@autter/runtime-cli 1.0.0 → 1.2.0

package/dist/index.cjs

@@ -21,19 +21,29 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   BUNDLE_RE: () => BUNDLE_RE,
+  CLIENT_KEY_PREFIX: () => CLIENT_KEY_PREFIX,
   DEBUG_ID_RE: () => DEBUG_ID_RE,
   DEBUG_ID_REGISTRY: () => DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT: () => DEFAULT_ENDPOINT,
   FatalUploadError: () => FatalUploadError,
+  KEY_ADVICE: () => KEY_ADVICE,
+  MAX_MAP_CHARS: () => MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES: () => MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS: () => RELEASE_ENV_VARS,
   RELEASE_RE: () => RELEASE_RE,
+  SCOPES_KEY: () => SCOPES_KEY,
+  SCOPES_VERSION: () => SCOPES_VERSION,
+  SERVER_KEY_PREFIX: () => SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY: () => SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX: () => UPLOAD_KEY_PREFIX,
+  computeScopes: () => computeScopes,
   debugIdFor: () => debugIdFor,
   debugIdSnippet: () => debugIdSnippet,
   findBundles: () => findBundles,
   formatUploadSummary: () => formatUploadSummary,
+  formatVerify: () => formatVerify,
   gitHead: () => gitHead,
+  globToRegExp: () => globToRegExp,
   hasDebugIdSnippet: () => hasDebugIdSnippet,
   injectBundle: () => injectBundle,
   injectDir: () => injectDir,
@@ -49,7 +59,8 @@ __export(src_exports, {
   snippetLine: () => snippetLine,
   storedMapJson: () => storedMapJson,
   stripSourceMappingUrl: () => stripSourceMappingUrl,
-  uploadDir: () => uploadDir
+  uploadDir: () => uploadDir,
+  verifyDir: () => verifyDir
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -121,7 +132,7 @@ function mapPathFor(js, code) {
   const sibling = `${js}.map`;
   return (0, import_node_fs.existsSync)(sibling) ? sibling : null;
 }
-async function walk(dir, out) {
+async function walk(dir, out, pattern = BUNDLE_RE) {
   let entries;
   try {
     entries = await (0, import_promises.readdir)(dir, { withFileTypes: true });
@@ -131,10 +142,47 @@ async function walk(dir, out) {
   for (const entry of entries) {
     if (entry.name === "node_modules") continue;
     const full = (0, import_node_path.join)(dir, entry.name);
-    if (entry.isDirectory()) await walk(full, out);
-    else if (entry.isFile() && BUNDLE_RE.test(entry.name)) out.push(full);
+    if (entry.isDirectory()) await walk(full, out, pattern);
+    else if (entry.isFile() && pattern.test(entry.name)) out.push(full);
   }
 }
+var CSS_SOURCE_MAPPING_URL_RE = /\/\*[#@] sourceMappingURL=([^\s*]+)\s*\*\/\s*$/;
+function pointsAt(file, url, map) {
+  if (!url || /^[a-z][\w+.-]*:/i.test(url) || url.startsWith("/")) return false;
+  let path = url.split(/[?#]/)[0];
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+  }
+  return (0, import_node_path.resolve)((0, import_node_path.dirname)(file), path) === map;
+}
+async function stripReference(file, map) {
+  let code;
+  try {
+    code = await (0, import_promises.readFile)(file, "utf8");
+  } catch {
+    return;
+  }
+  let stripped = code;
+  if (BUNDLE_RE.test(file)) {
+    if (pointsAt(file, readSourceMappingUrl(code), map)) stripped = stripSourceMappingUrl(code);
+  } else if (file.endsWith(".css")) {
+    const match = CSS_SOURCE_MAPPING_URL_RE.exec(code);
+    if (match && pointsAt(file, match[1], map)) stripped = code.slice(0, match.index).replace(/\n?$/, "\n");
+  }
+  if (stripped !== code) await (0, import_promises.writeFile)(file, stripped);
+}
+async function removeSourceMaps(maps, owners = /* @__PURE__ */ new Map()) {
+  const removed = [];
+  for (const map of [...new Set(maps)].sort()) {
+    if (!(0, import_node_fs.existsSync)(map)) continue;
+    await (0, import_promises.rm)(map, { force: true });
+    removed.push(map);
+    const owner = owners.get(map) ?? map.replace(/\.map$/, "");
+    await stripReference(owner, map);
+  }
+  return removed;
+}
 async function findBundles(dir, files) {
   const root = (0, import_node_path.resolve)(dir);
   const candidates = [];
@@ -260,6 +308,8 @@ async function injectDir(dir, options = {}) {
 // src/upload.ts
 var import_node_crypto2 = require("crypto");
 var import_promises3 = require("fs/promises");
+var import_node_util = require("util");
+var import_node_zlib = require("zlib");
 
 // src/release.ts
 var import_node_child_process = require("child_process");
@@ -305,9 +355,386 @@ function resolveRelease(explicit, env = process.env, cwd = process.cwd()) {
   );
 }
 
+// src/scopes.ts
+var import_acorn = require("acorn");
+var SCOPES_KEY = "x_autter_scopes";
+var SCOPES_VERSION = 1;
+var BASE_OPTIONS = {
+  ecmaVersion: "latest",
+  allowHashBang: true,
+  allowReturnOutsideFunction: true,
+  allowReserved: true
+};
+function parseBundle(code) {
+  try {
+    return (0, import_acorn.parse)(code, {
+      ...BASE_OPTIONS,
+      sourceType: "module",
+      allowAwaitOutsideFunction: true,
+      allowImportExportEverywhere: true
+    });
+  } catch (moduleError) {
+    try {
+      return (0, import_acorn.parse)(code, { ...BASE_OPTIONS, sourceType: "script" });
+    } catch (scriptError) {
+      const pos = (err) => typeof err.pos === "number" ? err.pos : -1;
