@afterpack/webpack 0.1.0-rc.20260925T1347

package/LICENSE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright 2026 AfterPack
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -0,0 +1,4 @@
+AfterPack CLI and framework integrations
+Copyright 2026 AfterPack — https://www.afterpack.dev
+
+This product includes software developed at AfterPack (https://www.afterpack.dev).

package/README.md

@@ -0,0 +1,103 @@
+# @afterpack/webpack
+
+A webpack obfuscation plugin for webpack 5. It obfuscates your production JavaScript inside the
+webpack build, using the [AfterPack](https://www.afterpack.dev) JavaScript obfuscator.
+
+## Install
+
+```sh
+npm install --save-dev @afterpack/webpack
+```
+
+## Usage
+
+```js
+// webpack.config.mjs
+import { AfterpackWebpackPlugin } from "@afterpack/webpack";
+
+export default {
+  // ...
+  plugins: [new AfterpackWebpackPlugin()],
+};
+```
+
+The plugin obfuscates each JavaScript asset your chunks produce at the last step before webpack
+writes to disk, so the readable bundle is never written. Hot-update chunks and assets other plugins
+copy in are left alone. If obfuscation fails, the build fails.
+
+Subresource integrity plugins keep working: they hash the obfuscated files.
+
+Each build writes a protection receipt, `.afterpack-protection.json`, into the output directory.
+Run `npx afterpack verify dist` in your deploy step to check that what you ship is what was
+obfuscated.
+
+## Options
+
+```js
+new AfterpackWebpackPlugin({ preset: "hard", seed: "git" });
+```
+
+| Option | What it does | Default |
+| --- | --- | --- |
+| [`preset`][preset] | `"minify"`, `"light"`, `"medium"`, `"hard"` or `"extreme"` | `"light"` |
+| [`seed`][seed] | a number or string; `"git"` uses the current commit | a new random seed per build |
+| [`identifiers.reserved`][identifiers.reserved] | names never to rename | none |
+| [`paths.exclude`][paths.exclude] | globs for files to leave untouched | none |
+| [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output | on in development when webpack emits a map, off in production |
+| [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when `devtool` emits source maps |
+| [`build.autorun`][build.autorun] | `false` turns AfterPack off | `true` |
+
+Dotted names are nested objects: `sourceMap.enabled` is `{ sourceMap: { enabled: true } }`. Every
+other option is in the [configuration reference](https://www.afterpack.dev/docs/config).
+
+[preset]: https://www.afterpack.dev/docs/config#preset
+[seed]: https://www.afterpack.dev/docs/config#seed
+[identifiers.reserved]: https://www.afterpack.dev/docs/config#identifiers-reserved
+[paths.exclude]: https://www.afterpack.dev/docs/config#paths-exclude
+[sourceMap.enabled]: https://www.afterpack.dev/docs/config#sourceMap-enabled
+[protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
+[build.autorun]: https://www.afterpack.dev/docs/config#build-autorun
+
+`/* @afterpack */` [directives](https://www.afterpack.dev/docs/directives) in your source need a
+`devtool` that emits source maps, such as `"source-map"`. Without one, the plugin skips them and
+tells you.
+
+The [Protection Map](https://www.afterpack.dev/docs/protection-map) is written to `.afterpack/`,
+outside webpack's output, and the plugin adds its local artifacts to your `.gitignore`. It contains
+your original source, so never deploy or commit it.
+
+Options can also live in `afterpack.json` or in `AFTERPACK_*` environment variables. The options
+object wins over the environment, which wins over the file. An unknown or misspelled key fails the
+build and names the right spelling.
+
+## Pro
+
+Without a key, AfterPack runs on your machine and applies basic protection. Set
+[`AFTERPACK_KEY`](https://www.afterpack.dev/docs/config#key) in your environment and the same plugin
+sends the build to AfterPack's cloud, which applies much stronger protection. Keep the key out of
+your webpack config: the plugin rejects it there. See [AfterPack
+Pro](https://www.afterpack.dev/docs/pro).
+
+## Not supported here
+
+- [`build.backup`](https://www.afterpack.dev/docs/config#build-backup): the output goes back to
+  webpack in memory, so there is no file to back up.
+- [`paths.include`](https://www.afterpack.dev/docs/config#paths-include): the plugin works on
+  webpack's assets and does not walk the output directory.
