afterpack 0.2.2 → 0.2.4

package/README.md

@@ -31,13 +31,27 @@ Nested `node_modules/` folders are skipped. Pass [`--paths.include`][paths.inclu
 
 Each run writes:
 
-- `.afterpack-protection.json` in the output directory, the receipt that `afterpack verify` checks.
+- `.afterpack/receipts/<output dir>.json` (`.afterpack/receipts/dist.json` for `dist`), the receipt
+  that `afterpack verify` checks.
 - `.afterpack/backup/`, a copy of the original files, so `afterpack restore` can undo the run.
   Turn it off with [`--build.backup`][build.backup]`=false`.
 - `.afterpack/protectionMap.html`, the [Protection Map](https://www.afterpack.dev/docs/protection-map),
   when your build has source maps.
-- `.map` files next to the output, when your build has source maps and the run is not a production
-  build.
+- `.map` files next to the output, only when you ask for them with
+  [`--sourceMap.enabled`][sourceMap.enabled] or run with `--build.mode=development` (or
+  `NODE_ENV=development`) on a build that has source maps.
+
+Every other run is a production run: it deletes your build's own source maps, hidden ones included,
+and the `sourceMappingURL` comments that name them, so no original source ships beside the output.
+
+`.afterpack/` sits next to your project's lockfile, `afterpack.json` or `.git` (failing those, its
+`package.json`), otherwise beside the build directory, never inside it: `cd public && npx afterpack
+.` keeps it beside `public/`, and a `package.json` your build emits, such as Nitro's
+`.output/server/package.json`, never moves it. A single file in a project root that holds a
+lockfile, `afterpack.json` or `.git` keeps it in that root. The same place holds every run's files
+whatever directory you run from, so a second run over the same output, or over the same file, is
+refused from anywhere. A run fails if it finds a `.afterpack/` inside the output, and removes a
+`.afterpack-protection.json` an older version left there.
 
 The backup and the Protection Map contain your original source. `.afterpack/` carries its own
 `.gitignore` and self-ignores. Never deploy or commit them.
@@ -49,13 +63,18 @@ runs. It never prompts.
 
 ## `afterpack verify [dir]`
 
-Checks a build against its protection receipt. Run it in your deploy step.
+Checks a build against its protection receipt in `.afterpack/receipts/`. Run it in your deploy
+step.
 
 ```sh
 npx afterpack@latest verify .        # looks in ./ and ./.next/
 npx afterpack@latest verify dist
+npx afterpack@latest verify build    # SvelteKit's adapter copy; also .output/public, out/
 ```
 
+A directory a framework copied from its build output, such as SvelteKit's `build/`, Nuxt's
+`.output/public/` or Next's `out/`, is checked against the receipt of the directory it copied.
+
 It exits `1` when the receipt is missing, belongs to a different build, or a file changed after it
 was obfuscated. The CLI and the plugins for Vite, Next.js, webpack, Rollup, esbuild and Angular all
 write a receipt.
@@ -104,8 +123,8 @@ the [configuration reference](https://www.afterpack.dev/docs/config). The
 [identifiers.reserved]: https://www.afterpack.dev/docs/config#identifiers-reserved
 [build.backup]: https://www.afterpack.dev/docs/config#build-backup
 [protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
+[sourceMap.enabled]: https://www.afterpack.dev/docs/config#sourceMap-enabled
 [diagnostics.format]: https://www.afterpack.dev/docs/config#diagnostics-format
-[allowUnobfuscated]: https://www.afterpack.dev/docs/config#allowUnobfuscated
 [inflation.max]: https://www.afterpack.dev/docs/config#inflation-max
 [key]: https://www.afterpack.dev/docs/config#key
 
@@ -136,8 +155,10 @@ Pro](https://www.afterpack.dev/docs/pro).
 | --- | --- |
 | `0` | Success. |
 | `1` | Failure. Nothing was changed, or `verify`, `restore` or `audit` failed. |
-| `2` | Some files shipped unobfuscated. Only possible with [`allowUnobfuscated`][allowUnobfuscated]. |
+| `2` | Partial. Reserved for a quota-exhausted build; no build returns it today. |
 | `3` | The size limit ([`inflation.max`][inflation.max]) stopped AfterPack before it reached the protection level. |
+| `4` | A region directive that raises protection needs a Pro key. |
+| `5` | A runtime-reflection pattern was not acknowledged. |
 | `6` | An update is required. The CLI prints the install command to run. |
 | `64` | Misuse: an unknown option or command, or a malformed value. |
 

package/SKILL.md

@@ -67,11 +67,26 @@ Rules:
 
