@autter/runtime-cli 1.0.0 → 1.2.0

package/dist/cli.js

@@ -1,48 +1,19 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync2, readFileSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
 import { createRequire } from "module";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join5, relative as relative5, resolve as resolve4, sep as sep5 } from "path";
 import { parseArgs } from "util";
 
-// src/inject.ts
-import { readFile as readFile2, writeFile } from "fs/promises";
-
-// src/debug-id.ts
-import { createHash } from "crypto";
-var DEBUG_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-function normalizeDebugId(value) {
-  if (typeof value !== "string") return null;
-  const id = value.trim().toLowerCase();
-  return DEBUG_ID_RE.test(id) ? id : null;
-}
-function debugIdFor(bytes) {
-  const hash = createHash("sha256").update(bytes).digest();
-  hash[6] = hash[6] & 15 | 64;
-  hash[8] = hash[8] & 63 | 128;
-  const hex = hash.subarray(0, 16).toString("hex");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-var DEBUG_ID_COMMENT_RE = /^\/\/# debugId=([0-9a-fA-F-]{36})[ \t]*\r?$/gm;
-function readDebugIdComment(code) {
-  let found = null;
-  for (const match of code.matchAll(DEBUG_ID_COMMENT_RE)) found = normalizeDebugId(match[1]) ?? found;
-  return found;
-}
-var DEBUG_ID_REGISTRY = "_autterDebugIds";
-function debugIdSnippet(id) {
-  return `;!function(){try{var g="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof self?self:{},s=(new g.Error).stack;s&&((g.${DEBUG_ID_REGISTRY}=g.${DEBUG_ID_REGISTRY}||{})[s]="${id}")}catch(e){}}();`;
-}
-var SNIPPET_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="[0-9a-f]{8}-/;
-function hasDebugIdSnippet(code) {
-  return SNIPPET_RE.test(code);
-}
+// src/build.ts
+import { existsSync as existsSync2 } from "fs";
+import { relative as relative2, sep as sep2 } from "path";
 
 // src/files.ts
 import { existsSync } from "fs";
-import { readdir, readFile } from "fs/promises";
+import { readdir, readFile, rm, writeFile } from "fs/promises";
 import { dirname, join, relative, resolve, sep } from "path";
 var BUNDLE_RE = /\.[cm]?js$/;
 var SOURCE_MAPPING_URL_RE = /^[ \t]*\/\/[#@] sourceMappingURL=([^\s'"]+)[ \t]*\r?$/gm;
@@ -78,7 +49,7 @@ function mapPathFor(js, code) {
   const sibling = `${js}.map`;
   return existsSync(sibling) ? sibling : null;
 }
-async function walk(dir, out) {
+async function walk(dir, out, pattern = BUNDLE_RE) {
   let entries;
   try {
     entries = await readdir(dir, { withFileTypes: true });
@@ -88,9 +59,51 @@ async function walk(dir, out) {
   for (const entry of entries) {
     if (entry.name === "node_modules") continue;
     const full = join(dir, entry.name);
-    if (entry.isDirectory()) await walk(full, out);
-    else if (entry.isFile() && BUNDLE_RE.test(entry.name)) out.push(full);
+    if (entry.isDirectory()) await walk(full, out, pattern);
+    else if (entry.isFile() && pattern.test(entry.name)) out.push(full);
+  }
+}
+async function findMapFiles(dir) {
+  const out = [];
+  await walk(resolve(dir), out, /\.map$/);
+  return out.sort();
+}
+var CSS_SOURCE_MAPPING_URL_RE = /\/\*[#@] sourceMappingURL=([^\s*]+)\s*\*\/\s*$/;
+function pointsAt(file, url, map) {
+  if (!url || /^[a-z][\w+.-]*:/i.test(url) || url.startsWith("/")) return false;
+  let path = url.split(/[?#]/)[0];
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+  }
+  return resolve(dirname(file), path) === map;
+}
+async function stripReference(file, map) {
+  let code;
+  try {
+    code = await readFile(file, "utf8");
+  } catch {
+    return;
+  }
+  let stripped = code;
+  if (BUNDLE_RE.test(file)) {
+    if (pointsAt(file, readSourceMappingUrl(code), map)) stripped = stripSourceMappingUrl(code);
+  } else if (file.endsWith(".css")) {
+    const match = CSS_SOURCE_MAPPING_URL_RE.exec(code);
+    if (match && pointsAt(file, match[1], map)) stripped = code.slice(0, match.index).replace(/\n?$/, "\n");
   }
+  if (stripped !== code) await writeFile(file, stripped);
+}
+async function removeSourceMaps(maps, owners = /* @__PURE__ */ new Map()) {
+  const removed = [];
+  for (const map of [...new Set(maps)].sort()) {
+    if (!existsSync(map)) continue;
+    await rm(map, { force: true });
+    removed.push(map);
+    const owner = owners.get(map) ?? map.replace(/\.map$/, "");
+    await stripReference(owner, map);
+  }
+  return removed;
 }
 async function findBundles(dir, files) {
   const root = resolve(dir);
@@ -114,6 +127,39 @@ async function findBundles(dir, files) {
   return bundles;
 }
 
+// src/inject.ts
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+
+// src/debug-id.ts
+import { createHash } from "crypto";
+var DEBUG_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function normalizeDebugId(value) {
+  if (typeof value !== "string") return null;
+  const id = value.trim().toLowerCase();
+  return DEBUG_ID_RE.test(id) ? id : null;
+}
+function debugIdFor(bytes) {
+  const hash = createHash("sha256").update(bytes).digest();
+  hash[6] = hash[6] & 15 | 64;
+  hash[8] = hash[8] & 63 | 128;
+  const hex = hash.subarray(0, 16).toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+var DEBUG_ID_COMMENT_RE = /^\/\/# debugId=([0-9a-fA-F-]{36})[ \t]*\r?$/gm;
+function readDebugIdComment(code) {
+  let found = null;
+  for (const match of code.matchAll(DEBUG_ID_COMMENT_RE)) found = normalizeDebugId(match[1]) ?? found;
+  return found;
+}
+var DEBUG_ID_REGISTRY = "_autterDebugIds";
+function debugIdSnippet(id) {
+  return `;!function(){try{var g="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof self?self:{},s=(new g.Error).stack;s&&((g.${DEBUG_ID_REGISTRY}=g.${DEBUG_ID_REGISTRY}||{})[s]="${id}")}catch(e){}}();`;
+}
+var SNIPPET_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="[0-9a-f]{8}-/;
+function hasDebugIdSnippet(code) {
+  return SNIPPET_RE.test(code);
+}
+
 // src/inject.ts
 var SNIPPET_LINE_KEY = "x_autter_snippet_line";
 function snippetLine(code) {
@@ -202,8 +248,8 @@ ${out.slice(offset)}`;
   }
   const changed = mapDirty || out !== code;
   if (changed && !options.dryRun) {
-    if (mapDirty) await writeFile(bundle.map, JSON.stringify(map));
-    if (out !== code) await writeFile(bundle.js, out);
+    if (mapDirty) await writeFile2(bundle.map, JSON.stringify(map));
+    if (out !== code) await writeFile2(bundle.js, out);
   }
   return { ...base, debugId, status: changed ? "injected" : "unchanged" };
 }
@@ -215,7 +261,9 @@ async function injectDir(dir, options = {}) {
 
 // src/upload.ts
 import { createHash as createHash2 } from "crypto";
-import { readFile as readFile3, rm, writeFile as writeFile2 } from "fs/promises";
+import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { promisify } from "util";
+import { gzip as gzipCallback } from "zlib";
 
 // src/release.ts
 import { execFileSync } from "child_process";
@@ -261,9 +309,385 @@ function resolveRelease(explicit, env = process.env, cwd = process.cwd()) {
   );
 }
 
+// src/scopes.ts
+import { parse } from "acorn";
+var SCOPES_KEY = "x_autter_scopes";
+var SCOPES_VERSION = 1;
+var BASE_OPTIONS = {
+  ecmaVersion: "latest",
+  allowHashBang: true,
+  allowReturnOutsideFunction: true,
+  allowReserved: true
+};
+function parseBundle(code) {
+  try {
+    return parse(code, {
+      ...BASE_OPTIONS,
+      sourceType: "module",
+      allowAwaitOutsideFunction: true,
+      allowImportExportEverywhere: true
+    });
+  } catch (moduleError) {
+    try {
+      return parse(code, { ...BASE_OPTIONS, sourceType: "script" });
+    } catch (scriptError) {
+      const pos = (err) => typeof err.pos === "number" ? err.pos : -1;
+      throw pos(scriptError) > pos(moduleError) ? scriptError : moduleError;
+    }
+  }
+}
+function isNode(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+var IDENTIFIER_NAME_RE = /^[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*$/u;
+function identifierToken(node) {
+  if (!isNode(node)) return null;
+  if (node.type === "Identifier") return { offset: node.start, name: node.name, literal: false };
+  if (node.type === "PrivateIdentifier") return { offset: node.start, name: `#${node.name}`, literal: false };
+  return null;
+}
+function literalToken(node) {
+  if (!isNode(node) || node.type !== "Literal" || typeof node.value !== "string") return null;
+  return IDENTIFIER_NAME_RE.test(node.value) ? { offset: node.start, name: node.value, literal: true } : null;
+}
+function keyToken(property) {
+  if (!property.computed) {
+    const id = identifierToken(property.key);
+    if (id) return id;
+  }
+  return literalToken(property.key);
+}
+function bindingToken(target) {
+  if (!isNode(target)) return null;
+  if (target.type === "Identifier") return identifierToken(target);
+  if (target.type === "MemberExpression") {
+    return target.computed ? literalToken(target.property) : identifierToken(target.property);
+  }
+  return null;
+}
+function contextTokens(node, parent) {
+  let token = null;
+  switch (parent?.type) {
+    case "VariableDeclarator":
+      if (parent.init === node) token = bindingToken(parent.id);
+      break;
+    case "AssignmentExpression":
+    case "AssignmentPattern":
+      if (parent.right === node) token = bindingToken(parent.left);
+      break;
+    case "Property":
+    case "PropertyDefinition":
+    case "MethodDefinition":
+      if (parent.value === node) token = keyToken(parent);
+      break;
+  }
+  return token ? [token] : [];
+}
+function classTokens(path) {
+  if (!path || path.node.type !== "ClassDeclaration" && path.node.type !== "ClassExpression") return [];
+  const own = identifierToken(path.node.id);
+  return [...own ? [own] : [], ...contextTokens(path.node, path.parent?.node)];
+}
+function describe(path) {
+  const fn = path.node;
+  const parent = path.parent?.node;
+  const own = identifierToken(fn.id);
+  const isMethod = parent?.type === "MethodDefinition" || parent?.type === "Property" && parent.value === fn && (parent.method === true || parent.kind !== "init");
+  let context;
+  if (parent?.type === "MethodDefinition" && parent.kind === "constructor") {
+    context = classTokens(path.parent?.parent?.parent ?? null);
+  } else {
+    context = contextTokens(fn, parent);
+  }
+  return {
+    start: fn.start,
+    end: fn.end,
+    own,
+    recoverAt: !own && fn.type !== "ArrowFunctionExpression" && !isMethod ? fn.start : null,
+    context
+  };
+}
+var FUNCTION_TYPES = /* @__PURE__ */ new Set(["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"]);
+function classInitializer(path) {
+  const node = path.node;
+  let range = null;
+  if (node.type === "StaticBlock") range = node;
+  else if (node.type === "PropertyDefinition" && isNode(node.value) && !FUNCTION_TYPES.has(node.value.type)) range = node.value;
+  if (!range) return null;
+  return { start: range.start, end: range.end, own: null, recoverAt: null, context: classTokens(path.parent?.parent ?? null) };
+}
+function collectFunctions(program) {
+  const found = [];
+  const stack = [{ node: program, parent: null }];
+  for (let path = stack.pop(); path; path = stack.pop()) {
+    const node = path.node;
+    if (FUNCTION_TYPES.has(node.type)) found.push(describe(path));
+    else {
+      const initializer = classInitializer(path);
+      if (initializer) found.push(initializer);
+    }
+    for (const key in node) {
+      const value = node[key];
+      if (Array.isArray(value)) {
+        for (let i = value.length - 1; i >= 0; i--) if (isNode(value[i])) stack.push({ node: value[i], parent: path });
+      } else if (isNode(value)) {
+        stack.push({ node: value, parent: path });
+      }
+    }
+  }
+  return found;
+}
+function lineStarts(code) {
+  const starts = [0];
+  for (let i = 0; i < code.length; i++) {
+    const c = code.charCodeAt(i);
+    if (c === 10 || c === 8232 || c === 8233) starts.push(i + 1);
+    else if (c === 13) {
+      if (code.charCodeAt(i + 1) === 10) i++;
+      starts.push(i + 1);
+    }
+  }
+  return starts;
+}
+function positionOf(starts, offset) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (starts[mid] <= offset) lo = mid;
+    else hi = mid - 1;
+  }
+  return [lo, offset - starts[lo]];
+}
+var BASE64 = new Int8Array(128).fill(-1);
+for (const [i, ch] of [..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"].entries()) BASE64[ch.charCodeAt(0)] = i;
+function findSegments(mappings, wanted) {
+  let line = 0;
+  let column = 0;
+  let source = 0;
+  let originalLine = 0;
+  let originalColumn = 0;
+  let name = 0;
+  let want = wanted.get(0);
+  const fields = [0, 0, 0, 0, 0];
+  let i = 0;
+  while (i < mappings.length) {
+    const ch = mappings.charCodeAt(i);
+    if (ch === 59) {
+      line++;
+      column = 0;
+      want = wanted.get(line);
+      i++;
+      continue;
+    }
+    if (ch === 44) {
+      i++;
+      continue;
+    }
+    let count = 0;
+    while (i < mappings.length) {
+      const next = mappings.charCodeAt(i);
+      if (next === 44 || next === 59) break;
+      let value = 0;
+      let shift = 0;
+      let digit;
+      do {
+        const code = mappings.charCodeAt(i++);
+        digit = code < 128 ? BASE64[code] : -1;
+        if (digit < 0 || shift > 30) throw new Error("invalid mappings");
+        value |= (digit & 31) << shift;
+        shift += 5;
+      } while (digit & 32);
+      const decoded = value & 1 ? -(value >>> 1) : value >>> 1;
+      if (count < 5) fields[count] = decoded;
+      count++;
+    }
+    column += fields[0];
+    if (count >= 4) {
+      source += fields[1];
+      originalLine += fields[2];
+      originalColumn += fields[3];
+    }
+    if (count >= 5) name += fields[4];
+    if (want && want.get(column) === null) {
+      want.set(column, {
+        source: count >= 4 ? source : -1,
+        line: originalLine,
+        column: originalColumn,
+        name: count >= 5 ? name : -1
+      });
+    }
+  }
+}
+function looksMangled(name) {
+  return name.replace(/^#/, "").length <= 2;
+}
+var IDENTIFIER_AT_RE = /[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*/uy;
+var OWN_NAME_AT_RE = /(?:async\s+)?function\b\s*\*?\s*([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)/uy;
+var NOT_A_NAME = new Set(
+  "abstract async await break case catch class const continue debugger declare default delete do else enum export extends false finally for function get if implements import in instanceof interface let new null of override package private protected public readonly return set static super switch this throw true try typeof var void while with yield".split(" ")
+);
+var NameResolver = class {
+  constructor(map, segmentAt) {
