@01.works/visual-review 0.1.0

package/dist/source-index-BdWeiNHZ.js

@@ -0,0 +1,1398 @@
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, opendir, readdir, realpath, rename, unlink, writeFile } from "node:fs/promises";
+const MAX_SOURCE_MAP_ARTIFACT_BYTES = 20 * 1024 * 1024;
+const RELEASES_PATH = "/v1/source-maps/releases";
+const MAX_MANIFEST_BYTES = 128 * 1024;
+const REQUEST_TIMEOUT_MS = 3e4;
+const SAFE_RELEASE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+const SAFE_ARTIFACT_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+const JAVASCRIPT_OUTPUT$1 = /\.(?:c|m)?js$/i;
+const PUBLIC_SOURCE_MAP_REFERENCE_OUTPUT = /\.(?:(?:c|m)?js|css)$/i;
+/**
+* Uploads Vite browser source maps and always removes every map from the deployment
+* output. Callers must fail the build when this promise rejects.
+*/
+async function uploadViteSourceMaps(input, dependencies = {}) {
+	const projectRoot = resolve(input.projectRoot);
+	const outputRoot = await resolveBuildOutputDirectory$1(projectRoot, resolve(input.outDir));
+	let uploadError;
+	let manifest;
+	try {
+		if (input.buildId === "unversioned" && input.gitCommit === null) throw new Error("Visual Review source-map upload requires a versioned build identity");
+		const artifacts = await collectArtifacts(projectRoot, outputRoot, input.base);
+		if (artifacts.length === 0) throw new Error("Visual Review source-map upload found no JavaScript output");
+		manifest = {
+			schemaVersion: 1,
+			release: {
+				buildId: input.buildId,
+				gitCommit: input.gitCommit,
+				framework: "vite",
+				...input.frameworkVersion ? { frameworkVersion: input.frameworkVersion } : {},
+				mode: input.mode
+			},
+			artifacts: artifacts.map(({ manifest: artifact }) => artifact)
+		};
+		await uploadSourceMapRelease({
+			manifest,
+			artifacts,
+			serviceUrl: input.serviceUrl,
+			token: input.token
+		}, dependencies);
+	} catch (error) {
+		uploadError = error;
+	}
+	let cleanupError;
+	try {
+		await removeSourceMapFiles$1(outputRoot);
+	} catch (error) {
+		cleanupError = error;
+	}
+	if (uploadError && cleanupError) throw new AggregateError([uploadError, cleanupError], "Visual Review source-map upload failed and deployment maps could not be removed");
+	if (cleanupError) throw new Error("Visual Review could not remove source maps from the deployment output", { cause: cleanupError });
+	if (uploadError) throw new Error("Visual Review source-map upload failed", { cause: uploadError });
+	if (!manifest) throw new Error("Visual Review source-map manifest was not created");
+	return manifest;
+}
+async function cleanupViteSourceMapOutput(projectRoot, outDir) {
+	await removeSourceMapFiles$1(await resolveBuildOutputDirectory$1(resolve(projectRoot), resolve(outDir)));
+}
+async function collectArtifacts(projectRoot, outputRoot, base) {
+	const files = await collectOutputFiles$1(outputRoot);
+	const publicOutputFiles = files.filter((path) => PUBLIC_SOURCE_MAP_REFERENCE_OUTPUT.test(path)).sort();
+	for (const generatedFile of publicOutputFiles) if (hasSourceMapReference((await readRegularFileBounded(generatedFile, outputRoot, 20971520)).toString("utf8"))) throw new Error(`Visual Review requires hidden source maps for ${deploymentRelativePath(outputRoot.path, generatedFile)}`);
+	const javascriptFiles = files.filter((path) => path.endsWith(".map") && JAVASCRIPT_OUTPUT$1.test(path.slice(0, -4))).map((path) => path.slice(0, -4)).sort();
+	const artifacts = [];
+	for (const generatedFile of javascriptFiles) {
+		const mapFile = `${generatedFile}.map`;
+		if (!files.includes(generatedFile)) throw new Error(`Visual Review generated JavaScript is missing for ${deploymentRelativePath(outputRoot.path, mapFile)}`);
+		const [generatedBytes, rawMapBytes] = await Promise.all([readRegularFileBounded(generatedFile, outputRoot, MAX_SOURCE_MAP_ARTIFACT_BYTES), readRegularFile$1(mapFile, outputRoot)]);
+		if (hasSourceMapReference(generatedBytes.toString("utf8"))) throw new Error(`Visual Review requires hidden source maps for ${deploymentRelativePath(outputRoot.path, generatedFile)}`);
+		const { bytes: mapBytes, debugId } = sanitizeSourceMapBytes(rawMapBytes, mapFile, projectRoot);
+		if (mapBytes.byteLength > 20971520) throw new Error(`Visual Review source map exceeds 20 MiB for ${deploymentRelativePath(outputRoot.path, generatedFile)}`);
+		artifacts.push({
+			manifest: {
+				runtime: "browser",
+				generatedPath: publicGeneratedPath(base, deploymentRelativePath(outputRoot.path, generatedFile)),
+				mapSha256: sha256$1(mapBytes),
+				generatedSha256: sha256$1(generatedBytes),
+				byteSize: mapBytes.byteLength,
+				...debugId ? { debugId } : {}
+			},
+			mapBytes
+		});
+	}
+	return artifacts;
+}
+async function uploadSourceMapRelease(input, dependencies = {}) {
+	const fetchImplementation = dependencies.fetch ?? globalThis.fetch;
+	if (typeof fetchImplementation !== "function") throw new Error("Visual Review source-map upload requires Node fetch");
+	const serviceUrl = normalizeServiceUrl(input.serviceUrl ?? "https://visual-review.01.works");
+	const token = normalizeToken(input.token);
+	const manifestBody = JSON.stringify(input.manifest);
+	if (Buffer.byteLength(manifestBody) > MAX_MANIFEST_BYTES) throw new Error("Visual Review source-map manifest exceeds the 128 KiB service limit");
+	const release = parseCreateReleaseResponse(await request(fetchImplementation, releaseUrl(serviceUrl), {
+		method: "POST",
+		headers: authenticatedJsonHeaders(token),
+		body: manifestBody
+	}, readJson));
+	if (release.state === "finalized") {
+		if (release.uploads.length !== 0) throw new Error("Visual Review source-map service returned uploads for a finalized release");
+		return;
+	}
+	const slots = correlateUploadSlots(release.uploads, input.artifacts);
+	await Promise.all(slots.map(async ({ slot, artifact }) => {
+		const headers = normalizeUploadHeaders(slot.headers);
+		if (!hasHeader(headers, "content-type")) headers["content-type"] = "application/json";
+		await request(fetchImplementation, normalizeUploadUrl(slot.uploadUrl), {
+			method: "PUT",
+			headers,
+			body: artifact.mapBytes.buffer.slice(artifact.mapBytes.byteOffset, artifact.mapBytes.byteOffset + artifact.mapBytes.byteLength)
+		}, discardResponseBody);
+	}));
+	const completeBody = JSON.stringify({
+		schemaVersion: 1,
+		artifacts: slots.map(({ slot, artifact }) => ({
+			artifactId: slot.artifactId,
+			mapSha256: artifact.manifest.mapSha256,
+			byteSize: artifact.manifest.byteSize
+		}))
+	});
+	await request(fetchImplementation, `${releaseUrl(serviceUrl)}/${encodeURIComponent(release.releaseId)}/complete`, {
+		method: "POST",
+		headers: authenticatedJsonHeaders(token),
+		body: completeBody
+	}, discardResponseBody);
+}
+async function request(fetchImplementation, url, init, consume) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+	try {
+		const response = await fetchImplementation(url, {
+			...init,
+			redirect: "error",
+			signal: controller.signal
+		});
+		if (!response.ok) {
+			await discardResponseBody(response);
+			throw new Error(`Visual Review source-map service returned HTTP ${response.status}`);
+		}
+		return await consume(response);
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+function authenticatedJsonHeaders(token) {
+	return {
+		authorization: `Bearer ${token}`,
+		"content-type": "application/json"
+	};
+}
+async function readJson(response) {
+	const body = await response.text();
+	if (Buffer.byteLength(body) > MAX_MANIFEST_BYTES) throw new Error("Visual Review source-map service response is too large");
+	try {
+		return JSON.parse(body);
+	} catch {
+		throw new Error("Visual Review source-map service returned invalid JSON");
+	}
+}
+async function discardResponseBody(response) {
+	try {
+		await response.body?.cancel();
+	} catch {}
+}
+function parseCreateReleaseResponse(value) {
+	if (!isRecord$2(value) || value.schemaVersion !== 1 || typeof value.releaseId !== "string" || !SAFE_RELEASE_ID.test(value.releaseId) || value.state !== "pending" && value.state !== "finalized") throw new Error("Visual Review source-map service returned an invalid release");
+	if (!Array.isArray(value.uploads)) throw new Error("Visual Review source-map service returned invalid upload slots");
+	const uploads = value.uploads.map((slot) => {
+		if (!isRecord$2(slot) || typeof slot.artifactId !== "string" || !SAFE_ARTIFACT_ID.test(slot.artifactId) || !isRuntime(slot.runtime) || typeof slot.generatedPath !== "string" || typeof slot.uploadUrl !== "string" || slot.headers !== void 0 && !isStringRecord(slot.headers)) throw new Error("Visual Review source-map service returned an invalid upload slot");