 ## What a run writes
 
-- `.afterpack-protection.json` in the output directory: the receipt `afterpack verify` checks.
+- `.afterpack/receipts/<output dir>.json` (`.afterpack/receipts/dist.json` for `dist`): the receipt
+  `afterpack verify` checks.
 - `.afterpack/backup/`: the original files, on by default for the CLI, so `afterpack restore` can
   undo the run. `--build.backup=false` turns it off.
 - `.afterpack/protectionMap.html`: the Protection Map report, when the build has source maps.
-- `.map` files beside the output, when an input map exists and the run is not a production build.
+- `.map` files beside the output, only with `--sourceMap.enabled` or on a development run
+  (`--build.mode=development` or `NODE_ENV=development`) when an input map exists.
+
+Every other run is a production run, `CI` and an unset `NODE_ENV` included. It deletes the build's
+own source maps, hidden ones included, and the `sourceMappingURL` comments that name them.
+
+Every front door puts `.afterpack/` next to the nearest lockfile, `afterpack.json` or `.git` above
+the build directory, failing those the nearest `package.json`, otherwise beside the build
+directory, never inside it (`cd public && npx afterpack .` keeps it beside `public/`). A
+`package.json` the build emits, such as Nitro's `.output/server/package.json` or a dual package's
+`dist/cjs/package.json`, never moves it. For a single file, the file's own directory counts when it
+holds a lockfile, `afterpack.json` or `.git`, so `npx afterpack app.js` in such a root keeps
+`.afterpack/` there. The place does not depend on the working directory, so a re-run over the same
+output or the same file is refused from anywhere. A run fails if it finds a `.afterpack/` inside
+the output, and removes a `.afterpack-protection.json` an older version left there.
 
 The backup and the Protection Map contain the original source. `.afterpack/` carries its own
 `.gitignore` and self-ignores. Never deploy, publish or commit them.
@@ -103,11 +118,10 @@ minification.
 | [`paths.include`][paths.include] | globs to add back to the walk | `[]` |
 | [`identifiers.reserved`][identifiers.reserved] | names never to rename | `[]` |
 | [`build.backup`][build.backup] | keep originals in `.afterpack/backup/` | `true` for the CLI, `false` in plugins |
-| [`sourceMap.enabled`][sourceMap.enabled] | write `.map` files | on when an input map exists, off in production |
+| [`sourceMap.enabled`][sourceMap.enabled] | write `.map` files | off; on in development mode when an input map exists |
 | [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when an input map exists |
 | [`diagnostics.format`][diagnostics.format] | `text` or `json` | `text` |
 | [`diagnostics.level`][diagnostics.level] | `summary`, `all` or `none` (errors still print) | `summary` |
-| [`allowUnobfuscated`][allowUnobfuscated] | ship a file that could not be processed, instead of failing (exit `2`) | `false` |
 | [`build.autorun`][build.autorun] | `false` turns AfterPack off for the project, CLI and plugins alike | `true` |
 | [`telemetry.enabled`][telemetry.enabled] | anonymous diagnostics, sent only when a build is refused or partial | `true` |
 
@@ -126,7 +140,6 @@ https://www.afterpack.dev/docs/config
 [protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
 [diagnostics.format]: https://www.afterpack.dev/docs/config#diagnostics-format
 [diagnostics.level]: https://www.afterpack.dev/docs/config#diagnostics-level
-[allowUnobfuscated]: https://www.afterpack.dev/docs/config#allowUnobfuscated
 [build.autorun]: https://www.afterpack.dev/docs/config#build-autorun
 [telemetry.enabled]: https://www.afterpack.dev/docs/config#telemetry-enabled
 [inflation.max]: https://www.afterpack.dev/docs/config#inflation-max
@@ -164,7 +177,7 @@ it too. Add `--diagnostics.level=none` for a run that prints nothing else.
 }
 ```
 
-`status` is `obfuscated`, `unchanged`, `unobfuscated` or `failed`. A failure is a document too,
+`status` is `obfuscated`, `unchanged` or `failed`. A failure is a document too,
 with the same exit code and a `fix` field to act on:
 
 ```json
@@ -196,15 +209,20 @@ Details: https://www.afterpack.dev/docs/pro
 
 ## `afterpack verify [dir]`
 
-Add this to the deploy step. It re-hashes every file the protection receipt names.
+Add this to the deploy step. It reads the receipt for `[dir]` from `.afterpack/receipts/`, found
+by the same rule as above, and re-hashes every file that receipt names.
 
 ```bash
 npx afterpack@latest verify .        # looks in ./ and ./.next/
 npx afterpack@latest verify dist
+npx afterpack@latest verify build    # SvelteKit's adapter copy; also .output/public, out/
 ```
 
-It exits `1` when the receipt is missing, belongs to a different build, or a file changed after it
-was obfuscated. A missing receipt is a failure. `verify` reads no configuration and takes only
+When `[dir]` has no receipt of its own, verify looks for the project receipt whose files `[dir]`
+holds, at the same relative paths or under one prefix, so a framework's copy of its build output
+(SvelteKit's `build/`, Nuxt's `.output/public/`, Next's `out/`) is checked against the receipt of
+the directory it copied. It exits `1` when the receipt is missing, belongs to a different build,
+or a file changed after it was obfuscated. A missing receipt is a failure. `verify` reads no configuration and takes only
 `--diagnostics.format` and `--diagnostics.level`.
 