+
+## Links
+
+- [webpack setup guide](https://www.afterpack.dev/docs/frameworks/webpack)
+- [Presets and protection levels](https://www.afterpack.dev/docs/presets)
+- [A javascript-obfuscator alternative: how AfterPack compares](https://www.afterpack.dev/docs/comparison)
+- [Protecting pricing logic](https://www.afterpack.dev/docs/use-cases/pricing-logic)
+
+## License
+
+Apache-2.0. The engine it runs, `@afterpack/core`, has its own
+[license](https://www.afterpack.dev/license).
+
+## Feedback
+
+Questions, suggestions and bug reports: [afterpack.dev/contact](https://www.afterpack.dev/contact).
+You can also file a bug on [GitHub Issues](https://github.com/afterpack-dev/afterpack/issues).

package/dist/index.cjs

@@ -0,0 +1,254 @@
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+const node_fs = __toESM(require("node:fs"));
+const node_path = __toESM(require("node:path"));
+const __afterpack_core = __toESM(require("@afterpack/core"));
+const __afterpack_integration_utils = __toESM(require("@afterpack/integration-utils"));
+
+//#region src/index.ts
+const PLUGIN_NAME = "AfterpackWebpackPlugin";
+const EMITTED_JS_RE = /\.(?:js|mjs|cjs)$/;
+const SOURCE_MODULE_RE = /\.(?:m?[jt]sx?)$/;
+const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack <dir> --paths.include=...` for a disk walk, or drop the key.";
+function isEmittedJs(name) {
+	return !name.includes(".hot-update.") && EMITTED_JS_RE.test(name);
+}
+function assetText(compilation, name) {
+	const asset = compilation.getAsset(name);
+	if (!asset) return null;
+	const value = asset.source.source();
+	return typeof value === "string" ? value : value.toString("utf8");
+}
+function inputSourceMap(compilation, asset) {
+	if (asset.mapName) return assetText(compilation, asset.mapName);
+	if (asset.url == null) return null;
+	if (asset.url.startsWith("data:")) return (0, __afterpack_integration_utils.decodeDataUri)(asset.url);
+	if (/^https?:\/\//i.test(asset.url) || asset.url.startsWith("//")) return null;
+	const dir = asset.name.includes("/") ? `${asset.name.replace(/\/[^/]*$/, "")}/` : "";
+	return assetText(compilation, `${dir}${asset.url}`.replace(/^\.\//, ""));
+}
+function chunkClaimedJsAssets(compilation) {
+	const names = new Set();
+	for (const chunk of compilation.chunks) for (const name of chunk.files) if (isEmittedJs(name)) names.add(name);
+	const out = [];
+	for (const name of names) {
+		const asset = compilation.getAsset(name);
+		if (!asset) continue;
+		const related = asset.info.related;
+		const sourceMap = related?.sourceMap;
+		const mapName = typeof sourceMap === "string" ? sourceMap : sourceMap?.[0] ?? null;
+		const text = assetText(compilation, name);
+		out.push({
+			name,
+			mapName,
+			url: text ? (0, __afterpack_integration_utils.extractSourceMappingURL)(text) : null
+		});
+	}
+	return out;
+}
+function collectResourcesThroughConcatenatedModules(module$1, out) {
+	if (module$1 == null || typeof module$1 !== "object") return;
+	const inner = module$1.modules;
+	if (Array.isArray(inner)) {
+		for (const m of inner) collectResourcesThroughConcatenatedModules(m, out);
+		return;
+	}
+	const resource = module$1.resource;
+	if (typeof resource === "string") out.push(resource.replace(/[?#].*$/, ""));
+}
+var AfterpackWebpackPlugin = class {
+	settings;
+	engineConfig;
+	captured = new Map();
+	seenByBuildHooksThisCompilation = new Set();
+	captureDiagnostics = [];
+	deferredReceiptByCompilation = new WeakMap();
+	constructor(options = {}) {
+		const resolved = (0, __afterpack_integration_utils.resolvePluginConfig)({
+			label: PLUGIN_NAME,
+			options,
+			unsupported: { "paths.include": PATHS_INCLUDE_UNSUPPORTED }
+		});
+		this.settings = resolved.options;
+		this.engineConfig = resolved.engineConfig;
+	}
+	apply(compiler) {
+		const context = compiler.options.context ?? process.cwd();
+		const directivesEnabled = this.settings.directives.enabled;