+		return {
+			artifactId: slot.artifactId,
+			runtime: slot.runtime,
+			generatedPath: slot.generatedPath,
+			uploadUrl: slot.uploadUrl,
+			...slot.headers ? { headers: slot.headers } : {}
+		};
+	});
+	return {
+		schemaVersion: 1,
+		releaseId: value.releaseId,
+		state: value.state,
+		uploads
+	};
+}
+function correlateUploadSlots(slots, artifacts) {
+	if (slots.length !== artifacts.length) throw new Error("Visual Review source-map service returned the wrong number of upload slots");
+	const artifactIds = /* @__PURE__ */ new Set();
+	const remaining = new Map(artifacts.map((artifact) => [artifactKey(artifact.manifest.runtime, artifact.manifest.generatedPath), artifact]));
+	const correlated = slots.map((slot) => {
+		if (artifactIds.has(slot.artifactId)) throw new Error("Visual Review source-map service returned a duplicate artifact ID");
+		artifactIds.add(slot.artifactId);
+		const key = artifactKey(slot.runtime, slot.generatedPath);
+		const artifact = remaining.get(key);
+		if (!artifact) throw new Error("Visual Review source-map service returned an unknown upload target");
+		remaining.delete(key);
+		return {
+			slot,
+			artifact
+		};
+	});
+	if (remaining.size > 0) throw new Error("Visual Review source-map service omitted an upload target");
+	return correlated;
+}
+function normalizeUploadHeaders(value) {
+	const normalized = {};
+	for (const [name, headerValue] of Object.entries(value ?? {})) {
+		const key = name.trim().toLowerCase();
+		if (!/^[a-z0-9!#$%&'*+.^_`|~-]+$/.test(key) || /[\r\n]/.test(headerValue)) throw new Error("Visual Review source-map service returned an invalid upload header");
+		if ([
+			"authorization",
+			"cookie",
+			"host"
+		].includes(key)) throw new Error("Visual Review source-map service returned a forbidden upload header");
+		normalized[key] = headerValue;
+	}
+	return normalized;
+}
+function normalizeServiceUrl(value) {
+	const url = parseSecureUrl(value, "service");
+	if (url.pathname !== "/" || url.search || url.hash) throw new Error("Visual Review source-map service URL must be an origin without a path");
+	return url.origin;
+}
+function normalizeUploadUrl(value) {
+	const url = parseSecureUrl(value, "upload");
+	if (url.hash) throw new Error("Visual Review source-map upload URL must not contain a fragment");
+	return url.href;
+}
+function parseSecureUrl(value, label) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`Visual Review source-map ${label} URL is invalid`);
+	}
+	const loopback = [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(url.hostname);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password) throw new Error(`Visual Review source-map ${label} URL must use HTTPS`);
+	return url;
+}
+function releaseUrl(serviceUrl) {
+	return `${serviceUrl}${RELEASES_PATH}`;
+}
+function normalizeToken(value) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 4096 || /\s/.test(value)) throw new Error("Visual Review source-map upload token is missing or invalid");
+	return value;
+}
+async function collectOutputFiles$1(outputRoot, directory = outputRoot.path) {
+	const entries = await readOutputDirectory$1(directory, outputRoot);
+	return (await Promise.all(entries.map(async (entry) => {
+		const path = resolve(directory, entry.name);
+		if (entry.isSymbolicLink()) throw new Error("Visual Review Vite build output must not contain symbolic links");
+		if (entry.isDirectory()) return collectOutputFiles$1(outputRoot, path);
+		if (entry.isFile()) return [path];
+		return [];
+	}))).flat();
+}
+async function removeSourceMapFiles$1(outputRoot, directory = outputRoot.path) {
+	const entries = await readOutputDirectory$1(directory, outputRoot);
+	const failures = [];
+	await Promise.all(entries.map(async (entry) => {
+		const path = resolve(directory, entry.name);
+		try {
+			if (entry.isDirectory()) await removeSourceMapFiles$1(outputRoot, path);
+			else if (entry.isSymbolicLink()) throw new Error("Visual Review Vite build output must not contain symbolic links");
+			else if (entry.isFile() && /\.map$/iu.test(entry.name)) await unlinkRegularFile$1(path, outputRoot);
+		} catch (error) {
+			failures.push(error);
+		}
+	}));
+	if (failures.length > 0) throw new AggregateError(failures, "Could not remove all Visual Review source maps");
+}
+async function readRegularFile$1(path, root) {
+	const { handle } = await openRegularFile$1(path, root, constants.O_RDONLY);
+	try {
+		return await handle.readFile();
+	} finally {
+		await handle.close();
+	}
+}
+async function readRegularFileBounded(path, root, maxBytes) {
+	const { handle, metadata } = await openRegularFile$1(path, root, constants.O_RDONLY);
+	try {
+		if (metadata.size > maxBytes) throw new Error(`Visual Review public source-map scan exceeds 20 MiB for ${deploymentRelativePath(root.path, path)}`);
+		const chunks = [];
+		let position = 0;
+		while (position <= maxBytes) {
+			const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1 - position));
+			const { bytesRead } = await handle.read(chunk, 0, chunk.byteLength, position);
+			if (bytesRead === 0) break;
+			chunks.push(chunk.subarray(0, bytesRead));
+			position += bytesRead;
+		}
+		if (position > maxBytes) throw new Error(`Visual Review public source-map scan exceeds 20 MiB for ${deploymentRelativePath(root.path, path)}`);
+		return Buffer.concat(chunks, position);
+	} finally {
+		await handle.close();
+	}
+}
+async function unlinkRegularFile$1(path, root) {
+	const parent = dirname(path);
+	const parentMetadata = await validateOutputDirectory$1(parent, root);
+	const { handle, metadata } = await openRegularFile$1(path, root, constants.O_WRONLY);
+	try {
+		await handle.truncate(0);
+	} finally {
+		await handle.close();
+	}
+	const [current, currentParent] = await Promise.all([lstat(path), validateOutputDirectory$1(parent, root)]);
+	if (current.isSymbolicLink() || !current.isFile() || !sameFile$1(current, metadata) || !sameFile$1(currentParent, parentMetadata)) throw new Error("Visual Review Vite source-map output changed during cleanup");
+	await unlink(path);
+}
+async function resolveBuildOutputDirectory$1(projectRoot, outDir) {
+	assertBuildOutput$1(projectRoot, outDir);
+	const before = await lstat(outDir);
+	if (!before.isDirectory() || before.isSymbolicLink()) throw new Error("Visual Review Vite outDir must be a real directory");
+	const [canonicalProjectRoot, canonicalOutDir] = await Promise.all([realpath(projectRoot), realpath(outDir)]);
+	assertBuildOutput$1(canonicalProjectRoot, canonicalOutDir);
+	const after = await lstat(outDir);
+	if (!after.isDirectory() || after.isSymbolicLink() || !sameFile$1(before, after)) throw new Error("Visual Review Vite outDir changed during validation");
+	return {
+		path: outDir,
+		canonicalPath: canonicalOutDir,
+		device: after.dev,
+		inode: after.ino
+	};
+}
+async function assertOutputRootUnchanged$1(root) {
+	const metadata = await lstat(root.path);
+	if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error("Visual Review Vite outDir must be a real directory");
+	if (metadata.dev !== root.device || metadata.ino !== root.inode) throw new Error("Visual Review Vite outDir changed during source-map processing");
+	if (await realpath(root.path) !== root.canonicalPath) throw new Error("Visual Review Vite outDir changed during source-map processing");
+}
+async function readOutputDirectory$1(directory, root) {
+	const before = await validateOutputDirectory$1(directory, root);
+	const entries = await readdir(directory, { withFileTypes: true });
+	if (!sameFile$1(before, await validateOutputDirectory$1(directory, root))) throw new Error("Visual Review Vite output directory changed while reading");
+	return entries;
+}
+async function validateOutputDirectory$1(directory, root) {
+	assertAtOrInside$1(root.path, directory);
+	await assertOutputRootUnchanged$1(root);
+	const before = await lstat(directory);
+	if (!before.isDirectory() || before.isSymbolicLink()) throw new Error("Visual Review Vite build output must not contain symbolic links");
+	const canonical = await realpath(directory);
+	assertAtOrInside$1(root.canonicalPath, canonical);
+	const after = await lstat(directory);
+	if (!after.isDirectory() || after.isSymbolicLink() || !sameFile$1(before, after)) throw new Error("Visual Review Vite output directory changed during validation");
+	await assertOutputRootUnchanged$1(root);
+	return after;
+}
+async function openRegularFile$1(path, root, flags) {
+	assertInside$2(root.path, path);
+	await assertOutputRootUnchanged$1(root);
+	const parent = dirname(path);
