@autter/runtime-cli 1.1.0 → 1.3.0

package/dist/cli.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync3, readFileSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
 import { createRequire } from "module";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join5, relative as relative5, resolve as resolve4, sep as sep5 } from "path";
 import { parseArgs } from "util";
 
 // src/build.ts
 import { existsSync as existsSync2 } from "fs";
-import { relative as relative2, sep as sep2 } from "path";
+import { isAbsolute, relative as relative2, sep as sep2 } from "path";
 
 // src/files.ts
 import { existsSync } from "fs";
@@ -63,6 +63,48 @@ async function walk(dir, out, pattern = BUNDLE_RE) {
     else if (entry.isFile() && pattern.test(entry.name)) out.push(full);
   }
 }
+async function findMapFiles(dir) {
+  const out = [];
+  await walk(resolve(dir), out, /\.map$/);
+  return out.sort();
+}
+var CSS_SOURCE_MAPPING_URL_RE = /\/\*[#@] sourceMappingURL=([^\s*]+)\s*\*\/\s*$/;
+function pointsAt(file, url, map) {
+  if (!url || /^[a-z][\w+.-]*:/i.test(url) || url.startsWith("/")) return false;
+  let path = url.split(/[?#]/)[0];
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+  }
+  return resolve(dirname(file), path) === map;
+}
+async function stripReference(file, map) {
+  let code;
+  try {
+    code = await readFile(file, "utf8");
+  } catch {
+    return;
+  }
+  let stripped = code;
+  if (BUNDLE_RE.test(file)) {
+    if (pointsAt(file, readSourceMappingUrl(code), map)) stripped = stripSourceMappingUrl(code);
+  } else if (file.endsWith(".css")) {
+    const match = CSS_SOURCE_MAPPING_URL_RE.exec(code);
+    if (match && pointsAt(file, match[1], map)) stripped = code.slice(0, match.index).replace(/\n?$/, "\n");
+  }
+  if (stripped !== code) await writeFile(file, stripped);
+}
+async function removeSourceMaps(maps, owners = /* @__PURE__ */ new Map()) {
+  const removed = [];
+  for (const map of [...new Set(maps)].sort()) {
+    if (!existsSync(map)) continue;
+    await rm(map, { force: true });
+    removed.push(map);
+    const owner = owners.get(map) ?? map.replace(/\.map$/, "");
+    await stripReference(owner, map);
+  }
+  return removed;
+}
 async function findBundles(dir, files) {
   const root = resolve(dir);
   const candidates = [];
@@ -642,6 +684,9 @@ var DEFAULT_ENDPOINT = "https://otlp.autter.dev";
 var MAX_MAP_CHARS = 32 * 1024 * 1024;
 var MAX_UPLOAD_BYTES = MAX_MAP_CHARS + 1024 * 1024;
 var LEGACY_MAX_BYTES = 5 * 1024 * 1024;
+var UPLOAD_KEY_PREFIX = "autter_rtu_";
+var CLIENT_KEY_PREFIX = "autter_rtc_";
+var KEY_ADVICE = "set AUTTER_RUNTIME_KEY to an upload-only key (autter_rtu_\u2026, recommended for CI: it can only upload source maps) or the full server key (autter_rt_\u2026, also works)";
 var gzip = promisify(gzipCallback);
 var CHECK_BATCH = 500;
 var MAX_ATTEMPTS = 3;
@@ -655,9 +700,56 @@ function servedFilename(urlPrefix, path) {
   if (!/^[a-z][\w+.-]*:\/\//i.test(prefix) && !prefix.startsWith("/")) prefix = `/${prefix}`;
   return `${prefix.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
 }
-function storedMapJson(map) {
-  const { sourcesContent: _omitted, ...safe } = map;
-  return JSON.stringify(safe);
+var NOT_IN_APP_PATH_PARTS = ["node_modules/", "/site-packages/", "/dist-packages/", "/vendor/", "/.pnpm/"];
+var NOT_IN_APP_PATH_PREFIXES = ["node:", "internal/"];
+var EXTENSION_SCHEMES = ["chrome-extension:", "moz-extension:", "safari-extension:", "safari-web-extension:", "webkit-masked-url:"];
+function isInAppSource(path) {
+  if (!path) return true;
+  const normalized = path.replace(/\\/g, "/");
+  if (NOT_IN_APP_PATH_PARTS.some((part) => normalized.includes(part))) return false;
+  if (NOT_IN_APP_PATH_PREFIXES.some((prefix) => normalized.startsWith(prefix))) return false;
+  const lower = normalized.toLowerCase();
+  return !EXTENSION_SCHEMES.some((scheme) => lower.startsWith(scheme));
+}
+var SOURCES_CONTENT_WRAPPER_BYTES = Buffer.byteLength(',"sourcesContent":[]');
+var NULL_ENTRY_BYTES = 4;