+		if (directivesEnabled) compiler.hooks.thisCompilation.tap(PLUGIN_NAME, () => {
+			this.seenByBuildHooksThisCompilation.clear();
+		});
+		compiler.hooks.compilation.tap(PLUGIN_NAME, (compilation) => {
+			if (directivesEnabled) {
+				const hooks = compiler.webpack.NormalModule.getCompilationHooks(compilation);
+				hooks.beforeLoaders.tap(PLUGIN_NAME, (_loaders, module$1) => {
+					this.capture(module$1.resource, context);
+				});
+			}
+			compilation.hooks.processAssets.tapPromise({
+				name: PLUGIN_NAME,
+				stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_REPORT
+			}, () => this.obfuscate(compiler, compilation, context));
+		});
+		compiler.hooks.afterEmit.tapPromise(PLUGIN_NAME, async (compilation) => {
+			const deferred = this.deferredReceiptByCompilation.get(compilation);
+			if (!deferred) return;
+			this.deferredReceiptByCompilation.delete(compilation);
+			try {
+				const receiptPath = (0, __afterpack_integration_utils.writeDeferredProtectionReceipt)(deferred);
+				if (receiptPath && this.settings.diagnostics?.level !== "none") console.log(`[afterpack-webpack] wrote protection receipt -> ${receiptPath} (afterpack verify)`);
+			} catch (error) {
+				console.warn(`[afterpack-webpack] failed to write protection receipt: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		});
+	}
+	async obfuscate(compiler, compilation, context) {
+		if (this.settings.build?.autorun === false) return;
+		const startedAt = Date.now();
+		const outputPath = compiler.outputPath;
+		const owned = chunkClaimedJsAssets(compilation);
+		if (owned.length === 0) return;
+		const byPath = new Map();
+		const inputs = new Map();
+		for (const asset of owned) {
+			const source = assetText(compilation, asset.name);
+			if (source == null) continue;
+			const filePath = (0, node_path.join)(outputPath, asset.name);
+			byPath.set(filePath, asset);
+			inputs.set(filePath, {
+				source,
+				sourceMap: inputSourceMap(compilation, asset)
+			});
+		}
+		const files = [...byPath.keys()];
+		if (files.length === 0) return;
+		const directivesEnabled = this.settings.directives.enabled;
+		const capturedByFile = directivesEnabled ? this.joinCaptured(compilation, outputPath, new Set(files), context) : new Map();
+		for (const message of this.captureDiagnostics) console.warn(`[afterpack-webpack] directive ${message}`);
+		this.captureDiagnostics.length = 0;
+		const devtool = compiler.options.devtool;
+		const result = await (0, __afterpack_integration_utils.runObfuscationPass)({
+			files,
+			inputs,
+			emitToCaller: true,
+			engine: {
+				processBatch: __afterpack_core.processBatch,
+				version: __afterpack_core.version
+			},
+			client: (0, __afterpack_integration_utils.resolveClientIdentity)(require("url").pathToFileURL(__filename).href),
+			telemetry: (0, __afterpack_integration_utils.createTelemetryReporter)(),
+			label: "afterpack-webpack",
+			gitignoreDir: context,
+			startedAt,
+			capturedByFile: capturedByFile.size > 0 ? capturedByFile : void 0,
+			combinedProtectionMap: {
+				buildDir: outputPath,
+				afterpackDir: (0, node_path.join)(context, ".afterpack")
+			},
+			...(0, __afterpack_integration_utils.passSettings)({
+				options: this.settings,
+				engineConfig: this.engineConfig
+			}),
+			hasBundlerSourcemap: typeof devtool === "string" && devtool.includes("source-map"),
+			messages: { autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found; set `devtool: 'source-map'` so future builds can render original source in the map." }
+		});
+		const { RawSource } = compiler.webpack.sources;
+		for (const out of result.outputs ?? []) {
+			const asset = byPath.get(out.path);
+			if (!asset) continue;
+			const emitMap = result.policy.sourceMap && out.sourceMap != null;
+			const mapName = asset.mapName ?? `${asset.name}.map`;
+			const keepWebpacksOwnReference = asset.mapName != null;
+			const url = emitMap && result.policy.emitSourceMappingURL ? keepWebpacksOwnReference ? asset.url : (0, node_path.basename)(mapName) : null;
