afterpack 0.2.3 → 0.2.4

package/README.md

@@ -31,13 +31,27 @@ Nested `node_modules/` folders are skipped. Pass [`--paths.include`][paths.inclu
 
 Each run writes:
 
-- `.afterpack-protection.json` in the output directory, the receipt that `afterpack verify` checks.
+- `.afterpack/receipts/<output dir>.json` (`.afterpack/receipts/dist.json` for `dist`), the receipt
+  that `afterpack verify` checks.
 - `.afterpack/backup/`, a copy of the original files, so `afterpack restore` can undo the run.
   Turn it off with [`--build.backup`][build.backup]`=false`.
 - `.afterpack/protectionMap.html`, the [Protection Map](https://www.afterpack.dev/docs/protection-map),
   when your build has source maps.
-- `.map` files next to the output, when your build has source maps and the run is not a production
-  build.
+- `.map` files next to the output, only when you ask for them with
+  [`--sourceMap.enabled`][sourceMap.enabled] or run with `--build.mode=development` (or
+  `NODE_ENV=development`) on a build that has source maps.
+
+Every other run is a production run: it deletes your build's own source maps, hidden ones included,
+and the `sourceMappingURL` comments that name them, so no original source ships beside the output.
+
+`.afterpack/` sits next to your project's lockfile, `afterpack.json` or `.git` (failing those, its
+`package.json`), otherwise beside the build directory, never inside it: `cd public && npx afterpack
+.` keeps it beside `public/`, and a `package.json` your build emits, such as Nitro's
+`.output/server/package.json`, never moves it. A single file in a project root that holds a
+lockfile, `afterpack.json` or `.git` keeps it in that root. The same place holds every run's files
+whatever directory you run from, so a second run over the same output, or over the same file, is
+refused from anywhere. A run fails if it finds a `.afterpack/` inside the output, and removes a
+`.afterpack-protection.json` an older version left there.
 
 The backup and the Protection Map contain your original source. `.afterpack/` carries its own
 `.gitignore` and self-ignores. Never deploy or commit them.
@@ -49,13 +63,18 @@ runs. It never prompts.
 
 ## `afterpack verify [dir]`
 
-Checks a build against its protection receipt. Run it in your deploy step.
+Checks a build against its protection receipt in `.afterpack/receipts/`. Run it in your deploy
+step.
 
 ```sh
 npx afterpack@latest verify .        # looks in ./ and ./.next/
 npx afterpack@latest verify dist
+npx afterpack@latest verify build    # SvelteKit's adapter copy; also .output/public, out/
 ```
 
+A directory a framework copied from its build output, such as SvelteKit's `build/`, Nuxt's
+`.output/public/` or Next's `out/`, is checked against the receipt of the directory it copied.
+
 It exits `1` when the receipt is missing, belongs to a different build, or a file changed after it
 was obfuscated. The CLI and the plugins for Vite, Next.js, webpack, Rollup, esbuild and Angular all
 write a receipt.
@@ -104,6 +123,7 @@ the [configuration reference](https://www.afterpack.dev/docs/config). The
 [identifiers.reserved]: https://www.afterpack.dev/docs/config#identifiers-reserved
 [build.backup]: https://www.afterpack.dev/docs/config#build-backup
 [protectionMap.enabled]: https://www.afterpack.dev/docs/config#protectionMap-enabled
+[sourceMap.enabled]: https://www.afterpack.dev/docs/config#sourceMap-enabled
 [diagnostics.format]: https://www.afterpack.dev/docs/config#diagnostics-format
 [inflation.max]: https://www.afterpack.dev/docs/config#inflation-max
 [key]: https://www.afterpack.dev/docs/config#key

package/SKILL.md

@@ -67,11 +67,26 @@ Rules:
 