+    this.segmentAt = segmentAt;
+    this.names = Array.isArray(map.names) ? map.names : [];
+    this.sourcesContent = Array.isArray(map.sourcesContent) ? map.sourcesContent : [];
+  }
+  segmentAt;
+  names;
+  sourcesContent;
+  sourceLines = /* @__PURE__ */ new Map();
+  originalLine(segment) {
+    if (segment.source < 0) return null;
+    let lines = this.sourceLines.get(segment.source);
+    if (lines === void 0) {
+      const content = this.sourcesContent[segment.source];
+      lines = typeof content === "string" ? content.split(/\r\n|[\n\r\u2028\u2029]/) : null;
+      this.sourceLines.set(segment.source, lines);
+    }
+    return lines?.[segment.line] ?? null;
+  }
+  /** The original identifier at a segment's source position. */
+  identifierAt(segment, re, group = 0) {
+    const text = this.originalLine(segment);
+    if (text === null) return null;
+    re.lastIndex = segment.column;
+    const found = re.exec(text)?.[group];
+    return found && !NOT_A_NAME.has(found) ? found : null;
+  }
+  /** Original name of a token: the map's `names` at its exact position;
+   * else the generated name when it isn't mangled; else the identifier
+   * at the mapped position in `sourcesContent`. Null when unknown. */
+  resolve(token) {
+    if (token.literal) return token.name;
+    const segment = this.segmentAt(token.offset);
+    if (segment && segment.name >= 0) {
+      const name = this.names[segment.name];
+      if (typeof name === "string" && name) return name;
+    }
+    if (!looksMangled(token.name)) return token.name;
+    return segment ? this.identifierAt(segment, IDENTIFIER_AT_RE) : null;
+  }
+  /** The name a minifier removed from `function name() {}`, read from the
+   * original source at the function's mapped start. */
+  recover(offset) {
+    const segment = this.segmentAt(offset);
+    return segment ? this.identifierAt(segment, OWN_NAME_AT_RE, 1) : null;
+  }
+};
+var BASE64_DIGITS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function vlq(value) {
+  let rest = value < 0 ? -value << 1 | 1 : value << 1;
+  let out = "";
+  do {
+    let digit = rest & 31;
+    rest >>>= 5;
+    if (rest > 0) digit |= 32;
+    out += BASE64_DIGITS[digit];
+  } while (rest > 0);
+  return out;
+}
+function encodeScopes(entries) {
+  const parts = [];
+  let line = 0;
+  let previousStart = 0;
+  let previousName = 0;
+  let firstOnLine = true;
+  for (const [startLine, startColumn, endLine, endColumn, nameIndex] of entries) {
+    if (startLine > line) {
+      parts.push(";".repeat(startLine - line));
+      line = startLine;
+      previousStart = 0;
+      firstOnLine = true;
+    }
+    if (!firstOnLine) parts.push(",");
+    firstOnLine = false;
+    let segment = vlq(startColumn - previousStart) + vlq(endLine - startLine) + vlq(endLine === startLine ? endColumn - startColumn : endColumn);
+    previousStart = startColumn;
+    if (nameIndex >= 0) {
+      segment += vlq(nameIndex - previousName);
+      previousName = nameIndex;
+    }
+    parts.push(segment);
+  }
+  return parts.join("");
+}
+function computeScopes(code, map) {
+  try {
+    return scopesOf(code, map);
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function scopesOf(code, map) {
+  if (typeof map.mappings !== "string") return { error: "the map has no mappings string" };
+  let functions;
+  try {
+    functions = collectFunctions(parseBundle(code));
+  } catch (err) {
+    return { error: `could not parse the bundle: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  const starts = lineStarts(code);
+  const wanted = /* @__PURE__ */ new Map();
+  const want = (offset) => {
+    const [line, column] = positionOf(starts, offset);
+    let columns = wanted.get(line);
+    if (!columns) wanted.set(line, columns = /* @__PURE__ */ new Map());
+    columns.set(column, null);
+  };
+  for (const fn of functions) {
+    if (fn.own && !fn.own.literal) want(fn.own.offset);
+    if (fn.recoverAt !== null) want(fn.recoverAt);
+    for (const token of fn.context) if (!token.literal) want(token.offset);
+  }
+  try {
+    findSegments(map.mappings, wanted);
+  } catch (err) {
+    return { error: `could not read the map: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  const resolver = new NameResolver(map, (offset) => {
+    const [line, column] = positionOf(starts, offset);
+    return wanted.get(line)?.get(column) ?? null;
+  });
+  functions.sort((a, b) => a.start - b.start || b.end - a.end);
+  const mapNames = Array.isArray(map.names) ? map.names : [];
+  const nameIndex = /* @__PURE__ */ new Map();
+  mapNames.forEach((name, index) => {
+    if (typeof name === "string" && !nameIndex.has(name)) nameIndex.set(name, index);
+  });
+  const extraNames = [];
+  const indexOf = (name) => {
+    let index = nameIndex.get(name);
+    if (index === void 0) {
+      index = mapNames.length + extraNames.push(name) - 1;
+      nameIndex.set(name, index);
+    }
+    return index;
+  };
+  const entries = functions.map((fn) => {
+    let name = fn.own ? resolver.resolve(fn.own) : null;
+    if (name === null && fn.recoverAt !== null) name = resolver.recover(fn.recoverAt);
+    for (const token of fn.context) {
+      if (name !== null) break;
+      name = resolver.resolve(token);
+    }
+    const index = name !== null ? indexOf(name) : fn.own || fn.context.length > 0 ? indexOf(null) : -1;
+    const [startLine, startColumn] = positionOf(starts, fn.start);
+    const [endLine, endColumn] = positionOf(starts, fn.end);
+    return [startLine, startColumn, endLine, endColumn, index];
+  });
+  return { scopes: { version: SCOPES_VERSION, names: extraNames, scopes: encodeScopes(entries) } };
+}
+
 // src/upload.ts
 var DEFAULT_ENDPOINT = "https://otlp.autter.dev";
-var MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+var MAX_MAP_CHARS = 32 * 1024 * 1024;
+var MAX_UPLOAD_BYTES = MAX_MAP_CHARS + 1024 * 1024;
+var LEGACY_MAX_BYTES = 5 * 1024 * 1024;
+var UPLOAD_KEY_PREFIX = "autter_rtu_";
+var CLIENT_KEY_PREFIX = "autter_rtc_";
+var KEY_ADVICE = "set AUTTER_RUNTIME_KEY to an upload-only key (autter_rtu_\u2026, recommended for CI: it can only upload source maps) or the full server key (autter_rt_\u2026, also works)";
+var gzip = promisify(gzipCallback);
 var CHECK_BATCH = 500;
 var MAX_ATTEMPTS = 3;
 function resolveEndpoint(flag, env = process.env) {
@@ -280,7 +704,16 @@ function storedMapJson(map) {
   const { sourcesContent: _omitted, ...safe } = map;
   return JSON.stringify(safe);
 }
-async function prepare(bundle, urlPrefix, release) {
+function bytesOf(buffer) {
+  return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+}
+function fits(json, body) {
+  return json.length <= MAX_MAP_CHARS && Buffer.byteLength(body) <= MAX_UPLOAD_BYTES;
+}
+function uploadBody(release, filename, debugId, json) {
+  return `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
+}
+async function prepare(bundle, urlPrefix, release, log, compress) {
   let map;
   try {
     map = JSON.parse(await readFile3(bundle.map, "utf8"));
@@ -292,23 +725,37 @@ async function prepare(bundle, urlPrefix, release) {
   }
   const code = await readFile3(bundle.js, "utf8");
   const debugId = readDebugIdComment(code) ?? normalizeDebugId(map.debugId);
-  const json = storedMapJson(map);
   const filename = servedFilename(urlPrefix, bundle.path);
-  const body = `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
+  const { [SCOPES_KEY]: _stale, ...plain } = map;
+  const scopes = computeScopes(code, map);
+  let json = storedMapJson(plain);
+  if ("scopes" in scopes) {
+    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes });
+    if (fits(scoped, uploadBody(release, filename, debugId, scoped))) json = scoped;
+    else if (fits(json, uploadBody(release, filename, debugId, json))) {
+      log(`warning: ${bundle.path}: its map is over 32 MB with function scopes, so it is uploaded without them (frames keep call-site names)`);
+    }
+  } else {
+    log(`warning: ${bundle.path}: no function scopes (${scopes.error}); its map is uploaded without them (frames keep call-site names)`);
+  }
+  const body = uploadBody(release, filename, debugId, json);
   return {
     bundle,
-    body,
+    // Maps are text that compresses several times over; the ingester
+    // inflates the body (Content-Encoding: gzip).
+    body: compress && fits(json, body) ? bytesOf(await gzip(body)) : new Uint8Array(0),
     path: bundle.path,
     filename,
     debugId,
     hash: createHash2("sha256").update(json).digest("hex"),
-    bytes: Buffer.byteLength(body)
+    bytes: Buffer.byteLength(body),
+    mapChars: json.length
   };
 }
 var FatalUploadError = class extends Error {
 };
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 async function uploadDir(dir, options = {}) {
   const env = options.env ?? process.env;
@@ -330,14 +777,14 @@ async function uploadDir(dir, options = {}) {
   };
   const items = [];
   for (const bundle of await findBundles(dir, options.files)) {
-    const prepared = await prepare(bundle, options.urlPrefix, release);
+    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun);
     if ("error" in prepared) {
       summary.failed.push({ path: bundle.path, filename: servedFilename(options.urlPrefix, bundle.path), error: prepared.error });
-    } else if (prepared.bytes > MAX_UPLOAD_BYTES) {
+    } else if (prepared.mapChars > MAX_MAP_CHARS || prepared.bytes > MAX_UPLOAD_BYTES) {
       summary.failed.push({
         path: prepared.path,
         filename: prepared.filename,
-        error: `map is ${(prepared.bytes / 1048576).toFixed(1)} MB without sourcesContent; the ingester accepts up to 5 MB`
+        error: `map is ${(prepared.mapChars / 1048576).toFixed(1)} MB without sourcesContent; the ingester accepts up to 32 MB`
       });
     } else {
       items.push(prepared);
@@ -348,11 +795,15 @@ async function uploadDir(dir, options = {}) {
     return summary;
   }
   const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
-  if (!key) throw new FatalUploadError("no ingest key: set AUTTER_RUNTIME_KEY to a server key (autter_rt_\u2026)");
-  if (key.startsWith("autter_rtc_")) {
-    throw new FatalUploadError("AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026); uploads need a server key (autter_rt_\u2026)");
+  if (!key) throw new FatalUploadError(`no ingest key: ${KEY_ADVICE}`);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    throw new FatalUploadError(`AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which cannot upload source maps: ${KEY_ADVICE}`);
   }
+  const rejected = (status, detail) => new FatalUploadError(
+    `the ingester rejected the key (${status}): ${detail}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later; the server key works with any)" : "")
+  );
   const headers = { "content-type": "application/json", authorization: `Bearer ${key}` };
+  const uploadHeaders = { ...headers, "content-encoding": "gzip" };
   const skipped = /* @__PURE__ */ new Set();
   for (let start = 0; start < items.length && !summary.legacyIngester; start += CHECK_BATCH) {
     const batch = items.slice(start, start + CHECK_BATCH);
@@ -372,9 +823,7 @@ async function uploadDir(dir, options = {}) {
         );
         break;
       }
-      if (res.status === 401 || res.status === 403) {
-        throw new FatalUploadError(`the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}`);
-      }
+      if (res.status === 401 || res.status === 403) throw rejected(res.status, (await res.text()).slice(0, 300));
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const body = await res.json();
       const present = new Set(Array.isArray(body.present) ? body.present : []);
@@ -394,7 +843,7 @@ async function uploadDir(dir, options = {}) {
       let status = 0;
       let detail = "";
       try {
-        const res = await doFetch(`${endpoint}/v1/sourcemaps`, { method: "POST", headers, body: item.body });
+        const res = await doFetch(`${endpoint}/v1/sourcemaps`, { method: "POST", headers: uploadHeaders, body: item.body });
         status = res.status;
         if (res.ok) {
           uploaded.push(item);
@@ -405,12 +854,16 @@ async function uploadDir(dir, options = {}) {
         detail = err.message;
       }
       if (status === 401 || status === 403) {
-        fatal = new FatalUploadError(`the ingester rejected the key (${status}): ${detail}`);
+        fatal = rejected(status, detail);
         return;
       }
       const retryable = status === 0 || status === 429 || status >= 500;
       if (!retryable || attempt >= MAX_ATTEMPTS) {
-        summary.failed.push({ path: item.path, filename: item.filename, error: status ? `HTTP ${status}: ${detail}` : detail });
+        let error = status ? `HTTP ${status}: ${detail}` : detail;
+        if (status === 413 && item.bytes > LEGACY_MAX_BYTES) {
+          error += ` (this map is ${(item.bytes / 1048576).toFixed(1)} MB; ingester 1.6.0 and older accept up to 5 MB, newer ones 32 MB)`;
+        }
+        summary.failed.push({ path: item.path, filename: item.filename, error });
         return;
       }
       await sleep(500 * 2 ** (attempt - 1));
@@ -426,10 +879,10 @@ async function uploadDir(dir, options = {}) {
   uploaded.sort(order);
   if (options.deleteAfterUpload) {
     for (const item of [...uploaded, ...skipped]) {
-      await rm(item.bundle.map, { force: true });
+      await rm2(item.bundle.map, { force: true });
       const code = await readFile3(item.bundle.js, "utf8");
       const stripped = stripSourceMappingUrl(code);
-      if (stripped !== code) await writeFile2(item.bundle.js, stripped);
+      if (stripped !== code) await writeFile3(item.bundle.js, stripped);
       summary.deletedMaps.push(item.bundle.map);
     }
   }
@@ -457,99 +910,1859 @@ function formatUploadSummary(summary) {
   return lines;
 }
 
-// src/cli.ts
-var USAGE = `autter-runtime \u2014 readable stack traces for Autter Runtime
-
-Usage:
-  autter-runtime sourcemaps inject <dir> [--dry-run]
-  autter-runtime sourcemaps upload <dir> [--release <r>] [--url-prefix <prefix>]
-                [--endpoint <url>] [--concurrency <n>] [--delete-after-upload] [--dry-run]
-  autter-runtime doctor ...      (provided by @autter/runtime-node)
-
-inject  Gives every .js/.mjs/.cjs bundle that has a source map a debug id
-        derived from its bytes: a "//# debugId=" comment, a one-line snippet
-        that registers it for @autter/runtime-browser, and "debugId" in the
-        .map. Running it again changes nothing.
-upload  Sends every map to <endpoint>/v1/sourcemaps with AUTTER_RUNTIME_KEY,
-        in parallel, skipping maps the ingester already has.
