@autter/runtime-cli 1.0.0 → 1.2.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, M as MAX_UPLOAD_BYTES, S as SNIPPET_LINE_KEY, U as UploadItem, d as UploadOptions, e as UploadSummary, f as findBundles, g as formatUploadSummary, i as injectBundle, h as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, j as resolveEndpoint, s as servedFilename, k as shiftMappings, l as snippetLine, n as storedMapJson, o as stripSourceMappingUrl, u as uploadDir } from './build-BXFh_jbP.cjs';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, n as resolveEndpoint, s as servedFilename, o as shiftMappings, q as snippetLine, t as storedMapJson, u as stripSourceMappingUrl, v as uploadDir } from './build-BqjqqeLg.cjs';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -28,6 +28,115 @@ declare function debugIdSnippet(id: string): string;
  * contains it too.) */
 declare function hasDebugIdSnippet(code: string): boolean;
 
+interface VerifyOptions {
+    /** Ingester base URL (default as for upload). */
+    endpoint?: string;
+    /** Default: $AUTTER_RUNTIME_KEY. */
+    key?: string;
+    /** Sent with the check (a debug id check ignores it). */
+    release?: string;
+    urlPrefix?: string;
+    /** Globs (relative to the directory) of JS files that are not bundles. */
+    ignore?: string[];
+    /** Report leftover .map files without failing (a step that runs before they are removed). */
+    allowMaps?: boolean;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    fetch?: typeof fetch;
+}
+interface VerifyBundle {
+    /** Relative to the directory. */
+    path: string;
+    status: "ok" | "failed" | "skipped";
+    debugId: string | null;
+    /** Why it failed, or why it was skipped. */
+    reasons: string[];
+    /** Whether the ingester has a map for its debug id (null: not checked). */
+    uploaded: boolean | null;
+}
+interface VerifyResult {
+    dir: string;
+    ok: boolean;
+    bundles: VerifyBundle[];
+    /** `.map` files in the directory (deploy risks unless allowMaps). */
+    maps: string[];
+    upload: {
+        /** verified: every checked bundle's map is on the ingester; missing: some are not;
+         * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */
+        status: "verified" | "missing" | "unverified" | "error";
+        endpoint: string | null;
+        reason: string | null;
+        checked: number;
+        missing: number;
+    };
+    /** Every failure, one per file and reason. */
+    failures: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
+/** A tiny glob: `**` any path, `*` any name part, `?` one character. A
+ * pattern without "/" matches the file name anywhere. */
+declare function globToRegExp(glob: string): RegExp;
+declare function verifyDir(dir: string, options?: VerifyOptions): Promise<VerifyResult>;
+/** Human-readable report. */
+declare function formatVerify(result: VerifyResult): string[];
+
+/**
+ * Function scopes for scope-based frame names (like Sentry's
+ * js-source-scopes and PostHog cymbal's `token.scope()`).
+ *
+ * The ingester used to name a resolved frame with the name the source map
+ * holds at its CALLER's position. That is right for `computeTotal()`, and
+ * wrong whenever the call goes through a variable: `const run =
+ * actions.captured; run()` reported `run`, and handlers a framework calls
+ * got the framework's identifier (`func`, `listener`, `fn`). So `upload`
+ * parses each bundle (the final file the browser loads, after `inject`),
+ * collects every function's generated range and the token that names it,
+ * maps that token to its ORIGINAL identifier, and sends the result with the
+ * map as `x_autter_scopes`. The ingester names a frame after the innermost
+ * function that contains it.
+ */
+/** Source map extension field that carries the bundle's function scopes. */
+declare const SCOPES_KEY = "x_autter_scopes";
+declare const SCOPES_VERSION = 1;
+/**
+ * The `x_autter_scopes` value. `scopes` is encoded like `mappings`: base64
+ * VLQ, `;` between generated lines (the line each scope starts on), `,`
+ * between the scopes that start on one line, in start order (outer first on
+ * a tie). Each scope is 3 or 4 values, 0-based, in UTF-16 columns:
+ *
+ *   1. start column, relative to the previous scope's start on the same
+ *      line (absolute for a line's first scope);
+ *   2. end line, relative to the start line;
+ *   3. end column (exclusive), relative to the start column when the scope
+ *      ends on its start line, else absolute;
+ *   4. the name, when the function has one: an index into the map's own
+ *      `names` followed by these `names`, relative to the last name index
+ *      written (starting from 0).
