@afterpack/webpack 0.2.2 → 0.2.4

package/README.md

@@ -28,9 +28,11 @@ copy in are left alone. If obfuscation fails, the build fails.
 Subresource integrity plugins such as `webpack-subresource-integrity` are not supported: they hash
 each chunk before AfterPack rewrites it, so the recorded hashes would not match the files you ship.
 
-Each build writes a protection receipt, `.afterpack-protection.json`, into the output directory.
-Run `npx afterpack verify dist` in your deploy step to check that what you ship is what was
-obfuscated.
+Each build writes a protection receipt to `.afterpack/receipts/`, one per output directory
+(`.afterpack/receipts/dist.json` for `dist`). `.afterpack/` sits next to your project's lockfile,
+`afterpack.json` or `.git` (failing those, its `package.json`), otherwise beside the build
+directory, so the receipt never ships with your build. Run `npx afterpack verify dist` in your
+deploy step to check that what you ship is what was obfuscated.
 
 ## Options
 
@@ -44,7 +46,7 @@ new AfterpackWebpackPlugin({ preset: "hard", seed: "git" });
 | [`seed`][seed] | a number or string; `"git"` uses the current commit | a new random seed per build |
 | [`identifiers.reserved`][identifiers.reserved] | names never to rename | none |
 | [`paths.exclude`][paths.exclude] | globs for files to leave untouched | none |
-| [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output; off also drops the build's CSS maps | on in development when webpack emits a map, off in production |
+| [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output; off also drops the build's CSS maps | off; on in development mode (`build.mode` or `NODE_ENV=development`) when webpack emits a map |
 | [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when `devtool` emits source maps |
 | [`build.autorun`][build.autorun] | `false` turns AfterPack off | `true` |
 