+      throw pos(scriptError) > pos(moduleError) ? scriptError : moduleError;
+    }
+  }
+}
+function isNode(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+var IDENTIFIER_NAME_RE = /^[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*$/u;
+function identifierToken(node) {
+  if (!isNode(node)) return null;
+  if (node.type === "Identifier") return { offset: node.start, name: node.name, literal: false };
+  if (node.type === "PrivateIdentifier") return { offset: node.start, name: `#${node.name}`, literal: false };
+  return null;
+}
+function literalToken(node) {
+  if (!isNode(node) || node.type !== "Literal" || typeof node.value !== "string") return null;
+  return IDENTIFIER_NAME_RE.test(node.value) ? { offset: node.start, name: node.value, literal: true } : null;
+}
+function keyToken(property) {
+  if (!property.computed) {
+    const id = identifierToken(property.key);
+    if (id) return id;
+  }
+  return literalToken(property.key);
+}
+function bindingToken(target) {
+  if (!isNode(target)) return null;
+  if (target.type === "Identifier") return identifierToken(target);
+  if (target.type === "MemberExpression") {
+    return target.computed ? literalToken(target.property) : identifierToken(target.property);
+  }
+  return null;
+}
+function contextTokens(node, parent) {
+  let token = null;
+  switch (parent?.type) {
+    case "VariableDeclarator":
+      if (parent.init === node) token = bindingToken(parent.id);
+      break;
+    case "AssignmentExpression":
+    case "AssignmentPattern":
+      if (parent.right === node) token = bindingToken(parent.left);
+      break;
+    case "Property":
+    case "PropertyDefinition":
+    case "MethodDefinition":
+      if (parent.value === node) token = keyToken(parent);
+      break;
+  }
+  return token ? [token] : [];
+}
+function classTokens(path) {
+  if (!path || path.node.type !== "ClassDeclaration" && path.node.type !== "ClassExpression") return [];
+  const own = identifierToken(path.node.id);
+  return [...own ? [own] : [], ...contextTokens(path.node, path.parent?.node)];
+}
+function describe(path) {
+  const fn = path.node;
+  const parent = path.parent?.node;
+  const own = identifierToken(fn.id);
+  const isMethod = parent?.type === "MethodDefinition" || parent?.type === "Property" && parent.value === fn && (parent.method === true || parent.kind !== "init");
+  let context;
+  if (parent?.type === "MethodDefinition" && parent.kind === "constructor") {
+    context = classTokens(path.parent?.parent?.parent ?? null);
+  } else {
+    context = contextTokens(fn, parent);
+  }
+  return {
+    start: fn.start,
+    end: fn.end,
+    own,
+    recoverAt: !own && fn.type !== "ArrowFunctionExpression" && !isMethod ? fn.start : null,
+    context
+  };
+}
+var FUNCTION_TYPES = /* @__PURE__ */ new Set(["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"]);
+function classInitializer(path) {
+  const node = path.node;
+  let range = null;
+  if (node.type === "StaticBlock") range = node;
+  else if (node.type === "PropertyDefinition" && isNode(node.value) && !FUNCTION_TYPES.has(node.value.type)) range = node.value;
+  if (!range) return null;
+  return { start: range.start, end: range.end, own: null, recoverAt: null, context: classTokens(path.parent?.parent ?? null) };
+}
+function collectFunctions(program) {
+  const found = [];
+  const stack = [{ node: program, parent: null }];
+  for (let path = stack.pop(); path; path = stack.pop()) {
+    const node = path.node;
+    if (FUNCTION_TYPES.has(node.type)) found.push(describe(path));
+    else {
+      const initializer = classInitializer(path);
+      if (initializer) found.push(initializer);
+    }
+    for (const key in node) {
+      const value = node[key];
+      if (Array.isArray(value)) {
+        for (let i = value.length - 1; i >= 0; i--) if (isNode(value[i])) stack.push({ node: value[i], parent: path });
+      } else if (isNode(value)) {
+        stack.push({ node: value, parent: path });
+      }
+    }
+  }
+  return found;
+}
+function lineStarts(code) {
+  const starts = [0];
+  for (let i = 0; i < code.length; i++) {
+    const c = code.charCodeAt(i);
+    if (c === 10 || c === 8232 || c === 8233) starts.push(i + 1);
+    else if (c === 13) {
+      if (code.charCodeAt(i + 1) === 10) i++;
+      starts.push(i + 1);
+    }
+  }
+  return starts;
+}
+function positionOf(starts, offset) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (starts[mid] <= offset) lo = mid;
+    else hi = mid - 1;
+  }
+  return [lo, offset - starts[lo]];
+}
+var BASE64 = new Int8Array(128).fill(-1);
+for (const [i, ch] of [..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"].entries()) BASE64[ch.charCodeAt(0)] = i;
+function findSegments(mappings, wanted) {
+  let line = 0;
+  let column = 0;
+  let source = 0;
+  let originalLine = 0;
+  let originalColumn = 0;
+  let name = 0;
+  let want = wanted.get(0);
+  const fields = [0, 0, 0, 0, 0];
+  let i = 0;
+  while (i < mappings.length) {
+    const ch = mappings.charCodeAt(i);
+    if (ch === 59) {
+      line++;
+      column = 0;
+      want = wanted.get(line);
+      i++;
+      continue;
+    }