 ## `afterpack restore [dir]`
@@ -231,8 +249,10 @@ exits `1`. Anonymous use is rate-limited per 24 hours. Docs: https://www.afterpa
 | --- | --- |
 | `0` | Success. Also `--help` and `--version`. |
 | `1` | Failure: bad path, no JavaScript found, an engine error, an already-obfuscated tree, a failed `verify`, `restore` or scan, or an unreachable cloud on a Pro build. |
-| `2` | Partial: some files shipped unobfuscated. Only with [`allowUnobfuscated`][allowUnobfuscated]. |
+| `2` | Partial. Reserved for a quota-exhausted build; no build returns it today. |
 | `3` | Size cap: [`inflation.max`][inflation.max] stopped the run before it reached the protection level. |
+| `4` | Pro required: a region directive that raises protection needs a Pro key (`DIAG_PRO_DIRECTIVE_REQUIRES_KEY`). |
+| `5` | Reflection: a runtime-reflection pattern was not acknowledged (`DIAG_REFLECTION_NOT_ACKNOWLEDGED`). |
 | `6` | Update required. Run the install command it prints, for example `npm install afterpack@latest @afterpack/core@<version>`. Nothing was written. |
 | `64` | Misuse: unknown flag or command, malformed value, or two path arguments. |
 

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { processBatch, version } from "@afterpack/core";
-import { AlreadyObfuscatedError, CLOUD_REFUSAL_SUMMARY, CONFIG_KEYS, CORE_FLOOR_SUMMARY, CloudApiError, CoreVersionError, DIAG_ALREADY_OBFUSCATED, PROTECTION_RECEIPT_FILE, UnreadableReceiptError, collectJsFiles, createTelemetryReporter, ensureAfterpackGitignore, findUpward, getPath, installedRequiredLine, loadConfigFile, mergeConfig, npxAlternative, parseCliOptions, parseEnvOptions, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, serverAddsInfo, sha256Of, toEngineConfig, toPluginOptions, verifyProtectionReceipt } from "@afterpack/integration-utils";
+import { AFTERPACK_DIR, AfterpackFilesError, AlreadyObfuscatedError, CLOUD_REFUSAL_SUMMARY, CONFIG_KEYS, CORE_FLOOR_SUMMARY, CloudApiError, CoreVersionError, DIAG_ALREADY_OBFUSCATED, PROTECTION_RECEIPTS_DIR, UnreadableReceiptError, afterpackHome, collectJsFiles, createTelemetryReporter, ensureAfterpackGitignore, getPath, installedRequiredLine, loadConfigFile, locateProtectionReceipt, mergeConfig, npxAlternative, parseCliOptions, parseEnvOptions, protectionReceiptPath, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, serverAddsInfo, sha256Of, toEngineConfig, toPluginOptions, verifyProtectionReceipt } from "@afterpack/integration-utils";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
 
@@ -170,20 +170,28 @@ const EXIT = {
 	usage: 64
 };
 const SIZE_CAP_CODE = "DIAG_SIZE_CAP_REACHED";
+const PRO_REQUIRED_CODE = "DIAG_PRO_DIRECTIVE_REQUIRES_KEY";
+const REFLECTION_CODE = "DIAG_REFLECTION_NOT_ACKNOWLEDGED";
 const EXIT_CODE_HELP = `Exit codes:
   0   success — every collected file was obfuscated and written
   1   total failure — nothing usable was produced (also: a Pro build whose
       cloud call failed; it never falls back to a local build)
-  2   partial — some files shipped unobfuscated; only reachable with
-      \`--allowUnobfuscated\`
+  2   partial — reserved for a quota-exhausted build; no build returns it today
   3   size cap — \`inflation.max\` could not reach the complexity target
       (${SIZE_CAP_CODE})
+  4   Pro required — a region directive that raises protection needs a Pro key
+      (${PRO_REQUIRED_CODE})
+  5   reflection — a runtime-reflection pattern was not acknowledged
+      (${REFLECTION_CODE})
   6   update required — the AfterPack cloud API, or this afterpack, needs a
       newer @afterpack/core; nothing was written
   64  misuse — an unknown flag or command, or a malformed value`;
 function failureExitCode(diagnostics) {
-	const sizeCap = diagnostics.some((d) => d.code === SIZE_CAP_CODE && d.severity !== "info");
-	return sizeCap ? EXIT.sizeCap : EXIT.failure;
+	const has = (code) => diagnostics.some((d) => d.code === code && d.severity !== "info");
+	if (has(PRO_REQUIRED_CODE)) return EXIT.proRequired;
+	if (has(REFLECTION_CODE)) return EXIT.reflection;
+	if (has(SIZE_CAP_CODE)) return EXIT.sizeCap;
+	return EXIT.failure;
 }
 