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 
 //#endregion
+const node_crypto = __toESM(require("node:crypto"));
 const node_fs = __toESM(require("node:fs"));
 const node_path = __toESM(require("node:path"));
 const __afterpack_core = __toESM(require("@afterpack/core"));
@@ -31,6 +32,7 @@ const PLUGIN_NAME = "AfterpackWebpackPlugin";
 const EMITTED_JS_RE = /\.(?:js|mjs|cjs)$/;
 const SOURCE_MODULE_RE = /\.(?:m?[jt]sx?)$/;
 const CSS_MAP_RE = /\.css\.map$/;
+const SRI_CONFLICT = "[afterpack-webpack] webpack-subresource-integrity is not compatible with AfterPack. It hashes each chunk for its <script integrity=...> before AfterPack obfuscates, so the browser would block every script, and it taps the same RealContentHash.updateHash bail hook AfterPack needs to rename obfuscated chunks. Remove the SubresourceIntegrityPlugin, or remove AfterPack.";
 const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack <dir> --paths.include=...` for a disk walk, or drop the key.";
 function isEmittedJs(name) {
 	return !name.includes(".hot-update.") && EMITTED_JS_RE.test(name);
@@ -59,11 +61,14 @@ function stripCssSourceMaps(compilation, RawSource) {
 		if (stripped !== css) compilation.updateAsset(name, new RawSource(stripped));
 	}
 }
-function chunkClaimedJsAssets(compilation) {
+function chunkClaimedJsNames(compilation) {
 	const names = new Set();
 	for (const chunk of compilation.chunks) for (const name of chunk.files) if (isEmittedJs(name)) names.add(name);
+	return [...names];
+}
+function chunkClaimedJsAssets(compilation) {
 	const out = [];
-	for (const name of names) {
+	for (const name of chunkClaimedJsNames(compilation)) {
 		const asset = compilation.getAsset(name);
 		if (!asset) continue;
 		const related = asset.info.related;
@@ -95,6 +100,8 @@ var AfterpackWebpackPlugin = class {
 	seenByBuildHooksThisCompilation = new Set();
 	captureDiagnostics = [];
 	deferredReceiptByCompilation = new WeakMap();
+	hashSalt = null;
+	warnedRealContentHash = false;
 	constructor(options = {}) {
 		const resolved = (0, __afterpack_integration_utils.resolvePluginConfig)({
 			label: PLUGIN_NAME,
@@ -106,10 +113,33 @@ var AfterpackWebpackPlugin = class {
 	}
 	apply(compiler) {
 		const context = compiler.options.context ?? process.cwd();
+		const sri = (compiler.options.plugins ?? []).find((plugin) => /SubresourceIntegrity/.test(plugin?.constructor?.name ?? ""));
+		if (sri) throw new Error(SRI_CONFLICT);
 		const directivesEnabled = this.settings.directives.enabled;
 		if (directivesEnabled) compiler.hooks.thisCompilation.tap(PLUGIN_NAME, () => {
 			this.seenByBuildHooksThisCompilation.clear();
 		});
+		if (this.settings.build?.autorun !== false) {
+			const devtool = compiler.options.devtool;
+			const hasBundlerSourcemap = typeof devtool === "string" && devtool.includes("source-map");
+			const prepare = async () => {
+				this.hashSalt = await (0, __afterpack_integration_utils.prepareHashSalt)({
+					seed: this.settings.seed,
+					root: context,
+					leg: compiler.outputPath,
+					localEngineVersion: await (0, __afterpack_integration_utils.readEngineVersion)({ version: __afterpack_core.version }),
+					settings: (0, __afterpack_integration_utils.saltSettings)((0, __afterpack_integration_utils.passSettings)({
+						options: this.settings,
+						engineConfig: this.engineConfig
+					}), { ...(0, __afterpack_integration_utils.reportPolicySaltBits)(process.env, this.settings.artifactOptions, hasBundlerSourcemap) }),
+					warn: (message) => console.warn(message)
+				});
+			};
+			compiler.hooks.make.tapPromise(PLUGIN_NAME, prepare);
+			compiler.hooks.compilation.tap(PLUGIN_NAME, (compilation) => {
+				this.saltJavascriptHashes(compiler, compilation);
+			});
+		}
 		compiler.hooks.compilation.tap(PLUGIN_NAME, (compilation) => {
 			if (directivesEnabled) {
