@afterpack/next 0.2.2 → 0.2.4

package/README.md

@@ -37,9 +37,11 @@ the comments that point at them, since a served source map gives your source awa
 
 ## Check a deploy
 
-Each build writes `.next/.afterpack-protection.json`, a receipt with a hash per obfuscated file.
-Run `npx afterpack verify .` before you deploy. It fails when the receipt is missing, belongs to a
-different build, or a file changed after obfuscation.
+Each build writes `.afterpack/receipts/.next.json`, a receipt with a hash per obfuscated file.
+`.afterpack/` sits next to your project's lockfile, `afterpack.json` or `.git` (failing those, its
+`package.json`), out of `.next/`, so it never ships with the build. Run `npx afterpack verify .`
+before you deploy. It fails when the receipt is missing, belongs to a different build, or a file
+changed after obfuscation.
 
 ## Options
 
@@ -51,7 +53,7 @@ Pass them as the second argument: `withAfterpack(nextConfig, { preset: "hard", s
 | [`seed`][seed] | a number or string; `"git"` uses the current commit | a new random seed per build |
 | [`identifiers.reserved`][identifiers.reserved] | names never to rename | none |
 | [`paths.exclude`][paths.exclude] | globs for files to leave untouched | none |
-| [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output | on in development when an input map exists, off in production |
+| [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output | off; on in development mode (`build.mode` or `NODE_ENV=development`) when an input map exists |
 | [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when Next emits browser source maps |
 | [`build.autorun`][build.autorun] | `false` turns AfterPack off | `true` |
 

package/dist/index.cjs

@@ -45,28 +45,30 @@ function detectBundler(distDir) {
 	if ((0, node_fs.existsSync)((0, node_path.join)(distDir, "server", "webpack-runtime.js"))) return "webpack";
 	return "unknown";
 }
-function stripTrailer(path, strip) {
-	try {
-		const code = (0, node_fs.readFileSync)(path, "utf8");
-		const stripped = strip(code);
-		if (stripped === code) return false;
-		(0, node_fs.writeFileSync)(path, stripped);
-		return true;
-	} catch {
-		return false;
-	}
+const TURBOPACK_CHUNK_RE = /^(?:turbopack-)?([0-9a-z~._-]{13})\.(?:js|css)$/;
+const WEBPACK_CHUNK_RE = /[-.]([0-9a-f]{16})\.js$/;
+function nextChunkToken(bundler) {
+	const pattern = bundler === "turbopack" ? TURBOPACK_CHUNK_RE : bundler === "webpack" ? WEBPACK_CHUNK_RE : null;
+	return (relativePath) => {
+		if (pattern === null || !relativePath.startsWith("static/chunks/")) return null;
+		return pattern.exec((0, node_path.basename)(relativePath))?.[1] ?? null;
+	};
+}
+function skipNextInternals(relativePath) {
+	return relativePath === "cache" || relativePath.startsWith("trace");
+}
+function stripTrailer(path) {
+	const code = (0, node_fs.readFileSync)(path, "utf8");
+	const stripped = (0, __afterpack_integration_utils.withSourceMappingURL)(code, null);
+	if (stripped === code) return false;
+	(0, node_fs.writeFileSync)(path, stripped);
+	return true;
 }
 function stripServedSourceMaps(chunks, servedDir, log = (message) => console.log(message)) {
-	let removed = 0;
-	for (const mapPath of (0, __afterpack_integration_utils.collectSourceMaps)(servedDir)) try {
-		(0, node_fs.unlinkSync)(mapPath);
-		removed++;
-	} catch (e) {
-		console.warn(`[${LABEL}] could not remove served source map ${mapPath}: ${e}`);
-	}
+	const removed = (0, __afterpack_integration_utils.removeSourceMaps)((0, __afterpack_integration_utils.collectSourceMaps)(servedDir), LABEL);
 	let trailers = 0;
-	for (const js of chunks) if (stripTrailer(js, (code) => (0, __afterpack_integration_utils.withSourceMappingURL)(code, null))) trailers++;