 ## What a run writes
 
-- `.afterpack-protection.json` in the output directory: the receipt `afterpack verify` checks.
+- `.afterpack/receipts/<output dir>.json` (`.afterpack/receipts/dist.json` for `dist`): the receipt
+  `afterpack verify` checks.
 - `.afterpack/backup/`: the original files, on by default for the CLI, so `afterpack restore` can
   undo the run. `--build.backup=false` turns it off.
 - `.afterpack/protectionMap.html`: the Protection Map report, when the build has source maps.
-- `.map` files beside the output, when an input map exists and the run is not a production build.
+- `.map` files beside the output, only with `--sourceMap.enabled` or on a development run
+  (`--build.mode=development` or `NODE_ENV=development`) when an input map exists.
+
+Every other run is a production run, `CI` and an unset `NODE_ENV` included. It deletes the build's
+own source maps, hidden ones included, and the `sourceMappingURL` comments that name them.
+
+Every front door puts `.afterpack/` next to the nearest lockfile, `afterpack.json` or `.git` above
+the build directory, failing those the nearest `package.json`, otherwise beside the build
+directory, never inside it (`cd public && npx afterpack .` keeps it beside `public/`). A
+`package.json` the build emits, such as Nitro's `.output/server/package.json` or a dual package's
+`dist/cjs/package.json`, never moves it. For a single file, the file's own directory counts when it
+holds a lockfile, `afterpack.json` or `.git`, so `npx afterpack app.js` in such a root keeps
+`.afterpack/` there. The place does not depend on the working directory, so a re-run over the same
+output or the same file is refused from anywhere. A run fails if it finds a `.afterpack/` inside
+the output, and removes a `.afterpack-protection.json` an older version left there.
 
 The backup and the Protection Map contain the original source. `.afterpack/` carries its own
 `.gitignore` and self-ignores. Never deploy, publish or commit them.
@@ -103,7 +118,7 @@ minification.
 | [`paths.include`][paths.include] | globs to add back to the walk | `[]` |
 | [`identifiers.reserved`][identifiers.reserved] | names never to rename | `[]` |
 | [`build.backup`][build.backup] | keep originals in `.afterpack/backup/` | `true` for the CLI, `false` in plugins |
-| [`sourceMap.enabled`][sourceMap.enabled] | write `.map` files | on when an input map exists, off in production |
+| [`sourceMap.enabled`][sourceMap.enabled] | write `.map` files | off; on in development mode when an input map exists |
 | [`protectionMap.enabled`][protectionMap.enabled] | write the Protection Map | on when an input map exists |
 | [`diagnostics.format`][diagnostics.format] | `text` or `json` | `text` |
 | [`diagnostics.level`][diagnostics.level] | `summary`, `all` or `none` (errors still print) | `summary` |
@@ -194,15 +209,20 @@ Details: https://www.afterpack.dev/docs/pro
 
 ## `afterpack verify [dir]`
 
-Add this to the deploy step. It re-hashes every file the protection receipt names.
+Add this to the deploy step. It reads the receipt for `[dir]` from `.afterpack/receipts/`, found
+by the same rule as above, and re-hashes every file that receipt names.
 
 ```bash
 npx afterpack@latest verify .        # looks in ./ and ./.next/
 npx afterpack@latest verify dist
+npx afterpack@latest verify build    # SvelteKit's adapter copy; also .output/public, out/
 ```
 
-It exits `1` when the receipt is missing, belongs to a different build, or a file changed after it
-was obfuscated. A missing receipt is a failure. `verify` reads no configuration and takes only
+When `[dir]` has no receipt of its own, verify looks for the project receipt whose files `[dir]`
+holds, at the same relative paths or under one prefix, so a framework's copy of its build output
+(SvelteKit's `build/`, Nuxt's `.output/public/`, Next's `out/`) is checked against the receipt of
+the directory it copied. It exits `1` when the receipt is missing, belongs to a different build,
+or a file changed after it was obfuscated. A missing receipt is a failure. `verify` reads no configuration and takes only
 `--diagnostics.format` and `--diagnostics.level`.
 