 				const hooks = compiler.webpack.NormalModule.getCompilationHooks(compilation);
@@ -119,7 +149,7 @@ var AfterpackWebpackPlugin = class {
 			}
 			compilation.hooks.processAssets.tapPromise({
 				name: PLUGIN_NAME,
-				stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_REPORT
+				stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_OPTIMIZE_HASH + 1
 			}, () => this.obfuscate(compiler, compilation, context));
 		});
 		compiler.hooks.afterEmit.tapPromise(PLUGIN_NAME, async (compilation) => {
@@ -134,6 +164,56 @@ var AfterpackWebpackPlugin = class {
 			}
 		});
 	}
+	directiveSaltForChunk(compilation, chunk) {
+		if (!this.settings.directives.enabled || this.captured.size === 0) return "";
+		const chunkGraph = compilation.chunkGraph;
+		if (!chunkGraph) return "";
+		const resources = [];
+		for (const module$1 of chunkGraph.getChunkModulesIterable(chunk)) collectResourcesThroughConcatenatedModules(module$1, resources);
+		const parts = [];
+		for (const resource of resources) {
+			const cap = this.captured.get(resource);
+			if (cap && (cap.directives.length > 0 || cap.renameGlobals)) parts.push(JSON.stringify({
+				id: cap.id,
+				d: cap.directives,
+				g: cap.renameGlobals
+			}));
+		}
+		if (parts.length === 0) return "";
+		return (0, node_crypto.createHash)("sha256").update(parts.sort().join("\0")).digest("hex").slice(0, 16);
+	}
+	saltJavascriptHashes(compiler, compilation) {
+		const salt = () => this.hashSalt?.salt;
+		const { JavascriptModulesPlugin } = compiler.webpack.javascript;
+		JavascriptModulesPlugin.getCompilationHooks(compilation).chunkHash.tap(PLUGIN_NAME, (chunk, hash) => {
+			const value = salt();
+			if (!value) return;
+			hash.update(value);
+			const directives = this.directiveSaltForChunk(compilation, chunk);
+			if (directives) hash.update(directives);
+		});
+		const realContentHash = compiler.webpack.optimize.RealContentHashPlugin;
+		if (typeof realContentHash.getCompilationHooks !== "function") {
+			if (compiler.options.optimization?.realContentHash && !this.warnedRealContentHash) {
+				this.warnedRealContentHash = true;
+				console.warn("[afterpack-webpack] this webpack version offers no hook into realContentHash, so each obfuscated chunk keeps the name of its plain bytes. Upgrade webpack, or set `optimization.realContentHash: false`.");
+			}
+			return;
+		}
+		let jsNames = null;
+		realContentHash.getCompilationHooks(compilation).updateHash.tap(PLUGIN_NAME, (content, oldHash) => {
+			const value = salt();
+			if (!value) return void 0;
+			jsNames ??= chunkClaimedJsNames(compilation);
+			if (!jsNames.some((name) => name.includes(oldHash))) return void 0;
+			const { hashFunction, hashDigest, hashSalt } = compilation.outputOptions;
+			const hash = compiler.webpack.util.createHash(hashFunction ?? "md4");
+			if (hashSalt) hash.update(hashSalt);
+			hash.update(value);
+			for (const chunk of content) hash.update(chunk);
+			return String(hash.digest(hashDigest ?? "hex")).slice(0, oldHash.length);
+		});
+	}
 	async obfuscate(compiler, compilation, context) {
 		if (this.settings.build?.autorun === false) return;
 		const startedAt = Date.now();
@@ -172,12 +252,11 @@ var AfterpackWebpackPlugin = class {
 			telemetry: (0, __afterpack_integration_utils.createTelemetryReporter)(),
 			label: "afterpack-webpack",
 			cwd: context,
+			resolvedSeed: this.hashSalt?.resolvedSeed,
+			cloudEngineExpectation: this.hashSalt?.engine,
 			startedAt,
 			capturedByFile: capturedByFile.size > 0 ? capturedByFile : void 0,
-			combinedProtectionMap: {
-				buildDir: outputPath,
-				afterpackDir: (0, node_path.join)(context, ".afterpack")
-			},
+			combinedProtectionMap: { buildDir: outputPath },
 			...(0, __afterpack_integration_utils.passSettings)({
 				options: this.settings,
 				engineConfig: this.engineConfig