+			compilation.updateAsset(asset.name, new RawSource((0, __afterpack_integration_utils.withSourceMappingURL)(out.code, url)));
+			if (emitMap && out.sourceMap != null) {
+				const map = new RawSource(out.sourceMap);
+				if (compilation.getAsset(mapName)) compilation.updateAsset(mapName, map);
+				else compilation.emitAsset(mapName, map);
+			} else if (asset.mapName && compilation.getAsset(asset.mapName)) compilation.deleteAsset(asset.mapName);
+		}
+		if (result.deferredReceipt) this.deferredReceiptByCompilation.set(compilation, result.deferredReceipt);
+	}
+	capture(resource, context) {
+		if (!resource) return;
+		const path = resource.replace(/[?#].*$/, "");
+		this.seenByBuildHooksThisCompilation.add(path);
+		if (path.replace(/\\/g, "/").includes("/node_modules/")) return;
+		if (!SOURCE_MODULE_RE.test(path)) return;
+		let source;
+		try {
+			source = (0, node_fs.readFileSync)(path, "utf8");
+		} catch {
+			return;
+		}
+		if (!source.includes("@afterpack")) {
+			this.captured.delete(path);
+			return;
+		}
+		const idAsWrittenInMapSources = `./${(0, node_path.relative)(context, path).replace(/\\/g, "/")}`;
+		const scan = (0, __afterpack_integration_utils.scanDirectives)(source);
+		if (scan.directives.length > 0 || scan.renameGlobals) this.captured.set(path, {
+			id: idAsWrittenInMapSources,
+			source,
+			directives: scan.directives,
+			renameGlobals: scan.renameGlobals
+		});
+		else this.captured.delete(path);
+		for (const d of scan.diagnostics) this.captureDiagnostics.push(`${idAsWrittenInMapSources} (${d.line}:${d.column}): ${d.message}`);
+	}
+	joinCaptured(compilation, outputPath, emitted, context) {
+		const out = new Map();
+		const chunkGraph = compilation.chunkGraph;
+		if (!chunkGraph) return out;
+		const byFile = new Map();
+		for (const chunk of compilation.chunks) {
+			const resources = [];
+			for (const module$1 of chunkGraph.getChunkModulesIterable(chunk)) collectResourcesThroughConcatenatedModules(module$1, resources);
+			const mods = [];
+			for (const resource of resources) {
+				const restoredFromCachePastEveryHook = !this.seenByBuildHooksThisCompilation.has(resource);
+				if (restoredFromCachePastEveryHook) this.capture(resource, context);
+				const cap = this.captured.get(resource);
+				if (cap) mods.push(cap);
+			}
+			if (mods.length === 0) continue;
+			for (const name of chunk.files) {
+				if (!isEmittedJs(name)) continue;
+				const full = (0, node_path.join)(outputPath, name);
+				if (!emitted.has(full)) continue;
+				let bucket = byFile.get(full);
+				if (!bucket) {
+					bucket = new Map();
+					byFile.set(full, bucket);
+				}
+				for (const mod of mods) bucket.set(mod.id, mod);
+			}
+		}
+		for (const [file, bucket] of byFile) out.set(file, [...bucket.values()]);
+		return out;
+	}
+};
+
+//#endregion
+exports.AfterpackWebpackPlugin = AfterpackWebpackPlugin;

package/dist/index.d.cts

@@ -0,0 +1,20 @@
+import { AfterpackPluginOptions } from "@afterpack/integration-utils";
+import { Compiler } from "webpack";
+
+//#region src/index.d.ts
+type AfterpackWebpackOptions = AfterpackPluginOptions;
+declare class AfterpackWebpackPlugin {
+  private readonly settings;
+  private readonly engineConfig;
+  private readonly captured;
+  private readonly seenByBuildHooksThisCompilation;
+  private readonly captureDiagnostics;
+  private readonly deferredReceiptByCompilation;
+  constructor(options?: AfterpackWebpackOptions);
+  apply(compiler: Compiler): void;
+  private obfuscate;
+  private capture;
+  private joinCaptured;
+}
+//#endregion
+export { AfterpackWebpackOptions, AfterpackWebpackPlugin };

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+import { AfterpackPluginOptions } from "@afterpack/integration-utils";
+import { Compiler } from "webpack";
+
+//#region src/index.d.ts
+type AfterpackWebpackOptions = AfterpackPluginOptions;