+// src/setup.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join3 } from "path";
 
-Options:
-  --release <r>          Default: $GITHUB_SHA, $VERCEL_GIT_COMMIT_SHA,
-                         $CF_PAGES_COMMIT_SHA, $GIT_SHA, then git rev-parse HEAD
-  --url-prefix <prefix>  Where <dir> is served from: "/" (default), "/static/",
-                         or "https://cdn.example.com/app/"
-  --endpoint <url>       Ingester base URL. Default: $AUTTER_ENDPOINT,
-                         $AUTTER_RUNTIME_ENDPOINT, $OTEL_EXPORTER_OTLP_ENDPOINT,
-                         then https://otlp.autter.dev
-  --concurrency <n>      Parallel uploads (default 8)
-  --delete-after-upload  Delete each .map once the ingester has it
-  --dry-run              Show what would change or be uploaded; write and send nothing
-  --json                 Print the result as JSON
-  -h, --help             Show this help
-  -v, --version          Print the version
+// src/setup-detect.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync3, readdirSync, readFileSync, statSync } from "fs";
+import { dirname as dirname2, join as join2, relative as relative3, resolve as resolve2, sep as sep3 } from "path";
 
-Environment:
-  AUTTER_RUNTIME_KEY     Server ingest key (autter_rt_\u2026), required by upload`;
-function ownVersion() {
-  try {
-    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
-  } catch {
-    return "unknown";
+// src/setup-edit.ts
+import { Parser } from "acorn";
+import { tsPlugin } from "@sveltejs/acorn-typescript";
+var TsParser = Parser.extend(tsPlugin());
+var isTypeScriptFile = (file) => /\.[cm]?tsx?$/.test(file);
+function parseFile(code, file) {
+  const parser = isTypeScriptFile(file) ? TsParser : Parser;
+  for (const sourceType of ["module", "script"]) {
+    const comments = [];
+    try {
+      const ast = parser.parse(code, {
+        ecmaVersion: "latest",
+        sourceType,
+        locations: true,
+        allowHashBang: true,
+        onComment: (_block, _text, start, end) => comments.push({ start, end })
+      });
+      ast.comments = comments;
+      return ast;
+    } catch {
+    }
   }
+  return null;
 }
-function delegate(pkg, args) {
-  let manifest;
-  try {
-    manifest = createRequire(join2(process.cwd(), "package.json")).resolve(`${pkg}/package.json`);
-  } catch {
-    return null;
+function walk2(node, visit) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const child of node) walk2(child, visit);
+    return;
+  }
+  const n = node;
+  if (typeof n.type !== "string") return;
+  visit(n);
+  for (const key of Object.keys(n)) {
+    if (key === "loc" || key === "range" || key === "start" || key === "end") continue;
+    const value = n[key];
+    if (value && typeof value === "object") walk2(value, visit);
   }
-  const bin = JSON.parse(readFileSync(manifest, "utf8")).bin;
-  const relative2 = typeof bin === "string" ? bin : bin?.["autter-runtime"];
-  if (!relative2) return null;
-  const script = resolve2(dirname2(manifest), relative2);
-  if (!existsSync2(script)) return null;
-  const result = spawnSync(process.execPath, [script, ...args], { stdio: "inherit" });
-  return result.status ?? 1;
 }
-var SOURCEMAPS_OPTIONS = {
-  release: { type: "string" },
-  "url-prefix": { type: "string" },
-  endpoint: { type: "string" },
-  concurrency: { type: "string" },
-  "delete-after-upload": { type: "boolean" },
-  "dry-run": { type: "boolean" },
-  json: { type: "boolean" },
-  help: { type: "boolean", short: "h" }
-};
-async function sourcemaps(argv) {
-  let parsed;
-  try {
-    parsed = parseArgs({ args: argv, allowPositionals: true, options: SOURCEMAPS_OPTIONS });
-  } catch (err) {
-    console.error(`${err.message}
-
-${USAGE}`);
-    return 64;
+var TS_WRAPPERS = /* @__PURE__ */ new Set(["TSAsExpression", "TSSatisfiesExpression", "TSNonNullExpression", "TSTypeAssertion", "ParenthesizedExpression"]);
+function unwrap(node) {
+  let n = node ?? null;
+  while (n && TS_WRAPPERS.has(n.type)) n = n.expression;
+  return n;
+}
+var isModuleExports = (node) => !!node && node.type === "MemberExpression" && !node.computed && node.object?.type === "Identifier" && node.object.name === "module" && node.property?.type === "Identifier" && node.property.name === "exports";
+function findExport(ast) {
+  const sites = [];
+  for (const statement of ast.body) {
+    if (statement.type === "ExportDefaultDeclaration") {
+      const declaration = statement.declaration;
+      if (declaration.type === "FunctionDeclaration" || declaration.type === "ClassDeclaration") {
+        return { error: "the default export is a function or class declaration" };
+      }
+      sites.push({ kind: "esm", expr: declaration });
+    } else if (statement.type === "ExpressionStatement" && statement.expression.type === "AssignmentExpression" && statement.expression.operator === "=" && isModuleExports(statement.expression.left)) {
+      sites.push({ kind: "cjs", expr: statement.expression.right });
+    }
   }
-  const { values, positionals } = parsed;
-  const [action, dir, ...extra] = positionals;
-  if (values.help) {
-    console.log(USAGE);
-    return 0;
+  if (sites.length === 0) return { error: "no `export default` or `module.exports =` found" };
+  if (sites.length > 1) return { error: "the config is exported more than once" };
+  return sites[0];
+}
+function resolveBinding(ast, name) {
+  let init = null;
+  for (const statement of ast.body) {
+    const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+    if (declaration?.type !== "VariableDeclaration") continue;
+    for (const declarator of declaration.declarations) {
+      if (declarator.id?.type === "Identifier" && declarator.id.name === name) init = declarator.init ?? null;
+    }
   }
-  if (action !== "inject" && action !== "upload" || !dir || extra.length) {
-    console.error(`${action && action !== "inject" && action !== "upload" ? `unknown command: sourcemaps ${action}
-
-` : ""}${USAGE}`);
-    return 64;
+  if (!init) return null;
+  let reassigned = false;
+  walk2(ast, (node) => {
+    if (node.type === "AssignmentExpression" && node.left?.type === "Identifier" && node.left.name === name) reassigned = true;
+  });
+  return reassigned ? null : init;
+}
+function returnedObject(fn) {
+  const body = fn.body;
+  if (body.type !== "BlockStatement") {
+    const value2 = unwrap(body);
+    return value2?.type === "ObjectExpression" ? value2 : null;
   }
-  if (!existsSync2(dir)) {
-    console.error(`autter-runtime: ${dir} does not exist`);
-    return 64;
+  const returns = [];
+  walk2(body, (node) => {
+    if (node.type === "ReturnStatement") returns.push(node);
+  });
+  if (returns.length !== 1) return null;
+  const last = body.body.at(-1);
+  if (last !== returns[0]) return null;
+  const value = unwrap(returns[0].argument);
+  return value?.type === "ObjectExpression" ? value : null;
+}
+function configObject(ast, expr, depth = 0) {
+  const node = unwrap(expr);
+  if (!node || depth > 4) return null;
+  switch (node.type) {
+    case "ObjectExpression":
+      return node;
+    case "Identifier": {
+      const init = resolveBinding(ast, node.name);
+      return init ? configObject(ast, init, depth + 1) : null;
+    }
+    case "CallExpression":
+      if (node.callee?.type === "Identifier" && /^define\w*Config$/.test(node.callee.name) && node.arguments.length === 1) {
+        return configObject(ast, node.arguments[0], depth + 1);
+      }
+      return null;
+    case "ArrowFunctionExpression":
+    case "FunctionExpression":
+      return returnedObject(node);
+    default:
+      return null;
   }
-  const dryRun = Boolean(values["dry-run"]);
-  if (action === "inject") {
+}
+function findProperty(obj, name) {
+  const matches = obj.properties.filter(
+    (p) => p.type === "Property" && !p.computed && (p.key.type === "Identifier" && p.key.name === name || p.key.type === "Literal" && p.key.value === name)
+  );
+  if (matches.length > 1) return "ambiguous";
+  const [match] = matches;
+  if (!match) return null;
+  if (match.kind !== "init" || match.method) return "ambiguous";
+  return match;
+}
+function literalProperty(obj, path) {
+  let node = obj;
+  for (const [i, name] of path.entries()) {
+    if (!node || node.type !== "ObjectExpression") return void 0;
+    const property = findProperty(node, name);
+    if (!property || property === "ambiguous") return void 0;
+    node = unwrap(property.value);
+    if (i === path.length - 1) {
+      if (node?.type === "Literal" && (typeof node.value !== "object" || node.value === null)) return node.value;
+      if (node?.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0].value.cooked;
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function applyEdits(code, edits) {
+  let out = code;
+  for (const edit of [...edits].sort((a, b) => b.start - a.start)) out = `${out.slice(0, edit.start)}${edit.text}${out.slice(edit.end)}`;
+  return out;
+}
+function lineIndent(code, pos) {
+  const lineStart = code.lastIndexOf("\n", pos - 1) + 1;
+  return /^[ \t]*/.exec(code.slice(lineStart))[0];
+}
+var spansLines = (code, node) => code.slice(node.start, node.end).includes("\n");
+function appendAfter(code, container, last, text) {
+  if (!spansLines(code, container)) return { start: last.end, end: last.end, text: `, ${text}` };
+  const indent = lineIndent(code, last.start);
+  const trailing = /^[^\S\n]*,[^\S\n]*(?:\/\/[^\n]*|\/\*[^\n]*?\*\/)?[^\S\n]*(?=\n)/.exec(code.slice(last.end, container.end));
+  if (trailing) {
+    const at = last.end + trailing[0].length;
+    return { start: at, end: at, text: `
+${indent}${text},` };
+  }
+  return { start: last.end, end: last.end, text: `,
+${indent}${text}` };
+}
+function appendElement(code, array, text) {
+  const elements = array.elements.filter((e) => !!e);
+  const last = elements.at(-1);
+  if (!last) {
+    const inner = code.slice(array.start + 1, array.end - 1);
+    return inner.trim() === "" ? { start: array.start + 1, end: array.end - 1, text } : { start: array.end - 1, end: array.end - 1, text };
+  }
+  return appendAfter(code, array, last, text);
+}
+function appendProperty(code, obj, text) {
+  const last = obj.properties.at(-1);
+  if (!last) {
+    if (code.slice(obj.start + 1, obj.end - 1).trim() !== "") return null;
+    return { start: obj.start, end: obj.end, text: `{ ${text} }` };
+  }
+  return appendAfter(code, obj, last, text);
+}
+function addPluginEdit(code, obj, element, container) {
+  let target = obj;
+  if (container) {
+    const property = findProperty(obj, container);
+    if (property === "ambiguous") return { error: `\`${container}\` is defined more than once or as a method` };
+    if (!property) {
+      if (obj.properties.some((p) => p.type === "SpreadElement")) {
+        return { error: `the config spreads another object, which may already set \`${container}\`` };
+      }
+      return appendProperty(code, obj, `${container}: { plugins: [${element}] }`) ?? { error: "the config object holds only comments" };
+    }
+    const value2 = unwrap(property.value);
+    if (value2?.type !== "ObjectExpression") return { error: `\`${container}\` is not an object literal` };
+    target = value2;
+  }
+  const plugins = findProperty(target, "plugins");
+  if (plugins === "ambiguous") return { error: "`plugins` is defined more than once or as a method" };
+  if (!plugins) {
+    if (target.properties.some((p) => p.type === "SpreadElement")) {
+      return { error: "the config spreads another object, which may already set `plugins`" };
+    }
+    return appendProperty(code, target, `plugins: [${element}]`) ?? { error: "the config object holds only comments" };
+  }
+  const value = unwrap(plugins.value);
+  if (value?.type !== "ArrayExpression") return { error: "`plugins` is not an array literal" };
+  return appendElement(code, value, element);
+}
+function requireCall(init) {
+  let node = unwrap(init);
+  while (node) {
+    if (node.type === "CallExpression") {
+      if (node.callee?.type === "Identifier" && node.callee.name === "require") return node;
+      node = unwrap(node.callee);
+    } else if (node.type === "MemberExpression") node = unwrap(node.object);
+    else return null;
+  }
+  return null;
+}
+function importEdit(code, ast, name, spec, kind) {
+  const body = ast.body;
+  let last;
+  let source = null;
+  if (kind === "esm") {
+    last = body.filter((s) => s.type === "ImportDeclaration").at(-1);
+    source = last?.source ?? null;
+  } else {
+    last = body.filter((s) => s.type === "VariableDeclaration" && s.declarations.every((d) => requireCall(d.init))).at(-1);
+    source = last ? requireCall(last.declarations[0].init)?.arguments[0] ?? null : null;
+  }
+  const quote = source && code[source.start] === "'" ? "'" : '"';
+  const semi = last ? code[last.end - 1] === ";" ? ";" : "" : ";";
+  const line = kind === "esm" ? `import { ${name} } from ${quote}${spec}${quote}${semi}` : `const { ${name} } = require(${quote}${spec}${quote})${semi}`;
+  if (last) return { start: last.end, end: last.end, text: `
+${line}` };
+  const first = body.find((s) => !(s.type === "ExpressionStatement" && typeof s.directive === "string"));
+  if (!first) return { start: code.length, end: code.length, text: `${code.endsWith("\n") || !code ? "" : "\n"}${line}
+` };
+  let at = first.start;
+  const comments = (ast.comments ?? []).filter((c) => c.end <= first.start);
+  for (let i = comments.length - 1; i >= 0; i--) {
+    const gap = code.slice(comments[i].end, at);
+    if (gap.trim() !== "" || (gap.match(/\n/g) ?? []).length > 1) break;
+    at = comments[i].start;
+  }
+  at = code.lastIndexOf("\n", at - 1) + 1;
+  return { start: at, end: at, text: `${line}
+
+` };
+}
+function calls(ast, name) {
+  const found = [];
+  walk2(ast, (node) => {
+    if ((node.type === "CallExpression" || node.type === "NewExpression") && node.callee?.type === "Identifier" && node.callee.name === name) {
+      found.push(node);
+    }
+  });
+  return found;
+}
+function finish(original, file, edits, name) {
+  const code = applyEdits(original, edits);
+  const ast = parseFile(code, file);
+  if (!ast || calls(ast, name).length === 0) return { status: "manual", reason: "the edited file did not parse back as expected" };
+  return { status: "edited", code };
+}
+function addBundlerPlugin(code, file, plugin) {
+  const ast = parseFile(code, file);
+  if (!ast) return { status: "manual", reason: `${file} does not parse as ${isTypeScriptFile(file) ? "TypeScript" : "JavaScript"}` };
+  if (calls(ast, plugin.name).length) return { status: "already" };
+  if (code.includes(plugin.spec)) return { status: "manual", reason: `${file} imports ${plugin.spec} but never uses ${plugin.name}` };
+  const site = findExport(ast);
+  if ("error" in site) return { status: "manual", reason: site.error };
+  const obj = configObject(ast, site.expr);
+  if (!obj) return { status: "manual", reason: "the exported config is not an object literal, a define\u2026Config({...}) call, a variable holding one, or a function returning one" };
+  const edit = addPluginEdit(code, obj, plugin.element, plugin.container);
+  if ("error" in edit) return { status: "manual", reason: edit.error };
+  return finish(code, file, [edit, importEdit(code, ast, plugin.name, plugin.spec, site.kind)], plugin.name);
+}
+var NEXT_WRAPPABLE = /* @__PURE__ */ new Set(["ObjectExpression", "Identifier", "CallExpression", "ArrowFunctionExpression", "FunctionExpression", "MemberExpression"]);
+function wrapNextConfig(code, file) {
+  const name = "withAutterSourceMaps";
+  const spec = "@autter/runtime-cli/next";
