@autter/runtime-cli 1.1.0 → 1.2.0

package/dist/index.cjs

@@ -21,23 +21,29 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   BUNDLE_RE: () => BUNDLE_RE,
+  CLIENT_KEY_PREFIX: () => CLIENT_KEY_PREFIX,
   DEBUG_ID_RE: () => DEBUG_ID_RE,
   DEBUG_ID_REGISTRY: () => DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT: () => DEFAULT_ENDPOINT,
   FatalUploadError: () => FatalUploadError,
+  KEY_ADVICE: () => KEY_ADVICE,
   MAX_MAP_CHARS: () => MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES: () => MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS: () => RELEASE_ENV_VARS,
   RELEASE_RE: () => RELEASE_RE,
   SCOPES_KEY: () => SCOPES_KEY,
   SCOPES_VERSION: () => SCOPES_VERSION,
+  SERVER_KEY_PREFIX: () => SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY: () => SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX: () => UPLOAD_KEY_PREFIX,
   computeScopes: () => computeScopes,
   debugIdFor: () => debugIdFor,
   debugIdSnippet: () => debugIdSnippet,
   findBundles: () => findBundles,
   formatUploadSummary: () => formatUploadSummary,
+  formatVerify: () => formatVerify,
   gitHead: () => gitHead,
+  globToRegExp: () => globToRegExp,
   hasDebugIdSnippet: () => hasDebugIdSnippet,
   injectBundle: () => injectBundle,
   injectDir: () => injectDir,
@@ -53,7 +59,8 @@ __export(src_exports, {
   snippetLine: () => snippetLine,
   storedMapJson: () => storedMapJson,
   stripSourceMappingUrl: () => stripSourceMappingUrl,
-  uploadDir: () => uploadDir
+  uploadDir: () => uploadDir,
+  verifyDir: () => verifyDir
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -723,6 +730,10 @@ var DEFAULT_ENDPOINT = "https://otlp.autter.dev";
 var MAX_MAP_CHARS = 32 * 1024 * 1024;
 var MAX_UPLOAD_BYTES = MAX_MAP_CHARS + 1024 * 1024;
 var LEGACY_MAX_BYTES = 5 * 1024 * 1024;
+var UPLOAD_KEY_PREFIX = "autter_rtu_";
+var SERVER_KEY_PREFIX = "autter_rt_";
+var CLIENT_KEY_PREFIX = "autter_rtc_";
+var KEY_ADVICE = "set AUTTER_RUNTIME_KEY to an upload-only key (autter_rtu_\u2026, recommended for CI: it can only upload source maps) or the full server key (autter_rt_\u2026, also works)";
 var gzip = (0, import_node_util.promisify)(import_node_zlib.gzip);
 var CHECK_BATCH = 500;
 var MAX_ATTEMPTS = 3;
@@ -791,7 +802,7 @@ async function prepare(bundle, urlPrefix, release, log, compress) {
 var FatalUploadError = class extends Error {
 };
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function uploadDir(dir, options = {}) {
   const env = options.env ?? process.env;
@@ -831,10 +842,13 @@ async function uploadDir(dir, options = {}) {
     return summary;
   }
   const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
-  if (!key) throw new FatalUploadError("no ingest key: set AUTTER_RUNTIME_KEY to a server key (autter_rt_\u2026)");
-  if (key.startsWith("autter_rtc_")) {
-    throw new FatalUploadError("AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026); uploads need a server key (autter_rt_\u2026)");
+  if (!key) throw new FatalUploadError(`no ingest key: ${KEY_ADVICE}`);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    throw new FatalUploadError(`AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which cannot upload source maps: ${KEY_ADVICE}`);
   }
+  const rejected = (status, detail) => new FatalUploadError(
+    `the ingester rejected the key (${status}): ${detail}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later; the server key works with any)" : "")
+  );
   const headers = { "content-type": "application/json", authorization: `Bearer ${key}` };
   const uploadHeaders = { ...headers, "content-encoding": "gzip" };
   const skipped = /* @__PURE__ */ new Set();
@@ -856,9 +870,7 @@ async function uploadDir(dir, options = {}) {
         );
         break;
       }
-      if (res.status === 401 || res.status === 403) {
-        throw new FatalUploadError(`the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}`);
-      }
+      if (res.status === 401 || res.status === 403) throw rejected(res.status, (await res.text()).slice(0, 300));