+declare class AfterpackWebpackPlugin {
+  private readonly settings;
+  private readonly engineConfig;
+  private readonly captured;
+  private readonly seenByBuildHooksThisCompilation;
+  private readonly captureDiagnostics;
+  private readonly deferredReceiptByCompilation;
+  constructor(options?: AfterpackWebpackOptions);
+  apply(compiler: Compiler): void;
+  private obfuscate;
+  private capture;
+  private joinCaptured;
+}
+//#endregion
+export { AfterpackWebpackOptions, AfterpackWebpackPlugin };

package/dist/index.js

@@ -0,0 +1,231 @@
+import { readFileSync } from "node:fs";
+import { basename, join, relative } from "node:path";
+import { processBatch, version } from "@afterpack/core";
+import { createTelemetryReporter, decodeDataUri, extractSourceMappingURL, passSettings, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, scanDirectives, withSourceMappingURL, writeDeferredProtectionReceipt } from "@afterpack/integration-utils";
+
+//#region src/index.ts
+const PLUGIN_NAME = "AfterpackWebpackPlugin";
+const EMITTED_JS_RE = /\.(?:js|mjs|cjs)$/;
+const SOURCE_MODULE_RE = /\.(?:m?[jt]sx?)$/;
+const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack <dir> --paths.include=...` for a disk walk, or drop the key.";
+function isEmittedJs(name) {
+	return !name.includes(".hot-update.") && EMITTED_JS_RE.test(name);
+}
+function assetText(compilation, name) {
+	const asset = compilation.getAsset(name);
+	if (!asset) return null;
+	const value = asset.source.source();
+	return typeof value === "string" ? value : value.toString("utf8");
+}
+function inputSourceMap(compilation, asset) {
+	if (asset.mapName) return assetText(compilation, asset.mapName);
+	if (asset.url == null) return null;
+	if (asset.url.startsWith("data:")) return decodeDataUri(asset.url);
+	if (/^https?:\/\//i.test(asset.url) || asset.url.startsWith("//")) return null;
+	const dir = asset.name.includes("/") ? `${asset.name.replace(/\/[^/]*$/, "")}/` : "";
+	return assetText(compilation, `${dir}${asset.url}`.replace(/^\.\//, ""));
+}
+function chunkClaimedJsAssets(compilation) {
+	const names = new Set();
+	for (const chunk of compilation.chunks) for (const name of chunk.files) if (isEmittedJs(name)) names.add(name);
+	const out = [];
+	for (const name of names) {
+		const asset = compilation.getAsset(name);
+		if (!asset) continue;
+		const related = asset.info.related;
+		const sourceMap = related?.sourceMap;
+		const mapName = typeof sourceMap === "string" ? sourceMap : sourceMap?.[0] ?? null;
+		const text = assetText(compilation, name);
+		out.push({
+			name,
+			mapName,
+			url: text ? extractSourceMappingURL(text) : null
+		});
+	}
+	return out;
+}
+function collectResourcesThroughConcatenatedModules(module, out) {
+	if (module == null || typeof module !== "object") return;
+	const inner = module.modules;
+	if (Array.isArray(inner)) {
+		for (const m of inner) collectResourcesThroughConcatenatedModules(m, out);
+		return;
+	}
+	const resource = module.resource;
+	if (typeof resource === "string") out.push(resource.replace(/[?#].*$/, ""));
+}
+var AfterpackWebpackPlugin = class {
+	settings;
+	engineConfig;
+	captured = new Map();
+	seenByBuildHooksThisCompilation = new Set();
+	captureDiagnostics = [];
+	deferredReceiptByCompilation = new WeakMap();
+	constructor(options = {}) {
+		const resolved = resolvePluginConfig({
+			label: PLUGIN_NAME,
+			options,
+			unsupported: { "paths.include": PATHS_INCLUDE_UNSUPPORTED }
+		});
+		this.settings = resolved.options;
+		this.engineConfig = resolved.engineConfig;
+	}
+	apply(compiler) {
+		const context = compiler.options.context ?? process.cwd();
+		const directivesEnabled = this.settings.directives.enabled;
+		if (directivesEnabled) compiler.hooks.thisCompilation.tap(PLUGIN_NAME, () => {
+			this.seenByBuildHooksThisCompilation.clear();
+		});
+		compiler.hooks.compilation.tap(PLUGIN_NAME, (compilation) => {
+			if (directivesEnabled) {
