@afterpack/rollup 0.2.2 → 0.2.4

package/README.md

@@ -26,9 +26,11 @@ The plugin runs last, after every other plugin, and obfuscates each JavaScript c
 writes it. The readable bundle never reaches disk. If obfuscation fails, the build fails and the
 output directory is left untouched.
 
-Each build writes a protection receipt, `.afterpack-protection.json`, into the output directory.
-Run `npx afterpack verify dist` in your deploy step to check that what you ship is what was
-obfuscated.
+Each build writes a protection receipt to `.afterpack/receipts/`, one per output directory
+(`.afterpack/receipts/dist.json` for `dist`). `.afterpack/` sits next to your project's lockfile,
+`afterpack.json` or `.git` (failing those, its `package.json`), otherwise beside the build
+directory, so the receipt never ships with your build. Run `npx afterpack verify dist` in your
+deploy step to check that what you ship is what was obfuscated.
 
 ## Options
 
@@ -42,7 +44,7 @@ afterpackRollup({ preset: "hard", seed: "git" });
 | [`seed`][seed] | a number or string; `"git"` uses the current commit | a new random seed per build |
 | [`identifiers.reserved`][identifiers.reserved] | names never to rename | none |
 | [`paths.exclude`][paths.exclude] | globs for files to leave untouched | none |
-| [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output; off also drops the build's CSS maps | on in development when Rollup emits a map, off in production |
+| [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output; off also drops the build's CSS maps | off; on in development mode (`build.mode` or `NODE_ENV=development`) when Rollup emits a map |
 | [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when `output.sourcemap` is set |
 | [`build.autorun`][build.autorun] | `false` turns AfterPack off | `true` |
 