+    if (ch === 44) {
+      i++;
+      continue;
+    }
+    let count = 0;
+    while (i < mappings.length) {
+      const next = mappings.charCodeAt(i);
+      if (next === 44 || next === 59) break;
+      let value = 0;
+      let shift = 0;
+      let digit;
+      do {
+        const code = mappings.charCodeAt(i++);
+        digit = code < 128 ? BASE64[code] : -1;
+        if (digit < 0 || shift > 30) throw new Error("invalid mappings");
+        value |= (digit & 31) << shift;
+        shift += 5;
+      } while (digit & 32);
+      const decoded = value & 1 ? -(value >>> 1) : value >>> 1;
+      if (count < 5) fields[count] = decoded;
+      count++;
+    }
+    column += fields[0];
+    if (count >= 4) {
+      source += fields[1];
+      originalLine += fields[2];
+      originalColumn += fields[3];
+    }
+    if (count >= 5) name += fields[4];
+    if (want && want.get(column) === null) {
+      want.set(column, {
+        source: count >= 4 ? source : -1,
+        line: originalLine,
+        column: originalColumn,
+        name: count >= 5 ? name : -1
+      });
+    }
+  }
+}
+function looksMangled(name) {
+  return name.replace(/^#/, "").length <= 2;
+}
+var IDENTIFIER_AT_RE = /[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*/uy;
+var OWN_NAME_AT_RE = /(?:async\s+)?function\b\s*\*?\s*([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)/uy;
+var NOT_A_NAME = new Set(
+  "abstract async await break case catch class const continue debugger declare default delete do else enum export extends false finally for function get if implements import in instanceof interface let new null of override package private protected public readonly return set static super switch this throw true try typeof var void while with yield".split(" ")
+);
+var NameResolver = class {
+  constructor(map, segmentAt) {
+    this.segmentAt = segmentAt;
+    this.names = Array.isArray(map.names) ? map.names : [];
+    this.sourcesContent = Array.isArray(map.sourcesContent) ? map.sourcesContent : [];
+  }
+  segmentAt;
+  names;
+  sourcesContent;
+  sourceLines = /* @__PURE__ */ new Map();
+  originalLine(segment) {
+    if (segment.source < 0) return null;
+    let lines = this.sourceLines.get(segment.source);
+    if (lines === void 0) {
+      const content = this.sourcesContent[segment.source];
+      lines = typeof content === "string" ? content.split(/\r\n|[\n\r\u2028\u2029]/) : null;
+      this.sourceLines.set(segment.source, lines);
+    }
+    return lines?.[segment.line] ?? null;
+  }
+  /** The original identifier at a segment's source position. */
+  identifierAt(segment, re, group = 0) {
+    const text = this.originalLine(segment);
+    if (text === null) return null;
+    re.lastIndex = segment.column;
+    const found = re.exec(text)?.[group];
+    return found && !NOT_A_NAME.has(found) ? found : null;
+  }
+  /** Original name of a token: the map's `names` at its exact position;
+   * else the generated name when it isn't mangled; else the identifier
+   * at the mapped position in `sourcesContent`. Null when unknown. */
+  resolve(token) {
+    if (token.literal) return token.name;
+    const segment = this.segmentAt(token.offset);
+    if (segment && segment.name >= 0) {
+      const name = this.names[segment.name];
+      if (typeof name === "string" && name) return name;
+    }
+    if (!looksMangled(token.name)) return token.name;
+    return segment ? this.identifierAt(segment, IDENTIFIER_AT_RE) : null;
+  }
+  /** The name a minifier removed from `function name() {}`, read from the
+   * original source at the function's mapped start. */
+  recover(offset) {
+    const segment = this.segmentAt(offset);
+    return segment ? this.identifierAt(segment, OWN_NAME_AT_RE, 1) : null;
+  }
+};
+var BASE64_DIGITS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function vlq(value) {
+  let rest = value < 0 ? -value << 1 | 1 : value << 1;
+  let out = "";
+  do {
+    let digit = rest & 31;
+    rest >>>= 5;
+    if (rest > 0) digit |= 32;
+    out += BASE64_DIGITS[digit];
+  } while (rest > 0);
+  return out;
+}
+function encodeScopes(entries) {
+  const parts = [];
+  let line = 0;
+  let previousStart = 0;
+  let previousName = 0;
+  let firstOnLine = true;
+  for (const [startLine, startColumn, endLine, endColumn, nameIndex] of entries) {
+    if (startLine > line) {
+      parts.push(";".repeat(startLine - line));
+      line = startLine;
+      previousStart = 0;
+      firstOnLine = true;
+    }
+    if (!firstOnLine) parts.push(",");
+    firstOnLine = false;
+    let segment = vlq(startColumn - previousStart) + vlq(endLine - startLine) + vlq(endLine === startLine ? endColumn - startColumn : endColumn);
+    previousStart = startColumn;
+    if (nameIndex >= 0) {
+      segment += vlq(nameIndex - previousName);
+      previousName = nameIndex;
+    }
+    parts.push(segment);
+  }
+  return parts.join("");
+}
+function computeScopes(code, map) {
+  try {
+    return scopesOf(code, map);
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function scopesOf(code, map) {
+  if (typeof map.mappings !== "string") return { error: "the map has no mappings string" };