+  const ast = parseFile(code, file);
+  if (!ast) return { status: "manual", reason: `${file} does not parse as ${isTypeScriptFile(file) ? "TypeScript" : "JavaScript"}` };
+  const site = findExport(ast);
+  const existing = calls(ast, name);
+  if (existing.length) {
+    if (!("error" in site) && unwrap(site.expr) === existing[0]) return { status: "already" };
+    return {
+      status: "manual",
+      reason: `${name} is not the outermost wrapper of the exported config, so other wrappers' webpack and runAfterProductionCompile hooks may not be chained`
+    };
+  }
+  if (code.includes(spec)) return { status: "manual", reason: `${file} imports ${spec} but never calls ${name}` };
+  if ("error" in site) return { status: "manual", reason: site.error };
+  const target = unwrap(site.expr);
+  if (!target || !NEXT_WRAPPABLE.has(target.type)) {
+    return { status: "manual", reason: "the exported config is not an object, a variable, a wrapper call or a function" };
+  }
+  const edits = [
+    { start: site.expr.start, end: site.expr.start, text: `${name}(` },
+    { start: site.expr.end, end: site.expr.end, text: ")" },
+    importEdit(code, ast, name, spec, site.kind)
+  ];
+  return finish(code, file, edits, name);
+}
+function nextConfigObject(ast) {
+  const site = findExport(ast);
+  if ("error" in site) return null;
+  let node = unwrap(site.expr);
+  for (let depth = 0; node && depth < 6; depth++) {
+    const obj = configObject(ast, node);
+    if (obj) return obj;
+    if (node.type === "CallExpression" && node.arguments.length) node = unwrap(node.arguments[0]);
+    else return null;
+  }
+  return null;
+}
+function exportedConfigObject(ast) {
+  const site = findExport(ast);
+  return "error" in site ? null : configObject(ast, site.expr);
+}
+
+// src/setup-detect.ts
+var posix = (path) => path.split(sep3).join("/");
+var rel = (from, to) => posix(relative3(from, to)) || ".";
+function readText(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function readJson(path) {
+  const text = readText(path);
+  if (text === null) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+var firstExisting = (dir, names) => names.find((name) => existsSync3(join2(dir, name))) ?? null;
+function ancestors(dir, stop) {
+  const out = [];
+  for (let current = dir; ; current = dirname2(current)) {
+    out.push(current);
+    if (current === stop || dirname2(current) === current) break;
+  }
+  return out;
+}
+function gitRoot(dir) {
+  for (const current of ancestors(dir, null)) if (existsSync3(join2(current, ".git"))) return current;
+  return null;
+}
+function githubRepo(root) {
+  if (!root) return null;
+  const git = (args) => {
+    try {
+      return execFileSync2("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }).trim();
+    } catch {
+      return "";
+    }
+  };
+  const remotes = git(["remote"]).split("\n").filter(Boolean);
+  for (const remote of remotes.includes("origin") ? ["origin", ...remotes.filter((r) => r !== "origin")] : remotes) {
+    const url = git(["remote", "get-url", remote]);
+    const match = /github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url);
+    if (match) return `${match[1]}/${match[2]}`;
+  }
+  return null;
+}
+function semver(version) {
+  const match = version ? /(\d+)\.(\d+)\.(\d+)/.exec(version) : null;
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+function atLeast(version, minimum) {
+  const a = semver(version);
+  const b = semver(minimum);
+  if (!a) return null;
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+function installedVersion(dir, name) {
+  for (const current of ancestors(dir, null)) {
+    const manifest = readJson(join2(current, "node_modules", ...name.split("/"), "package.json"));
+    if (manifest?.version) return manifest.version;
+  }
+  return null;
+}
+function packageManager(dir, pkg, stop) {
+  for (const current of ancestors(dir, stop)) {
+    const manifest = current === dir ? pkg : readJson(join2(current, "package.json"));
+    const declared = /^(npm|pnpm|yarn|bun)@(\S+)/.exec(manifest?.packageManager ?? "");
+    if (declared) {
+      const name = declared[1];
+      const lockfile2 = lockfileIn(current);
+      return { name, lockfile: lockfile2 ? rel(dir, join2(current, lockfile2)) : null, ...name === "yarn" ? { yarnBerry: !declared[2].startsWith("1.") } : {} };
+    }
+    const lockfile = lockfileIn(current);
+    if (lockfile) {
+      const name = lockfile.startsWith("pnpm") ? "pnpm" : lockfile === "yarn.lock" ? "yarn" : lockfile.startsWith("bun") ? "bun" : "npm";
+      const berry = name === "yarn" && (existsSync3(join2(current, ".yarnrc.yml")) || (readText(join2(current, lockfile)) ?? "").includes("__metadata:"));
+      return { name, lockfile: rel(dir, join2(current, lockfile)), ...name === "yarn" ? { yarnBerry: berry } : {} };
+    }
+  }
+  return { name: "npm", lockfile: null };
+}
+function lockfileIn(dir) {
+  return firstExisting(dir, ["pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb", "package-lock.json", "npm-shrinkwrap.json"]);
+}
+function scriptFlag(script, ...flags) {
+  if (!script) return null;
+  for (const flag of flags) {
+    const match = new RegExp(`(?:^|\\s)${flag.replace(/[-]/g, "\\-")}(?:=|\\s+)(?:"([^"]+)"|'([^']+)'|([^\\s&|;]+))`).exec(script);
+    if (match) return match[1] ?? match[2] ?? match[3] ?? null;
+  }
+  return null;
+}
+var CONFIG_NAMES = {
+  vite: ["vite.config.ts", "vite.config.mts", "vite.config.js", "vite.config.mjs", "vite.config.cts", "vite.config.cjs"],
+  next: ["next.config.ts", "next.config.mts", "next.config.mjs", "next.config.js", "next.config.cjs"],
+  webpack: ["webpack.config.js", "webpack.config.cjs", "webpack.config.mjs", "webpack.config.ts"],
+  rollup: ["rollup.config.js", "rollup.config.mjs", "rollup.config.cjs", "rollup.config.ts"],
+  nuxt: ["nuxt.config.ts", "nuxt.config.js", "nuxt.config.mjs"],
+  astro: ["astro.config.mjs", "astro.config.ts", "astro.config.js", "astro.config.mts", "astro.config.cjs"],
+  "vue-cli": ["vue.config.js", "vue.config.cjs", "vue.config.mjs"],
+  "solid-start": ["app.config.ts", "app.config.js"]
+};
+function buildTool(dir, pkg) {
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const has = (name) => typeof deps[name] === "string";
+  const buildScript = pkg.scripts?.build ?? null;
+  const scriptConfig = (tool2) => {
+    if (!buildScript || !new RegExp(`\\b${tool2}\\b`).test(buildScript)) return null;
+    const file = scriptFlag(buildScript, "--config", "-c");
+    return file && existsSync3(join2(dir, file)) ? file : null;
+  };
+  const tool = (id, framework, config, versionOf) => ({
+    id,
+    framework,
+    config,
+    version: deps[versionOf] ?? null,
+    buildScript
+  });
+  if (has("next")) return tool("next", null, firstExisting(dir, [...CONFIG_NAMES.next]), "next");
+  if (has("react-scripts")) return tool("cra", has("@craco/craco") ? "craco" : null, null, "react-scripts");
+  if (existsSync3(join2(dir, "angular.json")) && (has("@angular/core") || has("@angular/cli"))) {
+    return tool("angular", null, "angular.json", has("@angular/cli") ? "@angular/cli" : "@angular/core");
+  }
+  const viteConfig = scriptConfig("vite") ?? firstExisting(dir, [...CONFIG_NAMES.vite]);
+  if (has("nuxt")) return tool("vite", "nuxt", firstExisting(dir, [...CONFIG_NAMES.nuxt]), "nuxt");
+  if (has("astro")) return tool("vite", "astro", firstExisting(dir, [...CONFIG_NAMES.astro]), "astro");
+  if (has("@solidjs/start")) return tool("vite", "solid-start", firstExisting(dir, [...CONFIG_NAMES["solid-start"]]), "@solidjs/start");
+  const viteFrameworks = [
+    ["@sveltejs/kit", "sveltekit"],
+    ["@remix-run/dev", "remix"],
+    ["@react-router/dev", "react-router"],
+    ["@builder.io/qwik", "qwik"],
+    ["vite-plugin-solid", "solid"]
+  ];
+  for (const [dep, framework] of viteFrameworks) {
+    if (has(dep) && (viteConfig || has("vite"))) return tool("vite", framework, viteConfig, has("vite") ? "vite" : dep);
+  }
+  const builds = (name) => has(name) && new RegExp(`\\b${name}\\b`).test(buildScript ?? "");
+  if (viteConfig || builds("vite")) return tool("vite", null, viteConfig, "vite");
+  if (has("@vue/cli-service")) return tool("webpack", "vue-cli", firstExisting(dir, [...CONFIG_NAMES["vue-cli"]]), "@vue/cli-service");
+  const webpackConfig = scriptConfig("webpack") ?? firstExisting(dir, [...CONFIG_NAMES.webpack]);
+  if (webpackConfig || builds("webpack")) return tool("webpack", null, webpackConfig, "webpack");
+  const rollupConfig = scriptConfig("rollup") ?? firstExisting(dir, [...CONFIG_NAMES.rollup]);
+  if (rollupConfig || builds("rollup")) return tool("rollup", null, rollupConfig, "rollup");
+  if (has("parcel") || /\bparcel\b/.test(buildScript ?? "")) return tool("parcel", null, null, "parcel");
+  if (/\besbuild\b/.test(buildScript ?? "")) return tool("esbuild", null, null, "esbuild");
+  return tool("unknown", null, null, "");
+}
+function ciProviders(dir, root, env) {
+  const found = [];
+  const top = root ?? dir;
+  const near = (names) => {
+    for (const current of ancestors(dir, top)) {
+      const name = firstExisting(current, names);
+      if (name) return rel(dir, join2(current, name));
+    }
+    return null;
+  };
+  const workflows = join2(top, ".github", "workflows");
+  let workflowFile = null;
+  try {
+    workflowFile = readdirSync(workflows).filter((f) => /\.ya?ml$/.test(f)).sort()[0] ?? null;
+  } catch {
+  }
+  if (workflowFile) {
+    found.push({ id: "github", name: "GitHub Actions", evidence: rel(dir, join2(workflows, workflowFile)), repo: githubRepo(root) });
+  } else if (env.GITHUB_ACTIONS === "true") {
+    found.push({ id: "github", name: "GitHub Actions", evidence: "GITHUB_ACTIONS", repo: env.GITHUB_REPOSITORY ?? githubRepo(root) });
+  }
+  const vercel = near(["vercel.json", ".vercel"]);
+  if (vercel || env.VERCEL) found.push({ id: "vercel", name: "Vercel", evidence: vercel ?? "VERCEL" });
+  const netlify = near(["netlify.toml"]);
+  if (netlify || env.NETLIFY) found.push({ id: "netlify", name: "Netlify", evidence: netlify ?? "NETLIFY" });
+  const wrangler = near(["wrangler.toml", "wrangler.json", "wrangler.jsonc"]);
+  const pagesConfig = wrangler && /pages_build_output_dir/.test(readText(join2(dir, wrangler)) ?? "") ? wrangler : null;
+  const pkg = readJson(join2(dir, "package.json"));
+  const pagesScript = Object.values(pkg?.scripts ?? {}).some((s) => /wrangler\s+pages\b/.test(s)) ? "package.json (wrangler pages)" : null;
+  if (pagesConfig || pagesScript || env.CF_PAGES) {
+    found.push({ id: "cloudflare-pages", name: "Cloudflare Pages", evidence: pagesConfig ?? pagesScript ?? "CF_PAGES" });
+  }
+  const gitlab = near([".gitlab-ci.yml"]);
+  if (gitlab || env.GITLAB_CI) found.push({ id: "gitlab", name: "GitLab CI", evidence: gitlab ?? "GITLAB_CI" });
+  return found;
+}
+function workflowsPassKey(dir, root) {
+  const workflows = join2(root ?? dir, ".github", "workflows");
+  try {
+    return readdirSync(workflows).some((f) => /\.ya?ml$/.test(f) && /secrets\.AUTTER_RUNTIME_KEY\b/.test(readText(join2(workflows, f)) ?? ""));
+  } catch {
+    return false;
+  }
+}
+function angularInfo(json) {
+  const projects = json.projects ?? {};
+  const names = Object.keys(projects);
+  const name = (typeof json.defaultProject === "string" && projects[json.defaultProject] ? json.defaultProject : null) ?? names.find((n) => projects[n].projectType === "application") ?? names[0];
+  if (!name) return null;
+  const project = projects[name];
+  const build = (project.architect ?? project.targets)?.build;
+  if (!build) return null;
+  const options = build.options ?? {};
+  const production = build.configurations?.production ?? {};
+  const application = typeof build.builder === "string" && /:application$/.test(build.builder);
+  const outputPath = production.outputPath ?? options.outputPath ?? `dist/${name}`;
+  let outputDir;
+  if (outputPath && typeof outputPath === "object") {
+    const { base, browser } = outputPath;
+    outputDir = browser === "" ? String(base) : `${base}/${browser ?? "browser"}`;
+  } else {
+    outputDir = application ? `${outputPath}/browser` : String(outputPath);
+  }
+  const prefix = production.deployUrl ?? options.deployUrl ?? production.baseHref ?? options.baseHref;
+  return {
+    project: name,
+    outputDir,
+    sourceMap: "sourceMap" in production ? production.sourceMap : options.sourceMap,
+    urlPrefix: typeof prefix === "string" && prefix.startsWith("/") ? prefix : "/"
+  };
+}
+function mapStateFromLiteral(value, onTrue = "public") {
+  if (value === true) return onTrue;
+  if (value === false) return "off";
+  if (value === "hidden") return "hidden";
+  if (value === "inline") return "inline";
+  return "unknown";
+}
+var CRA_ENV_FILES = [".env.production.local", ".env.local", ".env.production", ".env"];
+function craEnv(dir, name) {
+  for (const file of CRA_ENV_FILES) {
+    const match = new RegExp(`^\\s*${name}\\s*=\\s*["']?([^"'\\s#]*)`, "m").exec(readText(join2(dir, file)) ?? "");
+    if (match) return { value: match[1], file };
+  }
+  return null;
+}
+function parseConfig(dir, config) {
+  if (!config) return null;
+  const code = readText(join2(dir, config));
+  return code === null ? null : parseFile(code, config);
+}
+function outputFacts(dir, pkg, tool) {
+  const script = tool.buildScript;
+  const none = (state, setting = null, file = null) => ({ state, setting, file });
+  switch (tool.id) {
+    case "vite": {
+      const ast = parseConfig(dir, tool.config);
+      const obj = ast ? exportedConfigObject(ast) : null;
+      const base = tool.framework === "nuxt" || tool.framework === "astro" ? ["vite"] : [];
+      const sourcemap = literalProperty(obj, [...base, "build", "sourcemap"]);
+      const viteBase = literalProperty(obj, [...base, "base"]);
+      const outDir = (tool.framework === "astro" ? literalProperty(obj, ["outDir"]) : literalProperty(obj, [...base, "build", "outDir"])) ?? scriptFlag(script, "--outDir");
+      const defaults = {
+        nuxt: ".output/public",
+        "solid-start": ".output/public",
+        sveltekit: "build",
+        remix: "build/client",
+        "react-router": "build/client"
+      };
+      return {
+        outputDir: typeof outDir === "string" ? outDir : defaults[tool.framework ?? ""] ?? "dist",
+        urlPrefix: typeof viteBase === "string" && viteBase.startsWith("/") ? viteBase : "/",
+        sourceMaps: sourcemap === void 0 ? none(obj || !tool.config ? "default-off" : "unknown") : none(mapStateFromLiteral(sourcemap), `build.sourcemap: ${JSON.stringify(sourcemap)}`, tool.config)
+      };
+    }
+    case "next": {
+      const ast = parseConfig(dir, tool.config);
+      const obj = ast ? nextConfigObject(ast) : null;
+      const distDir = literalProperty(obj, ["distDir"]);
+      const exported = literalProperty(obj, ["output"]) === "export";
+      const publicMaps = literalProperty(obj, ["productionBrowserSourceMaps"]);
+      const basePath = literalProperty(obj, ["assetPrefix"]) ?? literalProperty(obj, ["basePath"]);
+      return {
+        outputDir: exported ? "out" : `${typeof distDir === "string" ? distDir : ".next"}/static`,
+        urlPrefix: exported ? `${typeof basePath === "string" ? basePath.replace(/\/+$/, "") : ""}/` : `${typeof basePath === "string" ? basePath.replace(/\/+$/, "") : ""}/_next/static/`,
+        sourceMaps: publicMaps === true ? none("public", "productionBrowserSourceMaps: true", tool.config) : none(obj || !tool.config ? "default-off" : "unknown")
+      };
+    }
+    case "webpack":
+    case "rollup": {