+function storedSourcesContent(fields, baseBytes, limit = MAX_MAP_CHARS) {
+  const { sources, sourcesContent } = fields;
+  if (!Array.isArray(sources) || !Array.isArray(sourcesContent) || sources.length === 0) return null;
+  const ignored = /* @__PURE__ */ new Set();
+  for (const list of [fields.ignoreList, fields.x_google_ignoreList]) {
+    if (!Array.isArray(list)) continue;
+    for (const index of list) if (Number.isInteger(index)) ignored.add(index);
+  }
+  const count = sources.length;
+  const candidates = [];
+  for (let index = 0; index < count; index++) {
+    const source = sources[index];
+    const content = sourcesContent[index];
+    if (typeof source !== "string" || typeof content !== "string") continue;
+    if (ignored.has(index) || !isInAppSource(source)) continue;
+    candidates.push({ index, content, bytes: Buffer.byteLength(JSON.stringify(content)) });
+  }
+  if (candidates.length === 0) return null;
+  candidates.sort((a, b) => a.bytes - b.bytes || a.index - b.index);
+  let remaining = limit - baseBytes - SOURCES_CONTENT_WRAPPER_BYTES - NULL_ENTRY_BYTES * count - (count - 1);
+  const kept = new Array(count).fill(null);
+  let any = false;
+  for (const candidate of candidates) {
+    const extra = candidate.bytes - NULL_ENTRY_BYTES;
+    if (extra > remaining) break;
+    remaining -= extra;
+    kept[candidate.index] = candidate.content;
+    any = true;
+  }
+  return any ? kept : null;
+}
+function storedMapJson(map, options = {}) {
+  const { sourcesContent: _content, ...rest } = map;
+  const base = JSON.stringify(rest);
+  if (options.sourcesContent === false) return base;
+  const content = storedSourcesContent(map, Buffer.byteLength(base));
+  return content ? JSON.stringify({ ...rest, sourcesContent: content }) : base;
 }
 function bytesOf(buffer) {
   return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
@@ -668,7 +760,7 @@ function fits(json, body) {
 function uploadBody(release, filename, debugId, json) {
   return `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
 }
-async function prepare(bundle, urlPrefix, release, log, compress) {
+async function prepare(bundle, urlPrefix, release, log, compress, sourcesContent) {
   let map;
   try {
     map = JSON.parse(await readFile3(bundle.map, "utf8"));
@@ -683,9 +775,10 @@ async function prepare(bundle, urlPrefix, release, log, compress) {
   const filename = servedFilename(urlPrefix, bundle.path);
   const { [SCOPES_KEY]: _stale, ...plain } = map;
   const scopes = computeScopes(code, map);
-  let json = storedMapJson(plain);
+  const stored = { sourcesContent };
+  let json = storedMapJson(plain, stored);
   if ("scopes" in scopes) {
-    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes });
+    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes }, stored);
     if (fits(scoped, uploadBody(release, filename, debugId, scoped))) json = scoped;
     else if (fits(json, uploadBody(release, filename, debugId, json))) {
       log(`warning: ${bundle.path}: its map is over 32 MB with function scopes, so it is uploaded without them (frames keep call-site names)`);
@@ -710,7 +803,7 @@ async function prepare(bundle, urlPrefix, release, log, compress) {
 var FatalUploadError = class extends Error {
 };
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 async function uploadDir(dir, options = {}) {
   const env = options.env ?? process.env;
@@ -732,7 +825,7 @@ async function uploadDir(dir, options = {}) {
   };
   const items = [];
   for (const bundle of await findBundles(dir, options.files)) {
-    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun);
+    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun, options.sourcesContent !== false);
     if ("error" in prepared) {
       summary.failed.push({ path: bundle.path, filename: servedFilename(options.urlPrefix, bundle.path), error: prepared.error });
     } else if (prepared.mapChars > MAX_MAP_CHARS || prepared.bytes > MAX_UPLOAD_BYTES) {
@@ -750,10 +843,13 @@ async function uploadDir(dir, options = {}) {