package/dist/index.d.cts

@@ -10,8 +10,12 @@ declare class AfterpackWebpackPlugin {
   private readonly seenByBuildHooksThisCompilation;
   private readonly captureDiagnostics;
   private readonly deferredReceiptByCompilation;
+  private hashSalt;
+  private warnedRealContentHash;
   constructor(options?: AfterpackWebpackOptions);
   apply(compiler: Compiler): void;
+  private directiveSaltForChunk;
+  private saltJavascriptHashes;
   private obfuscate;
   private capture;
   private joinCaptured;

package/dist/index.d.ts

@@ -10,8 +10,12 @@ declare class AfterpackWebpackPlugin {
   private readonly seenByBuildHooksThisCompilation;
   private readonly captureDiagnostics;
   private readonly deferredReceiptByCompilation;
+  private hashSalt;
+  private warnedRealContentHash;
   constructor(options?: AfterpackWebpackOptions);
   apply(compiler: Compiler): void;
+  private directiveSaltForChunk;
+  private saltJavascriptHashes;
   private obfuscate;
   private capture;
   private joinCaptured;

package/dist/index.js

@@ -1,13 +1,15 @@
+import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { basename, join, relative } from "node:path";
 import { processBatch, version } from "@afterpack/core";
-import { createTelemetryReporter, decodeDataUri, extractSourceMappingURL, passSettings, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, scanDirectives, sourceTypeForOutputFormat, withSourceMappingURL, withoutCssSourceMappingURL, writeDeferredProtectionReceipt } from "@afterpack/integration-utils";
+import { createTelemetryReporter, decodeDataUri, extractSourceMappingURL, passSettings, prepareHashSalt, readEngineVersion, reportPolicySaltBits, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, saltSettings, scanDirectives, sourceTypeForOutputFormat, withSourceMappingURL, withoutCssSourceMappingURL, writeDeferredProtectionReceipt } from "@afterpack/integration-utils";
 