+      const ast = parseConfig(dir, tool.config);
+      const obj = ast ? exportedConfigObject(ast) : null;
+      if (tool.framework === "vue-cli") {
+        const productionSourceMap = literalProperty(obj, ["productionSourceMap"]);
+        const outputDir = literalProperty(obj, ["outputDir"]);
+        const publicPath = literalProperty(obj, ["publicPath"]);
+        return {
+          outputDir: typeof outputDir === "string" ? outputDir : "dist",
+          urlPrefix: typeof publicPath === "string" && publicPath.startsWith("/") ? publicPath : "/",
+          sourceMaps: productionSourceMap === false ? none("off", "productionSourceMap: false", tool.config) : none("default-public", productionSourceMap === true ? "productionSourceMap: true" : null, tool.config)
+        };
+      }
+      if (tool.id === "webpack") {
+        const devtool = literalProperty(obj, ["devtool"]);
+        const path = obj ? outputPathOf(obj) : null;
+        const publicPath = literalProperty(obj, ["output", "publicPath"]);
+        return {
+          outputDir: path ?? "dist",
+          urlPrefix: typeof publicPath === "string" && publicPath.startsWith("/") ? publicPath : "/",
+          sourceMaps: devtool === void 0 ? none(obj || !tool.config ? "default-off" : "unknown") : none(
+            devtool === false ? "off" : typeof devtool === "string" ? devtool.includes("hidden") ? "hidden" : devtool.includes("inline") || devtool.startsWith("eval") ? "inline" : "public" : "unknown",
+            `devtool: ${JSON.stringify(devtool)}`,
+            tool.config
+          )
+        };
+      }
+      const outDir = literalProperty(obj, ["output", "dir"]);
+      const outFile = literalProperty(obj, ["output", "file"]);
+      const sourcemap = literalProperty(obj, ["output", "sourcemap"]);
+      return {
+        outputDir: typeof outDir === "string" ? outDir : typeof outFile === "string" ? posix(dirname2(outFile)) : "dist",
+        urlPrefix: "/",
+        sourceMaps: sourcemap === void 0 ? none(obj || !tool.config ? "default-off" : "unknown") : none(mapStateFromLiteral(sourcemap), `output.sourcemap: ${JSON.stringify(sourcemap)}`, tool.config)
+      };
+    }
+    case "cra": {
+      const buildPath = (script && /BUILD_PATH=(\S+)/.exec(script)?.[1]) ?? craEnv(dir, "BUILD_PATH")?.value;
+      const inScript = script ? /GENERATE_SOURCEMAP=(\w+)/.exec(script) : null;
+      const fromEnv = craEnv(dir, "GENERATE_SOURCEMAP");
+      const homepage = pkg.homepage ? homepagePath(pkg.homepage) : "/";
+      const setting = inScript ? { value: inScript[1], file: "package.json" } : fromEnv;
+      return {
+        outputDir: buildPath || "build",
+        urlPrefix: homepage,
+        sourceMaps: setting ? none(setting.value === "false" ? "off" : "default-public", `GENERATE_SOURCEMAP=${setting.value}`, setting.file) : none("default-public")
+      };
+    }
+    case "angular": {
+      const json = readJson(join2(dir, "angular.json"));
+      const info = json ? angularInfo(json) : null;
+      if (!info) return { outputDir: null, urlPrefix: "/", sourceMaps: none("unknown", null, "angular.json") };
+      const sm = info.sourceMap;
+      const state = sm === void 0 ? "default-off" : sm === false ? "off" : sm === true ? "public" : sm.scripts === false ? "off" : sm.hidden ? "hidden" : "public";
+      return {
+        outputDir: info.outputDir,
+        urlPrefix: info.urlPrefix,
+        sourceMaps: none(state, sm === void 0 ? null : `sourceMap: ${JSON.stringify(sm)}`, "angular.json")
+      };
+    }
+    case "parcel": {
+      const off = /--no-source-maps\b/.test(script ?? "");
+      const publicUrl = scriptFlag(script, "--public-url");
+      return {
+        outputDir: scriptFlag(script, "--dist-dir") ?? "dist",
+        urlPrefix: publicUrl && publicUrl.startsWith("/") ? publicUrl : "/",
+        sourceMaps: off ? none("off", "--no-source-maps", "package.json") : none("default-public")
+      };
+    }
+    case "esbuild": {
+      const flag = script ? /--sourcemap(?:=(\w+))?/.exec(script) : null;
+      const outfile = scriptFlag(script, "--outfile");
+      return {
+        outputDir: scriptFlag(script, "--outdir") ?? (outfile ? posix(dirname2(outfile)) : "dist"),
+        urlPrefix: "/",
+        sourceMaps: flag ? none(flag[1] === "external" ? "hidden" : flag[1] === "inline" ? "inline" : "public", flag[0], "package.json") : none(script && /\besbuild\b/.test(script) ? "off" : "unknown")
+      };
+    }
+    default: {
+      const existing = ["dist", "build", "out"].find((d) => existsSync3(join2(dir, d)) && statSync(join2(dir, d)).isDirectory());
+      return { outputDir: existing ?? null, urlPrefix: "/", sourceMaps: none("unknown") };
+    }
+  }
+}
+function outputPathOf(obj) {
+  const output = findProperty(obj, "output");
+  if (!output || output === "ambiguous") return null;
+  const value = unwrap(output.value);
+  if (value?.type !== "ObjectExpression") return null;
+  const path = findProperty(value, "path");
+  if (!path || path === "ambiguous") return null;
+  const node = unwrap(path.value);
+  if (node?.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node?.type === "CallExpression" && node.callee?.type === "MemberExpression" && ["resolve", "join"].includes(node.callee.property?.name)) {
+    const parts = node.arguments.filter((a) => !(a.type === "Identifier" && a.name === "__dirname"));
+    if (parts.every((a) => a.type === "Literal" && typeof a.value === "string")) return parts.map((a) => a.value).join("/") || null;
+  }
+  return null;
+}
+function homepagePath(homepage) {
+  if (homepage === "." || homepage === "./") return "/";
+  try {
+    const path = new URL(homepage, "https://autter.invalid").pathname;
+    return path.endsWith("/") ? path : `${path}/`;
+  } catch {
+    return "/";
+  }
+}
+var SOURCE_EXTENSIONS = /\.(?:[cm]?[jt]sx?|vue|svelte|astro)$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "public", "static", "storybook-static"]);
+function releaseFacts(dir, skip) {
+  const found = [];
+  const visit = (current) => {
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue;
+      const full = join2(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name) && !skip.has(full)) visit(full);
+      } else if (entry.isFile() && SOURCE_EXTENSIONS.test(entry.name)) {
+        const code = readText(full);
+        if (!code?.includes("initAutterBrowser")) continue;
+        for (const passed of initCalls(code)) found.push({ file: rel(dir, full), passed });
+      }
+    }
+  };
+  visit(dir);
+  if (!found.length) return { file: null, passed: null };
+  const missing = found.find((f) => f.passed === false);
+  const unknown = found.find((f) => f.passed === null);
+  const pick = missing ?? unknown ?? found[0];
+  return { file: pick.file, passed: missing ? false : unknown ? null : true };
+}
+function initCalls(code) {
+  const out = [];
+  const re = /\binitAutterBrowser\s*\(/g;
+  for (let match = re.exec(code); match; match = re.exec(code)) {
+    let i = match.index + match[0].length;
+    while (/\s/.test(code[i] ?? "")) i++;
+    if (code[i] !== "{") {
+      out.push(code[i] === ")" ? false : null);
+      continue;
+    }
+    let depth = 0;
+    let quote = null;
+    let sawRelease = false;
+    let sawSpread = false;
+    for (; i < code.length; i++) {
+      const ch = code[i];
+      if (quote) {
+        if (ch === "\\") i++;
+        else if (ch === quote) quote = null;
+        continue;
+      }
+      if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+      else if (ch === "{" || ch === "(" || ch === "[") depth++;
+      else if (ch === "}" || ch === ")" || ch === "]") {
+        depth--;
+        if (depth === 0) break;
+      } else if (depth === 1) {
+        if (code.startsWith("...", i)) sawSpread = true;
+        if (/[\s{,]/.test(code[i - 1] ?? "") && /^release\s*[:,}(]/.test(code.slice(i, i + 20))) sawRelease = true;
+      }
+    }
+    out.push(sawRelease ? true : sawSpread ? null : false);
+  }
+  return out;
+}
+function detect(dir, env = process.env) {
+  const root = resolve2(dir);
+  const pkg = readJson(join2(root, "package.json"));
+  if (!pkg) throw new Error(`no readable package.json in ${root}`);
+  const git = gitRoot(root);
+  const tool = buildTool(root, pkg);
+  const facts = outputFacts(root, pkg, tool);
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const sdkPackage = deps["@autter/runtime-next"] ? "@autter/runtime-next" : deps["@autter/runtime-browser"] ? "@autter/runtime-browser" : null;
+  const sdkInstalled = sdkPackage ? installedVersion(root, sdkPackage) : null;
+  const skip = new Set(facts.outputDir ? [resolve2(root, facts.outputDir.split("/")[0])] : []);
+  return {
+    dir: root,
+    buildTool: tool,
+    packageManager: packageManager(root, pkg, git),
+    ci: ciProviders(root, git, env),
+    outputDir: facts.outputDir,
+    urlPrefix: facts.urlPrefix,
+    sourceMaps: facts.sourceMaps,
+    sdk: {
+      package: sdkPackage,
+      range: sdkPackage ? deps[sdkPackage] : null,
+      installed: sdkInstalled,
+      debugIds: sdkPackage ? atLeast(sdkInstalled ?? deps[sdkPackage], "1.6.0") : null
+    },
+    release: releaseFacts(root, skip),
+    cli: { range: deps["@autter/runtime-cli"] ?? null, installed: installedVersion(root, "@autter/runtime-cli") },
+    gitRoot: git
+  };
+}
+
+// src/setup.ts
+var PKG = "@autter/runtime-cli";
+var KEY_TEXT = "An upload-only key (autter_rtu_\u2026) is recommended: it can only upload source maps. The full server key (autter_rt_\u2026) also works.";
+var MIN_CLI = "1.2.0";
+function ownVersion() {
+  try {
+    return JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return MIN_CLI;
+  }
+}
+var Changes = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  dir;
+  files = /* @__PURE__ */ new Map();
+  read(file) {
+    const path = join3(this.dir, file);
+    return this.files.get(path) ?? readText(path);
+  }
+  write(file, content) {
+    this.files.set(join3(this.dir, file), content);
+  }
+};
+function rewriteJson(text, value) {
+  const indent = /^\{\r?\n([ \t]+)"/.exec(text)?.[1] ?? "  ";
+  return `${JSON.stringify(value, null, indent)}${text.endsWith("\n") ? "\n" : ""}`;
+}
+function insertAfter(obj, after, key, value) {
+  const out = {};
+  let placed = false;
+  for (const [k, v] of Object.entries(obj)) {
+    out[k] = v;
+    if (k === after) {
+      out[key] = value;
+      placed = true;
+    }
+  }
+  if (!placed) out[key] = value;
+  return out;
+}
+function addCommand(detected, spec, dev = true) {
+  const pm = detected.packageManager.name;
+  const verb = pm === "npm" ? "install" : "add";
+  const flag = pm === "npm" || pm === "pnpm" ? "--save-dev" : "--dev";
+  const argv = [pm, verb, ...dev ? [flag] : [], spec];
+  return { command: argv.join(" "), argv };
+}
+var shellArg = (value) => /^[\w./@:~-]+$/.test(value) ? value : JSON.stringify(value);
+function sourcemapsScript(outputDir, urlPrefix) {
+  const out = shellArg(outputDir);
+  return `autter-runtime sourcemaps inject ${out} && autter-runtime sourcemaps upload ${out}${urlPrefix && urlPrefix !== "/" ? ` --url-prefix ${shellArg(urlPrefix)}` : ""} --delete-after-upload --best-effort`;
+}
+function commitVars(ci) {
+  const byCi = {
+    vercel: "VERCEL_GIT_COMMIT_SHA",
+    netlify: "COMMIT_REF",
+    "cloudflare-pages": "CF_PAGES_COMMIT_SHA",
+    gitlab: "CI_COMMIT_SHA",
+    github: "GITHUB_SHA"
+  };
+  const order = ["vercel", "netlify", "cloudflare-pages", "gitlab", "github"];
+  const vars = order.filter((id) => ci.some((c) => c.id === id)).map((id) => byCi[id]);
+  return [...vars, "GIT_SHA"];
+}
+function releaseSnippet(detected) {
+  const vars = commitVars(detected.ci);
+  const expr = `${vars.map((v) => `process.env.${v}`).join(" ?? ")} ?? ""`;
+  const shellVar = `$${vars[0]}`;
+  const init = detected.release.file ?? "the file that calls initAutterBrowser";
+  const tool = detected.buildTool;
+  const config = tool.config ?? void 0;
+  const call = (value) => `// ${init}
+initAutterBrowser({ /* existing options */ release: ${value} });`;
+  switch (tool.id) {
+    case "vite": {
+      const define = `define: {
+  "import.meta.env.VITE_AUTTER_RELEASE": JSON.stringify(${expr}),
+},`;
+      const wrapped = tool.framework === "nuxt" || tool.framework === "astro" ? `vite: {
+  ${define.replace(/\n/g, "\n  ")}
+},` : define;
+      return {
+        file: config,
+        snippet: `// ${config ?? "vite.config.ts"}: the commit SHA is not a secret
+${wrapped}
+
+${call("import.meta.env.VITE_AUTTER_RELEASE")}`
+      };
+    }
+    case "next":
+      return {
+        file: config,
+        snippet: `// ${config ?? "next.config.mjs"}: the commit SHA is not a secret
+env: { NEXT_PUBLIC_AUTTER_RELEASE: ${expr} },
+
+${call("process.env.NEXT_PUBLIC_AUTTER_RELEASE")}`
+      };
+    case "webpack":
+      return {
+        file: config,
+        snippet: `// ${config ?? "webpack.config.js"}
+new webpack.DefinePlugin({ "process.env.AUTTER_RELEASE": JSON.stringify(${expr}) }),
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    case "rollup":
+      return {
+        file: config,
+        snippet: `// ${config ?? "rollup.config.js"} (@rollup/plugin-replace)
+replace({ preventAssignment: true, "process.env.AUTTER_RELEASE": JSON.stringify(${expr}) }),
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    case "cra":
+      return {
+        file: "package.json",
+        snippet: `// package.json: CRA inlines REACT_APP_* variables
+"build": "REACT_APP_AUTTER_RELEASE=${shellVar} react-scripts build",
+
+${call("process.env.REACT_APP_AUTTER_RELEASE")}`
+      };
+    case "angular":
+      return {
+        file: "package.json",
+        snippet: `// package.json (Angular 17.2+ application builder)
+"build": "ng build --define \\"AUTTER_RELEASE='${shellVar}'\\"",
+
+// ${init}
+declare const AUTTER_RELEASE: string | undefined;
+initAutterBrowser({ /* existing options */ release: typeof AUTTER_RELEASE === "string" ? AUTTER_RELEASE : undefined });`
+      };
+    case "parcel":
+      return {
+        file: "package.json",
+        snippet: `// package.json: Parcel inlines process.env values at build time
+"build": "AUTTER_RELEASE=${shellVar} ${tool.buildScript ?? "parcel build"}",
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    case "esbuild":
+      return {
+        file: "package.json",
+        snippet: `// the esbuild command
+--define:process.env.AUTTER_RELEASE=\\"${shellVar}\\"
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    default:
+      return {
+        file: void 0,
+        snippet: `// Inline the commit SHA (${vars.join(", ")}) into the browser bundle with your build tool's define/env mechanism, then:
+${call("<the inlined commit SHA>")}`
+      };
+  }
+}
+function secretTargets(detected) {
+  const where = [];
+  for (const ci of detected.ci) {
+    switch (ci.id) {
+      case "github":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          command: `gh secret set AUTTER_RUNTIME_KEY${ci.repo ? ` --repo ${ci.repo}` : ""}`,
+          note: "gh prompts for the value (or reads it from stdin), so the key never reaches your shell history. Then pass it to the step that runs the production build: env: AUTTER_RUNTIME_KEY: ${{ secrets.AUTTER_RUNTIME_KEY }}"
+        });
+        break;
+      case "vercel":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          command: "vercel env add AUTTER_RUNTIME_KEY production",
+          note: "vercel prompts for the value (or reads it from stdin). Add it for preview too (vercel env add AUTTER_RUNTIME_KEY preview) if preview builds should upload."