+  let functions;
+  try {
+    functions = collectFunctions(parseBundle(code));
+  } catch (err) {
+    return { error: `could not parse the bundle: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  const starts = lineStarts(code);
+  const wanted = /* @__PURE__ */ new Map();
+  const want = (offset) => {
+    const [line, column] = positionOf(starts, offset);
+    let columns = wanted.get(line);
+    if (!columns) wanted.set(line, columns = /* @__PURE__ */ new Map());
+    columns.set(column, null);
+  };
+  for (const fn of functions) {
+    if (fn.own && !fn.own.literal) want(fn.own.offset);
+    if (fn.recoverAt !== null) want(fn.recoverAt);
+    for (const token of fn.context) if (!token.literal) want(token.offset);
+  }
+  try {
+    findSegments(map.mappings, wanted);
+  } catch (err) {
+    return { error: `could not read the map: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  const resolver = new NameResolver(map, (offset) => {
+    const [line, column] = positionOf(starts, offset);
+    return wanted.get(line)?.get(column) ?? null;
+  });
+  functions.sort((a, b) => a.start - b.start || b.end - a.end);
+  const mapNames = Array.isArray(map.names) ? map.names : [];
+  const nameIndex = /* @__PURE__ */ new Map();
+  mapNames.forEach((name, index) => {
+    if (typeof name === "string" && !nameIndex.has(name)) nameIndex.set(name, index);
+  });
+  const extraNames = [];
+  const indexOf = (name) => {
+    let index = nameIndex.get(name);
+    if (index === void 0) {
+      index = mapNames.length + extraNames.push(name) - 1;
+      nameIndex.set(name, index);
+    }
+    return index;
+  };
+  const entries = functions.map((fn) => {
+    let name = fn.own ? resolver.resolve(fn.own) : null;
+    if (name === null && fn.recoverAt !== null) name = resolver.recover(fn.recoverAt);
+    for (const token of fn.context) {
+      if (name !== null) break;
+      name = resolver.resolve(token);
+    }
+    const index = name !== null ? indexOf(name) : fn.own || fn.context.length > 0 ? indexOf(null) : -1;
+    const [startLine, startColumn] = positionOf(starts, fn.start);
+    const [endLine, endColumn] = positionOf(starts, fn.end);
+    return [startLine, startColumn, endLine, endColumn, index];
+  });
+  return { scopes: { version: SCOPES_VERSION, names: extraNames, scopes: encodeScopes(entries) } };
+}
+
 // src/upload.ts
 var DEFAULT_ENDPOINT = "https://otlp.autter.dev";
-var MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+var MAX_MAP_CHARS = 32 * 1024 * 1024;
+var MAX_UPLOAD_BYTES = MAX_MAP_CHARS + 1024 * 1024;
+var LEGACY_MAX_BYTES = 5 * 1024 * 1024;
+var UPLOAD_KEY_PREFIX = "autter_rtu_";
+var SERVER_KEY_PREFIX = "autter_rt_";
+var CLIENT_KEY_PREFIX = "autter_rtc_";
+var KEY_ADVICE = "set AUTTER_RUNTIME_KEY to an upload-only key (autter_rtu_\u2026, recommended for CI: it can only upload source maps) or the full server key (autter_rt_\u2026, also works)";
+var gzip = (0, import_node_util.promisify)(import_node_zlib.gzip);
 var CHECK_BATCH = 500;
 var MAX_ATTEMPTS = 3;
 function resolveEndpoint(flag, env = process.env) {
@@ -324,7 +751,16 @@ function storedMapJson(map) {
   const { sourcesContent: _omitted, ...safe } = map;
   return JSON.stringify(safe);
 }
-async function prepare(bundle, urlPrefix, release) {
+function bytesOf(buffer) {
+  return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+}
+function fits(json, body) {
+  return json.length <= MAX_MAP_CHARS && Buffer.byteLength(body) <= MAX_UPLOAD_BYTES;
+}
+function uploadBody(release, filename, debugId, json) {
+  return `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
+}
+async function prepare(bundle, urlPrefix, release, log, compress) {
   let map;
   try {
     map = JSON.parse(await (0, import_promises3.readFile)(bundle.map, "utf8"));
@@ -336,23 +772,37 @@ async function prepare(bundle, urlPrefix, release) {
   }
   const code = await (0, import_promises3.readFile)(bundle.js, "utf8");
   const debugId = readDebugIdComment(code) ?? normalizeDebugId(map.debugId);
-  const json = storedMapJson(map);
   const filename = servedFilename(urlPrefix, bundle.path);
-  const body = `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
+  const { [SCOPES_KEY]: _stale, ...plain } = map;
+  const scopes = computeScopes(code, map);
+  let json = storedMapJson(plain);
+  if ("scopes" in scopes) {
+    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes });
+    if (fits(scoped, uploadBody(release, filename, debugId, scoped))) json = scoped;
+    else if (fits(json, uploadBody(release, filename, debugId, json))) {
+      log(`warning: ${bundle.path}: its map is over 32 MB with function scopes, so it is uploaded without them (frames keep call-site names)`);
+    }
+  } else {
+    log(`warning: ${bundle.path}: no function scopes (${scopes.error}); its map is uploaded without them (frames keep call-site names)`);
+  }
+  const body = uploadBody(release, filename, debugId, json);
   return {
     bundle,
-    body,
+    // Maps are text that compresses several times over; the ingester
+    // inflates the body (Content-Encoding: gzip).