+ *
+ * A 3-value scope is anonymous. `names` holds only names the map's own
+ * `names` lacks; a `null` entry stands for a minified name that could not
+ * be mapped back (the ingester then keeps the frame's call-site name).
+ */
+interface SourceMapScopes {
+    version: typeof SCOPES_VERSION;
+    names: Array<string | null>;
+    scopes: string;
+}
+type ScopesResult = {
+    scopes: SourceMapScopes;
+} | {
+    error: string;
+};
+/**
+ * The function scopes of `code` (the bundle exactly as served), named
+ * through its source map. Never throws: a bundle that does not parse, or a
+ * map without string `mappings`, gives `{ error }` (an upload then goes
+ * ahead without scopes).
+ */
+declare function computeScopes(code: string, map: Record<string, unknown>): ScopesResult;
+
 /** What the ingester accepts as a release. */
 declare const RELEASE_RE: RegExp;
 /** CI variables that carry the commit being built, in the order they are tried. */
@@ -47,4 +156,4 @@ declare function gitHead(cwd?: string): string | null;
  */
 declare function resolveRelease(explicit?: string | null, env?: NodeJS.ProcessEnv, cwd?: string): ResolvedRelease;
 
-export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, debugIdFor, debugIdSnippet, gitHead, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease };
+export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, type VerifyBundle, type VerifyOptions, type VerifyResult, computeScopes, debugIdFor, debugIdSnippet, formatVerify, gitHead, globToRegExp, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease, verifyDir };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, M as MAX_UPLOAD_BYTES, S as SNIPPET_LINE_KEY, U as UploadItem, d as UploadOptions, e as UploadSummary, f as findBundles, g as formatUploadSummary, i as injectBundle, h as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, j as resolveEndpoint, s as servedFilename, k as shiftMappings, l as snippetLine, n as storedMapJson, o as stripSourceMappingUrl, u as uploadDir } from './build-BXFh_jbP.js';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, n as resolveEndpoint, s as servedFilename, o as shiftMappings, q as snippetLine, t as storedMapJson, u as stripSourceMappingUrl, v as uploadDir } from './build-BqjqqeLg.js';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -28,6 +28,115 @@ declare function debugIdSnippet(id: string): string;
  * contains it too.) */
 declare function hasDebugIdSnippet(code: string): boolean;
 
+interface VerifyOptions {
+    /** Ingester base URL (default as for upload). */
+    endpoint?: string;
+    /** Default: $AUTTER_RUNTIME_KEY. */
+    key?: string;
+    /** Sent with the check (a debug id check ignores it). */
+    release?: string;
+    urlPrefix?: string;
+    /** Globs (relative to the directory) of JS files that are not bundles. */
+    ignore?: string[];
+    /** Report leftover .map files without failing (a step that runs before they are removed). */
+    allowMaps?: boolean;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    fetch?: typeof fetch;
+}
+interface VerifyBundle {
+    /** Relative to the directory. */
+    path: string;
+    status: "ok" | "failed" | "skipped";
+    debugId: string | null;
+    /** Why it failed, or why it was skipped. */
+    reasons: string[];
+    /** Whether the ingester has a map for its debug id (null: not checked). */
+    uploaded: boolean | null;
+}
+interface VerifyResult {
+    dir: string;
+    ok: boolean;
+    bundles: VerifyBundle[];
+    /** `.map` files in the directory (deploy risks unless allowMaps). */
+    maps: string[];
+    upload: {
+        /** verified: every checked bundle's map is on the ingester; missing: some are not;
+         * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */
+        status: "verified" | "missing" | "unverified" | "error";
+        endpoint: string | null;
+        reason: string | null;
+        checked: number;
+        missing: number;
+    };
+    /** Every failure, one per file and reason. */
+    failures: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
+/** A tiny glob: `**` any path, `*` any name part, `?` one character. A
+ * pattern without "/" matches the file name anywhere. */
+declare function globToRegExp(glob: string): RegExp;
+declare function verifyDir(dir: string, options?: VerifyOptions): Promise<VerifyResult>;
+/** Human-readable report. */
+declare function formatVerify(result: VerifyResult): string[];
+
+/**
+ * Function scopes for scope-based frame names (like Sentry's
+ * js-source-scopes and PostHog cymbal's `token.scope()`).