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 
 //#endregion
+const node_crypto = __toESM(require("node:crypto"));
 const node_path = __toESM(require("node:path"));
 const __afterpack_core = __toESM(require("@afterpack/core"));
 const __afterpack_integration_utils = __toESM(require("@afterpack/integration-utils"));
@@ -43,8 +44,47 @@ function afterpackRollup(options = {}) {
 	const preMinifyCapturedModulesById = new Map();
 	const captureDiagnostics = [];
 	const deferredReceiptByOutDir = new Map();
+	const hashSaltByOutDir = new Map();
+	let latestSalt;
+	const directiveSalt = (moduleIds) => {
+		if (!moduleIds || preMinifyCapturedModulesById.size === 0) return "";
+		const parts = [];
+		for (const id of moduleIds) {
+			const cap = preMinifyCapturedModulesById.get(id);
+			if (cap && (cap.directives.length > 0 || cap.renameGlobals)) parts.push(JSON.stringify({
+				id,
+				d: cap.directives,
+				g: cap.renameGlobals
+			}));
+		}
+		if (parts.length === 0) return "";
+		return (0, node_crypto.createHash)("sha256").update(parts.sort().join("\0")).digest("hex").slice(0, 16);
+	};
 	return {
 		name: "afterpack-rollup",
+		buildStart() {
+			hashSaltByOutDir.clear();
+			latestSalt = void 0;
+		},
+		async renderStart(outputOptions) {
+			if (!autorun) return;
+			const outDir = outputDir(outputOptions);
+			if (!outDir) return;
+			const prepared = await (0, __afterpack_integration_utils.prepareHashSalt)({
+				seed: settings.seed,
+				root: process.cwd(),
+				leg: outDir,
+				localEngineVersion: await (0, __afterpack_integration_utils.readEngineVersion)({ version: __afterpack_core.version }),
+				settings: (0, __afterpack_integration_utils.saltSettings)((0, __afterpack_integration_utils.passSettings)(resolved), { ...(0, __afterpack_integration_utils.reportPolicySaltBits)(process.env, settings.artifactOptions, Boolean(outputOptions.sourcemap)) }),
+				warn: (message) => console.warn(message)
+			});
+			hashSaltByOutDir.set(outDir, prepared);
+			latestSalt = prepared.salt;
+		},
+		augmentChunkHash(chunk) {
+			if (latestSalt === void 0) return void 0;
+			return latestSalt + directiveSalt(chunk?.moduleIds);
+		},
 		transform: {
 			order: "pre",
 			handler(code, id) {
@@ -71,6 +111,8 @@ function afterpackRollup(options = {}) {
 				const startedBeforeBundleWalk = Date.now();
 				const { files, inputs, entries } = (0, __afterpack_integration_utils.collectBundleJs)(bundle, outDir);
 				if (files.length === 0) return;
+				const unsalted = (0, __afterpack_integration_utils.unsaltedAssetsWarning)(entries, new Set());
+				if (unsalted) console.warn(`[afterpack-rollup] ${unsalted}`);
 				const capturedByFile = new Map();
 				if (preMinifyCapturedModulesById.size > 0) for (const [filePath, entry] of entries) {
 					const mods = [];
@@ -91,7 +133,6 @@ function afterpackRollup(options = {}) {
 				for (const message of captureDiagnostics) console.warn(`[afterpack-rollup] directive ${message}`);
 				captureDiagnostics.length = 0;
 				const cwd = process.cwd();
-				const gitignoredNonServedAfterpackDir = (0, node_path.join)(cwd, ".afterpack");
 				const result = await (0, __afterpack_integration_utils.runObfuscationPass)({
 					files,
 					inputs,
@@ -104,22 +145,26 @@ function afterpackRollup(options = {}) {
 					telemetry: (0, __afterpack_integration_utils.createTelemetryReporter)(),
 					label: "afterpack-rollup",
 					cwd,
+					resolvedSeed: hashSaltByOutDir.get(outDir)?.resolvedSeed,
+					cloudEngineExpectation: hashSaltByOutDir.get(outDir)?.engine,
 					startedAt: startedBeforeBundleWalk,
 					capturedByFile: capturedByFile.size > 0 ? capturedByFile : void 0,
-					combinedProtectionMap: {
-						buildDir: outDir,
-						afterpackDir: gitignoredNonServedAfterpackDir
-					},
+					combinedProtectionMap: { buildDir: outDir },
 					...(0, __afterpack_integration_utils.passSettings)(resolved),
 					sourceType: (0, __afterpack_integration_utils.sourceTypeForBundle)(outputOptions.format, entries.values()),
 					hasBundlerSourcemap: Boolean(outputOptions.sourcemap),
 					messages: { autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found; set `output.sourcemap: true` so future builds can render original source in the map." }
 				});
+				const obfuscated = new Set();
 				for (const out of result.outputs ?? []) {
 					const entry = entries.get(out.path);
-					if (entry) (0, __afterpack_integration_utils.applyBundleOutput)(bundle, entry, out, result.policy);
+					if (entry) {
+						(0, __afterpack_integration_utils.applyBundleOutput)(bundle, entry, out, result.policy);
+						obfuscated.add(entry.fileName);
+					}
 				}
 				if (!result.policy.sourceMap) (0, __afterpack_integration_utils.stripBundleCssSourceMaps)(bundle);
+				(0, __afterpack_integration_utils.regenerateCompressedSiblings)(bundle, obfuscated, "afterpack-rollup");
 				if (result.deferredReceipt) deferredReceiptByOutDir.set(outDir, result.deferredReceipt);
 			}
 		},

package/dist/index.js

@@ -1,6 +1,7 @@
-import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+import { dirname } from "node:path";
 import { processBatch, version } from "@afterpack/core";
-import { applyBundleOutput, collectBundleJs, createTelemetryReporter, passSettings, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, scanDirectives, sourceTypeForBundle, stripBundleCssSourceMaps, writeDeferredProtectionReceipt } from "@afterpack/integration-utils";
+import { applyBundleOutput, collectBundleJs, createTelemetryReporter, passSettings, prepareHashSalt, readEngineVersion, regenerateCompressedSiblings, reportPolicySaltBits, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, saltSettings, scanDirectives, sourceTypeForBundle, stripBundleCssSourceMaps, unsaltedAssetsWarning, writeDeferredProtectionReceipt } from "@afterpack/integration-utils";
 