+	const parentMetadata = await validateOutputDirectory$1(parent, root);
+	const before = await lstat(path);
+	if (!before.isFile() || before.isSymbolicLink()) throw new Error("Visual Review source-map output must be a regular file");
+	const canonical = await realpath(path);
+	assertInside$2(root.canonicalPath, canonical);
+	const handle = await open(path, flags | constants.O_NOFOLLOW);
+	try {
+		const metadata = await handle.stat();
+		const currentParent = await validateOutputDirectory$1(parent, root);
+		if (!metadata.isFile() || !sameFile$1(before, metadata) || !sameFile$1(parentMetadata, currentParent)) throw new Error("Visual Review Vite source-map output changed while opening");
+		return {
+			handle,
+			metadata
+		};
+	} catch (error) {
+		await handle.close();
+		throw error;
+	}
+}
+function assertBuildOutput$1(projectRoot, outDir) {
+	const path = relative(projectRoot, outDir);
+	if (!path || path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) throw new Error("Visual Review Vite outDir must be below the project root");
+}
+function sameFile$1(left, right) {
+	return left.dev === right.dev && left.ino === right.ino;
+}
+function assertAtOrInside$1(root, path) {
+	const candidate = relative(resolve(root), resolve(path));
+	if (candidate === ".." || candidate.startsWith(`..${sep}`) || isAbsolute(candidate)) throw new Error("Visual Review source-map path escaped the deployment output");
+}
+function deploymentRelativePath(outDir, path) {
+	assertInside$2(outDir, path);
+	return relative(outDir, path).split(sep).join("/");
+}
+function assertInside$2(root, path) {
+	const candidate = relative(resolve(root), resolve(path));
+	if (!candidate || candidate === ".." || candidate.startsWith(`..${sep}`) || isAbsolute(candidate)) throw new Error("Visual Review source-map path escaped the deployment output");
+}
+function publicGeneratedPath(base, relativePath) {
+	const safeRelative = relativePath.replace(/^\/+/, "");
+	if (base.includes("://")) {
+		const baseUrl = new URL(base.endsWith("/") ? base : `${base}/`);
+		return new URL(safeRelative, baseUrl).pathname;
+	}
+	const normalizedBase = base.trim().replace(/\\/g, "/");
+	return `${normalizedBase === "" || normalizedBase === "./" ? "/" : `/${normalizedBase.replace(/^\/+|\/+$/g, "")}/`}${safeRelative}`.replace(/\/{2,}/g, "/");
+}
+function sanitizeSourceMapBytes(bytes, mapFile, projectRoot, framework = "vite") {
+	let parsed;
+	try {
+		parsed = JSON.parse(bytes.toString("utf8"));
+	} catch {
+		throw new Error("Visual Review received an invalid source map");
+	}
+	if (!isRecord$2(parsed) || parsed.version !== 3) throw new Error("Visual Review only accepts Source Map v3 output");
+	const meaningful = sanitizeSourceMapObject(parsed, dirname(mapFile), projectRoot, framework);
+	if (!meaningful && Array.isArray(parsed.sections)) {
+		delete parsed.sections;
+		parsed.sources = [];
+		parsed.names = [];
+		parsed.mappings = "";
+	}
+	const debugId = typeof parsed.debugId === "string" && /^[A-Za-z0-9._:-]{1,255}$/.test(parsed.debugId) ? parsed.debugId : void 0;
+	return {
+		bytes: Buffer.from(JSON.stringify(parsed)),
+		...debugId ? { debugId } : {},
+		...!meaningful ? { empty: true } : {}
+	};
+}
+function sanitizeSourceMapObject(map, mapDirectory, projectRoot, framework) {
+	sanitizeSourceMapFile(map);
+	delete map.sourcesContent;
+	if (Array.isArray(map.sections)) {
+		delete map.sourceRoot;
+		let meaningful = false;
+		for (const section of map.sections) {
+			if (!isRecord$2(section) || "url" in section || !isRecord$2(section.map)) throw new Error("Visual Review refuses external or invalid indexed source maps");
+			if (section.map.version !== 3) throw new Error("Visual Review only accepts Source Map v3 output");
+			if (sanitizeSourceMapObject(section.map, mapDirectory, projectRoot, framework)) meaningful = true;
+			else section.map = {
+				version: 3,
+				sources: [],
+				names: [],
+				mappings: ""
+			};
+		}
+		return meaningful;
+	}
+	if (!Array.isArray(map.sources) || !map.sources.every((source) => typeof source === "string")) throw new Error("Visual Review source map is missing its sources");
+	if (!Array.isArray(map.names) || !map.names.every((name) => typeof name === "string")) throw new Error("Visual Review source map has invalid names");
+	if (typeof map.mappings !== "string") throw new Error("Visual Review source map is missing its mappings");
+	const sourceRoot = map.sourceRoot === void 0 ? "" : map.sourceRoot;
+	if (typeof sourceRoot !== "string" || framework !== "next" && isUnsafeSourcePath(sourceRoot)) throw new Error("Visual Review source map has an unsafe sourceRoot");
+	map.sources = map.sources.map((source) => normalizeSourcePath(source, sourceRoot, mapDirectory, projectRoot, framework));
+	delete map.sourceRoot;
+	return typeof map.mappings === "string" && /[^;,]/u.test(map.mappings);
+}
+function sanitizeSourceMapFile(map) {
+	if (map.file === void 0) return;
+	if (typeof map.file !== "string") {
+		delete map.file;
+		return;
+	}
+	const normalized = map.file.replaceAll("\\", "/").normalize("NFC");
+	if (normalized.length === 0 || normalized.length > 2048 || normalized.trim() !== normalized || normalized.startsWith("/") || /^[A-Za-z]:\//u.test(normalized) || /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(normalized) || hasUnsafePathCharacters(normalized) || normalized.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+		delete map.file;
+		return;
+	}
+	map.file = normalized;
+}
+function normalizeSourcePath(source, sourceRoot, mapDirectory, projectRoot, framework) {
+	if (framework === "next") return normalizeNextSourcePath(source, sourceRoot, mapDirectory, projectRoot);
+	if (source.length === 0 || isUnsafeSourcePath(source)) throw new Error("Visual Review source map has an unsafe source path");
+	const repositoryRelative = relative(projectRoot, isAbsolute(source) ? resolve(source) : resolve(mapDirectory, sourceRoot, source));
+	if (repositoryRelative.length === 0 || repositoryRelative === ".." || repositoryRelative.startsWith(`..${sep}`) || isAbsolute(repositoryRelative)) throw new Error("Visual Review source map source escaped the project root");
+	return repositoryRelative.split(sep).join("/");
+}
+function normalizeNextSourcePath(source, sourceRoot, mapDirectory, projectRoot) {
+	if (source.length === 0) throw new Error("Visual Review source map has an unsafe source path");
+	const combined = combineNextSourceRoot(sourceRoot, source);
+	if (combined.length === 0 || combined.length > 4096 || hasUnsafePathCharacters(combined)) throw new Error("Visual Review source map has an unsafe source path");
+	const ignoredSource = /^ignored\|(.+)$/u.exec(combined)?.[1];
+	if (ignoredSource) return normalizeNextSourcePath(ignoredSource, "", mapDirectory, projectRoot);
+	if (/^(?:webpack|turbopack):\/\//iu.test(combined)) return normalizeNextVirtualSource(combined, mapDirectory, projectRoot) ?? opaqueNextSource(combined);
+	if (/^file:\/\//iu.test(combined)) {
+		let url;
+		try {
+			url = new URL(combined);
+		} catch {
+			throw new Error("Visual Review source map has an unsafe source path");
+		}
+		if (url.hostname && url.hostname !== "localhost") return opaqueNextSource(combined);
+		const pathname = decodeNextDecoratedPath(url.pathname);
+		return (pathname ? repositoryRelativeSource(pathname, projectRoot) : null) ?? opaqueNextSource(combined);
+	}
+	if (/^https?:\/\//iu.test(combined)) {
+		let url;
+		try {
+			url = new URL(combined);
+		} catch {
+			return opaqueNextSource(combined);
+		}
+		if (!isLocalSourceMapHostname(url.hostname)) return opaqueNextSource(combined);
+		const pathname = decodeNextDecoratedPath(url.pathname);
+		return (pathname ? repositoryRelativeSource(pathname, projectRoot) : null) ?? opaqueNextSource(combined);
+	}
+	if (/^[A-Za-z]:[\\/]/u.test(combined)) {
+		const undecorated = decodeNextDecoratedPath(combined);
+		return (undecorated ? repositoryRelativeWindowsSource(undecorated, projectRoot) : null) ?? opaqueNextSource(combined);
+	}
+	if (/^[A-Za-z][A-Za-z0-9+.-]*:/u.test(combined)) return opaqueNextSource(combined);
+	const undecorated = decodeNextDecoratedPath(combined);
+	if (!undecorated) return opaqueNextSource(combined);
+	return repositoryRelativeSource(isAbsolute(undecorated) ? resolve(undecorated) : resolve(mapDirectory, undecorated), projectRoot) ?? normalizeNextContextPath(undecorated, projectRoot) ?? opaqueNextSource(combined);
+}
+function combineNextSourceRoot(sourceRoot, source) {
+	if (!sourceRoot) return source;
+	if (sourceRoot.endsWith("/") || sourceRoot.endsWith("\\")) return `${sourceRoot}${source}`;