+ *
+ * The ingester used to name a resolved frame with the name the source map
+ * holds at its CALLER's position. That is right for `computeTotal()`, and
+ * wrong whenever the call goes through a variable: `const run =
+ * actions.captured; run()` reported `run`, and handlers a framework calls
+ * got the framework's identifier (`func`, `listener`, `fn`). So `upload`
+ * parses each bundle (the final file the browser loads, after `inject`),
+ * collects every function's generated range and the token that names it,
+ * maps that token to its ORIGINAL identifier, and sends the result with the
+ * map as `x_autter_scopes`. The ingester names a frame after the innermost
+ * function that contains it.
+ */
+/** Source map extension field that carries the bundle's function scopes. */
+declare const SCOPES_KEY = "x_autter_scopes";
+declare const SCOPES_VERSION = 1;
+/**
+ * The `x_autter_scopes` value. `scopes` is encoded like `mappings`: base64
+ * VLQ, `;` between generated lines (the line each scope starts on), `,`
+ * between the scopes that start on one line, in start order (outer first on
+ * a tie). Each scope is 3 or 4 values, 0-based, in UTF-16 columns:
+ *
+ *   1. start column, relative to the previous scope's start on the same
+ *      line (absolute for a line's first scope);
+ *   2. end line, relative to the start line;
+ *   3. end column (exclusive), relative to the start column when the scope
+ *      ends on its start line, else absolute;
+ *   4. the name, when the function has one: an index into the map's own
+ *      `names` followed by these `names`, relative to the last name index
+ *      written (starting from 0).
+ *
+ * A 3-value scope is anonymous. `names` holds only names the map's own
+ * `names` lacks; a `null` entry stands for a minified name that could not
+ * be mapped back (the ingester then keeps the frame's call-site name).
+ */
+interface SourceMapScopes {
+    version: typeof SCOPES_VERSION;
+    names: Array<string | null>;
+    scopes: string;
+}
+type ScopesResult = {
+    scopes: SourceMapScopes;
+} | {
+    error: string;
+};
+/**
+ * The function scopes of `code` (the bundle exactly as served), named
+ * through its source map. Never throws: a bundle that does not parse, or a
+ * map without string `mappings`, gives `{ error }` (an upload then goes
+ * ahead without scopes).
+ */
+declare function computeScopes(code: string, map: Record<string, unknown>): ScopesResult;
+
 /** What the ingester accepts as a release. */
 declare const RELEASE_RE: RegExp;
 /** CI variables that carry the commit being built, in the order they are tried. */
@@ -47,4 +156,4 @@ declare function gitHead(cwd?: string): string | null;
  */
 declare function resolveRelease(explicit?: string | null, env?: NodeJS.ProcessEnv, cwd?: string): ResolvedRelease;
 
-export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, debugIdFor, debugIdSnippet, gitHead, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease };
+export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, type VerifyBundle, type VerifyOptions, type VerifyResult, computeScopes, debugIdFor, debugIdSnippet, formatVerify, gitHead, globToRegExp, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease, verifyDir };

package/dist/index.js

@@ -1,13 +1,21 @@
 import {
   BUNDLE_RE,
+  CLIENT_KEY_PREFIX,
   DEBUG_ID_RE,
   DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT,
   FatalUploadError,
+  KEY_ADVICE,
+  MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS,
   RELEASE_RE,
+  SCOPES_KEY,
+  SCOPES_VERSION,
+  SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX,
+  computeScopes,
   debugIdFor,
   debugIdSnippet,
   findBundles,
@@ -29,22 +37,272 @@ import {
   storedMapJson,
   stripSourceMappingUrl,
   uploadDir
-} from "./chunk-SIRFO2QU.js";
+} from "./chunk-KIQRQY3X.js";
+
+// src/verify.ts
+import { existsSync } from "fs";
+import { readdir, readFile } from "fs/promises";
+import { dirname, join, relative, resolve, sep } from "path";
+var CHECK_BATCH = 500;
+var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
+var NOT_BUNDLES = [
+  [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
+  [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
+  [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
+];
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") {
+      re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(glob.includes("/") ? `^${re.replace(/^\.\//, "")}$` : `(^|/)${re}$`);
+}
+async function walk(dir, out) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === "node_modules") continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) await walk(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+}