+				const hooks = compiler.webpack.NormalModule.getCompilationHooks(compilation);
+				hooks.beforeLoaders.tap(PLUGIN_NAME, (_loaders, module) => {
+					this.capture(module.resource, context);
+				});
+			}
+			compilation.hooks.processAssets.tapPromise({
+				name: PLUGIN_NAME,
+				stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_REPORT
+			}, () => this.obfuscate(compiler, compilation, context));
+		});
+		compiler.hooks.afterEmit.tapPromise(PLUGIN_NAME, async (compilation) => {
+			const deferred = this.deferredReceiptByCompilation.get(compilation);
+			if (!deferred) return;
+			this.deferredReceiptByCompilation.delete(compilation);
+			try {
+				const receiptPath = writeDeferredProtectionReceipt(deferred);
+				if (receiptPath && this.settings.diagnostics?.level !== "none") console.log(`[afterpack-webpack] wrote protection receipt -> ${receiptPath} (afterpack verify)`);
+			} catch (error) {
+				console.warn(`[afterpack-webpack] failed to write protection receipt: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		});
+	}
+	async obfuscate(compiler, compilation, context) {
+		if (this.settings.build?.autorun === false) return;
+		const startedAt = Date.now();
+		const outputPath = compiler.outputPath;
+		const owned = chunkClaimedJsAssets(compilation);
+		if (owned.length === 0) return;
+		const byPath = new Map();
+		const inputs = new Map();
+		for (const asset of owned) {
+			const source = assetText(compilation, asset.name);
+			if (source == null) continue;
+			const filePath = join(outputPath, asset.name);
+			byPath.set(filePath, asset);
+			inputs.set(filePath, {
+				source,
+				sourceMap: inputSourceMap(compilation, asset)
+			});
+		}
+		const files = [...byPath.keys()];
+		if (files.length === 0) return;
+		const directivesEnabled = this.settings.directives.enabled;
+		const capturedByFile = directivesEnabled ? this.joinCaptured(compilation, outputPath, new Set(files), context) : new Map();
+		for (const message of this.captureDiagnostics) console.warn(`[afterpack-webpack] directive ${message}`);
+		this.captureDiagnostics.length = 0;
+		const devtool = compiler.options.devtool;
+		const result = await runObfuscationPass({
+			files,
+			inputs,
+			emitToCaller: true,
+			engine: {
+				processBatch,
+				version
+			},
+			client: resolveClientIdentity(import.meta.url),
+			telemetry: createTelemetryReporter(),
+			label: "afterpack-webpack",
+			gitignoreDir: context,
+			startedAt,
+			capturedByFile: capturedByFile.size > 0 ? capturedByFile : void 0,
+			combinedProtectionMap: {
+				buildDir: outputPath,
+				afterpackDir: join(context, ".afterpack")
+			},
+			...passSettings({
+				options: this.settings,
+				engineConfig: this.engineConfig
+			}),
+			hasBundlerSourcemap: typeof devtool === "string" && devtool.includes("source-map"),
+			messages: { autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found; set `devtool: 'source-map'` so future builds can render original source in the map." }
+		});
+		const { RawSource } = compiler.webpack.sources;
+		for (const out of result.outputs ?? []) {
+			const asset = byPath.get(out.path);
+			if (!asset) continue;
+			const emitMap = result.policy.sourceMap && out.sourceMap != null;
+			const mapName = asset.mapName ?? `${asset.name}.map`;
+			const keepWebpacksOwnReference = asset.mapName != null;
+			const url = emitMap && result.policy.emitSourceMappingURL ? keepWebpacksOwnReference ? asset.url : basename(mapName) : null;
+			compilation.updateAsset(asset.name, new RawSource(withSourceMappingURL(out.code, url)));
+			if (emitMap && out.sourceMap != null) {
+				const map = new RawSource(out.sourceMap);
+				if (compilation.getAsset(mapName)) compilation.updateAsset(mapName, map);
+				else compilation.emitAsset(mapName, map);
+			} else if (asset.mapName && compilation.getAsset(asset.mapName)) compilation.deleteAsset(asset.mapName);
+		}