+	return `${sourceRoot}/${source}`;
+}
+function normalizeNextVirtualSource(source, mapDirectory, projectRoot) {
+	const separator = source.indexOf("://");
+	if (separator < 0) return null;
+	const rest = source.slice(separator + 3);
+	let pathname;
+	if (rest.startsWith("/")) pathname = rest.replace(/^\/+/, "");
+	else {
+		const firstSlash = rest.indexOf("/");
+		if (firstSlash < 0) return null;
+		pathname = rest.slice(firstSlash + 1);
+	}
+	pathname = decodeNextDecoratedPath(pathname) ?? "";
+	if (!pathname) return null;
+	pathname = pathname.replace(/^\[project\]\//u, "").replace(/^\.\//u, "");
+	const ignoredSource = /^ignored\|(.+)$/u.exec(pathname)?.[1];
+	if (ignoredSource) return normalizeNextSourcePath(ignoredSource, "", mapDirectory, projectRoot);
+	if (pathname.startsWith("[") || pathname.startsWith("external ") || pathname.startsWith("webpack/")) return null;
+	return normalizeNextContextPath(pathname, projectRoot);
+}
+function isLocalSourceMapHostname(hostname) {
+	const normalized = hostname.toLowerCase();
+	return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "[::1]";
+}
+function repositoryRelativeWindowsSource(path, projectRoot) {
+	const normalizedPath = path.replaceAll("\\", "/").normalize("NFC");
+	const normalizedRoot = projectRoot.replaceAll("\\", "/").replace(/\/$/u, "").normalize("NFC");
+	if (!/^[A-Za-z]:\//u.test(normalizedPath) || !/^[A-Za-z]:\//u.test(normalizedRoot)) return null;
+	const lowerPath = normalizedPath.toLowerCase();
+	const lowerRoot = normalizedRoot.toLowerCase();
+	if (!lowerPath.startsWith(`${lowerRoot}/`)) return null;
+	const repositoryRelative = normalizedPath.slice(normalizedRoot.length + 1);
+	return isCoreSafeNextRepositoryPath(repositoryRelative) ? repositoryRelative : null;
+}
+function normalizeNextContextPath(value, projectRoot) {
+	const withoutQuery = decodeNextDecoratedPath(value)?.replace(/^\.\//u, "") ?? "";
+	if (!withoutQuery || hasUnsafePathCharacters(withoutQuery)) return null;
+	let context = resolve(projectRoot);
+	while (true) {
+		const normalized = repositoryRelativeSource(resolve(context, withoutQuery), projectRoot);
+		if (normalized) return normalized;
+		const parent = dirname(context);
+		if (parent === context) break;
+		context = parent;
+	}
+	return null;
+}
+function decodeNextDecoratedPath(value) {
+	let decoded = value;
+	const encodedOctet = /%[0-9a-f]{2}/iu;
+	for (let iteration = 0; iteration < 4 && encodedOctet.test(decoded); iteration += 1) try {
+		decoded = decodeURIComponent(decoded);
+	} catch {
+		return null;
+	}
+	if (encodedOctet.test(decoded)) return null;
+	const undecorated = decoded.split(/[?#]/u, 1)[0] ?? "";
+	if (!undecorated || hasUnsafePathCharacters(undecorated)) return null;
+	return undecorated;
+}
+function repositoryRelativeSource(path, projectRoot) {
+	const repositoryRelative = relative(resolve(projectRoot), resolve(path));
+	if (repositoryRelative.length === 0 || repositoryRelative === ".." || repositoryRelative.startsWith(`..${sep}`) || isAbsolute(repositoryRelative)) return null;
+	const normalized = repositoryRelative.split(sep).join("/").normalize("NFC");
+	return isCoreSafeNextRepositoryPath(normalized) ? normalized : null;
+}
+function isCoreSafeNextRepositoryPath(value) {
+	if (value.length === 0 || value.length > 2048 || value.trim() !== value || value.startsWith("/") || value.startsWith("\\") || value.includes("\\") || value.includes("?") || value.includes("#") || value.includes(":") || /%[0-9a-f]{2}/iu.test(value) || hasUnsafePathCharacters(value)) return false;
+	return value.split("/").every((segment) => segment.length > 0 && segment.length <= 255 && segment !== "." && segment !== "..");
+}
+function opaqueNextSource(source) {
+	return `node_modules/.visual-review-next/${sha256$1(Buffer.from(source)).slice(0, 24)}.js`;
+}
+function hasUnsafePathCharacters(value) {
+	return /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(value);
+}
+function isUnsafeSourcePath(value) {
+	const uriScheme = /^[A-Za-z][A-Za-z0-9+.-]*:/.test(value);
+	const windowsDrive = /^[A-Za-z]:[\\/]/.test(value);
+	return value.length > 4096 || /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(value) || uriScheme && !windowsDrive;
+}
+function sha256$1(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function hasSourceMapReference(source) {
+	return /(?:^|\n)\s*\/\/[#@]\s*sourceMappingURL\s*=\s*\S+\s*(?:\n|$)/m.test(source) || /\/\*[#@]\s*sourceMappingURL\s*=\s*[^*]+\*\//m.test(source);
+}
+function artifactKey(runtime, generatedPath) {
+	return `${runtime}\0${generatedPath}`;
+}
+function hasHeader(headers, name) {
+	return Object.keys(headers).some((key) => key.toLowerCase() === name.toLowerCase());
+}
+function isRuntime(value) {
+	return value === "browser" || value === "server-node" || value === "server-edge";
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringRecord(value) {
+	return isRecord$2(value) && Object.values(value).every((item) => typeof item === "string");
+}
+//#endregion
+//#region src/next-source-map-upload.ts
+const JAVASCRIPT_OUTPUT = /\.(?:c|m)?js$/iu;
+const SOURCE_MAPPED_OUTPUT = /(?:\.(?:c|m)?js|\.css)$/iu;
+const MAX_EDGE_MANIFEST_BYTES$1 = 5 * 1024 * 1024;
+/**
+* Collects private Next.js browser, Node, and Edge maps after compilation.
+* Every sourceMappingURL and map is removed even when collection or upload fails.
+*/
+async function uploadNextSourceMaps(input, dependencies = {}) {
+	const projectRoot = resolve(input.projectRoot);
+	const outputRoot = await resolveBuildOutputDirectory(projectRoot, resolve(input.distDir));
+	let uploadError;
+	let manifest;
+	try {
+		if (input.buildId === "unversioned" && input.gitCommit === null) throw new Error("Visual Review source-map upload requires a versioned build identity");
+		const pairs = await collectNextOutputPairs({
+			outputRoot,
+			files: await collectOutputFiles(outputRoot),
+			edgeFiles: await readEdgeRuntimeFiles(outputRoot)
+		});
+		await stripSourceMapReferences(outputRoot);
+		const artifacts = await collectNextArtifacts({
+			projectRoot,
+			outputRoot,
+			pairs,
+			basePath: input.basePath,
+			assetPrefix: input.assetPrefix
+		});
+		if (artifacts.length === 0) throw new Error("Visual Review source-map upload found no paired Next.js output");
+		manifest = {
+			schemaVersion: 1,
+			release: {
+				buildId: input.buildId,
+				gitCommit: input.gitCommit,
+				framework: "next",
+				...input.frameworkVersion ? { frameworkVersion: input.frameworkVersion } : {},
+				mode: input.mode
+			},
+			artifacts: artifacts.map(({ manifest: artifact }) => artifact)
+		};
+		await uploadSourceMapRelease({
+			manifest,
+			artifacts,
+			token: input.token,
+			serviceUrl: input.serviceUrl
+		}, dependencies);
+	} catch (error) {
+		uploadError = error;
+	}
+	let cleanupError;
+	try {
+		await cleanupNextSourceMapOutputRoot(outputRoot);
+	} catch (error) {
+		cleanupError = error;
+	}
+	if (uploadError && cleanupError) throw new AggregateError([uploadError, cleanupError], "Visual Review Next.js source-map upload failed and private build output could not be cleaned");
+	if (cleanupError) throw new Error("Visual Review could not clean private Next.js source-map output", { cause: cleanupError });
+	if (uploadError) throw new Error("Visual Review Next.js source-map upload failed", { cause: uploadError });
+	if (!manifest) throw new Error("Visual Review Next.js source-map manifest was not created");
+	return manifest;
+}
+async function cleanupNextSourceMapOutput(projectRootValue, distDirValue) {
+	await cleanupNextSourceMapOutputRoot(await resolveBuildOutputDirectory(resolve(projectRootValue), resolve(distDirValue)));
+}
+async function cleanupNextSourceMapOutputRoot(outputRoot) {
+	const failures = (await Promise.allSettled([stripSourceMapReferences(outputRoot), removeSourceMapFiles(outputRoot)])).filter((result) => result.status === "rejected").map((result) => result.reason);
+	if (failures.length > 0) throw new AggregateError(failures, "Could not clean all Visual Review Next.js source maps");
+}
+async function collectNextArtifacts(input) {
+	const artifacts = [];
+	for (const { generatedFile, mapFile, outputPath, runtime } of input.pairs) {
+		const [generatedBytes, rawMapBytes] = await Promise.all([readRegularFile(generatedFile, input.outputRoot), readRegularFile(mapFile, input.outputRoot)]);
+		if (containsSourceMapReference(generatedBytes.toString("utf8"))) throw new Error(`Visual Review could not remove sourceMappingURL from ${outputPath}`);
+		const { bytes: mapBytes, debugId, empty } = sanitizeSourceMapBytes(rawMapBytes, mapFile, input.projectRoot, "next");