+    body: compress && fits(json, body) ? bytesOf(await gzip(body)) : new Uint8Array(0),
     path: bundle.path,
     filename,
     debugId,
     hash: (0, import_node_crypto2.createHash)("sha256").update(json).digest("hex"),
-    bytes: Buffer.byteLength(body)
+    bytes: Buffer.byteLength(body),
+    mapChars: json.length
   };
 }
 var FatalUploadError = class extends Error {
 };
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function uploadDir(dir, options = {}) {
   const env = options.env ?? process.env;
@@ -374,14 +824,14 @@ async function uploadDir(dir, options = {}) {
   };
   const items = [];
   for (const bundle of await findBundles(dir, options.files)) {
-    const prepared = await prepare(bundle, options.urlPrefix, release);
+    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun);
     if ("error" in prepared) {
       summary.failed.push({ path: bundle.path, filename: servedFilename(options.urlPrefix, bundle.path), error: prepared.error });
-    } else if (prepared.bytes > MAX_UPLOAD_BYTES) {
+    } else if (prepared.mapChars > MAX_MAP_CHARS || prepared.bytes > MAX_UPLOAD_BYTES) {
       summary.failed.push({
         path: prepared.path,
         filename: prepared.filename,
-        error: `map is ${(prepared.bytes / 1048576).toFixed(1)} MB without sourcesContent; the ingester accepts up to 5 MB`
+        error: `map is ${(prepared.mapChars / 1048576).toFixed(1)} MB without sourcesContent; the ingester accepts up to 32 MB`
       });
     } else {
       items.push(prepared);
@@ -392,11 +842,15 @@ async function uploadDir(dir, options = {}) {
     return summary;
   }
   const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
-  if (!key) throw new FatalUploadError("no ingest key: set AUTTER_RUNTIME_KEY to a server key (autter_rt_\u2026)");
-  if (key.startsWith("autter_rtc_")) {
-    throw new FatalUploadError("AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026); uploads need a server key (autter_rt_\u2026)");
+  if (!key) throw new FatalUploadError(`no ingest key: ${KEY_ADVICE}`);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    throw new FatalUploadError(`AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which cannot upload source maps: ${KEY_ADVICE}`);
   }
+  const rejected = (status, detail) => new FatalUploadError(
+    `the ingester rejected the key (${status}): ${detail}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later; the server key works with any)" : "")
+  );
   const headers = { "content-type": "application/json", authorization: `Bearer ${key}` };
+  const uploadHeaders = { ...headers, "content-encoding": "gzip" };
   const skipped = /* @__PURE__ */ new Set();
   for (let start = 0; start < items.length && !summary.legacyIngester; start += CHECK_BATCH) {
     const batch = items.slice(start, start + CHECK_BATCH);
@@ -416,9 +870,7 @@ async function uploadDir(dir, options = {}) {
         );
         break;
       }
-      if (res.status === 401 || res.status === 403) {
-        throw new FatalUploadError(`the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}`);
-      }
+      if (res.status === 401 || res.status === 403) throw rejected(res.status, (await res.text()).slice(0, 300));
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const body = await res.json();
       const present = new Set(Array.isArray(body.present) ? body.present : []);
@@ -438,7 +890,7 @@ async function uploadDir(dir, options = {}) {
       let status = 0;
       let detail = "";
       try {
-        const res = await doFetch(`${endpoint}/v1/sourcemaps`, { method: "POST", headers, body: item.body });
+        const res = await doFetch(`${endpoint}/v1/sourcemaps`, { method: "POST", headers: uploadHeaders, body: item.body });
         status = res.status;
         if (res.ok) {
           uploaded.push(item);
@@ -449,12 +901,16 @@ async function uploadDir(dir, options = {}) {
         detail = err.message;
       }
       if (status === 401 || status === 403) {
-        fatal = new FatalUploadError(`the ingester rejected the key (${status}): ${detail}`);
+        fatal = rejected(status, detail);
         return;
       }
       const retryable = status === 0 || status === 429 || status >= 500;
       if (!retryable || attempt >= MAX_ATTEMPTS) {
-        summary.failed.push({ path: item.path, filename: item.filename, error: status ? `HTTP ${status}: ${detail}` : detail });
+        let error = status ? `HTTP ${status}: ${detail}` : detail;
+        if (status === 413 && item.bytes > LEGACY_MAX_BYTES) {
+          error += ` (this map is ${(item.bytes / 1048576).toFixed(1)} MB; ingester 1.6.0 and older accept up to 5 MB, newer ones 32 MB)`;
+        }
+        summary.failed.push({ path: item.path, filename: item.filename, error });
         return;
       }
       await sleep(500 * 2 ** (attempt - 1));
@@ -486,7 +942,253 @@ function strip(item) {
   return { path, filename, debugId, hash, bytes };
 }
 
+// src/verify.ts
+var import_node_fs2 = require("fs");
+var import_promises4 = require("fs/promises");
+var import_node_path2 = require("path");
+var CHECK_BATCH2 = 500;
+var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
+var NOT_BUNDLES = [
+  [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
+  [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
+  [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
+];
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") {
+      re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(glob.includes("/") ? `^${re.replace(/^\.\//, "")}$` : `(^|/)${re}$`);