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const body = await res.json();
       const present = new Set(Array.isArray(body.present) ? body.present : []);
@@ -889,7 +901,7 @@ async function uploadDir(dir, options = {}) {
         detail = err.message;
       }
       if (status === 401 || status === 403) {
-        fatal = new FatalUploadError(`the ingester rejected the key (${status}): ${detail}`);
+        fatal = rejected(status, detail);
         return;
       }
       const retryable = status === 0 || status === 429 || status >= 500;
@@ -930,9 +942,249 @@ function strip(item) {
   return { path, filename, debugId, hash, bytes };
 }
 
-// src/build.ts
+// src/verify.ts
 var import_node_fs2 = require("fs");
+var import_promises4 = require("fs/promises");
 var import_node_path2 = require("path");
+var CHECK_BATCH2 = 500;
+var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
+var NOT_BUNDLES = [
+  [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
+  [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
+  [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
+];
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") {
+      re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(glob.includes("/") ? `^${re.replace(/^\.\//, "")}$` : `(^|/)${re}$`);
+}
+async function walk2(dir, out) {
+  let entries;
+  try {
+    entries = await (0, import_promises4.readdir)(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === "node_modules") continue;
+    const full = (0, import_node_path2.join)(dir, entry.name);
+    if (entry.isDirectory()) await walk2(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+}
+function staticRoots(dir) {
+  for (let current = (0, import_node_path2.dirname)(dir); (0, import_node_path2.dirname)(current) !== current; current = (0, import_node_path2.dirname)(current)) {
+    if ((0, import_node_fs2.existsSync)((0, import_node_path2.join)(current, "package.json"))) return ["public", "static", "src"].map((name) => (0, import_node_path2.join)(current, name));
+  }
+  return [];
+}
+async function verifyDir(dir, options = {}) {
+  const root = (0, import_node_path2.resolve)(dir);
+  const env = options.env ?? process.env;
+  const files = [];
+  await walk2(root, files);
+  files.sort();
+  const relPath = (path) => (0, import_node_path2.relative)(root, path).split(import_node_path2.sep).join("/");
+  const ignore = (options.ignore ?? []).map(globToRegExp);
+  const roots = staticRoots(root);
+  const result = {
+    dir: root,
+    ok: true,
+    bundles: [],
+    maps: [],
+    upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
+    failures: []
+  };
+  const fail = (path, reason) => result.failures.push({ path, reason });
+  for (const file of files) {
+    const path = relPath(file);
+    if (file.endsWith(".map")) {
+      result.maps.push(path);
+      if (!options.allowMaps) {
+        fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
+      }
+      continue;
+    }
+    if (!BUNDLE_RE.test(file)) continue;
+    const bytes = await (0, import_promises4.readFile)(file);
+    const bundle = { path, status: "ok", debugId: null, reasons: [], uploaded: null };
+    result.bundles.push(bundle);
+    const skip = (reason) => {
+      bundle.status = "skipped";
+      bundle.reasons.push(reason);
+    };
+    if (ignore.some((re) => re.test(path))) {
+      skip("matches --ignore");
+      continue;
+    }
+    const known = NOT_BUNDLES.find(([re]) => re.test(path));
+    if (known) {
+      skip(known[1]);
+      continue;
+    }
+    let copied = null;
+    for (const staticRoot of roots) {
+      const candidate = (0, import_node_path2.join)(staticRoot, path);
+      if ((0, import_node_fs2.existsSync)(candidate) && (await (0, import_promises4.readFile)(candidate)).equals(bytes)) copied = (0, import_node_path2.relative)((0, import_node_path2.dirname)(staticRoot), candidate).split(import_node_path2.sep).join("/");
+    }
+    if (copied) {
+      skip(`copied unchanged from ${copied}, not built`);
+      continue;