 //#endregion
@@ -482,6 +490,13 @@ function reportingLogger(logger, mode) {
 		error: (m) => logger.error(m)
 	};
 }
+function realDir(path) {
+	try {
+		return realpathSync.native(path);
+	} catch {
+		return path;
+	}
+}
 function documentPath(cwd, filePath) {
 	const rel = relative(cwd, filePath);
 	if (rel === "") return ".";
@@ -638,12 +653,19 @@ result, not a failure), 1 when the scan failed or the stream ended early,
 ${dim(CONTACT_FOOTER)}`;
 const DEFAULT_API_BASE = "https://api.afterpack.dev";
 const WEB_BASE = "https://www.afterpack.dev";
-function normalizeUrl(input) {
+const LOCAL_PATH = /^(?:[\\/.~]|[A-Za-z]:[\\/]|file:)/i;
+function isNamedHost(hostname) {
+	if (hostname === "localhost" || hostname.startsWith("[")) return true;
+	return hostname.includes(".");
+}
+function normalizeUrl(input, cwd) {
 	const raw = input.trim();
+	if (LOCAL_PATH.test(raw) || existsSync(resolve(cwd, raw))) return null;
 	const candidate = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
 	try {
 		const parsed = new URL(candidate);
-		return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.toString() : null;
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+		return isNamedHost(parsed.hostname) ? parsed.toString() : null;
 	} catch {
 		return null;
 	}
@@ -771,7 +793,7 @@ function misuse(deps, code, message) {
 async function audit(deps) {
 	if (deps.positionals.length === 0) return misuse(deps, "MISSING_URL", "audit needs a <url>");
 	if (deps.positionals.length > 1) return misuse(deps, "TOO_MANY_URLS", `audit takes a single <url>, got ${deps.positionals.length}`);
-	const url = normalizeUrl(deps.positionals[0]);
+	const url = normalizeUrl(deps.positionals[0], deps.cwd ?? process.cwd());
 	if (!url) return misuse(deps, "INVALID_URL", `not a URL: ${deps.positionals[0]}`);
 	const interactive = deps.mode.format !== "json" && deps.stdout.isTTY;
 	deps.report.log(header(deps.version));
@@ -865,19 +887,22 @@ async function audit(deps) {
 //#endregion
 //#region src/backup.ts
 const BACKUP_MANIFEST_FILE = "manifest.json";
-const BACKUP_MANIFEST_RELATIVE = join(".afterpack", "backup", BACKUP_MANIFEST_FILE);
-function projectRootFor(cwd, configFile) {
-	return configFile ? dirname(configFile) : cwd;
-}
 function backupDir(projectRoot) {
-	return join(projectRoot, ".afterpack", "backup");
+	return join(projectRoot, AFTERPACK_DIR, "backup");
 }
 function backupManifestPath(projectRoot) {
 	return join(backupDir(projectRoot), BACKUP_MANIFEST_FILE);
 }
-function findBackupProjectRoot(startDir) {
-	const manifestPath = findUpward(startDir, BACKUP_MANIFEST_RELATIVE, { stopAtDir: (dir) => existsSync(join(dir, ".git")) });
-	return manifestPath ? dirname(dirname(dirname(manifestPath))) : null;
+function homeProjectRoot(dir) {
+	try {
+		return afterpackHome(dir).projectRoot;
+	} catch {
+		return null;
+	}
+}
+function findBackupProjectRoot(dir) {
+	const candidates$1 = [dir, homeProjectRoot(dir)].filter((c) => c !== null);
+	return candidates$1.find((c) => existsSync(backupManifestPath(c))) ?? null;
 }
 function toPosixPath(value) {
 	return value.split(sep).join("/");
@@ -928,13 +953,15 @@ function readBackupManifest(projectRoot) {
 }
 function writeBackups(input) {
 	const dir = backupDir(input.projectRoot);
-	rmSync(dir, {
+	const previous = input.merge ? readBackupManifest(input.projectRoot) : null;
+	const replaced = new Set(input.pending.map((p) => p.relPath));
+	const files = previous?.status === "ok" && previous.manifest.protectedRoot === input.protectedRoot ? previous.manifest.files.filter((f) => !replaced.has(f.path)) : [];
+	if (files.length === 0) rmSync(dir, {
 		recursive: true,
 		force: true
 	});
 	mkdirSync(dir, { recursive: true });
 	ensureAfterpackGitignore(dir);
-	const files = [];
 	for (const pending of input.pending) {
 		const dest = absoluteFilePath(dir, pending.relPath);
 		mkdirSync(dirname(dest), { recursive: true });
@@ -1138,14 +1165,15 @@ const RESTORE_HELP = `${RESTORE_USAGE}
 Restores the original, pre-obfuscation files that a previous \`afterpack\` run backed up to
 .afterpack/backup/, undoing that run in place.
 