 ## `afterpack restore [dir]`

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { processBatch, version } from "@afterpack/core";
-import { AlreadyObfuscatedError, CLOUD_REFUSAL_SUMMARY, CONFIG_KEYS, CORE_FLOOR_SUMMARY, CloudApiError, CoreVersionError, DIAG_ALREADY_OBFUSCATED, PROTECTION_RECEIPT_FILE, UnreadableReceiptError, collectJsFiles, createTelemetryReporter, ensureAfterpackGitignore, findUpward, getPath, installedRequiredLine, loadConfigFile, mergeConfig, npxAlternative, parseCliOptions, parseEnvOptions, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, serverAddsInfo, sha256Of, toEngineConfig, toPluginOptions, verifyProtectionReceipt } from "@afterpack/integration-utils";
+import { AFTERPACK_DIR, AfterpackFilesError, AlreadyObfuscatedError, CLOUD_REFUSAL_SUMMARY, CONFIG_KEYS, CORE_FLOOR_SUMMARY, CloudApiError, CoreVersionError, DIAG_ALREADY_OBFUSCATED, PROTECTION_RECEIPTS_DIR, UnreadableReceiptError, afterpackHome, collectJsFiles, createTelemetryReporter, ensureAfterpackGitignore, getPath, installedRequiredLine, loadConfigFile, locateProtectionReceipt, mergeConfig, npxAlternative, parseCliOptions, parseEnvOptions, protectionReceiptPath, resolveClientIdentity, resolvePluginConfig, runObfuscationPass, serverAddsInfo, sha256Of, toEngineConfig, toPluginOptions, verifyProtectionReceipt } from "@afterpack/integration-utils";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
 
@@ -490,6 +490,13 @@ function reportingLogger(logger, mode) {
 		error: (m) => logger.error(m)
 	};
 }
+function realDir(path) {
+	try {
+		return realpathSync.native(path);
+	} catch {
+		return path;
+	}
+}
 function documentPath(cwd, filePath) {
 	const rel = relative(cwd, filePath);
 	if (rel === "") return ".";
@@ -646,12 +653,19 @@ result, not a failure), 1 when the scan failed or the stream ended early,
 ${dim(CONTACT_FOOTER)}`;
 const DEFAULT_API_BASE = "https://api.afterpack.dev";
 const WEB_BASE = "https://www.afterpack.dev";
-function normalizeUrl(input) {
+const LOCAL_PATH = /^(?:[\\/.~]|[A-Za-z]:[\\/]|file:)/i;
+function isNamedHost(hostname) {
+	if (hostname === "localhost" || hostname.startsWith("[")) return true;
+	return hostname.includes(".");
+}
+function normalizeUrl(input, cwd) {
 	const raw = input.trim();
+	if (LOCAL_PATH.test(raw) || existsSync(resolve(cwd, raw))) return null;
 	const candidate = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
 	try {
 		const parsed = new URL(candidate);
-		return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.toString() : null;
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+		return isNamedHost(parsed.hostname) ? parsed.toString() : null;
 	} catch {
 		return null;
 	}
@@ -779,7 +793,7 @@ function misuse(deps, code, message) {
 async function audit(deps) {
 	if (deps.positionals.length === 0) return misuse(deps, "MISSING_URL", "audit needs a <url>");
 	if (deps.positionals.length > 1) return misuse(deps, "TOO_MANY_URLS", `audit takes a single <url>, got ${deps.positionals.length}`);
-	const url = normalizeUrl(deps.positionals[0]);
+	const url = normalizeUrl(deps.positionals[0], deps.cwd ?? process.cwd());
 	if (!url) return misuse(deps, "INVALID_URL", `not a URL: ${deps.positionals[0]}`);
 	const interactive = deps.mode.format !== "json" && deps.stdout.isTTY;
 	deps.report.log(header(deps.version));
@@ -873,19 +887,22 @@ async function audit(deps) {
 //#endregion
 //#region src/backup.ts
 const BACKUP_MANIFEST_FILE = "manifest.json";
-const BACKUP_MANIFEST_RELATIVE = join(".afterpack", "backup", BACKUP_MANIFEST_FILE);
-function projectRootFor(cwd, configFile) {
-	return configFile ? dirname(configFile) : cwd;
-}
 function backupDir(projectRoot) {
-	return join(projectRoot, ".afterpack", "backup");
+	return join(projectRoot, AFTERPACK_DIR, "backup");
 }
 function backupManifestPath(projectRoot) {
 	return join(backupDir(projectRoot), BACKUP_MANIFEST_FILE);
 }
-function findBackupProjectRoot(startDir) {
-	const manifestPath = findUpward(startDir, BACKUP_MANIFEST_RELATIVE, { stopAtDir: (dir) => existsSync(join(dir, ".git")) });
-	return manifestPath ? dirname(dirname(dirname(manifestPath))) : null;
+function homeProjectRoot(dir) {
+	try {
+		return afterpackHome(dir).projectRoot;
+	} catch {
+		return null;
+	}
+}
+function findBackupProjectRoot(dir) {
+	const candidates$1 = [dir, homeProjectRoot(dir)].filter((c) => c !== null);
+	return candidates$1.find((c) => existsSync(backupManifestPath(c))) ?? null;
 }
 function toPosixPath(value) {
 	return value.split(sep).join("/");
@@ -936,13 +953,15 @@ function readBackupManifest(projectRoot) {
 }
 function writeBackups(input) {
 	const dir = backupDir(input.projectRoot);
-	rmSync(dir, {
+	const previous = input.merge ? readBackupManifest(input.projectRoot) : null;
+	const replaced = new Set(input.pending.map((p) => p.relPath));
+	const files = previous?.status === "ok" && previous.manifest.protectedRoot === input.protectedRoot ? previous.manifest.files.filter((f) => !replaced.has(f.path)) : [];
+	if (files.length === 0) rmSync(dir, {
 		recursive: true,
 		force: true
 	});
 	mkdirSync(dir, { recursive: true });
 	ensureAfterpackGitignore(dir);
-	const files = [];
 	for (const pending of input.pending) {
 		const dest = absoluteFilePath(dir, pending.relPath);
 		mkdirSync(dirname(dest), { recursive: true });
@@ -1146,14 +1165,15 @@ const RESTORE_HELP = `${RESTORE_USAGE}
 Restores the original, pre-obfuscation files that a previous \`afterpack\` run backed up to
 .afterpack/backup/, undoing that run in place.
 