+function staticRoots(dir) {
+  for (let current = dirname(dir); dirname(current) !== current; current = dirname(current)) {
+    if (existsSync(join(current, "package.json"))) return ["public", "static", "src"].map((name) => join(current, name));
+  }
+  return [];
+}
+async function verifyDir(dir, options = {}) {
+  const root = resolve(dir);
+  const env = options.env ?? process.env;
+  const files = [];
+  await walk(root, files);
+  files.sort();
+  const relPath = (path) => relative(root, path).split(sep).join("/");
+  const ignore = (options.ignore ?? []).map(globToRegExp);
+  const roots = staticRoots(root);
+  const result = {
+    dir: root,
+    ok: true,
+    bundles: [],
+    maps: [],
+    upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
+    failures: []
+  };
+  const fail = (path, reason) => result.failures.push({ path, reason });
+  for (const file of files) {
+    const path = relPath(file);
+    if (file.endsWith(".map")) {
+      result.maps.push(path);
+      if (!options.allowMaps) {
+        fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
+      }
+      continue;
+    }
+    if (!BUNDLE_RE.test(file)) continue;
+    const bytes = await readFile(file);
+    const bundle = { path, status: "ok", debugId: null, reasons: [], uploaded: null };
+    result.bundles.push(bundle);
+    const skip = (reason) => {
+      bundle.status = "skipped";
+      bundle.reasons.push(reason);
+    };
+    if (ignore.some((re) => re.test(path))) {
+      skip("matches --ignore");
+      continue;
+    }
+    const known = NOT_BUNDLES.find(([re]) => re.test(path));
+    if (known) {
+      skip(known[1]);
+      continue;
+    }
+    let copied = null;
+    for (const staticRoot of roots) {
+      const candidate = join(staticRoot, path);
+      if (existsSync(candidate) && (await readFile(candidate)).equals(bytes)) copied = relative(dirname(staticRoot), candidate).split(sep).join("/");
+    }
+    if (copied) {
+      skip(`copied unchanged from ${copied}, not built`);
+      continue;
+    }
+    const code = bytes.toString("utf8");
+    const commentId = readDebugIdComment(code);
+    const snippetId = SNIPPET_ID_RE.exec(code)?.[1] ?? null;
+    bundle.debugId = commentId;
+    if (!commentId && !hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "no debug id: its errors can't be matched to a source map. Run `autter-runtime sourcemaps inject` on the build output (or use the bundler plugin with AUTTER_RUNTIME_KEY set) before deploying"
+      );
+    } else if (!commentId) {
+      bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
+    } else if (!hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "has a //# debugId= comment but no registration snippet, so the browser SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+      );
+    } else if (snippetId && snippetId !== commentId) {
+      bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
+    }
+    const url = readSourceMappingUrl(code);
+    if (url?.startsWith("data:")) {
+      bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+    } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
+      let target = url.split(/[?#]/)[0];
+      try {
+        target = decodeURIComponent(target);
+      } catch {
+      }
+      if (!existsSync(resolve(dirname(file), target))) {
+        bundle.reasons.push(
+          `its sourceMappingURL points at ${url}, which is not in the output (browsers' devtools request it and get a 404). Remove the comment: upload --delete-after-upload does`
+        );
+      }
+    }
+    if (bundle.reasons.length) {
+      bundle.status = "failed";
+      for (const reason of bundle.reasons) fail(path, reason);
+    }
+  }
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  if (!counted.length) fail(".", `no .js/.mjs/.cjs bundles under ${dir}: is this the build output?`);
+  await checkUploads(result, counted, options, env);
+  result.ok = result.failures.length === 0;
+  return result;
+}
+async function checkUploads(result, bundles, options, env) {
+  const upload = result.upload;
+  const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
+  if (!key) {
+    upload.reason = "AUTTER_RUNTIME_KEY is not set: only the local checks ran";
+    return;
+  }
+  upload.endpoint = resolveEndpoint(options.endpoint, env);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    upload.status = "error";
+    upload.reason = "AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which can't check source maps: use an upload key (autter_rtu_\u2026) or the server key (autter_rt_\u2026)";