-Searches upward from [dir] (or the working directory) for the project root that holds
-.afterpack/backup/ — the same directory the \`afterpack\` run was launched from — so restore
-works whether it is pointed at that root or at the build directory beneath it.
+Finds .afterpack/backup/ where the \`afterpack\` run kept it: next to the nearest lockfile,
+afterpack.json or .git above the build directory (failing those the nearest package.json,
+otherwise beside the build directory). Point it at that project root or at the build directory
+itself.
 
 Verifies every recorded file against the hash it was obfuscated to BEFORE touching anything: if
 any file no longer matches, or the manifest itself is unreadable, restore changes nothing and
-fails closed. On success it deletes the backup and the stale protection receipt it recorded,
-leaving .afterpack/ itself in place.
+fails closed. On success it deletes the backup and the stale protection receipt it recorded in
+.afterpack/receipts/, leaving .afterpack/ itself in place.
 
 Arguments:
   [dir]                    a directory at or beneath the project root that holds
@@ -1164,7 +1192,8 @@ function fail$1(deps, exitCode, code, message, fix, detail = []) {
 	return commandFailure(deps, "restore", exitCode, code, message, fix, detail);
 }
 function isRecordedReceipt(projectRoot, receiptPath) {
-	if (basename(receiptPath) !== PROTECTION_RECEIPT_FILE) return false;
+	if (basename(dirname(receiptPath)) !== PROTECTION_RECEIPTS_DIR) return false;
+	if (!receiptPath.endsWith(".json")) return false;
 	const rel = relative(projectRoot, receiptPath);
 	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel) && existsSync(receiptPath);
 }
@@ -1173,9 +1202,9 @@ function restore(deps) {
 	const { cwd, positionals } = deps;
 	if (positionals.length > 1) return fail$1(deps, EXIT.usage, "TOO_MANY_ARGUMENTS", `expected a single [dir], got ${positionals.length}`, RESTORE_USAGE);
 	const requested = positionals[0] ?? ".";
-	const target = isAbsolute(requested) ? requested : resolve(cwd, requested);
-	if (!existsSync(target)) return fail$1(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point restore at the project root that holds .afterpack/backup/, or a directory beneath it.");
-	const projectRoot = findBackupProjectRoot(target);
+	const requestedPath = isAbsolute(requested) ? requested : resolve(cwd, requested);
+	if (!existsSync(requestedPath)) return fail$1(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point restore at the project root that holds .afterpack/backup/, or a directory beneath it.");
+	const projectRoot = findBackupProjectRoot(realDir(requestedPath));
 	if (projectRoot === null) return fail$1(deps, EXIT.failure, "NOTHING_TO_RESTORE", "Nothing to restore", NOTHING_TO_RESTORE_FIX);
 	const manifestResult = readBackupManifest(projectRoot);
 	if (manifestResult.status === "corrupt") return fail$1(deps, EXIT.failure, "BACKUP_MANIFEST_CORRUPT", "Backup manifest is unreadable", `Delete ${documentPath(cwd, manifestResult.path)} and run \`afterpack <path>\` again — a corrupt manifest cannot be restored from.`);
@@ -1346,15 +1375,18 @@ const VERIFY_USAGE = "usage: afterpack verify [dir] [--diagnostics.format=text|j
 const VERIFY_HELP = `${VERIFY_USAGE}
 
 Re-checks a build output tree against the protection receipt the build wrote
-into it: every recorded file must still hash to the value it was obfuscated to.
-Run it in the deploy step, after the build and before the upload.
+for it in .afterpack/receipts/, next to the nearest lockfile, afterpack.json or
+.git above the tree (failing those the nearest package.json, otherwise beside
+the tree): every recorded file must still
+hash to the value it was obfuscated to. Run it in the deploy step, after the
+build and before the upload.
 
 A MISSING receipt FAILS. This command is only ever run by someone who expects a
 protected tree, so "there was nothing to check" is not a pass.
 
 Arguments:
-  [dir]                    the build output, or a project root whose .next/
-                           holds the receipt (default: the working directory)
+  [dir]                    the build output, or a Next.js project root whose
+                           .next/ was protected (default: the working directory)
 