-Searches upward from [dir] (or the working directory) for the project root that holds
-.afterpack/backup/ — the same directory the \`afterpack\` run was launched from — so restore
-works whether it is pointed at that root or at the build directory beneath it.
+Finds .afterpack/backup/ where the \`afterpack\` run kept it: next to the nearest lockfile,
+afterpack.json or .git above the build directory (failing those the nearest package.json,
+otherwise beside the build directory). Point it at that project root or at the build directory
+itself.
 
 Verifies every recorded file against the hash it was obfuscated to BEFORE touching anything: if
 any file no longer matches, or the manifest itself is unreadable, restore changes nothing and
-fails closed. On success it deletes the backup and the stale protection receipt it recorded,
-leaving .afterpack/ itself in place.
+fails closed. On success it deletes the backup and the stale protection receipt it recorded in
+.afterpack/receipts/, leaving .afterpack/ itself in place.
 
 Arguments:
   [dir]                    a directory at or beneath the project root that holds
@@ -1172,7 +1192,8 @@ function fail$1(deps, exitCode, code, message, fix, detail = []) {
 	return commandFailure(deps, "restore", exitCode, code, message, fix, detail);
 }
 function isRecordedReceipt(projectRoot, receiptPath) {
-	if (basename(receiptPath) !== PROTECTION_RECEIPT_FILE) return false;
+	if (basename(dirname(receiptPath)) !== PROTECTION_RECEIPTS_DIR) return false;
+	if (!receiptPath.endsWith(".json")) return false;
 	const rel = relative(projectRoot, receiptPath);
 	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel) && existsSync(receiptPath);
 }
@@ -1181,9 +1202,9 @@ function restore(deps) {
 	const { cwd, positionals } = deps;
 	if (positionals.length > 1) return fail$1(deps, EXIT.usage, "TOO_MANY_ARGUMENTS", `expected a single [dir], got ${positionals.length}`, RESTORE_USAGE);
 	const requested = positionals[0] ?? ".";
-	const target = isAbsolute(requested) ? requested : resolve(cwd, requested);
-	if (!existsSync(target)) return fail$1(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point restore at the project root that holds .afterpack/backup/, or a directory beneath it.");
-	const projectRoot = findBackupProjectRoot(target);
+	const requestedPath = isAbsolute(requested) ? requested : resolve(cwd, requested);
+	if (!existsSync(requestedPath)) return fail$1(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point restore at the project root that holds .afterpack/backup/, or a directory beneath it.");
+	const projectRoot = findBackupProjectRoot(realDir(requestedPath));
 	if (projectRoot === null) return fail$1(deps, EXIT.failure, "NOTHING_TO_RESTORE", "Nothing to restore", NOTHING_TO_RESTORE_FIX);
 	const manifestResult = readBackupManifest(projectRoot);
 	if (manifestResult.status === "corrupt") return fail$1(deps, EXIT.failure, "BACKUP_MANIFEST_CORRUPT", "Backup manifest is unreadable", `Delete ${documentPath(cwd, manifestResult.path)} and run \`afterpack <path>\` again — a corrupt manifest cannot be restored from.`);
@@ -1354,15 +1375,18 @@ const VERIFY_USAGE = "usage: afterpack verify [dir] [--diagnostics.format=text|j
 const VERIFY_HELP = `${VERIFY_USAGE}
 
