyte-shipyard 2.1.0.

Why

JS obfuscation has been forced on every install since v1: no real security (client JS is readable in the browser), storage bloat (the obfuscated copy duplicates the source), and operational breakage (WAFs/firewalls have blocked legitimate obfuscated JS). It also drives #188: non-deterministic re-obfuscation made detectChanges see a change on every publish → a content-identical KytePageVersion each time.

What (behavioral only — no migration)

• Publish always serves plain source. KytePageController::buildJavaScript() (page JS, the kyte_connect block, header/footer) and KyteScriptController::handleScriptPublication() ignore the obfuscate_js / obfuscate_kyte_connect flags. Lossless — the plain source was always stored alongside the obfuscated copy.
• #188 fix: obfuscate_js removed from the metadata-field sets and javascript_obfuscated/content_js_obfuscated from the content-field sets in detectChanges/addChangedFieldsToVersion (KytePage) and detectScriptChanges/addChangedFieldsToScriptVersion (KyteScript). (generateContentHash already excluded them.)
• Application.obfuscate_kyte_connect now defaults to 0 for new apps.

The obfuscated columns are left in place (inert). They get dropped in a follow-up (Phase 2, expand/contract) once this is confirmed stable — so a code rollback never strands a dropped column on a live DB.

Compatibility

Forward/backward compatible during rollout: the storage hooks still accept the *_obfuscated columns, so an older Shipyard that sends an obfuscated blob keeps working (kyte-php ignores it at publish), and a newer Shipyard that sends empty *_obfuscated + obfuscate_js=0 also works.

Verification

• PHPStan clean; php -l clean.
• Deployed to dev (19) and exercised the real patched buildJavaScript via a reflection harness with both obfuscate flags set to 1 → output contains the plain JS + plain kyte_connect and excludes the obfuscated variants. MCP read path (list_applications → read_page) confirmed healthy on the patched code.
• Full phpunit runs in CI (MariaDB).

🤖 Generated with Claude Code