+		if (empty) continue;
+		if (mapBytes.byteLength > 20971520) throw new Error(`Visual Review source map exceeds 20 MiB for ${outputPath}`);
+		artifacts.push({
+			manifest: {
+				runtime,
+				generatedPath: runtime === "browser" ? browserGeneratedPath(outputPath, input.basePath, input.assetPrefix) : serverGeneratedPath(input.projectRoot, generatedFile),
+				mapSha256: sha256(mapBytes),
+				generatedSha256: sha256(generatedBytes),
+				byteSize: mapBytes.byteLength,
+				...debugId ? { debugId } : {}
+			},
+			mapBytes
+		});
+	}
+	return artifacts.sort((left, right) => `${left.manifest.runtime}\0${left.manifest.generatedPath}`.localeCompare(`${right.manifest.runtime}\0${right.manifest.generatedPath}`));
+}
+async function collectNextOutputPairs(input) {
+	const fileSet = new Set(input.files);
+	const generatedFiles = input.files.filter((path) => JAVASCRIPT_OUTPUT.test(path)).sort();
+	const pairs = [];
+	for (const generatedFile of generatedFiles) {
+		const outputPath = outputRelativePath(input.outputRoot.path, generatedFile);
+		const runtime = classifyRuntime(outputPath, input.edgeFiles);
+		if (!runtime) continue;
+		const reference = trailingSourceMapReference((await readRegularFile(generatedFile, input.outputRoot)).toString("utf8"));
+		const mapFile = reference === null ? `${generatedFile}.map` : resolveSourceMapReference(generatedFile, reference, input.outputRoot.path);
+		if (!fileSet.has(mapFile)) continue;
+		pairs.push({
+			generatedFile,
+			mapFile,
+			outputPath,
+			runtime
+		});
+	}
+	return pairs;
+}
+function trailingSourceMapReference(source) {
+	const line = source.match(/(?:^|\r?\n)[ \t]*\/\/[#@][ \t]*sourceMappingURL[ \t]*=[ \t]*([^\r\n]+?)[ \t]*(?:\r?\n)?$/u);
+	if (line) return line[1] ?? null;
+	return source.match(/(?:^|\r?\n)?[ \t]*\/\*[#@][ \t]*sourceMappingURL[ \t]*=[ \t]*([^*]+?)[ \t]*\*\/[ \t]*(?:\r?\n)?$/u)?.[1] ?? null;
+}
+function resolveSourceMapReference(generatedFile, reference, distDir) {
+	let decoded = reference;
+	let stable = false;
+	for (let iteration = 0; iteration < 8; iteration += 1) {
+		let next;
+		try {
+			next = decodeURIComponent(decoded);
+		} catch {
+			throw new Error("Visual Review received an invalid Next.js source-map reference");
+		}
+		if (next === decoded) {
+			stable = true;
+			break;
+		}
+		decoded = next;
+	}
+	if (!reference || reference.length > 4096 || reference.trim() !== reference || !stable || decoded.startsWith("/") || decoded.includes("\\") || decoded.includes("?") || decoded.includes("#") || /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(decoded) || /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(decoded) || decoded.split("/").some((segment) => !segment || segment === "." || segment === "..") || !decoded.endsWith(".map")) throw new Error("Visual Review received an unsafe Next.js source-map reference");
+	const mapFile = resolve(dirname(generatedFile), decoded);
+	assertInside$1(distDir, mapFile);
+	return mapFile;
+}
+function classifyRuntime(outputPath, edgeFiles) {
+	if (outputPath.startsWith("static/")) return "browser";
+	if (!outputPath.startsWith("server/")) return null;
+	if (outputPath.startsWith("server/edge/") || outputPath === "server/edge-runtime-webpack.js" || edgeFiles.has(outputPath)) return "server-edge";
+	return "server-node";
+}
+async function readEdgeRuntimeFiles(outputRoot) {
+	const manifestPath = resolve(outputRoot.path, "server/middleware-manifest.json");
+	let bytes;
+	try {
+		bytes = await readRegularFile(manifestPath, outputRoot);
+	} catch (error) {
+		if (isNodeError$1(error) && error.code === "ENOENT") return /* @__PURE__ */ new Set();
+		throw error;
+	}
+	if (bytes.byteLength > MAX_EDGE_MANIFEST_BYTES$1) throw new Error("Visual Review Next.js middleware manifest exceeds 5 MiB");
+	let parsed;
+	try {
+		parsed = JSON.parse(bytes.toString("utf8"));
+	} catch {
+		throw new Error("Visual Review received an invalid Next.js middleware manifest");
+	}
+	if (!isRecord$1(parsed)) throw new Error("Visual Review received an invalid Next.js middleware manifest");
+	const files = /* @__PURE__ */ new Set();
+	for (const groupName of ["middleware", "functions"]) {
+		const group = parsed[groupName];
+		if (group === void 0) continue;
+		if (!isRecord$1(group)) throw new Error("Visual Review received an invalid Next.js middleware manifest");
+		for (const entry of Object.values(group)) {
+			if (!isRecord$1(entry) || !Array.isArray(entry.files)) throw new Error("Visual Review received an invalid Next.js middleware manifest");
+			for (const file of entry.files) {
+				if (typeof file !== "string") throw new Error("Visual Review received an invalid Next.js middleware manifest");
+				const normalized = normalizeManifestOutputPath(file);
+				if (normalized.endsWith(".js")) files.add(normalized);
+			}
+		}
+	}
+	return files;
+}
+function normalizeManifestOutputPath(value) {
+	const normalized = value.replaceAll("\\", "/").replace(/^\/+/, "");
+	if (!normalized || normalized.length > 4096 || normalized.split("/").some((segment) => segment === "..") || /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(normalized)) throw new Error("Visual Review received an unsafe Next.js middleware output path");
+	return normalized;
+}
+async function stripSourceMapReferences(outputRoot) {
+	const files = await collectOutputFiles(outputRoot);
+	const failures = [];
+	await Promise.all(files.filter((path) => SOURCE_MAPPED_OUTPUT.test(path)).map(async (path) => {
+		try {
+			const source = (await readRegularFile(path, outputRoot)).toString("utf8");
+			const stripped = stripTrailingSourceMapReferences(source);
+			if (stripped !== source) await writeRegularFile(path, stripped, outputRoot);
+		} catch (error) {
+			failures.push(error);
+		}
+	}));
+	if (failures.length > 0) throw new AggregateError(failures, "Could not remove all Next.js sourceMappingURL comments");
+}
+function stripTrailingSourceMapReferences(source) {
+	let result = source;
+	while (true) {
+		const stripped = result.replace(/(?:(?:^|\r?\n)[ \t]*\/\/[#@][ \t]*sourceMappingURL[ \t]*=[^\r\n]*|(?:\r?\n)?[ \t]*\/\*[#@][ \t]*sourceMappingURL[ \t]*=[\s\S]*?\*\/)[ \t]*(?:\r?\n)?$/u, "");
+		if (stripped === result) return result;
+		result = stripped;
+	}
+}
+function containsSourceMapReference(source) {
+	return /(?:^|\n)\s*\/\/[#@]\s*sourceMappingURL\s*=\s*\S+\s*(?:\n|$)/mu.test(source) || /\/\*[#@]\s*sourceMappingURL\s*=\s*[^*]+\*\//mu.test(source);
+}
+async function collectOutputFiles(outputRoot, directory = outputRoot.path) {
+	const entries = await readOutputDirectory(directory, outputRoot);
+	return (await Promise.all(entries.map(async (entry) => {
+		const path = resolve(directory, entry.name);
+		if (entry.isSymbolicLink()) throw new Error("Visual Review Next.js build output must not contain symbolic links");
+		if (entry.isDirectory()) return collectOutputFiles(outputRoot, path);
+		if (entry.isFile()) return [path];
+		return [];
+	}))).flat();
+}
+async function removeSourceMapFiles(outputRoot, directory = outputRoot.path) {
+	const entries = await readOutputDirectory(directory, outputRoot);
+	const failures = [];
+	await Promise.all(entries.map(async (entry) => {
+		const path = resolve(directory, entry.name);
+		try {
+			if (entry.isDirectory()) await removeSourceMapFiles(outputRoot, path);
+			else if (entry.isSymbolicLink()) throw new Error("Visual Review Next.js build output must not contain symbolic links");
+			else if (entry.isFile() && entry.name.endsWith(".map")) await unlinkRegularFile(path, outputRoot);
+		} catch (error) {
+			failures.push(error);
+		}
+	}));
+	if (failures.length > 0) throw new AggregateError(failures, "Could not remove all Next.js source maps");
+}
+async function readRegularFile(path, root) {
+	const { handle } = await openRegularFile(path, root, constants.O_RDONLY);
+	try {
+		return await handle.readFile();
+	} finally {
+		await handle.close();
+	}
+}
+async function writeRegularFile(path, value, root) {
+	const { handle } = await openRegularFile(path, root, constants.O_WRONLY);
+	try {
+		await handle.truncate(0);
+		await handle.writeFile(value, "utf8");
+	} finally {
+		await handle.close();
+	}
+}
+async function unlinkRegularFile(path, root) {
+	const parent = dirname(path);
+	const parentMetadata = await validateOutputDirectory(parent, root);
+	const { handle, metadata } = await openRegularFile(path, root, constants.O_WRONLY);
+	try {
+		await handle.truncate(0);
+	} finally {
+		await handle.close();
+	}
+	const [current, currentParent] = await Promise.all([lstat(path), validateOutputDirectory(parent, root)]);
