@afterpack/webpack 0.2.6 → 1.0.0

package/README.md

@@ -31,8 +31,8 @@ each chunk before AfterPack rewrites it, so the recorded hashes would not match
 Each build writes a protection receipt to `.afterpack/receipts/`, one per output directory
 (`.afterpack/receipts/dist.json` for `dist`). `.afterpack/` sits next to your project's lockfile,
 `afterpack.json` or `.git` (failing those, its `package.json`), otherwise beside the build
-directory, so the receipt never ships with your build. Run `npx afterpack verify dist` in your
-deploy step to check that what you ship is what was obfuscated.
+directory, so the receipt never ships with your build. Run `npx afterpack@latest verify dist` in
+your deploy step to check that what you ship is what was obfuscated.
 
 ## Options
 
@@ -47,7 +47,7 @@ new AfterpackWebpackPlugin({ preset: "hard", seed: "git" });
 | [`identifiers.reserved`][identifiers.reserved] | names never to rename | none |
 | [`paths.exclude`][paths.exclude] | globs for files to leave untouched | none |
 | [`sourceMap.enabled`][sourceMap.enabled] | write source maps for the obfuscated output; off also drops the build's CSS maps | off; on in development mode (`build.mode` or `NODE_ENV=development`) when webpack emits a map |
-| [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when `devtool` emits source maps |
+| [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when `devtool` emits source maps, outside CI |
 | [`build.autorun`][build.autorun] | `false` turns AfterPack off | `true` |
 
 Dotted names are nested objects: `sourceMap.enabled` is `{ sourceMap: { enabled: true } }`. Every
@@ -65,9 +65,11 @@ other option is in the [configuration reference](https://www.afterpack.dev/docs/
 a region are a [Pro](https://www.afterpack.dev/docs/pro) feature. They need a `devtool` that emits
 source maps, such as `"source-map"`. Without one, the plugin skips them and tells you.
 
-The [Protection Map](https://www.afterpack.dev/docs/protection-map) is written to `.afterpack/`,
-outside webpack's output; that directory carries its own `.gitignore` and self-ignores. It contains
-your original source, so never deploy or commit it.
+When `devtool` emits source maps, the
+[Protection Map](https://www.afterpack.dev/docs/protection-map) is written to `.afterpack/`, outside
+webpack's output; that directory carries its own `.gitignore` and self-ignores. Without source
+maps, or in CI, it is off unless `protectionMap.enabled` is `true`. It contains your original
+source, so never deploy or commit it.
 
 Options can also live in `afterpack.json` or in `AFTERPACK_*` environment variables. The options
 object wins over the environment, which wins over the file. An unknown or misspelled key fails the

package/dist/index.cjs

@@ -33,7 +33,7 @@ const EMITTED_JS_RE = /\.(?:js|mjs|cjs)$/;
 const SOURCE_MODULE_RE = /\.(?:m?[jt]sx?)$/;
 const CSS_MAP_RE = /\.css\.map$/;
 const SRI_CONFLICT = "[afterpack-webpack] webpack-subresource-integrity is not compatible with AfterPack. It hashes each chunk for its <script integrity=...> before AfterPack obfuscates, so the browser would block every script, and it taps the same RealContentHash.updateHash bail hook AfterPack needs to rename obfuscated chunks. Remove the SubresourceIntegrityPlugin, or remove AfterPack.";
-const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack <dir> --paths.include=...` for a disk walk, or drop the key.";
+const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack@latest <dir> --paths.include=...` for a disk walk, or drop the key.";
 function isEmittedJs(name) {
 	return !name.includes(".hot-update.") && EMITTED_JS_RE.test(name);
 }
@@ -263,6 +263,7 @@ var AfterpackWebpackPlugin = class {
 			}),
 			sourceType: (0, __afterpack_integration_utils.sourceTypeForOutputFormat)(outputModule ? "module" : void 0),
 			hasBundlerSourcemap: typeof devtool === "string" && devtool.includes("source-map"),
+			receipt: { bundler: "webpack" },
 			messages: { autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found; set `devtool: 'source-map'` so future builds can render original source in the map." }
 		});
 		const { RawSource } = compiler.webpack.sources;

package/dist/index.js

@@ -10,7 +10,7 @@ const EMITTED_JS_RE = /\.(?:js|mjs|cjs)$/;
 const SOURCE_MODULE_RE = /\.(?:m?[jt]sx?)$/;
 const CSS_MAP_RE = /\.css\.map$/;
 const SRI_CONFLICT = "[afterpack-webpack] webpack-subresource-integrity is not compatible with AfterPack. It hashes each chunk for its <script integrity=...> before AfterPack obfuscates, so the browser would block every script, and it taps the same RealContentHash.updateHash bail hook AfterPack needs to rename obfuscated chunks. Remove the SubresourceIntegrityPlugin, or remove AfterPack.";
-const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack <dir> --paths.include=...` for a disk walk, or drop the key.";
+const PATHS_INCLUDE_UNSUPPORTED = "this plugin obfuscates the assets webpack's own chunks claim, in the pipeline — there is no output-directory walk for a glob to re-admit anything into. Use `npx afterpack@latest <dir> --paths.include=...` for a disk walk, or drop the key.";
 function isEmittedJs(name) {
 	return !name.includes(".hot-update.") && EMITTED_JS_RE.test(name);
 }
@@ -240,6 +240,7 @@ var AfterpackWebpackPlugin = class {
 			}),
 			sourceType: sourceTypeForOutputFormat(outputModule ? "module" : void 0),
 			hasBundlerSourcemap: typeof devtool === "string" && devtool.includes("source-map"),
+			receipt: { bundler: "webpack" },
 			messages: { autoEnableBundlerSourcemap: "protectionMap:true but no bundler sourcemap was found; set `devtool: 'source-map'` so future builds can render original source in the map." }
 		});
 		const { RawSource } = compiler.webpack.sources;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afterpack/webpack",
-  "version": "0.2.6",
+  "version": "1.0.0",
   "description": "webpack plugin for AfterPack: obfuscate your production JavaScript during the webpack build",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -28,15 +28,15 @@
     "webpack": "^5.0.0"
   },
   "dependencies": {
-    "@afterpack/core": "~0.2.7",
-    "@afterpack/integration-utils": "0.2.6"
+    "@afterpack/core": "~1.0.0",
+    "@afterpack/integration-utils": "1.0.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",
     "@types/node": "^22.0.0",
     "tsdown": "^0.11.0",
     "typescript": "^5.0.0",
-    "vitest": "^2.0.0",
+    "vitest": "^4.1.12",
     "webpack": "^5.0.0"
   },
   "engines": {