+        });
+        break;
+      case "netlify":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          command: 'netlify env:set AUTTER_RUNTIME_KEY "$(cat)" --context production --scope builds --secret',
+          note: "Paste the key, press Enter, then Ctrl-D: $(cat) reads it from stdin, so it stays out of your shell history. netlify env:set has no prompt; without a value it stores an empty one."
+        });
+        break;
+      case "cloudflare-pages":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          note: "Cloudflare dashboard \u2192 Workers & Pages \u2192 your project \u2192 Settings \u2192 Variables and Secrets \u2192 Add: type Secret, name AUTTER_RUNTIME_KEY, for Production (and Preview if preview builds should upload). Builds read it from the environment."
+        });
+        break;
+      case "gitlab":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          note: "GitLab \u2192 Settings \u2192 CI/CD \u2192 Variables \u2192 Add variable: key AUTTER_RUNTIME_KEY, visibility Masked (and Protected when only protected branches deploy). Jobs get it as an environment variable."
+        });
+        break;
+    }
+  }
+  if (!where.length) {
+    where.push({
+      ci: "other",
+      name: "your build environment",
+      note: "Add AUTTER_RUNTIME_KEY as a secret environment variable wherever the production build runs. Never in a committed .env file, and never under a public prefix (VITE_, NEXT_PUBLIC_, REACT_APP_, PUBLIC_)."
+    });
+  }
+  return where;
+}
+var PLUGINS = {
+  vite: { name: "autterSourceMaps", spec: "@autter/runtime-cli/vite", element: "autterSourceMaps()" },
+  rollup: { name: "autterSourceMaps", spec: "@autter/runtime-cli/rollup", element: "autterSourceMaps()" },
+  webpack: { name: "AutterSourceMapsWebpackPlugin", spec: "@autter/runtime-cli/webpack", element: "new AutterSourceMapsWebpackPlugin()" }
+};
+function pluginSnippet(kind, container, cjs) {
+  const plugin = PLUGINS[kind];
+  const importLine = cjs ? `const { ${plugin.name} } = require("${plugin.spec}");` : `import { ${plugin.name} } from "${plugin.spec}";`;
+  const plugins = `plugins: [/* existing plugins */ ${plugin.element}],`;
+  const body = container ? `${container}: {
+    ${plugins}
+  },` : plugins;
+  return `${importLine}
+
+// in the exported config object:
+  ${body}`;
+}
+function runSetup(dir, options = {}) {
+  const env = options.env ?? process.env;
+  const detected = detect(dir, env);
+  const changes = new Changes(detected.dir);
+  const actions = [];
+  const next = [];
+  const tool = detected.buildTool;
+  const pkgText = changes.read("package.json");
+  let pkg = JSON.parse(pkgText);
+  const version = ownVersion();
+  const range = `^${atLeast(version, MIN_CLI) ? version : MIN_CLI}`;
+  const install = addCommand(detected, `${PKG}@${range}`);
+  const manual = (description, file, snippet, command) => actions.push({ type: "manual", ...file ? { file } : {}, description, ...snippet ? { snippet } : {}, ...command ? { command } : {} });
+  const savePkg = () => changes.write("package.json", rewriteJson(changes.read("package.json"), pkg));
+  if (tool.id === "unknown" && !pkg.scripts?.build) {
+    manual(
+      "No build tool and no build script: if this app ships hand-written, unminified scripts there is nothing to upload. If another step builds its JavaScript, run this after it, on the output directory",
+      "package.json",
+      sourcemapsScript("<output dir>", "/")
+    );
+    return {
+      dir: detected.dir,
+      dryRun: Boolean(options.dryRun),
+      detected,
+      actions,
+      secret: { name: "AUTTER_RUNTIME_KEY", key: KEY_TEXT, where: [] },
+      next: ["Nothing was changed."],
+      exitCode: 2
+    };
+  }
+  const current = pkg.devDependencies?.[PKG] ?? pkg.dependencies?.[PKG];
+  let dependencyChanged = false;
+  if (!current) {
+    const devDependencies = { ...pkg.devDependencies };
+    const keys = Object.keys(devDependencies);
+    const sorted = keys.every((k, i) => i === 0 || keys[i - 1].localeCompare(k) <= 0);
+    devDependencies[PKG] = range;
+    pkg = {
+      ...pkg,
+      devDependencies: sorted ? Object.fromEntries(Object.entries(devDependencies).sort(([a], [b]) => a.localeCompare(b))) : devDependencies
+    };
+    if (!("devDependencies" in JSON.parse(pkgText))) pkg = insertAfter(pkg, "dependencies", "devDependencies", pkg.devDependencies);
+    dependencyChanged = true;
+    actions.push({ type: "add-dependency", file: "package.json", description: `Add ${PKG}@${range} to devDependencies`, command: install.command });
+  } else if (atLeast(current, MIN_CLI) === false) {
+    const section = pkg.devDependencies?.[PKG] ? "devDependencies" : "dependencies";
+    pkg = { ...pkg, [section]: { ...pkg[section], [PKG]: range } };
+    dependencyChanged = true;
+    actions.push({
+      type: "add-dependency",
+      file: "package.json",
+      description: `Raise ${PKG} from ${current} to ${range} (setup, verify and upload --best-effort need ${MIN_CLI})`,
+      command: install.command
+    });
+  }
+  if (dependencyChanged) savePkg();
+  const applyEdit = (result, file, description, fallback) => {
+    if (result.status === "edited") {
+      changes.write(file, result.code);
+      actions.push({ type: "edit", file, description });
+    } else if (result.status === "manual") {
+      manual(`${result.reason}: ${description[0].toLowerCase()}${description.slice(1)} by hand`, file, fallback);
+    } else if (result.note) {
+      next.push(result.note);
+    }
+  };
+  const addScript = () => {
+    const out = detected.outputDir;
+    const scripts = { ...pkg.scripts };
+    if (Object.values(scripts).some((s) => /autter-runtime\s+sourcemaps\s+(inject|upload)/.test(s))) return;
+    if (!out) {
+      manual("Could not tell where the build writes its output: after the production build, inject and upload from that directory", void 0, sourcemapsScript("<output dir>", "/"));
+      return;
+    }
+    const script = sourcemapsScript(out, detected.urlPrefix);
+    if (!scripts.build) {
+      manual(`No build script in package.json: run this after the production build (it writes ${out})`, "package.json", script);
+      return;
+    }
+    const { name: pm, yarnBerry } = detected.packageManager;
+    const post = pm === "npm" || pm === "yarn" && !yarnBerry;
+    if (post) {
+      pkg = { ...pkg, scripts: scripts.postbuild ? { ...scripts, postbuild: `${scripts.postbuild} && ${script}` } : insertAfter(scripts, "build", "postbuild", script) };
+      actions.push({
+        type: "add-script",
+        file: "package.json",
+        description: `${scripts.postbuild ? "Extend" : "Add"} the postbuild script: inject debug ids into ${out}, upload its maps, then delete them (with or without a key, so maps are never deployed; never fails the build)`,
+        snippet: `"postbuild": ${JSON.stringify(pkg.scripts.postbuild)}`
+      });
+    } else {
+      pkg = { ...pkg, scripts: { ...scripts, build: `${scripts.build} && ${script}` } };
+      actions.push({
+        type: "add-script",
+        file: "package.json",
+        description: `Append to the build script (${pm}${pm === "yarn" ? " 2+" : ""} does not run postbuild): inject debug ids into ${out}, upload its maps, then delete them (never fails the build)`,
+        snippet: `"build": ${JSON.stringify(pkg.scripts.build)}`
+      });
+    }
+    savePkg();
+  };
+  switch (tool.id) {
+    case "vite":
+    case "rollup": {
+      const kind = tool.id;
+      const container = tool.framework === "nuxt" || tool.framework === "astro" ? "vite" : void 0;
+      if (tool.framework === "solid-start") {
+        manual(
+          "SolidStart's app.config wraps Vite through vinxi: add the plugin to the client router's Vite config by hand",
+          tool.config ?? "app.config.ts",
+          pluginSnippet("vite", "vite", false)
+        );
+        break;
+      }
+      if (!tool.config) {
+        if (kind === "vite" && !tool.framework) {
+          const file = existsSync4(join3(detected.dir, "tsconfig.json")) ? "vite.config.ts" : "vite.config.js";
+          changes.write(
+            file,
+            `import { defineConfig } from "vite";
+import { autterSourceMaps } from "@autter/runtime-cli/vite";
+
+export default defineConfig({
+	plugins: [autterSourceMaps()],
+});
+`
+          );
+          actions.push({ type: "edit", file, description: `Create ${file} with the autterSourceMaps() plugin (the project had no Vite config)` });
+        } else {
+          manual(`No ${tool.framework ?? kind} config file found: create one with the plugin`, void 0, pluginSnippet(kind, container, false));
+        }
+        break;
+      }
+      const code = changes.read(tool.config);
+      const cjs = /\bmodule\.exports\b/.test(code);
+      applyEdit(
+        addBundlerPlugin(code, tool.config, { ...PLUGINS[kind], container }),
+        tool.config,
+        `Add ${PLUGINS[kind].element} to the ${container ? `${container}.` : ""}plugins in ${tool.config}`,
+        pluginSnippet(kind, container, cjs)
+      );
+      if (detected.sourceMaps.state === "inline") {
+        manual(
+          `${tool.config} writes inline source maps (${detected.sourceMaps.setting}): there are no map files to upload. Use "hidden"`,
+          tool.config,
+          kind === "vite" ? `build: { sourcemap: "hidden" },` : `output: { sourcemap: "hidden" },`
+        );
+      }
+      break;
+    }
+    case "webpack": {
+      const container = tool.framework === "vue-cli" ? "configureWebpack" : void 0;
+      if (!tool.config) {
+        manual(
+          `No ${tool.framework === "vue-cli" ? "vue.config.js" : "webpack config"} found: add the plugin to the config your build uses`,
+          void 0,
+          pluginSnippet("webpack", container, true)
+        );
+        break;
+      }
+      const code = changes.read(tool.config);
+      const cjs = /\bmodule\.exports\b/.test(code) || !/\b(import|export)\b/.test(code);
+      applyEdit(
+        addBundlerPlugin(code, tool.config, { ...PLUGINS.webpack, container }),
+        tool.config,
+        `Add new AutterSourceMapsWebpackPlugin() to the ${container ? `${container}.` : ""}plugins in ${tool.config}`,
+        pluginSnippet("webpack", container, cjs)
+      );
+      if (detected.sourceMaps.state === "inline") {
+        manual(`${tool.config} uses an inline/eval devtool: there are no map files to upload. Use "hidden-source-map" for production`, tool.config, `devtool: "hidden-source-map",`);
+      }
+      break;
+    }
+    case "next": {
+      const snippet = `import { withAutterSourceMaps } from "@autter/runtime-cli/next";
+
+// outermost, around any other wrappers:
+export default withAutterSourceMaps(withOtherPlugins(nextConfig));`;
+      if (!tool.config) {
+        changes.write("next.config.mjs", `import { withAutterSourceMaps } from "@autter/runtime-cli/next";
+
+/** @type {import("next").NextConfig} */
+const nextConfig = {};
+
+export default withAutterSourceMaps(nextConfig);
+`);
+        actions.push({ type: "edit", file: "next.config.mjs", description: "Create next.config.mjs exporting withAutterSourceMaps(nextConfig) (the project had none)" });
+      } else {
+        applyEdit(wrapNextConfig(changes.read(tool.config), tool.config), tool.config, `Wrap the exported config in withAutterSourceMaps(...), outermost, in ${tool.config}`, snippet);
+      }
+      if (/--turbo(pack)?\b/.test(tool.buildScript ?? "") && atLeast(tool.version, "15.4.1") === false) {
+        next.push(`Next.js ${tool.version} builds with Turbopack: withAutterSourceMaps covers Turbopack production builds from Next.js 15.4.1 (runAfterProductionCompile). Upgrade Next.js, or build with webpack.`);
+      }
+      break;
+    }
+    case "cra": {
+      addScript();
+      const sm = detected.sourceMaps;
+      if (sm.state === "off" && sm.file && CRA_ENV_FILES.includes(sm.file)) {
+        const text = changes.read(sm.file);
+        changes.write(sm.file, text.replace(/^(\s*GENERATE_SOURCEMAP\s*=\s*)["']?false["']?/m, "$1true"));
+        actions.push({
+          type: "edit",
+          file: sm.file,
+          description: `Set GENERATE_SOURCEMAP=true in ${sm.file}: the postbuild step uploads the maps and deletes them, so they are never deployed`
+        });
+      } else if (sm.state === "off") {
+        manual("The build script sets GENERATE_SOURCEMAP=false: remove it (or set true) so there are maps to upload; the postbuild step deletes them", "package.json", `"build": "react-scripts build"`);
+      }
+      break;
+    }
+    case "angular": {
+      addScript();
+      const text = changes.read("angular.json");
+      let json = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      const info = json ? angularInfo(json) : null;
+      const hidden = { scripts: true, styles: false, hidden: true, vendor: false };
+      const sm = detected.sourceMaps.state;
+      if (!json || !info) {
+        manual("angular.json could not be read: turn on hidden script source maps for the production build", "angular.json", `"sourceMap": ${JSON.stringify(hidden)}`);
+      } else if (sm === "default-off" || sm === "off") {
+        const architect = json.projects[info.project].architect ?? json.projects[info.project].targets;
+        const build = architect.build;
+        const configurations = build.configurations ?? {};
+        if (configurations.production) configurations.production.sourceMap = hidden;
+        else build.options = { ...build.options, sourceMap: hidden };
+        changes.write("angular.json", rewriteJson(text, json));
+        actions.push({
+          type: "edit",
+          file: "angular.json",
+          description: `Turn on hidden script source maps for ${info.project}'s ${configurations.production ? "production " : ""}build (written next to the bundles, not referenced by them; the postbuild step uploads and deletes them)`,
+          snippet: `"sourceMap": ${JSON.stringify(hidden)}`
+        });
+      } else if (sm === "public") {
+        next.push('angular.json emits public source maps (referenced by the bundles); the postbuild step deletes them after upload. Use "sourceMap": { "scripts": true, "hidden": true } to stop referencing them.');
+      }
+      break;
+    }
+    case "parcel":
+      addScript();
+      if (detected.sourceMaps.state === "off") {