+	if (current.isSymbolicLink() || !current.isFile() || !sameFile(current, metadata) || !sameFile(currentParent, parentMetadata)) throw new Error("Visual Review Next.js source-map output changed during cleanup");
+	await unlink(path);
+}
+function browserGeneratedPath(outputPath, basePath, assetPrefix) {
+	const staticPath = outputPath.slice(7);
+	return `${normalizeNextPublicPrefix(assetPrefix || basePath || "")}/_next/static/${staticPath}`.replace(/\/{2,}/gu, "/");
+}
+function normalizeNextPublicPrefix(value) {
+	if (value.length > 2048 || value.trim() !== value || value.includes("\\") || /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(value)) throw new Error("Visual Review Next.js asset prefix is unsafe");
+	if (!value) return "";
+	let url;
+	let rawPath;
+	if (value.startsWith("//")) {
+		if (value.startsWith("///")) throw new Error("Visual Review Next.js asset prefix URL is invalid");
+		url = parseNextPublicUrl(`https:${value}`);
+		rawPath = rawUrlPath(value, 2);
+	} else if (/^[A-Za-z][A-Za-z0-9+.-]*:/u.test(value)) {
+		if (!/^https?:\/\//iu.test(value)) throw new Error("Visual Review Next.js asset prefix must use HTTP or HTTPS");
+		url = parseNextPublicUrl(value);
+		rawPath = rawUrlPath(value, value.indexOf("://") + 3);
+	} else {
+		if (!value.startsWith("/")) throw new Error("Visual Review Next.js asset prefix path must be absolute");
+		if (value.includes("?") || value.includes("#")) throw new Error("Visual Review Next.js asset prefix must not contain query or fragment");
+		rawPath = value;
+		url = new URL(value, "https://visual-review.invalid");
+	}
+	if (url.username || url.password || url.search || url.hash) throw new Error("Visual Review Next.js asset prefix must not contain credentials, query, or fragment");
+	assertSafePublicPath(rawPath);
+	const path = url.pathname;
+	if (!path || path === "/") return "";
+	return `/${path.replace(/^\/+|\/+$/gu, "")}`;
+}
+function parseNextPublicUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Visual Review Next.js asset prefix URL is invalid");
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:" || !url.hostname) throw new Error("Visual Review Next.js asset prefix must use HTTP or HTTPS");
+	return url;
+}
+function rawUrlPath(value, authorityStart) {
+	const pathStart = value.indexOf("/", authorityStart);
+	if (pathStart < 0) return "/";
+	const queryStart = value.search(/[?#]/u);
+	return value.slice(pathStart, queryStart >= pathStart ? queryStart : void 0);
+}
+function assertSafePublicPath(value) {
+	let decoded = value;
+	let stable = false;
+	for (let iteration = 0; iteration < 8; iteration += 1) {
+		let next;
+		try {
+			next = decodeURIComponent(decoded);
+		} catch {
+			throw new Error("Visual Review Next.js asset prefix contains invalid encoding");
+		}
+		if (next === decoded) {
+			stable = true;
+			break;
+		}
+		decoded = next;
+	}
+	if (!stable || !decoded.startsWith("/") || decoded.includes("\\") || /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(decoded) || decoded.split("/").some((segment) => segment === "." || segment === "..")) throw new Error("Visual Review Next.js asset prefix path is unsafe");
+}
+function serverGeneratedPath(projectRoot, generatedFile) {
+	const path = relative(resolve(projectRoot), resolve(generatedFile));
+	if (!path || path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) throw new Error("Visual Review Next.js server output escaped the project root");
+	return `/${path.split(sep).join("/")}`;
+}
+function outputRelativePath(distDir, path) {
+	assertInside$1(distDir, path);
+	return relative(distDir, path).split(sep).join("/");
+}
+function assertBuildOutput(projectRoot, distDir) {
+	const path = relative(projectRoot, distDir);
+	if (!path || path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) throw new Error("Visual Review Next.js distDir must be below the project root");
+}
+async function resolveBuildOutputDirectory(projectRoot, distDir) {
+	assertBuildOutput(projectRoot, distDir);
+	const before = await lstat(distDir);
+	if (!before.isDirectory() || before.isSymbolicLink()) throw new Error("Visual Review Next.js distDir must be a real directory");
+	const [canonicalProjectRoot, canonicalDistDir] = await Promise.all([realpath(projectRoot), realpath(distDir)]);
+	assertBuildOutput(canonicalProjectRoot, canonicalDistDir);
+	const after = await lstat(distDir);
+	if (!after.isDirectory() || after.isSymbolicLink() || !sameFile(before, after)) throw new Error("Visual Review Next.js distDir changed during validation");
+	return {
+		path: distDir,
+		canonicalPath: canonicalDistDir,
+		device: after.dev,
+		inode: after.ino
+	};
+}
+async function assertOutputRootUnchanged(root) {
+	const metadata = await lstat(root.path);
+	if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error("Visual Review Next.js distDir must be a real directory");
+	if (metadata.dev !== root.device || metadata.ino !== root.inode) throw new Error("Visual Review Next.js distDir changed during source-map processing");
+	if (await realpath(root.path) !== root.canonicalPath) throw new Error("Visual Review Next.js distDir changed during source-map processing");
+}
+async function readOutputDirectory(directory, root) {
+	const before = await validateOutputDirectory(directory, root);
+	const entries = await readdir(directory, { withFileTypes: true });
+	if (!sameFile(before, await validateOutputDirectory(directory, root))) throw new Error("Visual Review Next.js output directory changed while reading");
+	return entries;
+}
+async function validateOutputDirectory(directory, root) {
+	assertAtOrInside(root.path, directory);
+	await assertOutputRootUnchanged(root);
+	const before = await lstat(directory);
+	if (!before.isDirectory() || before.isSymbolicLink()) throw new Error("Visual Review Next.js build output must not contain symbolic links");
+	const canonical = await realpath(directory);
+	assertAtOrInside(root.canonicalPath, canonical);
+	const after = await lstat(directory);
+	if (!after.isDirectory() || after.isSymbolicLink() || !sameFile(before, after)) throw new Error("Visual Review Next.js output directory changed during validation");
+	await assertOutputRootUnchanged(root);
+	return after;
+}
+async function openRegularFile(path, root, flags) {
+	assertInside$1(root.path, path);
+	await assertOutputRootUnchanged(root);
+	const parent = dirname(path);
+	const parentMetadata = await validateOutputDirectory(parent, root);
+	const before = await lstat(path);
+	if (!before.isFile() || before.isSymbolicLink()) throw new Error("Visual Review Next.js source-map output must be a regular file");
+	const canonical = await realpath(path);
+	assertInside$1(root.canonicalPath, canonical);
+	const handle = await open(path, flags | constants.O_NOFOLLOW);
+	try {
+		const metadata = await handle.stat();
+		const currentParent = await validateOutputDirectory(parent, root);
+		if (!metadata.isFile() || !sameFile(before, metadata) || !sameFile(parentMetadata, currentParent)) throw new Error("Visual Review Next.js source-map output changed while opening");
+		return {
+			handle,
+			metadata
+		};
+	} catch (error) {
+		await handle.close();
+		throw error;
+	}
+}
+function sameFile(left, right) {
+	return left.dev === right.dev && left.ino === right.ino;
+}
+function assertAtOrInside(root, path) {
+	const candidate = relative(resolve(root), resolve(path));
+	if (candidate === ".." || candidate.startsWith(`..${sep}`) || isAbsolute(candidate)) throw new Error("Visual Review Next.js source-map path escaped the build output");
+}
+function assertInside$1(root, path) {
+	const candidate = relative(resolve(root), resolve(path));
+	if (!candidate || candidate === ".." || candidate.startsWith(`..${sep}`) || isAbsolute(candidate)) throw new Error("Visual Review Next.js source-map path escaped the build output");
+}
+function sha256(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNodeError$1(value) {
+	return value instanceof Error;
+}
+//#endregion
+//#region src/source-index.ts
+const VISUAL_REVIEW_SOURCE_MARKER_ATTRIBUTE = "data-visual-review-source";
+const VISUAL_REVIEW_SOURCE_COORDINATE_ATTRIBUTE = "data-visual-review-source-coordinate";
+const VISUAL_REVIEW_SOURCE_INDEX_ATTRIBUTE = "data-visual-review-source-index";
+const SOURCE_MARKER_PREFIX = "vr1_";
+const SOURCE_COORDINATE_PATTERN = /vrc1_([0-9a-f]{32})/gu;
+const SOURCE_INDEX_FILENAME_PATTERN = /^visual-review-sources-[0-9a-f]{16}\.json$/u;
+const SOURCE_INDEX_REFERENCE_SCAN_PATTERN = /\/_next\/static\/(visual-review-sources-[0-9a-f]{16}\.json)(?![A-Za-z0-9._-])/gu;
+const MAX_SOURCE_INDEX_ENTRIES = 1e5;