+    }
+    const code = bytes.toString("utf8");
+    const commentId = readDebugIdComment(code);
+    const snippetId = SNIPPET_ID_RE.exec(code)?.[1] ?? null;
+    bundle.debugId = commentId;
+    if (!commentId && !hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "no debug id: its errors can't be matched to a source map. Run `autter-runtime sourcemaps inject` on the build output (or use the bundler plugin with AUTTER_RUNTIME_KEY set) before deploying"
+      );
+    } else if (!commentId) {
+      bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
+    } else if (!hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "has a //# debugId= comment but no registration snippet, so the browser SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+      );
+    } else if (snippetId && snippetId !== commentId) {
+      bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
+    }
+    const url = readSourceMappingUrl(code);
+    if (url?.startsWith("data:")) {
+      bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+    } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
+      let target = url.split(/[?#]/)[0];
+      try {
+        target = decodeURIComponent(target);
+      } catch {
+      }
+      if (!(0, import_node_fs2.existsSync)((0, import_node_path2.resolve)((0, import_node_path2.dirname)(file), target))) {
+        bundle.reasons.push(
+          `its sourceMappingURL points at ${url}, which is not in the output (browsers' devtools request it and get a 404). Remove the comment: upload --delete-after-upload does`
+        );
+      }
+    }
+    if (bundle.reasons.length) {
+      bundle.status = "failed";
+      for (const reason of bundle.reasons) fail(path, reason);
+    }
+  }
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  if (!counted.length) fail(".", `no .js/.mjs/.cjs bundles under ${dir}: is this the build output?`);
+  await checkUploads(result, counted, options, env);
+  result.ok = result.failures.length === 0;
+  return result;
+}
+async function checkUploads(result, bundles, options, env) {
+  const upload = result.upload;
+  const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
+  if (!key) {
+    upload.reason = "AUTTER_RUNTIME_KEY is not set: only the local checks ran";
+    return;
+  }
+  upload.endpoint = resolveEndpoint(options.endpoint, env);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    upload.status = "error";
+    upload.reason = "AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which can't check source maps: use an upload key (autter_rtu_\u2026) or the server key (autter_rt_\u2026)";
+    result.failures.push({ path: ".", reason: upload.reason });
+    return;
+  }
+  const withIds = bundles.filter((b) => b.debugId);
+  if (!withIds.length) {
+    upload.reason = "no bundle has a debug id to check";
+    return;
+  }
+  let release = "verify";
+  try {
+    release = resolveRelease(options.release, env, options.cwd).release;
+  } catch {
+  }
+  const doFetch = options.fetch ?? fetch;
+  const missing = [];
+  for (let start = 0; start < withIds.length; start += CHECK_BATCH2) {
+    const batch = withIds.slice(start, start + CHECK_BATCH2);
+    let res;
+    try {
+      res = await doFetch(`${upload.endpoint}/v1/sourcemaps/check`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+        body: JSON.stringify({ release, files: batch.map((b) => ({ filename: servedFilename(options.urlPrefix, b.path), debugId: b.debugId })) })
+      });
+    } catch (err) {
+      upload.status = "error";
+      upload.reason = `could not reach the ingester: ${err.message}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (res.status === 404 || res.status === 400) {
+      upload.status = "unverified";
+      upload.reason = res.status === 404 ? "the ingester predates 1.6.0 (no /v1/sourcemaps/check), so uploads can't be checked: upgrade it" : "the ingester predates 1.7.0, which checks maps by debug id alone, so uploads can't be checked after the maps were deleted: upgrade it";