-	for (const css of (0, __afterpack_integration_utils.collectStylesheets)(servedDir)) if (stripTrailer(css, __afterpack_integration_utils.withoutCssSourceMappingURL)) trailers++;
+	for (const js of chunks) if (stripTrailer(js)) trailers++;
+	trailers += (0, __afterpack_integration_utils.stripCssSourceMappingURLs)((0, __afterpack_integration_utils.collectStylesheets)(servedDir));
 	if (removed > 0 || trailers > 0) {
 		const tail = trailers > 0 ? ` + ${trailers} sourceMappingURL trailer(s)` : "";
 		log(`[${LABEL}] stripped ${removed} served source map(s)${tail} from the client tree`);
@@ -99,7 +101,10 @@ async function runAfterpackHook(input) {
 	const files = (0, __afterpack_integration_utils.collectJsFiles)(chunksDir, { include: settings.paths?.include });
 	if (files.length === 0) throw new Error(`[${LABEL}] no client JS found under ${chunksDir} — refusing to report a protected build for a tree nothing was obfuscated in.`);
 	const engine = input.engine ?? await loadEngineOnDemand();
-	await (0, __afterpack_integration_utils.runObfuscationPass)({
+	const bundler = detectBundler(distDir);
+	if (bundler === "unknown") console.warn(`[${LABEL}] could not tell whether this build used Turbopack or webpack, so no content-hashed chunk name was changed. The obfuscated chunks keep the plain build's names, and an immutable cache may serve stale bytes. Report this with your Next.js version.`);
+	const buildId = readBuildIdFromManifest(distDir);
+	const result = await (0, __afterpack_integration_utils.runObfuscationPass)({
 		files,
 		engine,
 		client: (0, __afterpack_integration_utils.resolveClientIdentity)(require("url").pathToFileURL(__filename).href),
@@ -107,24 +112,32 @@ async function runAfterpackHook(input) {
 		label: LABEL,
 		cwd: projectDir,
 		startedAt,
-		combinedProtectionMap: {
-			buildDir: distDir,
-			afterpackDir: (0, node_path.join)(projectDir, ".afterpack")
-		},
+		combinedProtectionMap: { buildDir: distDir },
+		sourceMapSweepDir: (0, node_path.join)(distDir, "static"),
 		...(0, __afterpack_integration_utils.passSettings)(resolved),
 		postMinify: true,
-		afterWrite: () => {
-			stripServedSourceMaps(files, (0, node_path.join)(distDir, "static"), settings.diagnostics?.level === "none" ? () => {} : (message) => console.log(message));
+		hashedNames: {
+			root: distDir,
+			tokenOf: nextChunkToken(bundler),
+			skip: skipNextInternals
+		},
+		afterWrite: (written) => {
+			stripServedSourceMaps(written, (0, node_path.join)(distDir, "static"), settings.diagnostics?.level === "none" ? () => {} : (message) => console.log(message));
 		},
 		receipt: {
-			bundler: detectBundler(distDir),
-			buildId: readBuildIdFromManifest(distDir)
+			bundler,
+			buildId
 		},
 		messages: {
 			autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found. Set `productionBrowserSourceMaps: true` in next.config so the Protection Map can render your original pre-bundle source.",
 			directivesNeedClientMaps: "directives are enabled but no client source maps were found. Set `productionBrowserSourceMaps: true` in next.config so `/* @afterpack ... */` directives can be recovered from the emitted chunks' sourcesContent."
 		}
 	});
+	if (buildId !== null && result.transformedFiles.length > 0) warnIfBuildIdPinned(buildId, settings.diagnostics?.level);
+}
+function warnIfBuildIdPinned(buildId, diagnosticsLevel) {
+	if (diagnosticsLevel === "none") return;
+	if (!/^[0-9a-z]{16,}$/i.test(buildId)) console.warn(`[${LABEL}] this build's id "${buildId}" is not a random Next id, so \`static/${buildId}/_buildManifest.js\` and \`_ssgManifest.js\` keep one immutable URL across releases while their bytes change. AfterPack cannot rename the build id — Next writes into static/${buildId}/ after the build hook runs. Leave \`generateBuildId\` unset so Next randomizes it per build, or bump it every release.`);
 }
 