 Re-checks a build output tree against the protection receipt the build wrote
-into it: every recorded file must still hash to the value it was obfuscated to.
-Run it in the deploy step, after the build and before the upload.
+for it in .afterpack/receipts/, next to the nearest lockfile, afterpack.json or
+.git above the tree (failing those the nearest package.json, otherwise beside
+the tree): every recorded file must still
+hash to the value it was obfuscated to. Run it in the deploy step, after the
+build and before the upload.
 
 A MISSING receipt FAILS. This command is only ever run by someone who expects a
 protected tree, so "there was nothing to check" is not a pass.
 
 Arguments:
-  [dir]                    the build output, or a project root whose .next/
-                           holds the receipt (default: the working directory)
+  [dir]                    the build output, or a Next.js project root whose
+                           .next/ was protected (default: the working directory)
 
 Options:
   --diagnostics.format=<text|json>   json prints ONE document on stdout
@@ -1398,11 +1422,17 @@ function verify(deps) {
 	const { cwd, positionals } = deps;
 	if (positionals.length > 1) return fail(deps, EXIT.usage, "TOO_MANY_ARGUMENTS", `expected a single [dir], got ${positionals.length}`, VERIFY_USAGE);
 	const requested = positionals[0] ?? ".";
-	const target = isAbsolute(requested) ? requested : resolve(cwd, requested);
-	if (!existsSync(target)) return fail(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point verify at the build output directory, or at the project root above it.");
-	const dir = candidates(target).find((c) => existsSync(join(c, PROTECTION_RECEIPT_FILE)));
-	if (!dir) return fail(deps, EXIT.failure, "RECEIPT_MISSING", `no protection receipt found for ${requested}`, "A receipt is written by the run that obfuscated the tree — run `afterpack <dir>`, or build again through the framework plugin, then point verify at that output directory.", candidates(target).map((c) => `looked in ${documentPath(cwd, join(c, PROTECTION_RECEIPT_FILE))}`));
-	const { receipt, problems } = verifyProtectionReceipt(dir, readBuildId(dir));
+	const requestedPath = isAbsolute(requested) ? requested : resolve(cwd, requested);
+	if (!existsSync(requestedPath)) return fail(deps, EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Point verify at the build output directory, or at the project root above it.");
+	const target = realDir(requestedPath);
+	const dirs = candidates(target).filter((c) => existsSync(c));
+	const located = dirs.map((c) => locateProtectionReceipt(c, { copies: false })).find((l) => l !== null) ?? dirs.map((c) => locateProtectionReceipt(c)).find((l) => l !== null);
+	if (!located) {
+		const looked = dirs.flatMap((c) => [...new Set([protectionReceiptPath(c), protectionReceiptPath(afterpackHome(c, { fileTarget: true }))])]);
+		return fail(deps, EXIT.failure, "RECEIPT_MISSING", `no protection receipt found for ${requested}`, "A receipt is written to .afterpack/receipts/ by the run that obfuscated the tree — run `afterpack <dir>`, or build again through the framework plugin, then point verify at that output directory.", [...looked.map((path) => `looked in ${documentPath(cwd, path)}`), "and for a receipt whose files this directory holds a copy of"]);
+	}
+	const { dir, receiptPath, copiedFrom } = located;
+	const { receipt, problems } = verifyProtectionReceipt(receiptPath, dir, readBuildId(dir));
 	if (problems.length > 0) return fail(deps, EXIT.failure, "RECEIPT_MISMATCH", `${documentPath(cwd, dir)} FAILED verification: ${problems.join("; ")}`, "Rebuild the tree with the AfterPack front door and verify the fresh output; never deploy a tree whose receipt does not match.", problems);
 	const files = receipt?.files ?? [];
 	if (deps.mode.format === "json") {
@@ -1421,6 +1451,8 @@ function verify(deps) {
 			diagnostics: [],
 			summary: {
 				directory: documentPath(cwd, dir),
+				receipt: documentPath(cwd, receiptPath),
+				copiedFrom: copiedFrom === null ? null : documentPath(cwd, copiedFrom),
 				tool: receipt?.tool ?? null,
 				engine: receipt?.engine ?? null,
 				bundler: receipt?.bundler ?? null,
@@ -1435,7 +1467,7 @@ function verify(deps) {
 		return EXIT.ok;
 	}
 	const engine = receipt?.engine === "cloud" ? " · AfterPack Pro" : "";
-	deps.report.log(`${green("✓")} Verified ${files.length} ${files.length === 1 ? "file" : "files"} · ` + displayDir(deps.cwd, dir) + engine);
+	deps.report.log(`${green("✓")} Verified ${files.length} ${files.length === 1 ? "file" : "files"} · ` + displayDir(deps.cwd, dir) + (copiedFrom === null ? "" : dim(` · copy of ${displayDir(deps.cwd, copiedFrom)}`)) + engine);
 	return EXIT.ok;
 }
 