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      upload.status = "error";
+      upload.reason = `the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later)" : "");
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (!res.ok) {
+      upload.status = "error";
+      upload.reason = `the source map check failed: HTTP ${res.status}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    const body = await res.json();
+    const present = new Set(Array.isArray(body.present) ? body.present : []);
+    batch.forEach((bundle, index) => {
+      bundle.uploaded = present.has(index);
+      if (!bundle.uploaded) missing.push(bundle);
+    });
+  }
+  upload.checked = withIds.length;
+  upload.missing = missing.length;
+  upload.status = missing.length ? "missing" : "verified";
+  upload.reason = missing.length ? `${missing.length} of ${withIds.length} bundle(s) have no map on the ingester` : null;
+  for (const bundle of missing) {
+    const reason = `no map with debug id ${bundle.debugId} on the ingester for this key's repository: upload this build's maps (autter-runtime sourcemaps upload, or the bundler plugin with AUTTER_RUNTIME_KEY set)`;
+    bundle.status = "failed";
+    bundle.reasons.push(reason);
+    result.failures.push({ path: bundle.path, reason });
+  }
+}
+function formatVerify(result) {
+  const lines = [];
+  for (const bundle of result.bundles) {
+    if (bundle.status === "ok") lines.push(`ok      ${bundle.path} (debug id ${bundle.debugId}${bundle.uploaded ? ", map uploaded" : ""})`);
+    else if (bundle.status === "skipped") lines.push(`skipped ${bundle.path}: ${bundle.reasons.join("; ")}`);
+    else for (const reason of bundle.reasons) lines.push(`FAILED  ${bundle.path}: ${reason}`);
+  }
+  for (const map of result.maps) {
+    const failure = result.failures.find((f) => f.path === map);
+    lines.push(failure ? `FAILED  ${map}: ${failure.reason}` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`);
+  }
+  for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
+  const u = result.upload;
+  lines.push(
+    u.status === "verified" ? `upload: verified, ${u.checked} bundle map(s) on the ingester (${u.endpoint})` : u.status === "missing" ? `upload: ${u.reason} (${u.endpoint})` : `upload: ${u.status}${u.reason ? `, ${u.reason}` : ""}`
+  );
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  lines.push(
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (--allow-maps)` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+  );
+  return lines;
+}
+
+// src/build.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
 function buildKey(options) {
   const key = (options.key ?? process.env.AUTTER_RUNTIME_KEY ?? "").trim();
   return key || null;
@@ -1017,9 +1269,9 @@ async function processBuildOutput(input) {
   async function cleanUp() {
     if (!input.ownMaps) return;
     const maps = /* @__PURE__ */ new Set([...input.maps ?? [], ...owners.keys()]);
-    const rel = (path) => (0, import_node_path2.relative)(input.dir, path).split(import_node_path2.sep).join("/");
+    const rel = (path) => (0, import_node_path3.relative)(input.dir, path).split(import_node_path3.sep).join("/");
     if (options.upload === false || options.deleteAfterUpload === false) {
-      const kept = [...maps].filter((map) => (0, import_node_fs2.existsSync)(map));
+      const kept = [...maps].filter((map) => (0, import_node_fs3.existsSync)(map));
       if (kept.length) {
         log(
           `kept ${kept.length} source map(s) this plugin generated (${options.upload === false ? "upload: false" : "deleteAfterUpload: false"}): they expose your source, so upload them with \`autter-runtime sourcemaps upload --delete-after-upload\` or keep them out of the deploy`
@@ -1034,7 +1286,7 @@ async function processBuildOutput(input) {
       if (options.failOnError) throw new Error(`[autter-runtime] ${message}`);
       if (!options.silent) console.warn(`[autter-runtime] ${message}`);
     }
-    result.removedMaps = [...maps].filter((map) => !(0, import_node_fs2.existsSync)(map)).map(rel).sort();