+}
+async function walk2(dir, out) {
+  let entries;
+  try {
+    entries = await (0, import_promises4.readdir)(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === "node_modules") continue;
+    const full = (0, import_node_path2.join)(dir, entry.name);
+    if (entry.isDirectory()) await walk2(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+}
+function staticRoots(dir) {
+  for (let current = (0, import_node_path2.dirname)(dir); (0, import_node_path2.dirname)(current) !== current; current = (0, import_node_path2.dirname)(current)) {
+    if ((0, import_node_fs2.existsSync)((0, import_node_path2.join)(current, "package.json"))) return ["public", "static", "src"].map((name) => (0, import_node_path2.join)(current, name));
+  }
+  return [];
+}
+async function verifyDir(dir, options = {}) {
+  const root = (0, import_node_path2.resolve)(dir);
+  const env = options.env ?? process.env;
+  const files = [];
+  await walk2(root, files);
+  files.sort();
+  const relPath = (path) => (0, import_node_path2.relative)(root, path).split(import_node_path2.sep).join("/");
+  const ignore = (options.ignore ?? []).map(globToRegExp);
+  const roots = staticRoots(root);
+  const result = {
+    dir: root,
+    ok: true,
+    bundles: [],
+    maps: [],
+    upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
+    failures: []
+  };
+  const fail = (path, reason) => result.failures.push({ path, reason });
+  for (const file of files) {
+    const path = relPath(file);
+    if (file.endsWith(".map")) {
+      result.maps.push(path);
+      if (!options.allowMaps) {
+        fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
+      }
+      continue;
+    }
+    if (!BUNDLE_RE.test(file)) continue;
+    const bytes = await (0, import_promises4.readFile)(file);
+    const bundle = { path, status: "ok", debugId: null, reasons: [], uploaded: null };
+    result.bundles.push(bundle);
+    const skip = (reason) => {
+      bundle.status = "skipped";
+      bundle.reasons.push(reason);
+    };
+    if (ignore.some((re) => re.test(path))) {
+      skip("matches --ignore");
+      continue;
+    }
+    const known = NOT_BUNDLES.find(([re]) => re.test(path));
+    if (known) {
+      skip(known[1]);
+      continue;
+    }
+    let copied = null;
+    for (const staticRoot of roots) {
+      const candidate = (0, import_node_path2.join)(staticRoot, path);
+      if ((0, import_node_fs2.existsSync)(candidate) && (await (0, import_promises4.readFile)(candidate)).equals(bytes)) copied = (0, import_node_path2.relative)((0, import_node_path2.dirname)(staticRoot), candidate).split(import_node_path2.sep).join("/");
+    }
+    if (copied) {
+      skip(`copied unchanged from ${copied}, not built`);
+      continue;
+    }
+    const code = bytes.toString("utf8");
+    const commentId = readDebugIdComment(code);
+    const snippetId = SNIPPET_ID_RE.exec(code)?.[1] ?? null;
+    bundle.debugId = commentId;
+    if (!commentId && !hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "no debug id: its errors can't be matched to a source map. Run `autter-runtime sourcemaps inject` on the build output (or use the bundler plugin with AUTTER_RUNTIME_KEY set) before deploying"
+      );
+    } else if (!commentId) {
+      bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
+    } else if (!hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "has a //# debugId= comment but no registration snippet, so the browser SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+      );
+    } else if (snippetId && snippetId !== commentId) {
+      bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
+    }
+    const url = readSourceMappingUrl(code);
+    if (url?.startsWith("data:")) {
+      bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+    } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
+      let target = url.split(/[?#]/)[0];
+      try {
+        target = decodeURIComponent(target);
+      } catch {
+      }
+      if (!(0, import_node_fs2.existsSync)((0, import_node_path2.resolve)((0, import_node_path2.dirname)(file), target))) {
+        bundle.reasons.push(
+          `its sourceMappingURL points at ${url}, which is not in the output (browsers' devtools request it and get a 404). Remove the comment: upload --delete-after-upload does`
+        );
+      }
+    }
+    if (bundle.reasons.length) {
+      bundle.status = "failed";
+      for (const reason of bundle.reasons) fail(path, reason);
+    }
+  }
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  if (!counted.length) fail(".", `no .js/.mjs/.cjs bundles under ${dir}: is this the build output?`);
+  await checkUploads(result, counted, options, env);
+  result.ok = result.failures.length === 0;
+  return result;
+}
+async function checkUploads(result, bundles, options, env) {
+  const upload = result.upload;
+  const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
+  if (!key) {
+    upload.reason = "AUTTER_RUNTIME_KEY is not set: only the local checks ran";
+    return;
+  }
+  upload.endpoint = resolveEndpoint(options.endpoint, env);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    upload.status = "error";
+    upload.reason = "AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which can't check source maps: use an upload key (autter_rtu_\u2026) or the server key (autter_rt_\u2026)";
+    result.failures.push({ path: ".", reason: upload.reason });
+    return;
+  }