 Options:
   --diagnostics.format=<text|json>   json prints ONE document on stdout
@@ -1390,11 +1422,17 @@ function verify(deps) {
 	const { cwd, positionals } = deps;
 	if (positionals.length > 1) return fail(deps, EXIT.usage, "TOO_MANY_ARGUMENTS", `expected a single [dir], got ${positionals.length}`, VERIFY_USAGE);
 	const requested = positionals[0] ?? ".";
-	const target = isAbsolute(requested) ? requested : resolve(cwd, requested);
-	if (!existsSync(target)) return fail(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point verify at the build output directory, or at the project root above it.");
-	const dir = candidates(target).find((c) => existsSync(join(c, PROTECTION_RECEIPT_FILE)));
-	if (!dir) return fail(deps, EXIT.failure, "RECEIPT_MISSING", `no protection receipt found for ${requested}`, "A receipt is written by the run that obfuscated the tree — run `afterpack <dir>`, or build again through the framework plugin, then point verify at that output directory.", candidates(target).map((c) => `looked in ${documentPath(cwd, join(c, PROTECTION_RECEIPT_FILE))}`));
-	const { receipt, problems } = verifyProtectionReceipt(dir, readBuildId(dir));
+	const requestedPath = isAbsolute(requested) ? requested : resolve(cwd, requested);
+	if (!existsSync(requestedPath)) return fail(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point verify at the build output directory, or at the project root above it.");
+	const target = realDir(requestedPath);
+	const dirs = candidates(target).filter((c) => existsSync(c));
+	const located = dirs.map((c) => locateProtectionReceipt(c, { copies: false })).find((l) => l !== null) ?? dirs.map((c) => locateProtectionReceipt(c)).find((l) => l !== null);
+	if (!located) {
+		const looked = dirs.flatMap((c) => [...new Set([protectionReceiptPath(c), protectionReceiptPath(afterpackHome(c, { fileTarget: true }))])]);
+		return fail(deps, EXIT.failure, "RECEIPT_MISSING", `no protection receipt found for ${requested}`, "A receipt is written to .afterpack/receipts/ by the run that obfuscated the tree — run `afterpack <dir>`, or build again through the framework plugin, then point verify at that output directory.", [...looked.map((path) => `looked in ${documentPath(cwd, path)}`), "and for a receipt whose files this directory holds a copy of"]);
+	}
+	const { dir, receiptPath, copiedFrom } = located;
+	const { receipt, problems } = verifyProtectionReceipt(receiptPath, dir, readBuildId(dir));
 	if (problems.length > 0) return fail(deps, EXIT.failure, "RECEIPT_MISMATCH", `${documentPath(cwd, dir)} FAILED verification: ${problems.join("; ")}`, "Rebuild the tree with the AfterPack front door and verify the fresh output; never deploy a tree whose receipt does not match.", problems);
 	const files = receipt?.files ?? [];
 	if (deps.mode.format === "json") {
@@ -1413,6 +1451,8 @@ function verify(deps) {
 			diagnostics: [],
 			summary: {
 				directory: documentPath(cwd, dir),
+				receipt: documentPath(cwd, receiptPath),
+				copiedFrom: copiedFrom === null ? null : documentPath(cwd, copiedFrom),
 				tool: receipt?.tool ?? null,
 				engine: receipt?.engine ?? null,
 				bundler: receipt?.bundler ?? null,
@@ -1427,7 +1467,7 @@ function verify(deps) {
 		return EXIT.ok;
 	}
 	const engine = receipt?.engine === "cloud" ? " · AfterPack Pro" : "";
-	deps.report.log(`${green("✓")} Verified ${files.length} ${files.length === 1 ? "file" : "files"} · ` + displayDir(deps.cwd, dir) + engine);
+	deps.report.log(`${green("✓")} Verified ${files.length} ${files.length === 1 ? "file" : "files"} · ` + displayDir(deps.cwd, dir) + (copiedFrom === null ? "" : dim(` · copy of ${displayDir(deps.cwd, copiedFrom)}`)) + engine);
 	return EXIT.ok;
 }
 