 //#region src/index.ts
 const PLUGIN_NAME = "AfterpackWebpackPlugin";
 const EMITTED_JS_RE = /\.(?:js|mjs|cjs)$/;
 const SOURCE_MODULE_RE = /\.(?:m?[jt]sx?)$/;
 const CSS_MAP_RE = /\.css\.map$/;
+const SRI_CONFLICT = "[afterpack-webpack] webpack-subresource-integrity is not compatible with AfterPack. It hashes each chunk for its <script integrity=...> before AfterPack obfuscates, so the browser would block every script, and it taps the same RealContentHash.updateHash bail hook AfterPack needs to rename obfuscated chunks. Remove the SubresourceIntegrityPlugin, or remove AfterPack.";
 const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack <dir> --paths.include=...` for a disk walk, or drop the key.";
 function isEmittedJs(name) {
 	return !name.includes(".hot-update.") && EMITTED_JS_RE.test(name);
@@ -36,11 +38,14 @@ function stripCssSourceMaps(compilation, RawSource) {
 		if (stripped !== css) compilation.updateAsset(name, new RawSource(stripped));
 	}
 }
-function chunkClaimedJsAssets(compilation) {
+function chunkClaimedJsNames(compilation) {
 	const names = new Set();
 	for (const chunk of compilation.chunks) for (const name of chunk.files) if (isEmittedJs(name)) names.add(name);
+	return [...names];
+}
+function chunkClaimedJsAssets(compilation) {
 	const out = [];
-	for (const name of names) {
+	for (const name of chunkClaimedJsNames(compilation)) {
 		const asset = compilation.getAsset(name);
 		if (!asset) continue;
 		const related = asset.info.related;
@@ -72,6 +77,8 @@ var AfterpackWebpackPlugin = class {
 	seenByBuildHooksThisCompilation = new Set();
 	captureDiagnostics = [];
 	deferredReceiptByCompilation = new WeakMap();
+	hashSalt = null;
+	warnedRealContentHash = false;
 	constructor(options = {}) {
 		const resolved = resolvePluginConfig({
 			label: PLUGIN_NAME,
@@ -83,10 +90,33 @@ var AfterpackWebpackPlugin = class {
 	}
 	apply(compiler) {
 		const context = compiler.options.context ?? process.cwd();
+		const sri = (compiler.options.plugins ?? []).find((plugin) => /SubresourceIntegrity/.test(plugin?.constructor?.name ?? ""));
+		if (sri) throw new Error(SRI_CONFLICT);
 		const directivesEnabled = this.settings.directives.enabled;
 		if (directivesEnabled) compiler.hooks.thisCompilation.tap(PLUGIN_NAME, () => {
 			this.seenByBuildHooksThisCompilation.clear();
 		});
+		if (this.settings.build?.autorun !== false) {
+			const devtool = compiler.options.devtool;
+			const hasBundlerSourcemap = typeof devtool === "string" && devtool.includes("source-map");
+			const prepare = async () => {
+				this.hashSalt = await prepareHashSalt({
+					seed: this.settings.seed,
+					root: context,
+					leg: compiler.outputPath,
+					localEngineVersion: await readEngineVersion({ version }),
+					settings: saltSettings(passSettings({
+						options: this.settings,
+						engineConfig: this.engineConfig
+					}), { ...reportPolicySaltBits(process.env, this.settings.artifactOptions, hasBundlerSourcemap) }),
+					warn: (message) => console.warn(message)
+				});
+			};
+			compiler.hooks.make.tapPromise(PLUGIN_NAME, prepare);
+			compiler.hooks.compilation.tap(PLUGIN_NAME, (compilation) => {
+				this.saltJavascriptHashes(compiler, compilation);
+			});
+		}
 		compiler.hooks.compilation.tap(PLUGIN_NAME, (compilation) => {
 			if (directivesEnabled) {
 				const hooks = compiler.webpack.NormalModule.getCompilationHooks(compilation);
@@ -96,7 +126,7 @@ var AfterpackWebpackPlugin = class {
 			}
 			compilation.hooks.processAssets.tapPromise({
 				name: PLUGIN_NAME,
-				stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_REPORT
+				stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_OPTIMIZE_HASH + 1
 			}, () => this.obfuscate(compiler, compilation, context));
 		});
 		compiler.hooks.afterEmit.tapPromise(PLUGIN_NAME, async (compilation) => {
@@ -111,6 +141,56 @@ var AfterpackWebpackPlugin = class {
 			}
 		});
 	}
+	directiveSaltForChunk(compilation, chunk) {
+		if (!this.settings.directives.enabled || this.captured.size === 0) return "";
+		const chunkGraph = compilation.chunkGraph;
+		if (!chunkGraph) return "";
+		const resources = [];
+		for (const module of chunkGraph.getChunkModulesIterable(chunk)) collectResourcesThroughConcatenatedModules(module, resources);
+		const parts = [];
+		for (const resource of resources) {
+			const cap = this.captured.get(resource);
+			if (cap && (cap.directives.length > 0 || cap.renameGlobals)) parts.push(JSON.stringify({
+				id: cap.id,
+				d: cap.directives,
+				g: cap.renameGlobals
+			}));
+		}
+		if (parts.length === 0) return "";
+		return createHash("sha256").update(parts.sort().join("\0")).digest("hex").slice(0, 16);
+	}
+	saltJavascriptHashes(compiler, compilation) {
+		const salt = () => this.hashSalt?.salt;
+		const { JavascriptModulesPlugin } = compiler.webpack.javascript;
+		JavascriptModulesPlugin.getCompilationHooks(compilation).chunkHash.tap(PLUGIN_NAME, (chunk, hash) => {
+			const value = salt();
+			if (!value) return;
+			hash.update(value);
+			const directives = this.directiveSaltForChunk(compilation, chunk);
+			if (directives) hash.update(directives);
+		});
+		const realContentHash = compiler.webpack.optimize.RealContentHashPlugin;
+		if (typeof realContentHash.getCompilationHooks !== "function") {
+			if (compiler.options.optimization?.realContentHash && !this.warnedRealContentHash) {
+				this.warnedRealContentHash = true;
+				console.warn("[afterpack-webpack] this webpack version offers no hook into realContentHash, so each obfuscated chunk keeps the name of its plain bytes. Upgrade webpack, or set `optimization.realContentHash: false`.");
+			}
+			return;
+		}
+		let jsNames = null;
+		realContentHash.getCompilationHooks(compilation).updateHash.tap(PLUGIN_NAME, (content, oldHash) => {
+			const value = salt();
+			if (!value) return void 0;
+			jsNames ??= chunkClaimedJsNames(compilation);
+			if (!jsNames.some((name) => name.includes(oldHash))) return void 0;
+			const { hashFunction, hashDigest, hashSalt } = compilation.outputOptions;
+			const hash = compiler.webpack.util.createHash(hashFunction ?? "md4");
+			if (hashSalt) hash.update(hashSalt);
+			hash.update(value);
+			for (const chunk of content) hash.update(chunk);
+			return String(hash.digest(hashDigest ?? "hex")).slice(0, oldHash.length);
+		});
+	}
 	async obfuscate(compiler, compilation, context) {
 		if (this.settings.build?.autorun === false) return;
 		const startedAt = Date.now();
@@ -149,12 +229,11 @@ var AfterpackWebpackPlugin = class {
 			telemetry: createTelemetryReporter(),
 			label: "afterpack-webpack",
 			cwd: context,
+			resolvedSeed: this.hashSalt?.resolvedSeed,
+			cloudEngineExpectation: this.hashSalt?.engine,
 			startedAt,
 			capturedByFile: capturedByFile.size > 0 ? capturedByFile : void 0,
-			combinedProtectionMap: {
-				buildDir: outputPath,
-				afterpackDir: join(context, ".afterpack")
-			},
+			combinedProtectionMap: { buildDir: outputPath },
 			...passSettings({
 				options: this.settings,
 				engineConfig: this.engineConfig

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afterpack/webpack",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "webpack plugin for AfterPack: obfuscate your production JavaScript during the webpack build",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -28,8 +28,8 @@
     "webpack": "^5.0.0"
   },
   "dependencies": {
-    "@afterpack/core": "~0.2.3",
-    "@afterpack/integration-utils": "0.2.2"
+    "@afterpack/core": "~0.2.5",
+    "@afterpack/integration-utils": "0.2.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",