 //#endregion

package/dist/index.js

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { collectJsFiles, collectSourceMaps, collectStylesheets, createTelemetryReporter, passSettings, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, withSourceMappingURL, withoutCssSourceMappingURL } from "@afterpack/integration-utils";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { collectJsFiles, collectSourceMaps, collectStylesheets, createTelemetryReporter, passSettings, removeSourceMaps, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, stripCssSourceMappingURLs, withSourceMappingURL } from "@afterpack/integration-utils";
 
 //#region src/hook.ts
 const LABEL = "afterpack-next";
@@ -22,28 +22,30 @@ function detectBundler(distDir) {
 	if (existsSync(join(distDir, "server", "webpack-runtime.js"))) return "webpack";
 	return "unknown";
 }
-function stripTrailer(path, strip) {
-	try {
-		const code = readFileSync(path, "utf8");
-		const stripped = strip(code);
-		if (stripped === code) return false;
-		writeFileSync(path, stripped);
-		return true;
-	} catch {
-		return false;
-	}
+const TURBOPACK_CHUNK_RE = /^(?:turbopack-)?([0-9a-z~._-]{13})\.(?:js|css)$/;
+const WEBPACK_CHUNK_RE = /[-.]([0-9a-f]{16})\.js$/;
+function nextChunkToken(bundler) {
+	const pattern = bundler === "turbopack" ? TURBOPACK_CHUNK_RE : bundler === "webpack" ? WEBPACK_CHUNK_RE : null;
+	return (relativePath) => {
+		if (pattern === null || !relativePath.startsWith("static/chunks/")) return null;
+		return pattern.exec(basename(relativePath))?.[1] ?? null;
+	};
+}
+function skipNextInternals(relativePath) {
+	return relativePath === "cache" || relativePath.startsWith("trace");
+}
+function stripTrailer(path) {
+	const code = readFileSync(path, "utf8");
+	const stripped = withSourceMappingURL(code, null);
+	if (stripped === code) return false;
+	writeFileSync(path, stripped);
+	return true;
 }
 function stripServedSourceMaps(chunks, servedDir, log = (message) => console.log(message)) {
-	let removed = 0;
-	for (const mapPath of collectSourceMaps(servedDir)) try {
-		unlinkSync(mapPath);
-		removed++;
-	} catch (e) {
-		console.warn(`[${LABEL}] could not remove served source map ${mapPath}: ${e}`);
-	}
+	const removed = removeSourceMaps(collectSourceMaps(servedDir), LABEL);
 	let trailers = 0;
-	for (const js of chunks) if (stripTrailer(js, (code) => withSourceMappingURL(code, null))) trailers++;
-	for (const css of collectStylesheets(servedDir)) if (stripTrailer(css, withoutCssSourceMappingURL)) trailers++;
+	for (const js of chunks) if (stripTrailer(js)) trailers++;
+	trailers += stripCssSourceMappingURLs(collectStylesheets(servedDir));
 	if (removed > 0 || trailers > 0) {
 		const tail = trailers > 0 ? ` + ${trailers} sourceMappingURL trailer(s)` : "";
 		log(`[${LABEL}] stripped ${removed} served source map(s)${tail} from the client tree`);
@@ -76,7 +78,10 @@ async function runAfterpackHook(input) {
 	const files = collectJsFiles(chunksDir, { include: settings.paths?.include });
 	if (files.length === 0) throw new Error(`[${LABEL}] no client JS found under ${chunksDir} — refusing to report a protected build for a tree nothing was obfuscated in.`);
 	const engine = input.engine ?? await loadEngineOnDemand();
-	await runObfuscationPass({
+	const bundler = detectBundler(distDir);
+	if (bundler === "unknown") console.warn(`[${LABEL}] could not tell whether this build used Turbopack or webpack, so no content-hashed chunk name was changed. The obfuscated chunks keep the plain build's names, and an immutable cache may serve stale bytes. Report this with your Next.js version.`);
+	const buildId = readBuildIdFromManifest(distDir);
+	const result = await runObfuscationPass({
 		files,
 		engine,
 		client: resolveClientIdentity(import.meta.url),
@@ -84,24 +89,32 @@ async function runAfterpackHook(input) {
 		label: LABEL,
 		cwd: projectDir,
 		startedAt,
-		combinedProtectionMap: {
-			buildDir: distDir,
-			afterpackDir: join(projectDir, ".afterpack")
-		},
+		combinedProtectionMap: { buildDir: distDir },
+		sourceMapSweepDir: join(distDir, "static"),
 		...passSettings(resolved),
 		postMinify: true,
-		afterWrite: () => {
-			stripServedSourceMaps(files, join(distDir, "static"), settings.diagnostics?.level === "none" ? () => {} : (message) => console.log(message));
+		hashedNames: {
+			root: distDir,
+			tokenOf: nextChunkToken(bundler),
+			skip: skipNextInternals
+		},
+		afterWrite: (written) => {
+			stripServedSourceMaps(written, join(distDir, "static"), settings.diagnostics?.level === "none" ? () => {} : (message) => console.log(message));
 		},
 		receipt: {
-			bundler: detectBundler(distDir),
-			buildId: readBuildIdFromManifest(distDir)
+			bundler,
+			buildId
 		},
 		messages: {
 			autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found. Set `productionBrowserSourceMaps: true` in next.config so the Protection Map can render your original pre-bundle source.",
 			directivesNeedClientMaps: "directives are enabled but no client source maps were found. Set `productionBrowserSourceMaps: true` in next.config so `/* @afterpack ... */` directives can be recovered from the emitted chunks' sourcesContent."
 		}
 	});
+	if (buildId !== null && result.transformedFiles.length > 0) warnIfBuildIdPinned(buildId, settings.diagnostics?.level);
+}
+function warnIfBuildIdPinned(buildId, diagnosticsLevel) {
+	if (diagnosticsLevel === "none") return;
+	if (!/^[0-9a-z]{16,}$/i.test(buildId)) console.warn(`[${LABEL}] this build's id "${buildId}" is not a random Next id, so \`static/${buildId}/_buildManifest.js\` and \`_ssgManifest.js\` keep one immutable URL across releases while their bytes change. AfterPack cannot rename the build id — Next writes into static/${buildId}/ after the build hook runs. Leave \`generateBuildId\` unset so Next randomizes it per build, or bump it every release.`);
 }
 
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afterpack/next",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Next.js integration for AfterPack: obfuscate the client JavaScript of a Next.js build inside next build",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -28,8 +28,8 @@
     "next": ">=15.4.0"
   },
   "dependencies": {
-    "@afterpack/core": "~0.2.3",
-    "@afterpack/integration-utils": "0.2.2"
+    "@afterpack/core": "~0.2.5",
+    "@afterpack/integration-utils": "0.2.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",