 //#region src/index.ts
 const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates Rollup's own bundle, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack <dir> --paths.include=...` for a disk walk, or drop the key.";
@@ -20,8 +21,47 @@ function afterpackRollup(options = {}) {
 	const preMinifyCapturedModulesById = new Map();
 	const captureDiagnostics = [];
 	const deferredReceiptByOutDir = new Map();
+	const hashSaltByOutDir = new Map();
+	let latestSalt;
+	const directiveSalt = (moduleIds) => {
+		if (!moduleIds || preMinifyCapturedModulesById.size === 0) return "";
+		const parts = [];
+		for (const id of moduleIds) {
+			const cap = preMinifyCapturedModulesById.get(id);
+			if (cap && (cap.directives.length > 0 || cap.renameGlobals)) parts.push(JSON.stringify({
+				id,
+				d: cap.directives,
+				g: cap.renameGlobals
+			}));
+		}
+		if (parts.length === 0) return "";
+		return createHash("sha256").update(parts.sort().join("\0")).digest("hex").slice(0, 16);
+	};
 	return {
 		name: "afterpack-rollup",
+		buildStart() {
+			hashSaltByOutDir.clear();
+			latestSalt = void 0;
+		},
+		async renderStart(outputOptions) {
+			if (!autorun) return;
+			const outDir = outputDir(outputOptions);
+			if (!outDir) return;
+			const prepared = await prepareHashSalt({
+				seed: settings.seed,
+				root: process.cwd(),
+				leg: outDir,
+				localEngineVersion: await readEngineVersion({ version }),
+				settings: saltSettings(passSettings(resolved), { ...reportPolicySaltBits(process.env, settings.artifactOptions, Boolean(outputOptions.sourcemap)) }),
+				warn: (message) => console.warn(message)
+			});
+			hashSaltByOutDir.set(outDir, prepared);
+			latestSalt = prepared.salt;
+		},
+		augmentChunkHash(chunk) {
+			if (latestSalt === void 0) return void 0;
+			return latestSalt + directiveSalt(chunk?.moduleIds);
+		},
 		transform: {
 			order: "pre",
 			handler(code, id) {
@@ -48,6 +88,8 @@ function afterpackRollup(options = {}) {
 				const startedBeforeBundleWalk = Date.now();
 				const { files, inputs, entries } = collectBundleJs(bundle, outDir);
 				if (files.length === 0) return;
+				const unsalted = unsaltedAssetsWarning(entries, new Set());
+				if (unsalted) console.warn(`[afterpack-rollup] ${unsalted}`);
 				const capturedByFile = new Map();
 				if (preMinifyCapturedModulesById.size > 0) for (const [filePath, entry] of entries) {
 					const mods = [];
@@ -68,7 +110,6 @@ function afterpackRollup(options = {}) {
 				for (const message of captureDiagnostics) console.warn(`[afterpack-rollup] directive ${message}`);
 				captureDiagnostics.length = 0;
 				const cwd = process.cwd();
-				const gitignoredNonServedAfterpackDir = join(cwd, ".afterpack");
 				const result = await runObfuscationPass({
 					files,
 					inputs,
@@ -81,22 +122,26 @@ function afterpackRollup(options = {}) {
 					telemetry: createTelemetryReporter(),
 					label: "afterpack-rollup",
 					cwd,
+					resolvedSeed: hashSaltByOutDir.get(outDir)?.resolvedSeed,
+					cloudEngineExpectation: hashSaltByOutDir.get(outDir)?.engine,
 					startedAt: startedBeforeBundleWalk,
 					capturedByFile: capturedByFile.size > 0 ? capturedByFile : void 0,
-					combinedProtectionMap: {
-						buildDir: outDir,
-						afterpackDir: gitignoredNonServedAfterpackDir
-					},
+					combinedProtectionMap: { buildDir: outDir },
 					...passSettings(resolved),
 					sourceType: sourceTypeForBundle(outputOptions.format, entries.values()),
 					hasBundlerSourcemap: Boolean(outputOptions.sourcemap),
 					messages: { autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found; set `output.sourcemap: true` so future builds can render original source in the map." }
 				});
+				const obfuscated = new Set();
 				for (const out of result.outputs ?? []) {
 					const entry = entries.get(out.path);
-					if (entry) applyBundleOutput(bundle, entry, out, result.policy);
+					if (entry) {
+						applyBundleOutput(bundle, entry, out, result.policy);
+						obfuscated.add(entry.fileName);
+					}
 				}
 				if (!result.policy.sourceMap) stripBundleCssSourceMaps(bundle);
+				regenerateCompressedSiblings(bundle, obfuscated, "afterpack-rollup");
 				if (result.deferredReceipt) deferredReceiptByOutDir.set(outDir, result.deferredReceipt);
 			}
 		},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afterpack/rollup",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Rollup plugin for AfterPack: obfuscate your JavaScript output during the Rollup build",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -28,8 +28,8 @@
     "rollup": "^3.0.0 || ^4.0.0"
   },
   "dependencies": {
-    "@afterpack/core": "~0.2.3",
-    "@afterpack/integration-utils": "0.2.2"
+    "@afterpack/core": "~0.2.5",
+    "@afterpack/integration-utils": "0.2.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",