+const MAX_SOURCE_INDEX_BYTES = 8 * 1024 * 1024;
+const MAX_EDGE_MANIFEST_BYTES = 5 * 1024 * 1024;
+const MAX_EDGE_MANIFEST_FILES = 5e4;
+const MAX_NEXT_SOURCE_INDEX_FILES = 16;
+const VISUAL_REVIEW_SOURCE_SCAN_LIMITS = Object.freeze({
+	maxDirectoryEntries: 1e5,
+	maxFiles: 5e4,
+	maxJavaScriptFiles: 2e4,
+	maxJavaScriptFileBytes: 32 * 1024 * 1024,
+	maxJavaScriptBytes: 512 * 1024 * 1024
+});
+function visualReviewSourceMarker(digest) {
+	if (!/^[0-9a-f]{32}$/u.test(digest)) throw new Error("Visual Review source marker digest is invalid");
+	return `${SOURCE_MARKER_PREFIX}${digest}`;
+}
+function visualReviewSourceIndexFilename(buildId, markerSalt) {
+	if (!/^[0-9a-f]{64}$/u.test(markerSalt)) throw new Error("Visual Review source index marker salt is invalid");
+	return `visual-review-sources-${createHmac("sha256", Buffer.from(markerSalt, "hex")).update("visual-review-source-index\0").update(buildId).digest("hex").slice(0, 16)}.json`;
+}
+function viteSourceIndexUrl(base, filename) {
+	if (base === "" || base === "." || base === "./") return `./.visual-review/${filename}`;
+	return `${normalizeVitePublicPrefix(base)}/.visual-review/${filename}`.replace(/\/{2,}/gu, "/");
+}
+function viteGeneratedAssetPath(base, filename) {
+	return `${normalizeVitePublicPrefix(base)}/${normalizeGeneratedFilename(filename)}`.replace(/\/{2,}/gu, "/");
+}
+function nextSourceIndexUrl(basePath, filename) {
+	return `${normalizeNextPublicPrefix(basePath ?? "")}/_next/static/${filename}`.replace(/\/{2,}/gu, "/");
+}
+function createVisualReviewSourceIndexAccumulator() {
+	return {
+		coordinateCount: 0,
+		index: {
+			schemaVersion: 1,
+			entries: Object.create(null)
+		},
+		locatorKeys: /* @__PURE__ */ new Map()
+	};
+}
+function appendVisualReviewSourceIndexAsset(accumulator, asset) {
+	let line1 = 1;
+	let lineStart = 0;
+	let nextNewline = asset.code.indexOf("\n");
+	for (const match of asset.code.matchAll(SOURCE_COORDINATE_PATTERN)) {
+		const digest = match[1];
+		if (!digest) continue;
+		const marker = visualReviewSourceMarker(digest);
+		const index = match.index;
+		while (nextNewline !== -1 && nextNewline < index) {
+			line1 += 1;
+			lineStart = nextNewline + 1;
+			nextNewline = asset.code.indexOf("\n", lineStart);
+		}
+		accumulator.coordinateCount += 1;
+		if (accumulator.coordinateCount > MAX_SOURCE_INDEX_ENTRIES) throw new Error("Visual Review source index exceeds 100,000 generated markers");
+		const locator = {
+			assetPath: asset.assetPath,
+			line1,
+			column0: index - lineStart,
+			runtime: asset.runtime
+		};
+		const current = accumulator.index.entries[marker] ?? [];
+		let locatorKeys = accumulator.locatorKeys.get(marker);
+		if (!locatorKeys) {
+			locatorKeys = /* @__PURE__ */ new Set();
+			accumulator.locatorKeys.set(marker, locatorKeys);
+		}
+		const locatorKey = JSON.stringify([
+			locator.assetPath,
+			locator.line1,
+			locator.column0,
+			locator.runtime
+		]);
+		if (locatorKeys.has(locatorKey)) continue;
+		if (current.length >= 64) throw new Error("Visual Review source marker exceeds 64 generated locators");
+		locatorKeys.add(locatorKey);
+		current.push(locator);
+		accumulator.index.entries[marker] = current;
+	}
+}
+function serializeVisualReviewSourceIndex(index) {
+	const serialized = `${JSON.stringify(index)}\n`;
+	if (Buffer.byteLength(serialized) > MAX_SOURCE_INDEX_BYTES) throw new Error("Visual Review source index exceeds 8 MiB");
+	return serialized;
+}
+function createVisualReviewSourceScanBudget() {
+	return {
+		directoryEntries: 0,
+		files: 0,
+		javascriptBytes: 0,
+		javascriptFiles: 0
+	};
+}
+function reserveVisualReviewSourceScanEntry(budget, input) {
+	assertSourceScanBudget(budget);
+	budget.directoryEntries += 1;
+	if (budget.directoryEntries > VISUAL_REVIEW_SOURCE_SCAN_LIMITS.maxDirectoryEntries) throw new Error("Visual Review source scan exceeds 100,000 directory entries");
+	if (input.kind === "directory") return;
+	budget.files += 1;
+	if (budget.files > VISUAL_REVIEW_SOURCE_SCAN_LIMITS.maxFiles) throw new Error("Visual Review source scan exceeds 50,000 files");
+	if (input.kind === "file") return;
+	const size = input.size;
+	if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0) throw new Error("Visual Review source scan received an invalid JavaScript file size");
+	if (size > VISUAL_REVIEW_SOURCE_SCAN_LIMITS.maxJavaScriptFileBytes) throw new Error("Visual Review source scan exceeds 32 MiB for one JavaScript file");
+	budget.javascriptFiles += 1;
+	budget.javascriptBytes += size;
+	if (budget.javascriptFiles > VISUAL_REVIEW_SOURCE_SCAN_LIMITS.maxJavaScriptFiles) throw new Error("Visual Review source scan exceeds 20,000 JavaScript files");
+	if (!Number.isSafeInteger(budget.javascriptBytes) || budget.javascriptBytes > VISUAL_REVIEW_SOURCE_SCAN_LIMITS.maxJavaScriptBytes) throw new Error("Visual Review source scan exceeds 512 MiB of JavaScript");
+}
+function assertSourceScanBudget(budget) {
+	for (const value of [
+		budget.directoryEntries,
+		budget.files,
+		budget.javascriptBytes,
+		budget.javascriptFiles
+	]) if (!Number.isSafeInteger(value) || value < 0) throw new Error("Visual Review source scan budget is invalid");
+}
+async function writeNextVisualReviewSourceIndex(input) {
+	const projectRoot = resolve(input.projectDir);
+	const outputRoot = resolve(projectRoot, input.distDir);
+	assertInside(projectRoot, outputRoot);
+	const staticRoot = resolve(outputRoot, "static");
+	const serverRoot = resolve(outputRoot, "server");
+	assertInside(outputRoot, staticRoot);
+	assertInside(outputRoot, serverRoot);
+	const budget = createVisualReviewSourceScanBudget();
+	const staticFiles = await collectJavaScriptFiles(staticRoot, budget);
+	const serverFiles = await collectJavaScriptFiles(serverRoot, budget);
+	const edgeFiles = await readNextEdgeRuntimeFiles(serverRoot);
+	const prefix = normalizeNextPublicPrefix(input.assetPrefix || input.basePath || "");
+	const accumulator = createVisualReviewSourceIndexAccumulator();
+	const filenames = createNextSourceIndexFilenameSet(input.filename);
+	for (const file of staticFiles) {
+		const code = await readCapturedFile(file, "Visual Review JavaScript output changed while scanning");
+		appendVisualReviewSourceIndexAsset(accumulator, {
+			assetPath: `${prefix}/_next/${relative(outputRoot, file.path).split(sep).join("/")}`.replace(/\/{2,}/gu, "/"),
+			code,
+			runtime: "browser"
+		});
+		addNextSourceIndexReferences(filenames, code);
+	}
+	for (const file of serverFiles) {
+		const code = await readCapturedFile(file, "Visual Review JavaScript output changed while scanning");
+		const outputPath = relative(outputRoot, file.path).split(sep).join("/");
+		appendVisualReviewSourceIndexAsset(accumulator, {
+			assetPath: `/${relative(projectRoot, file.path).split(sep).join("/")}`,
+			code,
+			runtime: nextServerRuntime(outputPath, edgeFiles)
+		});
+		addNextSourceIndexReferences(filenames, code);
+	}
+	const serialized = serializeVisualReviewSourceIndex(accumulator.index);
+	await mkdir(staticRoot, { recursive: true });
+	for (const filename of [...filenames].sort()) await writeAtomicNextSourceIndex(staticRoot, filename, serialized);
+}
+async function writeViteVisualReviewSourceIndex(input) {
+	const projectRoot = resolve(input.projectRoot);
+	const outputRoot = resolve(input.outDir);
+	assertInside(projectRoot, outputRoot);
+	const files = await collectJavaScriptFiles(outputRoot, createVisualReviewSourceScanBudget());
+	const accumulator = createVisualReviewSourceIndexAccumulator();
+	for (const file of files) appendVisualReviewSourceIndexAsset(accumulator, {
+		assetPath: viteGeneratedAssetPath(input.base, relative(outputRoot, file.path).split(sep).join("/")),
+		code: await readCapturedFile(file, "Visual Review JavaScript output changed while scanning"),
+		runtime: "browser"
+	});
+	const destinationRoot = resolve(outputRoot, ".visual-review");
+	const destination = resolve(destinationRoot, input.filename);
+	assertInside(outputRoot, destinationRoot);
+	assertInside(destinationRoot, destination);
+	await mkdir(destinationRoot, { recursive: true });
+	await writeFile(destination, serializeVisualReviewSourceIndex(accumulator.index), { flag: "w" });
+}
+async function collectJavaScriptFiles(directory, budget) {
+	const metadata = await lstat(directory, { bigint: true });
+	if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error("Visual Review JavaScript output directory is invalid");
+	const files = [];
+	await collect(directory, files, budget);
+	files.sort((left, right) => left.path.localeCompare(right.path));
+	return files;
+}