@@ -1460,15 +1492,10 @@ function unknownCommand(argv, cwd) {
 	};
 	return null;
 }
-function observeEngine(engine, into) {
-	return {
-		processBatch: async (inputs, config, buildContext) => {
-			const bytesIn = new Map(inputs.map((i) => [i.path, Buffer.byteLength(i.source)]));
-			const batch = await engine.processBatch(inputs, config, buildContext);
-			for (const file of batch.files) into.push(captureFile(file, bytesIn.get(file.path) ?? 0));
-			return batch;
-		},
-		...engine.version ? { version: () => engine.version() } : {}
+function captureBatch(into) {
+	return (inputs, batch) => {
+		const bytesIn = new Map(inputs.map((i) => [i.path, Buffer.byteLength(i.source)]));
+		for (const file of batch.files) into.push(captureFile(file, bytesIn.get(file.path) ?? 0));
 	};
 }
 function captureFile(file, bytesIn) {
@@ -1712,14 +1739,16 @@ async function runObfuscationAndBackup(input) {
 			label: input.label,
 			work: () => runObfuscationPass({
 				files: input.files,
-				engine: observeEngine(input.engine, captured),
+				engine: input.engine,
+				onBatch: captureBatch(captured),
 				label: "afterpack",
 				cwd: input.cwd,
 				startedAt: input.startedAt,
 				combinedProtectionMap: {
 					buildDir: input.buildDir,
-					afterpackDir: join(input.cwd, ".afterpack")
+					fileTarget: input.fileTarget
 				},
+				sourceMapSweepDir: input.sweepSourceMaps ? input.buildDir : null,
 				artifactOptions: {
 					...input.parsed.artifactOptions,
 					build: {
@@ -1753,7 +1782,8 @@ async function runObfuscationAndBackup(input) {
 		protectedRoot: input.buildDir,
 		cliVersion: input.version,
 		pending: input.pendingBackups,
-		receiptPath: result?.receiptPath ?? null
+		receiptPath: result?.receiptPath ?? null,
+		merge: input.fileTarget
 	});
 	return {
 		captured,
@@ -1769,7 +1799,7 @@ function renderNextSteps(input) {
 	if (backupWritten !== null && backupWritten.count > 0) report.log(`  backup   ${documentPath(cwd, backupDir(projectRoot))}/`);
 	if (receiptPath || backupWritten !== null) report.log("");
 	if (receiptPath) {
-		const verifyDir = documentPath(cwd, dirname(receiptPath));
+		const verifyDir = documentPath(cwd, input.buildDir);
 		const verifyCommand = verifyDir === "." ? "afterpack verify" : `afterpack verify ${verifyDir}`;
 		report.log(alignRow("next", `${verifyCommand}   before you deploy`));
 	}
@@ -1812,6 +1842,12 @@ function refusalFor(error) {
 		message: error.message,
 		fix: error.fix
 	};
+	if (error instanceof AfterpackFilesError) return {
+		exitCode: EXIT.failure,
+		code: error.code,
+		message: error.summary,
+		fix: error.fix
+	};
 	if (error instanceof UnreadableReceiptError) return {
 		exitCode: EXIT.failure,
 		code: error.code,
@@ -1865,7 +1901,8 @@ function defaultCliStdout() {
 }
 async function run(deps) {
 	const startedAt = Date.now();
-	const { cwd, engine, logger, version: version$1 } = deps;
+	const { engine, logger, version: version$1 } = deps;
+	const cwd = realDir(deps.cwd);
 	const env = deps.env ?? process.env;
 	const stdout = deps.stdout ?? defaultCliStdout();
 	const argv = expandShortFlags(deps.argv);
@@ -1876,6 +1913,7 @@ async function run(deps) {
 	const command = argv[0];