+  const withIds = bundles.filter((b) => b.debugId);
+  if (!withIds.length) {
+    upload.reason = "no bundle has a debug id to check";
+    return;
+  }
+  let release = "verify";
+  try {
+    release = resolveRelease(options.release, env, options.cwd).release;
+  } catch {
+  }
+  const doFetch = options.fetch ?? fetch;
+  const missing = [];
+  for (let start = 0; start < withIds.length; start += CHECK_BATCH2) {
+    const batch = withIds.slice(start, start + CHECK_BATCH2);
+    let res;
+    try {
+      res = await doFetch(`${upload.endpoint}/v1/sourcemaps/check`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+        body: JSON.stringify({ release, files: batch.map((b) => ({ filename: servedFilename(options.urlPrefix, b.path), debugId: b.debugId })) })
+      });
+    } catch (err) {
+      upload.status = "error";
+      upload.reason = `could not reach the ingester: ${err.message}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (res.status === 404 || res.status === 400) {
+      upload.status = "unverified";
+      upload.reason = res.status === 404 ? "the ingester predates 1.6.0 (no /v1/sourcemaps/check), so uploads can't be checked: upgrade it" : "the ingester predates 1.7.0, which checks maps by debug id alone, so uploads can't be checked after the maps were deleted: upgrade it";
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      upload.status = "error";
+      upload.reason = `the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later)" : "");
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (!res.ok) {
+      upload.status = "error";
+      upload.reason = `the source map check failed: HTTP ${res.status}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    const body = await res.json();
+    const present = new Set(Array.isArray(body.present) ? body.present : []);
+    batch.forEach((bundle, index) => {
+      bundle.uploaded = present.has(index);
+      if (!bundle.uploaded) missing.push(bundle);
+    });
+  }
+  upload.checked = withIds.length;
+  upload.missing = missing.length;
+  upload.status = missing.length ? "missing" : "verified";
+  upload.reason = missing.length ? `${missing.length} of ${withIds.length} bundle(s) have no map on the ingester` : null;
+  for (const bundle of missing) {
+    const reason = `no map with debug id ${bundle.debugId} on the ingester for this key's repository: upload this build's maps (autter-runtime sourcemaps upload, or the bundler plugin with AUTTER_RUNTIME_KEY set)`;
+    bundle.status = "failed";
+    bundle.reasons.push(reason);
+    result.failures.push({ path: bundle.path, reason });
+  }
+}
+function formatVerify(result) {
+  const lines = [];
+  for (const bundle of result.bundles) {
+    if (bundle.status === "ok") lines.push(`ok      ${bundle.path} (debug id ${bundle.debugId}${bundle.uploaded ? ", map uploaded" : ""})`);
+    else if (bundle.status === "skipped") lines.push(`skipped ${bundle.path}: ${bundle.reasons.join("; ")}`);
+    else for (const reason of bundle.reasons) lines.push(`FAILED  ${bundle.path}: ${reason}`);
+  }
+  for (const map of result.maps) {
+    const failure = result.failures.find((f) => f.path === map);
+    lines.push(failure ? `FAILED  ${map}: ${failure.reason}` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`);
+  }
+  for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
+  const u = result.upload;
+  lines.push(
+    u.status === "verified" ? `upload: verified, ${u.checked} bundle map(s) on the ingester (${u.endpoint})` : u.status === "missing" ? `upload: ${u.reason} (${u.endpoint})` : `upload: ${u.status}${u.reason ? `, ${u.reason}` : ""}`
+  );
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  lines.push(
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (--allow-maps)` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+  );
+  return lines;
+}
+
 // src/build.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+function buildKey(options) {
+  const key = (options.key ?? process.env.AUTTER_RUNTIME_KEY ?? "").trim();
+  return key || null;
+}
 function formatUploadSummary(summary) {
   const lines = [];
   const verb = summary.dryRun ? "would upload" : "uploaded";
@@ -505,63 +1207,117 @@ async function processBuildOutput(input) {
   const log = (line) => {
     if (!options.silent) console.log(`[autter-runtime] ${line}`);
   };
-  const result = { injected: [], upload: null };
+  const result = { injected: [], upload: null, removedMaps: [] };
+  let outcome = "they were uploaded";
+  const owners = /* @__PURE__ */ new Map();
+  if (input.ownMaps) {
+    for (const bundle of await findBundles(input.dir, input.files)) owners.set(bundle.map, bundle.js);
+  }
   try {
-    result.injected = await injectDir(input.dir, {
-      files: input.files,
-      dryRun: options.dryRun,
-      stripSourceMappingUrl: input.stripSourceMappingUrl
-    });
-    const changed = result.injected.filter((r) => r.status === "injected").length;
-    if (result.injected.length) {
-      log(`debug ids: ${changed} bundle(s) injected, ${result.injected.length - changed} already had one`);
-    }
-    for (const bad of result.injected.filter((r) => r.status === "invalid-map")) log(`skipped ${bad.path}: its map is not valid JSON`);
-    if (options.upload === false) return result;
-    const key = options.key ?? process.env.AUTTER_RUNTIME_KEY;
-    if (!key && !options.dryRun) {
-      if (result.injected.length) log("AUTTER_RUNTIME_KEY is not set: source maps were not uploaded");
-      return result;
-    }