+        manual("The build script passes --no-source-maps: remove it so there are maps to upload (the postbuild step deletes them)", "package.json", (tool.buildScript ?? "").replace(/\s*--no-source-maps\b/, ""));
+      }
+      break;
+    case "esbuild":
+      addScript();
+      if (detected.sourceMaps.state === "off" || detected.sourceMaps.state === "unknown") {
+        manual(
+          'Make esbuild write external source maps (written next to the bundles, not referenced by them): add --sourcemap=external to the esbuild command, or sourcemap: "external" to its build() options',
+          "package.json",
+          "--sourcemap=external"
+        );
+      } else if (detected.sourceMaps.state === "inline") {
+        manual("esbuild writes inline source maps: there are no map files to upload. Use --sourcemap=external", "package.json", "--sourcemap=external");
+      }
+      break;
+    default:
+      if (detected.outputDir && pkg.scripts?.build) {
+        addScript();
+        manual(
+          `Build tool not recognised: make sure the production build writes source maps (hidden if it can) into ${detected.outputDir}, and that ${detected.outputDir} is the deployed output`,
+          void 0
+        );
+      } else {
+        manual(
+          "Build tool not recognised: after the production build, inject debug ids and upload the maps from the output directory",
+          void 0,
+          sourcemapsScript(detected.outputDir ?? "<output dir>", "/")
+        );
+      }
+  }
+  if (detected.sdk.package && detected.release.file && detected.release.passed === false) {
+    const { file, snippet } = releaseSnippet(detected);
+    manual(
+      `initAutterBrowser in ${detected.release.file} gets no release: pass the commit SHA through ${tool.id === "unknown" ? "your build tool's" : `${tool.id}'s`} public env or define mechanism, so release-based features match the upload (debug ids match maps either way)`,
+      file ?? detected.release.file,
+      snippet
+    );
+  } else if (detected.sdk.package && detected.release.file && detected.release.passed === null) {
+    next.push(`Check that initAutterBrowser in ${detected.release.file} passes release: the commit SHA (setup could not read its options).`);
+  }
+  if (detected.sdk.package && detected.sdk.debugIds === false) {
+    manual(
+      `${detected.sdk.package} ${detected.sdk.installed ?? detected.sdk.range} predates 1.6.0, so exceptions carry no debug ids: upgrade it`,
+      "package.json",
+      void 0,
+      addCommand(detected, `${detected.sdk.package}@latest`, false).command
+    );
+  }
+  if (!detected.sdk.package) {
+    next.push("No Autter browser SDK in package.json: source maps resolve browser errors that @autter/runtime-browser (or @autter/runtime-next) 1.6.0+ reports. Set it up first, or alongside.");
+  }
+  if (detected.sourceMaps.state === "public" && tool.id !== "angular") {
+    next.push(
+      `${detected.sourceMaps.file ?? "The build"} emits public source maps (${detected.sourceMaps.setting}): your source is downloadable from production. Switch to hidden maps, or set deleteAfterUpload: true on the plugin, if you don't publish them on purpose.`
+    );
+  }
+  const where = secretTargets(detected);
+  for (const target of where) {
+    actions.push({
+      type: "set-secret",
+      description: `Store AUTTER_RUNTIME_KEY in ${target.name}${target.command ? "" : `: ${target.note}`}`,
+      ...target.command ? { command: target.command } : {}
+    });
+  }
+  const hosting = detected.ci.some((c) => c.id === "vercel" || c.id === "netlify" || c.id === "cloudflare-pages");
+  if (detected.ci.some((c) => c.id === "github") && !workflowsPassKey(detected.dir, detected.gitRoot)) {
+    const snippet = `- run: ${detected.packageManager.name === "npm" ? "npm run" : detected.packageManager.name} build
+  env:
+    AUTTER_RUNTIME_KEY: \${{ secrets.AUTTER_RUNTIME_KEY }}`;
+    if (hosting) {
+      next.push(`If a GitHub workflow builds the deployed output, give that step the key:
+${snippet}`);
+    } else {
+      manual(
+        "Pass the secret to the GitHub Actions step that runs the production build (only that job; never to jobs that run untrusted pull request code)",
+        detected.ci.find((c) => c.id === "github").evidence,
+        snippet
+      );
+    }
+  }
+  if (!options.dryRun) {
+    for (const [path, content] of changes.files) writeFileSync(path, content);
+  }
+  const needsInstall = dependencyChanged || !detected.cli.installed;
+  if (needsInstall && options.install && !options.dryRun) {
+    const [command, ...args] = install.argv;
+    const result = spawnSync(command, args, {
+      cwd: detected.dir,
+      stdio: options.installOutput === "stderr" ? ["ignore", 2, 2] : "inherit",
+      shell: process.platform === "win32"
+    });
+    if (result.status !== 0) throw new Error(`${install.command} failed (exit ${result.status ?? result.signal ?? "unknown"})`);
+  } else if (needsInstall) {
+    next.push(`Install it: ${install.command}`);
+  }
+  next.push(
+    "Get an upload-only key (autter_rtu_\u2026) for this repository from Autter: it can only upload source maps, so it is the right key for CI. The full server key (autter_rt_\u2026) also works. Never paste it into chat or commit it.",
+    `Store it as AUTTER_RUNTIME_KEY where the production build runs (see secret.where). Without it, builds still pass and upload nothing.`
+  );
+  if (detected.outputDir) {
+    next.push(`After a production build with the key set, check it: npx autter-runtime sourcemaps verify ${shellArg(detected.outputDir)}`);
+  }
+  return {
+    dir: detected.dir,
+    dryRun: Boolean(options.dryRun),
+    detected,
+    actions,
+    secret: {
+      name: "AUTTER_RUNTIME_KEY",
+      key: KEY_TEXT,
+      where
+    },
+    next,
+    exitCode: actions.some((a) => a.type === "manual") ? 2 : 0
+  };
+}
+var LABEL = {
+  edit: "edit",
+  "add-dependency": "dependency",
+  "add-script": "script",
+  manual: "manual",
+  "set-secret": "secret"
+};
+function formatSetup(result) {
+  const d = result.detected;
+  const lines = [`autter-runtime sourcemaps setup${result.dryRun ? " (dry run: nothing written)" : ""}: ${d.dir}`, "", "Detected"];
+  const row = (label, value) => lines.push(`  ${label.padEnd(16)} ${value}`);
+  const tool = d.buildTool;
+  row("build tool", `${tool.id}${tool.framework ? ` (${tool.framework})` : ""}${tool.config ? `, ${tool.config}` : ""}${tool.version ? `, ${tool.version}` : ""}`);
+  row("package manager", `${d.packageManager.name}${d.packageManager.lockfile ? ` (${d.packageManager.lockfile})` : ""}`);
+  row("CI", d.ci.length ? d.ci.map((c) => `${c.name} (${c.evidence}${c.repo ? `, ${c.repo}` : ""})`).join("; ") : "none found");
+  row("output", `${d.outputDir ?? "unknown"}${d.urlPrefix !== "/" ? `, served from ${d.urlPrefix}` : ""}`);
+  row("source maps", `${d.sourceMaps.state}${d.sourceMaps.setting ? ` (${d.sourceMaps.setting})` : ""}`);
+  row(
+    "browser SDK",
+    d.sdk.package ? `${d.sdk.package} ${d.sdk.installed ?? d.sdk.range}${d.sdk.debugIds === false ? " (no debug ids: needs 1.6.0+)" : ""}` : "none in package.json"
+  );
+  row(
+    "release",
+    d.release.file ? `${d.release.file}: ${d.release.passed === true ? "passed" : d.release.passed === false ? "not passed" : "could not tell"}` : "no initAutterBrowser call found"
+  );
+  row("runtime-cli", d.cli.range ? `${d.cli.range}${d.cli.installed ? ` (installed ${d.cli.installed})` : " (not installed)"}` : "not in package.json");
+  lines.push("", "Actions");
+  if (!result.actions.length) lines.push("  nothing to do");
+  for (const action of result.actions) {
+    const status = action.type === "manual" ? "TODO" : action.type === "set-secret" ? "KEY " : result.dryRun ? "PLAN" : "DONE";
+    lines.push(`  ${status} ${LABEL[action.type].padEnd(10)} ${action.file ? `${action.file}: ` : ""}${action.description}`);
+    if (action.command) lines.push(`         run: ${action.command}`);
+    if (action.snippet && action.type === "manual") for (const line of action.snippet.split("\n")) lines.push(`         | ${line}`);
+  }
+  lines.push("", `Secret: ${result.secret.name}. ${result.secret.key}`);
+  for (const target of result.secret.where) {
+    lines.push(`  ${target.name}: ${target.command ?? ""}${target.command ? "" : target.note}`);
+    if (target.command) lines.push(`    ${target.note}`);
+  }
+  lines.push("", "Next");
+  result.next.forEach((item, i) => lines.push(`  ${i + 1}. ${item.replace(/\n/g, "\n     ")}`));
+  return lines;
+}
+
+// src/verify.ts
+import { existsSync as existsSync5 } from "fs";
+import { readdir as readdir2, readFile as readFile4 } from "fs/promises";
+import { dirname as dirname3, join as join4, relative as relative4, resolve as resolve3, sep as sep4 } from "path";
+var CHECK_BATCH2 = 500;
+var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
+var NOT_BUNDLES = [
+  [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
+  [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
+  [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
+];
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") {
+      re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(glob.includes("/") ? `^${re.replace(/^\.\//, "")}$` : `(^|/)${re}$`);
+}
+async function walk3(dir, out) {
+  let entries;
+  try {
+    entries = await readdir2(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === "node_modules") continue;
+    const full = join4(dir, entry.name);
+    if (entry.isDirectory()) await walk3(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+}
+function staticRoots(dir) {
+  for (let current = dirname3(dir); dirname3(current) !== current; current = dirname3(current)) {
+    if (existsSync5(join4(current, "package.json"))) return ["public", "static", "src"].map((name) => join4(current, name));
+  }
+  return [];
+}
+async function verifyDir(dir, options = {}) {
+  const root = resolve3(dir);
+  const env = options.env ?? process.env;
+  const files = [];
+  await walk3(root, files);
+  files.sort();
+  const relPath = (path) => relative4(root, path).split(sep4).join("/");
+  const ignore = (options.ignore ?? []).map(globToRegExp);
+  const roots = staticRoots(root);
+  const result = {
+    dir: root,
+    ok: true,
+    bundles: [],
+    maps: [],
+    upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
+    failures: []
+  };
+  const fail = (path, reason) => result.failures.push({ path, reason });
+  for (const file of files) {
+    const path = relPath(file);
+    if (file.endsWith(".map")) {
+      result.maps.push(path);
+      if (!options.allowMaps) {
+        fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
+      }
+      continue;
+    }
+    if (!BUNDLE_RE.test(file)) continue;
+    const bytes = await readFile4(file);
+    const bundle = { path, status: "ok", debugId: null, reasons: [], uploaded: null };
+    result.bundles.push(bundle);
+    const skip = (reason) => {
+      bundle.status = "skipped";
+      bundle.reasons.push(reason);
+    };
+    if (ignore.some((re) => re.test(path))) {
+      skip("matches --ignore");
+      continue;
+    }
+    const known = NOT_BUNDLES.find(([re]) => re.test(path));
+    if (known) {
+      skip(known[1]);
+      continue;
+    }
+    let copied = null;
+    for (const staticRoot of roots) {
+      const candidate = join4(staticRoot, path);
+      if (existsSync5(candidate) && (await readFile4(candidate)).equals(bytes)) copied = relative4(dirname3(staticRoot), candidate).split(sep4).join("/");
+    }
+    if (copied) {
+      skip(`copied unchanged from ${copied}, not built`);
+      continue;
+    }
+    const code = bytes.toString("utf8");
+    const commentId = readDebugIdComment(code);
+    const snippetId = SNIPPET_ID_RE.exec(code)?.[1] ?? null;
+    bundle.debugId = commentId;
+    if (!commentId && !hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "no debug id: its errors can't be matched to a source map. Run `autter-runtime sourcemaps inject` on the build output (or use the bundler plugin with AUTTER_RUNTIME_KEY set) before deploying"
+      );
+    } else if (!commentId) {
+      bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
+    } else if (!hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "has a //# debugId= comment but no registration snippet, so the browser SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+      );
+    } else if (snippetId && snippetId !== commentId) {
+      bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
+    }
+    const url = readSourceMappingUrl(code);
+    if (url?.startsWith("data:")) {
+      bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+    } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
+      let target = url.split(/[?#]/)[0];
+      try {
+        target = decodeURIComponent(target);
+      } catch {
+      }
+      if (!existsSync5(resolve3(dirname3(file), target))) {
+        bundle.reasons.push(
+          `its sourceMappingURL points at ${url}, which is not in the output (browsers' devtools request it and get a 404). Remove the comment: upload --delete-after-upload does`
+        );
+      }
+    }
+    if (bundle.reasons.length) {
+      bundle.status = "failed";
+      for (const reason of bundle.reasons) fail(path, reason);
+    }
+  }
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  if (!counted.length) fail(".", `no .js/.mjs/.cjs bundles under ${dir}: is this the build output?`);
+  await checkUploads(result, counted, options, env);
+  result.ok = result.failures.length === 0;
+  return result;
+}
+async function checkUploads(result, bundles, options, env) {
+  const upload = result.upload;
+  const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
+  if (!key) {
+    upload.reason = "AUTTER_RUNTIME_KEY is not set: only the local checks ran";
+    return;
+  }
+  upload.endpoint = resolveEndpoint(options.endpoint, env);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    upload.status = "error";
+    upload.reason = "AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which can't check source maps: use an upload key (autter_rtu_\u2026) or the server key (autter_rt_\u2026)";
+    result.failures.push({ path: ".", reason: upload.reason });
+    return;
+  }
+  const withIds = bundles.filter((b) => b.debugId);
+  if (!withIds.length) {