 	if (command === "verify" || command === "audit" || command === "restore") return runSubcommand(command, argv.slice(1), {
 		...deps,
+		cwd,
 		env,
 		stdout,
 		argv
@@ -1960,7 +1998,6 @@ async function run(deps) {
 	});
 	if (resolved.positionals.length > 1) return refuseHere(EXIT.usage, "TOO_MANY_PATHS", `expected a single [path], got ${resolved.positionals.length}`, "Name one directory or one .js file; run it again for the second target.");
 	const parsed = toRunOptions(resolved.config);
-	const projectRoot = projectRootFor(cwd, resolved.configFile);
 	const backupEnabled = parsed.artifactOptions.build?.backup ?? true;
 	const configuredKey = getPath(resolved.config, "key");
 	const hasConfiguredKey = typeof configuredKey === "string" && configuredKey !== "" || typeof env.AFTERPACK_KEY === "string" && env.AFTERPACK_KEY !== "";
@@ -2010,10 +2047,18 @@ async function run(deps) {
 			requested = join(explicitTarget, bare.requested);
 		}
 	}
-	const target = isAbsolute(requested) ? requested : resolve(cwd, requested);
-	if (!existsSync(target)) return refuseHere(EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Name an existing directory or .js file, or run `afterpack` with no path to detect the build output.");
+	const requestedPath = isAbsolute(requested) ? requested : resolve(cwd, requested);
+	if (!existsSync(requestedPath)) return refuseHere(EXIT.failure, "PATH_NOT_FOUND", `path not found: ${requested}`, "Name an existing directory or .js file, or run `afterpack` with no path to detect the build output.");
+	const target = realDir(requestedPath);
 	const isDirectory = statSync(target).isDirectory();
 	const buildDir = isDirectory ? target : dirname(target);
+	let projectRoot;
+	try {
+		projectRoot = afterpackHome(buildDir, { fileTarget: !isDirectory }).projectRoot;
+	} catch (error) {
+		if (!(error instanceof AfterpackFilesError)) throw error;
+		return refuseHere(EXIT.failure, error.code, error.summary, error.fix);
+	}
 	const nestedProjects = [];
 	const files = collectJsFiles(target, {
 		include: parsed.pathsInclude,
@@ -2040,6 +2085,8 @@ async function run(deps) {
 		engine,
 		cwd,
 		buildDir,
+		fileTarget: !isDirectory,
+		sweepSourceMaps: isDirectory,
 		sourceType: detectCliSourceType({
 			files,
 			buildDir
@@ -2096,6 +2143,7 @@ async function run(deps) {
 		env,
 		stdout,
 		projectRoot,
+		buildDir,
 		receiptPath: result?.receiptPath,
 		backupWritten,
 		hasConfiguredKey
@@ -2148,6 +2196,7 @@ async function runSubcommand(command, rest, deps) {
 		version: version$1
 	});
 	return audit({
+		cwd,
 		positionals: args.positionals,
 		logger,
 		report,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "afterpack",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "AfterPack CLI: obfuscate the JavaScript in any build output, verify a build before deploy, and scan a live site",
   "type": "module",
   "bin": {
@@ -14,8 +14,8 @@
     "dist"
   ],
   "dependencies": {
-    "@afterpack/core": "~0.2.4",
-    "@afterpack/integration-utils": "0.2.3"
+    "@afterpack/core": "~0.2.5",
+    "@afterpack/integration-utils": "0.2.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.4",