+async function readNextEdgeRuntimeFiles(serverRoot) {
+	const manifestPath = resolve(serverRoot, "middleware-manifest.json");
+	let manifest;
+	try {
+		manifest = await captureRegularFile(manifestPath, MAX_EDGE_MANIFEST_BYTES, "Visual Review Next.js middleware manifest is invalid");
+	} catch (error) {
+		if (isNodeError(error) && error.code === "ENOENT") return /* @__PURE__ */ new Set();
+		throw error;
+	}
+	let value;
+	try {
+		value = JSON.parse(await readCapturedFile(manifest, "Visual Review Next.js middleware manifest is invalid"));
+	} catch {
+		throw new Error("Visual Review Next.js middleware manifest is invalid");
+	}
+	if (!isRecord(value)) throw new Error("Visual Review Next.js middleware manifest is invalid");
+	const files = /* @__PURE__ */ new Set();
+	for (const groupName of ["middleware", "functions"]) {
+		const group = value[groupName];
+		if (group === void 0) continue;
+		if (!isRecord(group)) throw new Error("Visual Review Next.js middleware manifest is invalid");
+		for (const entry of Object.values(group)) {
+			if (!isRecord(entry) || !Array.isArray(entry.files)) throw new Error("Visual Review Next.js middleware manifest is invalid");
+			for (const file of entry.files) {
+				if (typeof file !== "string") throw new Error("Visual Review Next.js middleware manifest is invalid");
+				files.add(normalizeNextOutputPath(file));
+				if (files.size > MAX_EDGE_MANIFEST_FILES) throw new Error("Visual Review Next.js middleware manifest is invalid");
+			}
+		}
+	}
+	return files;
+}
+function nextServerRuntime(outputPath, edgeFiles) {
+	if (outputPath.startsWith("server/edge/") || outputPath === "server/edge-runtime-webpack.js" || edgeFiles.has(outputPath)) return "server-edge";
+	return "server-node";
+}
+function normalizeNextOutputPath(value) {
+	const normalized = value.replaceAll("\\", "/").replace(/^\/+/, "");
+	if (!normalized || normalized.length > 4096 || normalized.split("/").some((segment) => segment === "..") || /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(normalized)) throw new Error("Visual Review Next.js middleware manifest is invalid");
+	return normalized;
+}
+function normalizeVitePublicPrefix(base) {
+	if (base === "" || base === "." || base === "./") return "";
+	if (!base.startsWith("/") && !base.startsWith("//") && !/^https?:\/\//iu.test(base)) throw new Error("Visual Review Vite base must be root-absolute, HTTP(S), or ./");
+	return normalizeNextPublicPrefix(base);
+}
+function normalizeGeneratedFilename(filename) {
+	const normalized = filename.replace(/^\/+/, "");
+	if (!normalized || normalized.length > 4096 || normalized.includes("\\") || normalized.includes("?") || normalized.includes("#") || normalized.split("/").some((segment) => !segment || segment === "." || segment === "..") || /[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/u.test(normalized)) throw new Error("Visual Review generated asset filename is unsafe");
+	return normalized;
+}
+function createNextSourceIndexFilenameSet(configuredFilename) {
+	if (!SOURCE_INDEX_FILENAME_PATTERN.test(configuredFilename)) throw new Error("Visual Review Next.js source index filename is invalid");
+	return /* @__PURE__ */ new Set([configuredFilename]);
+}
+function addNextSourceIndexReferences(filenames, code) {
+	for (const match of code.matchAll(SOURCE_INDEX_REFERENCE_SCAN_PATTERN)) {
+		const filename = match[1];
+		if (!filename) continue;
+		filenames.add(filename);
+		if (filenames.size > MAX_NEXT_SOURCE_INDEX_FILES) throw new Error("Visual Review Next.js build references too many source indexes");
+	}
+}
+async function writeAtomicNextSourceIndex(staticRoot, filename, serialized) {
+	const destination = resolve(staticRoot, filename);
+	const temporary = resolve(staticRoot, `.${filename}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+	assertInside(staticRoot, destination);
+	assertInside(staticRoot, temporary);
+	try {
+		await writeFile(temporary, serialized, {
+			flag: "wx",
+			mode: 420
+		});
+		await rename(temporary, destination);
+	} finally {
+		await unlink(temporary).catch(() => void 0);
+	}
+}
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isNodeError(value) {
+	return value instanceof Error && "code" in value;
+}
+async function collect(directory, files, budget) {
+	const directories = [directory];
+	while (directories.length > 0) {
+		const current = directories.pop();
+		if (!current) continue;
+		const before = await lstat(current, { bigint: true });
+		if (!before.isDirectory() || before.isSymbolicLink()) throw new Error("Visual Review source scan does not follow symbolic links");
+		const handle = await opendir(current);
+		for await (const entry of handle) {
+			const path = join(current, entry.name);
+			const metadata = await lstat(path, { bigint: true });
+			if (metadata.isSymbolicLink()) throw new Error("Visual Review source scan does not follow symbolic links");
+			if (metadata.isDirectory()) {
+				reserveVisualReviewSourceScanEntry(budget, { kind: "directory" });
+				directories.push(path);
+				continue;
+			}
+			if (!metadata.isFile()) throw new Error("Visual Review source scan only accepts regular files and directories");
+			if (/\.(?:c|m)?js$/iu.test(entry.name)) {
+				const size = safeFileSize(metadata.size);
+				reserveVisualReviewSourceScanEntry(budget, {
+					kind: "javascript",
+					size
+				});
+				files.push(capturedFile(path, metadata, size));
+			} else reserveVisualReviewSourceScanEntry(budget, { kind: "file" });
+		}
+		if (!sameCapturedDirectory(before, await lstat(current, { bigint: true }))) throw new Error("Visual Review source directory changed while scanning");
+	}
+}
+async function captureRegularFile(path, maxBytes, message) {
+	const metadata = await lstat(path, { bigint: true });
+	if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error(message);
+	const size = safeFileSize(metadata.size);
+	if (size > maxBytes) throw new Error(message);
+	return capturedFile(path, metadata, size);
+}
+function capturedFile(path, metadata, size) {
+	return {
+		ctimeNs: metadata.ctimeNs,
+		dev: metadata.dev,
+		ino: metadata.ino,
+		mtimeNs: metadata.mtimeNs,
+		path,
+		size
+	};
+}
+function safeFileSize(size) {
+	if (size < 0n || size > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error("Visual Review source scan received an invalid file size");
+	return Number(size);
+}
+async function readCapturedFile(file, message) {
+	const noFollow = constants.O_NOFOLLOW;
+	if (!Number.isInteger(noFollow)) throw new Error("Visual Review source scan requires no-follow file support");
+	const handle = await open(file.path, constants.O_RDONLY | noFollow);
+	try {
+		if (!sameCapturedFile(file, await handle.stat({ bigint: true }))) throw new Error(message);
+		const bytes = Buffer.allocUnsafe(file.size);
+		let offset = 0;
+		while (offset < bytes.byteLength) {
+			const result = await handle.read(bytes, offset, Math.min(64 * 1024, bytes.byteLength - offset), offset);
+			if (result.bytesRead === 0) throw new Error(message);
+			offset += result.bytesRead;
+		}
+		const trailing = Buffer.allocUnsafe(1);
+		const trailingRead = await handle.read(trailing, 0, 1, file.size);
+		const after = await handle.stat({ bigint: true });
+		if (trailingRead.bytesRead !== 0 || !sameCapturedFile(file, after)) throw new Error(message);
+		return bytes.toString("utf8");
+	} finally {
+		await handle.close();
+	}
+}
+function sameCapturedDirectory(left, right) {
+	return right.isDirectory() && !right.isSymbolicLink() && left.dev === right.dev && left.ino === right.ino && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+function sameCapturedFile(captured, current) {
+	return current.isFile() && current.dev === captured.dev && current.ino === captured.ino && current.size === BigInt(captured.size) && current.mtimeNs === captured.mtimeNs && current.ctimeNs === captured.ctimeNs;
+}
+function assertInside(root, path) {
+	const candidate = relative(resolve(root), resolve(path));
+	if (!candidate || candidate === ".." || candidate.startsWith(`..${sep}`) || isAbsolute(candidate)) throw new Error("Visual Review source index escaped the build output");
+}
+//#endregion
+export { visualReviewSourceIndexFilename as a, writeNextVisualReviewSourceIndex as c, uploadNextSourceMaps as d, cleanupViteSourceMapOutput as f, nextSourceIndexUrl as i, writeViteVisualReviewSourceIndex as l, VISUAL_REVIEW_SOURCE_INDEX_ATTRIBUTE as n, visualReviewSourceMarker as o, uploadViteSourceMaps as p, VISUAL_REVIEW_SOURCE_MARKER_ATTRIBUTE as r, viteSourceIndexUrl as s, VISUAL_REVIEW_SOURCE_COORDINATE_ATTRIBUTE as t, cleanupNextSourceMapOutput as u };