+    upload.reason = "no bundle has a debug id to check";
+    return;
+  }
+  let release = "verify";
+  try {
+    release = resolveRelease(options.release, env, options.cwd).release;
+  } catch {
+  }
+  const doFetch = options.fetch ?? fetch;
+  const missing = [];
+  for (let start = 0; start < withIds.length; start += CHECK_BATCH2) {
+    const batch = withIds.slice(start, start + CHECK_BATCH2);
+    let res;
+    try {
+      res = await doFetch(`${upload.endpoint}/v1/sourcemaps/check`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+        body: JSON.stringify({ release, files: batch.map((b) => ({ filename: servedFilename(options.urlPrefix, b.path), debugId: b.debugId })) })
+      });
+    } catch (err) {
+      upload.status = "error";
+      upload.reason = `could not reach the ingester: ${err.message}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (res.status === 404 || res.status === 400) {
+      upload.status = "unverified";
+      upload.reason = res.status === 404 ? "the ingester predates 1.6.0 (no /v1/sourcemaps/check), so uploads can't be checked: upgrade it" : "the ingester predates 1.7.0, which checks maps by debug id alone, so uploads can't be checked after the maps were deleted: upgrade it";
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      upload.status = "error";
+      upload.reason = `the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later)" : "");
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (!res.ok) {
+      upload.status = "error";
+      upload.reason = `the source map check failed: HTTP ${res.status}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    const body = await res.json();
+    const present = new Set(Array.isArray(body.present) ? body.present : []);
+    batch.forEach((bundle, index) => {
+      bundle.uploaded = present.has(index);
+      if (!bundle.uploaded) missing.push(bundle);
+    });
+  }
+  upload.checked = withIds.length;
+  upload.missing = missing.length;
+  upload.status = missing.length ? "missing" : "verified";
+  upload.reason = missing.length ? `${missing.length} of ${withIds.length} bundle(s) have no map on the ingester` : null;
+  for (const bundle of missing) {
+    const reason = `no map with debug id ${bundle.debugId} on the ingester for this key's repository: upload this build's maps (autter-runtime sourcemaps upload, or the bundler plugin with AUTTER_RUNTIME_KEY set)`;
+    bundle.status = "failed";
+    bundle.reasons.push(reason);
+    result.failures.push({ path: bundle.path, reason });
+  }
+}
+function formatVerify(result) {
+  const lines = [];
+  for (const bundle of result.bundles) {
+    if (bundle.status === "ok") lines.push(`ok      ${bundle.path} (debug id ${bundle.debugId}${bundle.uploaded ? ", map uploaded" : ""})`);
+    else if (bundle.status === "skipped") lines.push(`skipped ${bundle.path}: ${bundle.reasons.join("; ")}`);
+    else for (const reason of bundle.reasons) lines.push(`FAILED  ${bundle.path}: ${reason}`);
+  }
+  for (const map of result.maps) {
+    const failure = result.failures.find((f) => f.path === map);
+    lines.push(failure ? `FAILED  ${map}: ${failure.reason}` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`);
+  }
+  for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
+  const u = result.upload;
+  lines.push(
+    u.status === "verified" ? `upload: verified, ${u.checked} bundle map(s) on the ingester (${u.endpoint})` : u.status === "missing" ? `upload: ${u.reason} (${u.endpoint})` : `upload: ${u.status}${u.reason ? `, ${u.reason}` : ""}`
+  );
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  lines.push(
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (--allow-maps)` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+  );
+  return lines;
+}
+
+// src/cli.ts
+var USAGE = `autter-runtime \u2014 readable stack traces for Autter Runtime
+
+Usage:
+  autter-runtime sourcemaps setup [dir] [--dry-run] [--install] [--json]
+  autter-runtime sourcemaps verify <dir> [--endpoint <url>] [--url-prefix <prefix>]
+                [--ignore <glob>]... [--allow-maps] [--json]
+  autter-runtime sourcemaps inject <dir> [--dry-run] [--json]
+  autter-runtime sourcemaps upload <dir> [--release <r>] [--url-prefix <prefix>]
+                [--endpoint <url>] [--concurrency <n>] [--delete-after-upload]
+                [--best-effort] [--dry-run] [--json]
+  autter-runtime doctor ...      (provided by @autter/runtime-node)
+
+setup   Wires source map upload into the project in [dir] (default "."):
+        detects the build tool, package manager, CI and browser SDK, adds
+        @autter/runtime-cli to devDependencies, adds the Vite/Rollup, webpack
+        or Next.js plugin when the config is safe to edit (else a postbuild
+        step), turns on hidden maps, and prints what is left to do by hand,
+        including where to store AUTTER_RUNTIME_KEY. Never writes a key.
+        Safe to re-run. Exit 0: all applied; 2: manual actions remain; 1: error.
+verify  Checks a production build before deploy: every bundle has a debug
+        id, no .map file is left, no sourceMappingURL points at a missing
+        map, and (with AUTTER_RUNTIME_KEY) every bundle's map is on the
+        ingester. Exit 0: ok (upload unverified without a key); 1: problems.
+inject  Gives every .js/.mjs/.cjs bundle that has a source map a debug id
+        derived from its bytes: a "//# debugId=" comment, a one-line snippet
+        that registers it for @autter/runtime-browser, and "debugId" in the
+        .map. Running it again changes nothing.
+upload  Sends every map to <endpoint>/v1/sourcemaps with AUTTER_RUNTIME_KEY,
+        in parallel, skipping maps the ingester already has. Each map carries
+        the bundle's function scopes ("x_autter_scopes"), so stack frames are
+        named after the function they are in, not the call site.
+
+Options:
+  --release <r>          Default: $GITHUB_SHA, $VERCEL_GIT_COMMIT_SHA,
+                         $CF_PAGES_COMMIT_SHA, $GIT_SHA, then git rev-parse HEAD
+  --url-prefix <prefix>  Where <dir> is served from: "/" (default), "/static/",
+                         or "https://cdn.example.com/app/"
+  --endpoint <url>       Ingester base URL. Default: $AUTTER_ENDPOINT,
+                         $AUTTER_RUNTIME_ENDPOINT, $OTEL_EXPORTER_OTLP_ENDPOINT,
+                         then https://otlp.autter.dev
+  --concurrency <n>      Parallel uploads (default 8)
+  --delete-after-upload  Delete each .map once the ingester has it
+  --best-effort          For build scripts: never fail. Without a key, or when
+                         the upload fails, report it and exit 0; with
+                         --delete-after-upload, every .map under <dir> is then
+                         deleted anyway, so a build never ships maps
+  --install              setup: also run the package manager's install
+  --ignore <glob>        verify: JS files that are not bundles (repeatable)
+  --allow-maps           verify: report leftover .map files without failing
+  --dry-run              Show what would change or be uploaded; write and send nothing
+  --json                 Print the result as JSON
+  -h, --help             Show this help
+  -v, --version          Print the version
+
+Environment:
+  AUTTER_RUNTIME_KEY     Upload-only key (autter_rtu_\u2026, recommended for CI: it
+                         can only upload source maps) or the server key
+                         (autter_rt_\u2026, also works). Required by upload; used by
+                         verify to check the ingester. Never a client key.`;
+function ownVersion2() {
+  try {
+    return JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return "unknown";
+  }
+}
+function delegate(pkg, args) {
+  let manifest;
+  try {
+    manifest = createRequire(join5(process.cwd(), "package.json")).resolve(`${pkg}/package.json`);
+  } catch {
+    return null;
+  }
+  const bin = JSON.parse(readFileSync3(manifest, "utf8")).bin;
+  const relative6 = typeof bin === "string" ? bin : bin?.["autter-runtime"];
+  if (!relative6) return null;
+  const script = resolve4(dirname4(manifest), relative6);
+  if (!existsSync6(script)) return null;
+  const result = spawnSync2(process.execPath, [script, ...args], { stdio: "inherit" });
+  return result.status ?? 1;
+}
+var SOURCEMAPS_OPTIONS = {
+  release: { type: "string" },
+  "url-prefix": { type: "string" },
+  endpoint: { type: "string" },
+  concurrency: { type: "string" },
+  "delete-after-upload": { type: "boolean" },
+  "best-effort": { type: "boolean" },
+  install: { type: "boolean" },
+  ignore: { type: "string", multiple: true },
+  "allow-maps": { type: "boolean" },
+  "dry-run": { type: "boolean" },
+  json: { type: "boolean" },
+  help: { type: "boolean", short: "h" }
+};
+var ACTION_FLAGS = {
+  setup: ["dry-run", "install"],
+  inject: ["dry-run"],
+  upload: ["release", "url-prefix", "endpoint", "concurrency", "delete-after-upload", "best-effort", "dry-run"],
+  verify: ["endpoint", "url-prefix", "release", "ignore", "allow-maps"]
+};
+async function sourcemaps(argv) {
+  let parsed;
+  try {
+    parsed = parseArgs({ args: argv, allowPositionals: true, options: SOURCEMAPS_OPTIONS });
+  } catch (err) {
+    console.error(`${err.message}
+
+${USAGE}`);
+    return 64;
+  }
+  const { values, positionals } = parsed;
+  const [action, dirArg, ...extra] = positionals;
+  if (values.help) {
+    console.log(USAGE);
+    return 0;
+  }
+  const known = action !== void 0 && action in ACTION_FLAGS;
+  const dir = dirArg ?? (action === "setup" ? "." : void 0);
+  if (!known || !dir || extra.length) {
+    console.error(`${action && !known ? `unknown command: sourcemaps ${action}
+
+` : ""}${USAGE}`);
+    return 64;
+  }
+  const allowed = /* @__PURE__ */ new Set([...ACTION_FLAGS[action], "json", "help"]);
+  const stray = Object.keys(values).filter((flag) => !allowed.has(flag));
+  if (stray.length) {
+    console.error(`autter-runtime: sourcemaps ${action} does not take --${stray.join(", --")}
+
+${USAGE}`);
+    return 64;
+  }
+  if (!existsSync6(dir)) {
+    console.error(`autter-runtime: ${dir} does not exist`);
+    return action === "setup" ? 1 : 64;
+  }
+  const dryRun = Boolean(values["dry-run"]);
+  if (action === "setup") {
+    try {
+      const result = runSetup(dir, { dryRun, install: Boolean(values.install), installOutput: values.json ? "stderr" : "inherit" });
+      if (values.json) console.log(JSON.stringify(result, null, 2));
+      else for (const line of formatSetup(result)) console.log(line);
+      return result.exitCode;
+    } catch (err) {
+      console.error(`autter-runtime: sourcemaps setup: ${err instanceof Error ? err.message : String(err)}`);
+      return 1;
+    }
+  }
+  if (action === "verify") {
+    const result = await verifyDir(dir, {
+      endpoint: values.endpoint,
+      urlPrefix: values["url-prefix"],
+      release: values.release,
+      ignore: values.ignore,
+      allowMaps: Boolean(values["allow-maps"])
+    });
+    if (values.json) console.log(JSON.stringify(result, null, 2));
+    else for (const line of formatVerify(result)) console.log(line);
+    return result.ok ? 0 : 1;
+  }
+  if (action === "inject") {
     const results = await injectDir(dir, { dryRun });
     if (values.json) {
       console.log(JSON.stringify(results.map(({ path, debugId, status }) => ({ path, debugId, status })), null, 2));
@@ -570,28 +2783,55 @@ ${USAGE}`);
     console.error("autter-runtime: --concurrency must be a positive integer");
     return 64;
   }
-  const summary = await uploadDir(dir, {
+  const deleteAfterUpload = Boolean(values["delete-after-upload"]);
+  const bestEffort = Boolean(values["best-effort"]);
+  let summary = null;
+  let error = null;
+  const run = () => uploadDir(dir, {
     release: values.release,
     urlPrefix: values["url-prefix"],
     endpoint: values.endpoint,
     concurrency,
     dryRun,
-    deleteAfterUpload: Boolean(values["delete-after-upload"]),
+    deleteAfterUpload,
     log: (line) => console.error(line)
   });
-  if (values.json) console.log(JSON.stringify(summary, null, 2));
+  if (!bestEffort) summary = await run();
+  else if (!dryRun && !(process.env.AUTTER_RUNTIME_KEY ?? "").trim()) error = `AUTTER_RUNTIME_KEY is not set, so nothing was uploaded (${KEY_ADVICE})`;
   else {
-    if (!summary.uploaded.length && !summary.skipped.length && !summary.failed.length) {
-      console.log(`no .js/.mjs/.cjs bundles with source maps under ${dir}`);
+    try {
+      summary = await run();
+    } catch (err) {
+      error = err instanceof Error ? err.message : String(err);
+    }
+  }
+  let removedMaps = [];
+  if (bestEffort && deleteAfterUpload && !dryRun) {
+    const owners = new Map((await findBundles(dir)).map((bundle) => [bundle.map, bundle.js]));
+    removedMaps = (await removeSourceMaps(await findMapFiles(dir), owners)).map((map) => relative5(resolve4(dir), map).split(sep5).join("/"));
+  }
+  if (values.json) {
+    console.log(JSON.stringify({ ...summary ?? { uploaded: [], skipped: [], failed: [] }, ...bestEffort ? { error, removedMaps } : {} }, null, 2));
+  } else {
+    if (summary) {
+      if (!summary.uploaded.length && !summary.skipped.length && !summary.failed.length) {
+        console.log(`no .js/.mjs/.cjs bundles with source maps under ${dir}`);
+      }
+      for (const line of formatUploadSummary(summary)) console.log(line);
+    }
+    if (error) console.error(`autter-runtime: ${error}`);
+    if (removedMaps.length) {
+      const why = error ? "the upload did not run" : summary?.failed.length ? `${summary.failed.length} could not be uploaded` : "they were uploaded";
+      console.log(`removed ${removedMaps.length} source map(s) under ${dir}, so they are not deployed: ${why}`);
     }
-    for (const line of formatUploadSummary(summary)) console.log(line);
+    if (bestEffort && (error || summary?.failed.length)) console.error("autter-runtime: --best-effort: the build continues");
   }
-  return summary.failed.length ? 1 : 0;
+  return bestEffort ? 0 : summary?.failed.length ? 1 : 0;
 }
 async function main(argv) {
   const [command, ...rest] = argv;
   if (command === "-v" || command === "--version") {
-    console.log(ownVersion());
+    console.log(ownVersion2());
     return 0;
   }
   if (command === void 0 || command === "-h" || command === "--help" || command === "help") {