@@ -1452,15 +1492,10 @@ function unknownCommand(argv, cwd) {
 	};
 	return null;
 }
-function observeEngine(engine, into) {
-	return {
-		processBatch: async (inputs, config, buildContext) => {
-			const bytesIn = new Map(inputs.map((i) => [i.path, Buffer.byteLength(i.source)]));
-			const batch = await engine.processBatch(inputs, config, buildContext);
-			for (const file of batch.files) into.push(captureFile(file, bytesIn.get(file.path) ?? 0));
-			return batch;
-		},
-		...engine.version ? { version: () => engine.version() } : {}
+function captureBatch(into) {
+	return (inputs, batch) => {
+		const bytesIn = new Map(inputs.map((i) => [i.path, Buffer.byteLength(i.source)]));
+		for (const file of batch.files) into.push(captureFile(file, bytesIn.get(file.path) ?? 0));
 	};
 }
 function captureFile(file, bytesIn) {
@@ -1469,7 +1504,6 @@ function captureFile(file, bytesIn) {
 		bytesIn,
 		bytesOut: Buffer.byteLength(file.code),
 		status: file.status,
-		unobfuscated: file.unobfuscated === true,
 		diagnostics: sanitizeEngineDiagnostics(file.diagnostics).map((d) => ({
 			...d,
 			file: d.file ?? file.path
@@ -1481,9 +1515,28 @@ function alignRow(label, value) {
 }
 function fileStatus(file) {
 	if (file.status !== "success") return "failed";
-	if (file.unobfuscated) return "unobfuscated";
 	return file.bytesOut === file.bytesIn && file.diagnostics.length === 0 ? "unchanged" : "obfuscated";
 }
+function failureDetail(exitCode) {
+	switch (exitCode) {
+		case EXIT.sizeCap: return {
+			code: SIZE_CAP_CODE,
+			fix: "Raise --inflation.max, or lower --complexity, so the target fits the size budget."
+		};
+		case EXIT.proRequired: return {
+			code: PRO_REQUIRED_CODE,
+			fix: "A region directive raises protection, which needs a Pro key. Add --key=<ap_live_…>, or remove the directive."
+		};
+		case EXIT.reflection: return {
+			code: REFLECTION_CODE,
+			fix: "Acknowledge the runtime-reflection pattern with --reflection.allow=<value> (the diagnostic above names the value), carve the file out with --paths.exclude=<glob>, or (Pro) mark it with an @afterpack allow-reflection directive."
+		};
+		default: return {
+			code: "BUILD_FAILED",
+			fix: "Fix the diagnostic(s) above, or carve the file out with --paths.exclude=<glob>. Your build output was left exactly as your bundler wrote it."
+		};
+	}
+}
 function buildDocument(input) {
 	const { cwd, files, result } = input;
 	const asJson = (d) => {
@@ -1512,7 +1565,6 @@ function buildDocument(input) {
 		summary: {
 			files: files.length,
 			transformed: input.transformed.size,
-			unobfuscated: files.filter((f) => f.unobfuscated).length,
 			failed: files.filter((f) => f.status !== "success").length,
 			bytesIn: files.reduce((n, f) => n + f.bytesIn, 0),
 			bytesOut: files.reduce((n, f) => n + f.bytesOut, 0),
@@ -1687,14 +1739,16 @@ async function runObfuscationAndBackup(input) {
 			label: input.label,
 			work: () => runObfuscationPass({
 				files: input.files,
-				engine: observeEngine(input.engine, captured),
+				engine: input.engine,
+				onBatch: captureBatch(captured),
 				label: "afterpack",
 				cwd: input.cwd,
 				startedAt: input.startedAt,
 				combinedProtectionMap: {
 					buildDir: input.buildDir,
-					afterpackDir: join(input.cwd, ".afterpack")
+					fileTarget: input.fileTarget
 				},
+				sourceMapSweepDir: input.sweepSourceMaps ? input.buildDir : null,
 				artifactOptions: {
 					...input.parsed.artifactOptions,
 					build: {
@@ -1728,7 +1782,8 @@ async function runObfuscationAndBackup(input) {
 		protectedRoot: input.buildDir,
 		cliVersion: input.version,
 		pending: input.pendingBackups,
-		receiptPath: result?.receiptPath ?? null
+		receiptPath: result?.receiptPath ?? null,
+		merge: input.fileTarget
 	});
 	return {
 		captured,
@@ -1744,7 +1799,7 @@ function renderNextSteps(input) {
 	if (backupWritten !== null && backupWritten.count > 0) report.log(`  backup   ${documentPath(cwd, backupDir(projectRoot))}/`);
 	if (receiptPath || backupWritten !== null) report.log("");
 	if (receiptPath) {
-		const verifyDir = documentPath(cwd, dirname(receiptPath));
+		const verifyDir = documentPath(cwd, input.buildDir);
 		const verifyCommand = verifyDir === "." ? "afterpack verify" : `afterpack verify ${verifyDir}`;
 		report.log(alignRow("next", `${verifyCommand}   before you deploy`));
 	}
@@ -1787,6 +1842,12 @@ function refusalFor(error) {
 		message: error.message,
 		fix: error.fix
 	};
+	if (error instanceof AfterpackFilesError) return {
+		exitCode: EXIT.failure,
+		code: error.code,
+		message: error.summary,
+		fix: error.fix
+	};
 	if (error instanceof UnreadableReceiptError) return {
 		exitCode: EXIT.failure,
 		code: error.code,
@@ -1840,7 +1901,8 @@ function defaultCliStdout() {
 }
 async function run(deps) {
 	const startedAt = Date.now();
-	const { cwd, engine, logger, version: version$1 } = deps;
+	const { engine, logger, version: version$1 } = deps;
+	const cwd = realDir(deps.cwd);
 	const env = deps.env ?? process.env;
 	const stdout = deps.stdout ?? defaultCliStdout();
 	const argv = expandShortFlags(deps.argv);
@@ -1851,6 +1913,7 @@ async function run(deps) {