+    result.removedMaps = [...maps].filter((map) => !(0, import_node_fs3.existsSync)(map)).map(rel).sort();
     if (result.removedMaps.length) {
       log(`removed ${result.removedMaps.length} source map(s) this plugin generated, so they are not deployed: ${outcome}`);
     }
@@ -1043,23 +1295,29 @@ async function processBuildOutput(input) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BUNDLE_RE,
+  CLIENT_KEY_PREFIX,
   DEBUG_ID_RE,
   DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT,
   FatalUploadError,
+  KEY_ADVICE,
   MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS,
   RELEASE_RE,
   SCOPES_KEY,
   SCOPES_VERSION,
+  SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX,
   computeScopes,
   debugIdFor,
   debugIdSnippet,
   findBundles,
   formatUploadSummary,
+  formatVerify,
   gitHead,
+  globToRegExp,
   hasDebugIdSnippet,
   injectBundle,
   injectDir,
@@ -1075,5 +1333,6 @@ async function processBuildOutput(input) {
   snippetLine,
   storedMapJson,
   stripSourceMappingUrl,
-  uploadDir
+  uploadDir,
+  verifyDir
 });

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SNIPPET_LINE_KEY, U as UploadItem, e as UploadOptions, f as UploadSummary, g as findBundles, h as formatUploadSummary, i as injectBundle, j as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, k as resolveEndpoint, s as servedFilename, l as shiftMappings, n as snippetLine, o as storedMapJson, q as stripSourceMappingUrl, u as uploadDir } from './build-CPXR9Xd3.cjs';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, n as resolveEndpoint, s as servedFilename, o as shiftMappings, q as snippetLine, t as storedMapJson, u as stripSourceMappingUrl, v as uploadDir } from './build-BqjqqeLg.cjs';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -28,6 +28,60 @@ declare function debugIdSnippet(id: string): string;
  * contains it too.) */
 declare function hasDebugIdSnippet(code: string): boolean;
 
+interface VerifyOptions {
+    /** Ingester base URL (default as for upload). */
+    endpoint?: string;
+    /** Default: $AUTTER_RUNTIME_KEY. */
+    key?: string;
+    /** Sent with the check (a debug id check ignores it). */
+    release?: string;
+    urlPrefix?: string;
+    /** Globs (relative to the directory) of JS files that are not bundles. */
+    ignore?: string[];
+    /** Report leftover .map files without failing (a step that runs before they are removed). */
+    allowMaps?: boolean;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    fetch?: typeof fetch;
+}
+interface VerifyBundle {
+    /** Relative to the directory. */
+    path: string;
+    status: "ok" | "failed" | "skipped";
+    debugId: string | null;
+    /** Why it failed, or why it was skipped. */
+    reasons: string[];
+    /** Whether the ingester has a map for its debug id (null: not checked). */
+    uploaded: boolean | null;
+}
+interface VerifyResult {
+    dir: string;
+    ok: boolean;
+    bundles: VerifyBundle[];
+    /** `.map` files in the directory (deploy risks unless allowMaps). */
+    maps: string[];
+    upload: {
+        /** verified: every checked bundle's map is on the ingester; missing: some are not;
+         * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */
+        status: "verified" | "missing" | "unverified" | "error";
+        endpoint: string | null;
+        reason: string | null;
+        checked: number;
+        missing: number;
+    };
+    /** Every failure, one per file and reason. */
+    failures: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
+/** A tiny glob: `**` any path, `*` any name part, `?` one character. A
+ * pattern without "/" matches the file name anywhere. */
+declare function globToRegExp(glob: string): RegExp;
+declare function verifyDir(dir: string, options?: VerifyOptions): Promise<VerifyResult>;
+/** Human-readable report. */
+declare function formatVerify(result: VerifyResult): string[];
+
 /**
  * Function scopes for scope-based frame names (like Sentry's
  * js-source-scopes and PostHog cymbal's `token.scope()`).