-    if (!result.injected.some((r) => r.status !== "invalid-map")) return result;
-    result.upload = await uploadDir(input.dir, {
-      files: input.files,
-      release: options.release,
-      urlPrefix: options.urlPrefix ?? input.urlPrefix,
-      endpoint: options.endpoint,
-      key,
-      dryRun: options.dryRun,
-      concurrency: options.concurrency,
-      deleteAfterUpload: options.deleteAfterUpload ?? input.deleteAfterUpload,
-      log
-    });
-    for (const line of formatUploadSummary(result.upload)) log(line);
-    if (result.upload.failed.length && options.failOnError) {
-      throw new Error(`${result.upload.failed.length} source map upload(s) failed`);
+    try {
+      result.injected = await injectDir(input.dir, {
+        files: input.files,
+        dryRun: options.dryRun,
+        stripSourceMappingUrl: input.stripSourceMappingUrl
+      });
+      const changed = result.injected.filter((r) => r.status === "injected").length;
+      if (result.injected.length) {
+        log(`debug ids: ${changed} bundle(s) injected, ${result.injected.length - changed} already had one`);
+      }
+      for (const bad of result.injected.filter((r) => r.status === "invalid-map")) log(`skipped ${bad.path}: its map is not valid JSON`);
+      if (options.upload === false) return result;
+      const key = buildKey(options);
+      if (!key && !options.dryRun) {
+        outcome = "AUTTER_RUNTIME_KEY is not set";
+        if (result.injected.length && !input.ownMaps) log("AUTTER_RUNTIME_KEY is not set: source maps were not uploaded");
+        return result;
+      }
+      if (!result.injected.some((r) => r.status !== "invalid-map")) {
+        outcome = "no bundle had a usable map to upload";
+        return result;
+      }
+      result.upload = await uploadDir(input.dir, {
+        files: input.files,
+        release: options.release,
+        urlPrefix: options.urlPrefix ?? input.urlPrefix,
+        endpoint: options.endpoint,
+        key: key ?? void 0,
+        dryRun: options.dryRun,
+        concurrency: options.concurrency,
+        deleteAfterUpload: options.deleteAfterUpload ?? input.deleteAfterUpload,
+        log
+      });
+      for (const line of formatUploadSummary(result.upload)) log(line);
+      const { failed, uploaded, skipped, dryRun } = result.upload;
+      if (dryRun) outcome = "dry run, nothing was uploaded";
+      else if (failed.length) {
+        outcome = `${failed.length} of ${failed.length + uploaded.length + skipped.length} could not be uploaded (${failed[0].error})`;
+      }
+      if (failed.length && options.failOnError) {
+        throw new Error(`${failed.length} source map upload(s) failed`);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (outcome === "they were uploaded") outcome = `the upload failed (${message})`;
+      if (options.failOnError) throw new Error(`[autter-runtime] source maps: ${message}`);
+      if (!options.silent) console.warn(`[autter-runtime] source maps: ${message}`);
     }
-  } catch (err) {
-    const message = `source maps: ${err instanceof Error ? err.message : String(err)}`;
-    if (options.failOnError) throw new Error(`[autter-runtime] ${message}`);
-    if (!options.silent) console.warn(`[autter-runtime] ${message}`);
+  } finally {
+    await cleanUp();
   }
   return result;
+  async function cleanUp() {
+    if (!input.ownMaps) return;
+    const maps = /* @__PURE__ */ new Set([...input.maps ?? [], ...owners.keys()]);
+    const rel = (path) => (0, import_node_path3.relative)(input.dir, path).split(import_node_path3.sep).join("/");
+    if (options.upload === false || options.deleteAfterUpload === false) {
+      const kept = [...maps].filter((map) => (0, import_node_fs3.existsSync)(map));
+      if (kept.length) {
+        log(
+          `kept ${kept.length} source map(s) this plugin generated (${options.upload === false ? "upload: false" : "deleteAfterUpload: false"}): they expose your source, so upload them with \`autter-runtime sourcemaps upload --delete-after-upload\` or keep them out of the deploy`
+        );
+      }
+      return;
+    }
+    try {
+      await removeSourceMaps(maps, owners);
+    } catch (err) {
+      const message = `could not delete the source maps this plugin generated (${err instanceof Error ? err.message : String(err)}): keep them out of the deploy`;
+      if (options.failOnError) throw new Error(`[autter-runtime] ${message}`);
+      if (!options.silent) console.warn(`[autter-runtime] ${message}`);
+    }
+    result.removedMaps = [...maps].filter((map) => !(0, import_node_fs3.existsSync)(map)).map(rel).sort();
+    if (result.removedMaps.length) {
+      log(`removed ${result.removedMaps.length} source map(s) this plugin generated, so they are not deployed: ${outcome}`);
+    }
+  }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BUNDLE_RE,
+  CLIENT_KEY_PREFIX,
   DEBUG_ID_RE,
   DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT,
   FatalUploadError,
+  KEY_ADVICE,
+  MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS,
   RELEASE_RE,
+  SCOPES_KEY,
+  SCOPES_VERSION,
+  SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX,
+  computeScopes,
   debugIdFor,
   debugIdSnippet,
   findBundles,
   formatUploadSummary,
+  formatVerify,
   gitHead,
+  globToRegExp,
   hasDebugIdSnippet,
   injectBundle,
   injectDir,
@@ -577,5 +1333,6 @@ async function processBuildOutput(input) {
   snippetLine,
   storedMapJson,
   stripSourceMappingUrl,
-  uploadDir
+  uploadDir,
+  verifyDir
 });