 	const command = argv[0];
 	if (command === "verify" || command === "audit" || command === "restore") return runSubcommand(command, argv.slice(1), {
 		...deps,
+		cwd,
 		env,
 		stdout,
 		argv
@@ -1922,12 +1985,12 @@ async function run(deps) {
 		warn: (m) => logger.warn(m),
 		error: (m) => logger.error(m)
 	};
-	const refuseHere = (exitCode$1, code, message, fix, detail) => refuse({
+	const refuseHere = (exitCode, code, message, fix, detail) => refuse({
 		logger,
 		mode,
 		version: version$1,
 		command: "obfuscate",
-		exitCode: exitCode$1,
+		exitCode,
 		code,
 		message,
 		fix,
@@ -1935,7 +1998,6 @@ async function run(deps) {
 	});
 	if (resolved.positionals.length > 1) return refuseHere(EXIT.usage, "TOO_MANY_PATHS", `expected a single [path], got ${resolved.positionals.length}`, "Name one directory or one .js file; run it again for the second target.");
 	const parsed = toRunOptions(resolved.config);
-	const projectRoot = projectRootFor(cwd, resolved.configFile);
 	const backupEnabled = parsed.artifactOptions.build?.backup ?? true;
 	const configuredKey = getPath(resolved.config, "key");
 	const hasConfiguredKey = typeof configuredKey === "string" && configuredKey !== "" || typeof env.AFTERPACK_KEY === "string" && env.AFTERPACK_KEY !== "";
@@ -1985,10 +2047,18 @@ async function run(deps) {
 			requested = join(explicitTarget, bare.requested);
 		}
 	}
-	const target = isAbsolute(requested) ? requested : resolve(cwd, requested);
-	if (!existsSync(target)) return refuseHere(EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Name an existing directory or .js file, or run `afterpack` with no path to detect the build output.");
+	const requestedPath = isAbsolute(requested) ? requested : resolve(cwd, requested);
+	if (!existsSync(requestedPath)) return refuseHere(EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Name an existing directory or .js file, or run `afterpack` with no path to detect the build output.");
+	const target = realDir(requestedPath);
 	const isDirectory = statSync(target).isDirectory();
 	const buildDir = isDirectory ? target : dirname(target);
+	let projectRoot;
+	try {
+		projectRoot = afterpackHome(buildDir, { fileTarget: !isDirectory }).projectRoot;
+	} catch (error) {
+		if (!(error instanceof AfterpackFilesError)) throw error;
+		return refuseHere(EXIT.failure, error.code, error.summary, error.fix);
+	}
 	const nestedProjects = [];
 	const files = collectJsFiles(target, {
 		include: parsed.pathsInclude,
@@ -2015,6 +2085,8 @@ async function run(deps) {
 		engine,
 		cwd,
 		buildDir,
+		fileTarget: !isDirectory,
+		sweepSourceMaps: isDirectory,
 		sourceType: detectCliSourceType({
 			files,
 			buildDir
@@ -2050,27 +2122,20 @@ async function run(deps) {
 	}
 	const diagnostics = captured.flatMap((f) => f.diagnostics);
 	if (failure !== null) {
-		const exitCode$1 = failureExitCode(diagnostics);
-		return refuseHere(exitCode$1, exitCode$1 === EXIT.sizeCap ? SIZE_CAP_CODE : "BUILD_FAILED", failure, exitCode$1 === EXIT.sizeCap ? "Raise --inflation.max, or lower --complexity, so the target fits the size budget." : "Fix the diagnostic(s) above, or carve the file out with --paths.exclude=<glob>. Your build output was left exactly as your bundler wrote it.");
+		const exitCode = failureExitCode(diagnostics);
+		const { code, fix } = failureDetail(exitCode);
+		return refuseHere(exitCode, code, failure, fix);
 	}
-	const unobfuscated = captured.filter((f) => f.unobfuscated);
-	const exitCode = unobfuscated.length > 0 ? EXIT.partial : EXIT.ok;
 	if (mode.format === "json") {
 		emitJson(logger, buildDocument({
 			version: version$1,
 			cwd,
-			exitCode,
+			exitCode: EXIT.ok,
 			files: captured,
 			result,
 			transformed: new Set(result?.transformedFiles ?? [])
 		}));
-		return exitCode;
-	}
-	if (exitCode === EXIT.partial) {
-		logger.error(`${yellow("⚠")} ${unobfuscated.length} ${unobfuscated.length === 1 ? "file" : "files"} shipped UNOBFUSCATED — drop --allowUnobfuscated to fail closed instead.`);
-		logger.error("");
-		logger.error(dim(CONTACT_FOOTER));
-		return exitCode;
+		return EXIT.ok;
 	}
 	renderNextSteps({
 		report,
@@ -2078,11 +2143,12 @@ async function run(deps) {
 		env,
 		stdout,
 		projectRoot,
+		buildDir,
 		receiptPath: result?.receiptPath,
 		backupWritten,
 		hasConfiguredKey
 	});
-	return exitCode;
+	return EXIT.ok;
 }
 const SUBCOMMAND_HELP = {
 	verify: VERIFY_HELP,
@@ -2130,6 +2196,7 @@ async function runSubcommand(command, rest, deps) {
 		version: version$1
 	});
 	return audit({
+		cwd,
 		positionals: args.positionals,
 		logger,
 		report,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "afterpack",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "AfterPack CLI: obfuscate the JavaScript in any build output, verify a build before deploy, and scan a live site",
   "type": "module",
   "bin": {
@@ -14,8 +14,8 @@
     "dist"
   ],
   "dependencies": {
-    "@afterpack/core": "~0.2.3",
-    "@afterpack/integration-utils": "0.2.2"
+    "@afterpack/core": "~0.2.5",
+    "@afterpack/integration-utils": "0.2.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",