@@ -102,4 +156,4 @@ declare function gitHead(cwd?: string): string | null;
  */
 declare function resolveRelease(explicit?: string | null, env?: NodeJS.ProcessEnv, cwd?: string): ResolvedRelease;
 
-export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, computeScopes, debugIdFor, debugIdSnippet, gitHead, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease };
+export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, type VerifyBundle, type VerifyOptions, type VerifyResult, computeScopes, debugIdFor, debugIdSnippet, formatVerify, gitHead, globToRegExp, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease, verifyDir };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SNIPPET_LINE_KEY, U as UploadItem, e as UploadOptions, f as UploadSummary, g as findBundles, h as formatUploadSummary, i as injectBundle, j as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, k as resolveEndpoint, s as servedFilename, l as shiftMappings, n as snippetLine, o as storedMapJson, q as stripSourceMappingUrl, u as uploadDir } from './build-CPXR9Xd3.js';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, n as resolveEndpoint, s as servedFilename, o as shiftMappings, q as snippetLine, t as storedMapJson, u as stripSourceMappingUrl, v as uploadDir } from './build-BqjqqeLg.js';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -28,6 +28,60 @@ declare function debugIdSnippet(id: string): string;
  * contains it too.) */
 declare function hasDebugIdSnippet(code: string): boolean;
 
+interface VerifyOptions {
+    /** Ingester base URL (default as for upload). */
+    endpoint?: string;
+    /** Default: $AUTTER_RUNTIME_KEY. */
+    key?: string;
+    /** Sent with the check (a debug id check ignores it). */
+    release?: string;
+    urlPrefix?: string;
+    /** Globs (relative to the directory) of JS files that are not bundles. */
+    ignore?: string[];
+    /** Report leftover .map files without failing (a step that runs before they are removed). */
+    allowMaps?: boolean;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    fetch?: typeof fetch;
+}
+interface VerifyBundle {
+    /** Relative to the directory. */
+    path: string;
+    status: "ok" | "failed" | "skipped";
+    debugId: string | null;
+    /** Why it failed, or why it was skipped. */
+    reasons: string[];
+    /** Whether the ingester has a map for its debug id (null: not checked). */
+    uploaded: boolean | null;
+}
+interface VerifyResult {
+    dir: string;
+    ok: boolean;
+    bundles: VerifyBundle[];
+    /** `.map` files in the directory (deploy risks unless allowMaps). */
+    maps: string[];
+    upload: {
+        /** verified: every checked bundle's map is on the ingester; missing: some are not;
+         * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */
+        status: "verified" | "missing" | "unverified" | "error";
+        endpoint: string | null;
+        reason: string | null;
+        checked: number;
+        missing: number;
+    };
+    /** Every failure, one per file and reason. */
+    failures: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
+/** A tiny glob: `**` any path, `*` any name part, `?` one character. A
+ * pattern without "/" matches the file name anywhere. */
+declare function globToRegExp(glob: string): RegExp;
+declare function verifyDir(dir: string, options?: VerifyOptions): Promise<VerifyResult>;
+/** Human-readable report. */
+declare function formatVerify(result: VerifyResult): string[];
+
 /**
  * Function scopes for scope-based frame names (like Sentry's
  * js-source-scopes and PostHog cymbal's `token.scope()`).
@@ -102,4 +156,4 @@ declare function gitHead(cwd?: string): string | null;
  */
 declare function resolveRelease(explicit?: string | null, env?: NodeJS.ProcessEnv, cwd?: string): ResolvedRelease;
 
-export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, computeScopes, debugIdFor, debugIdSnippet, gitHead, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease };
+export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, type VerifyBundle, type VerifyOptions, type VerifyResult, computeScopes, debugIdFor, debugIdSnippet, formatVerify, gitHead, globToRegExp, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease, verifyDir };