+    result.failures.push({ path: ".", reason: upload.reason });
+    return;
+  }
+  const withIds = bundles.filter((b) => b.debugId);
+  if (!withIds.length) {
+    upload.reason = "no bundle has a debug id to check";
+    return;
+  }
+  let release = "verify";
+  try {
+    release = resolveRelease(options.release, env, options.cwd).release;
+  } catch {
+  }
+  const doFetch = options.fetch ?? fetch;
+  const missing = [];
+  for (let start = 0; start < withIds.length; start += CHECK_BATCH) {
+    const batch = withIds.slice(start, start + CHECK_BATCH);
+    let res;
+    try {
+      res = await doFetch(`${upload.endpoint}/v1/sourcemaps/check`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+        body: JSON.stringify({ release, files: batch.map((b) => ({ filename: servedFilename(options.urlPrefix, b.path), debugId: b.debugId })) })
+      });
+    } catch (err) {
+      upload.status = "error";
+      upload.reason = `could not reach the ingester: ${err.message}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (res.status === 404 || res.status === 400) {
+      upload.status = "unverified";
+      upload.reason = res.status === 404 ? "the ingester predates 1.6.0 (no /v1/sourcemaps/check), so uploads can't be checked: upgrade it" : "the ingester predates 1.7.0, which checks maps by debug id alone, so uploads can't be checked after the maps were deleted: upgrade it";
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      upload.status = "error";
+      upload.reason = `the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later)" : "");
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (!res.ok) {
+      upload.status = "error";
+      upload.reason = `the source map check failed: HTTP ${res.status}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    const body = await res.json();
+    const present = new Set(Array.isArray(body.present) ? body.present : []);
+    batch.forEach((bundle, index) => {
+      bundle.uploaded = present.has(index);
+      if (!bundle.uploaded) missing.push(bundle);
+    });
+  }
+  upload.checked = withIds.length;
+  upload.missing = missing.length;
+  upload.status = missing.length ? "missing" : "verified";
+  upload.reason = missing.length ? `${missing.length} of ${withIds.length} bundle(s) have no map on the ingester` : null;
+  for (const bundle of missing) {
+    const reason = `no map with debug id ${bundle.debugId} on the ingester for this key's repository: upload this build's maps (autter-runtime sourcemaps upload, or the bundler plugin with AUTTER_RUNTIME_KEY set)`;
+    bundle.status = "failed";
+    bundle.reasons.push(reason);
+    result.failures.push({ path: bundle.path, reason });
+  }
+}
+function formatVerify(result) {
+  const lines = [];
+  for (const bundle of result.bundles) {
+    if (bundle.status === "ok") lines.push(`ok      ${bundle.path} (debug id ${bundle.debugId}${bundle.uploaded ? ", map uploaded" : ""})`);
+    else if (bundle.status === "skipped") lines.push(`skipped ${bundle.path}: ${bundle.reasons.join("; ")}`);
+    else for (const reason of bundle.reasons) lines.push(`FAILED  ${bundle.path}: ${reason}`);
+  }
+  for (const map of result.maps) {
+    const failure = result.failures.find((f) => f.path === map);
+    lines.push(failure ? `FAILED  ${map}: ${failure.reason}` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`);
+  }
+  for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
+  const u = result.upload;
+  lines.push(
+    u.status === "verified" ? `upload: verified, ${u.checked} bundle map(s) on the ingester (${u.endpoint})` : u.status === "missing" ? `upload: ${u.reason} (${u.endpoint})` : `upload: ${u.status}${u.reason ? `, ${u.reason}` : ""}`
+  );
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  lines.push(
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (--allow-maps)` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+  );
+  return lines;
+}
 export {
   BUNDLE_RE,
+  CLIENT_KEY_PREFIX,
   DEBUG_ID_RE,
   DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT,
   FatalUploadError,
+  KEY_ADVICE,
+  MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS,
   RELEASE_RE,
+  SCOPES_KEY,
+  SCOPES_VERSION,
+  SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX,
+  computeScopes,
   debugIdFor,
   debugIdSnippet,
   findBundles,
   formatUploadSummary,
+  formatVerify,
   gitHead,
+  globToRegExp,
   hasDebugIdSnippet,
   injectBundle,
   injectDir,
@@ -60,5 +318,6 @@ export {
   snippetLine,
   storedMapJson,
   stripSourceMappingUrl,
-  uploadDir
+  uploadDir,
+  verifyDir
 };