+		if (result.deferredReceipt) this.deferredReceiptByCompilation.set(compilation, result.deferredReceipt);
+	}
+	capture(resource, context) {
+		if (!resource) return;
+		const path = resource.replace(/[?#].*$/, "");
+		this.seenByBuildHooksThisCompilation.add(path);
+		if (path.replace(/\\/g, "/").includes("/node_modules/")) return;
+		if (!SOURCE_MODULE_RE.test(path)) return;
+		let source;
+		try {
+			source = readFileSync(path, "utf8");
+		} catch {
+			return;
+		}
+		if (!source.includes("@afterpack")) {
+			this.captured.delete(path);
+			return;
+		}
+		const idAsWrittenInMapSources = `./${relative(context, path).replace(/\\/g, "/")}`;
+		const scan = scanDirectives(source);
+		if (scan.directives.length > 0 || scan.renameGlobals) this.captured.set(path, {
+			id: idAsWrittenInMapSources,
+			source,
+			directives: scan.directives,
+			renameGlobals: scan.renameGlobals
+		});
+		else this.captured.delete(path);
+		for (const d of scan.diagnostics) this.captureDiagnostics.push(`${idAsWrittenInMapSources} (${d.line}:${d.column}): ${d.message}`);
+	}
+	joinCaptured(compilation, outputPath, emitted, context) {
+		const out = new Map();
+		const chunkGraph = compilation.chunkGraph;
+		if (!chunkGraph) return out;
+		const byFile = new Map();
+		for (const chunk of compilation.chunks) {
+			const resources = [];
+			for (const module of chunkGraph.getChunkModulesIterable(chunk)) collectResourcesThroughConcatenatedModules(module, resources);
+			const mods = [];
+			for (const resource of resources) {
+				const restoredFromCachePastEveryHook = !this.seenByBuildHooksThisCompilation.has(resource);
+				if (restoredFromCachePastEveryHook) this.capture(resource, context);
+				const cap = this.captured.get(resource);
+				if (cap) mods.push(cap);
+			}
+			if (mods.length === 0) continue;
+			for (const name of chunk.files) {
+				if (!isEmittedJs(name)) continue;
+				const full = join(outputPath, name);
+				if (!emitted.has(full)) continue;
+				let bucket = byFile.get(full);
+				if (!bucket) {
+					bucket = new Map();
+					byFile.set(full, bucket);
+				}
+				for (const mod of mods) bucket.set(mod.id, mod);
+			}
+		}
+		for (const [file, bucket] of byFile) out.set(file, [...bucket.values()]);
+		return out;
+	}
+};
+
+//#endregion
+export { AfterpackWebpackPlugin };

package/package.json

@@ -0,0 +1,79 @@
+{
+  "name": "@afterpack/webpack",
+  "version": "0.1.0-rc.20260925T1347",
+  "description": "webpack plugin for AfterPack: obfuscate your production JavaScript during the webpack build",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      },
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "LICENSE",
+    "NOTICE",
+    "dist"
+  ],
+  "peerDependencies": {
+    "webpack": "^5.0.0"
+  },
+  "dependencies": {
+    "@afterpack/core": "~0.1.0",
+    "@afterpack/integration-utils": "0.1.0-rc.20260925T1347"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.4.4",
+    "@types/node": "^22.0.0",
+    "tsdown": "^0.11.0",
+    "typescript": "^5.0.0",
+    "vitest": "^2.0.0",
+    "webpack": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/afterpack-dev/afterpack.git",
+    "directory": "packages/webpack"
+  },
+  "keywords": [
+    "obfuscator",
+    "javascript-obfuscator",
+    "obfuscation",
+    "code-protection",
+    "source-code-protection",
+    "javascript-security",
+    "anti-reverse-engineering",
+    "webpack",
+    "webpack-plugin",
+    "afterpack"
+  ],
+  "author": "AfterPack (https://www.afterpack.dev)",
+  "license": "Apache-2.0",
+  "homepage": "https://www.afterpack.dev/docs/frameworks/webpack",
+  "bugs": {
+    "url": "https://github.com/afterpack-dev/afterpack/issues"
+  },
+  "scripts": {
+    "build": "tsdown src/index.ts --format esm --format cjs --dts --shims",
+    "dev": "tsdown src/index.ts --format esm --format cjs --shims --watch",
+    "lint": "biome check .",
+    "lint:fix": "biome check --write .",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}