     return summary;
   }
   const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
-  if (!key) throw new FatalUploadError("no ingest key: set AUTTER_RUNTIME_KEY to a server key (autter_rt_\u2026)");
-  if (key.startsWith("autter_rtc_")) {
-    throw new FatalUploadError("AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026); uploads need a server key (autter_rt_\u2026)");
+  if (!key) throw new FatalUploadError(`no ingest key: ${KEY_ADVICE}`);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    throw new FatalUploadError(`AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which cannot upload source maps: ${KEY_ADVICE}`);
   }
+  const rejected = (status, detail) => new FatalUploadError(
+    `the ingester rejected the key (${status}): ${detail}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later; the server key works with any)" : "")
+  );
   const headers = { "content-type": "application/json", authorization: `Bearer ${key}` };
   const uploadHeaders = { ...headers, "content-encoding": "gzip" };
   const skipped = /* @__PURE__ */ new Set();
@@ -775,9 +871,7 @@ async function uploadDir(dir, options = {}) {
         );
         break;
       }
-      if (res.status === 401 || res.status === 403) {
-        throw new FatalUploadError(`the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}`);
-      }
+      if (res.status === 401 || res.status === 403) throw rejected(res.status, (await res.text()).slice(0, 300));
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const body = await res.json();
       const present = new Set(Array.isArray(body.present) ? body.present : []);
@@ -808,7 +902,7 @@ async function uploadDir(dir, options = {}) {
         detail = err.message;
       }
       if (status === 401 || status === 403) {
-        fatal = new FatalUploadError(`the ingester rejected the key (${status}): ${detail}`);
+        fatal = rejected(status, detail);
         return;
       }
       const retryable = status === 0 || status === 429 || status >= 500;
@@ -864,44 +958,1777 @@ function formatUploadSummary(summary) {
   return lines;
 }
 
+// src/setup.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join3 } from "path";
+
+// src/setup-detect.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync3, readdirSync, readFileSync, statSync } from "fs";
+import { dirname as dirname2, join as join2, relative as relative3, resolve as resolve2, sep as sep3 } from "path";
+
+// src/setup-edit.ts
+import { Parser } from "acorn";
+import { tsPlugin } from "@sveltejs/acorn-typescript";
+var TsParser = Parser.extend(tsPlugin());
+var isTypeScriptFile = (file) => /\.[cm]?tsx?$/.test(file);
+function parseFile(code, file) {
+  const parser = isTypeScriptFile(file) ? TsParser : Parser;
+  for (const sourceType of ["module", "script"]) {
+    const comments = [];
+    try {
+      const ast = parser.parse(code, {
+        ecmaVersion: "latest",
+        sourceType,
+        locations: true,
+        allowHashBang: true,
+        onComment: (_block, _text, start, end) => comments.push({ start, end })
+      });
+      ast.comments = comments;
+      return ast;
+    } catch {
+    }
+  }
+  return null;
+}
+function walk2(node, visit) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const child of node) walk2(child, visit);
+    return;
+  }
+  const n = node;
+  if (typeof n.type !== "string") return;
+  visit(n);
+  for (const key of Object.keys(n)) {
+    if (key === "loc" || key === "range" || key === "start" || key === "end") continue;
+    const value = n[key];
+    if (value && typeof value === "object") walk2(value, visit);
+  }
+}
+var TS_WRAPPERS = /* @__PURE__ */ new Set(["TSAsExpression", "TSSatisfiesExpression", "TSNonNullExpression", "TSTypeAssertion", "ParenthesizedExpression"]);
+function unwrap(node) {
+  let n = node ?? null;
+  while (n && TS_WRAPPERS.has(n.type)) n = n.expression;
+  return n;
+}
+var isModuleExports = (node) => !!node && node.type === "MemberExpression" && !node.computed && node.object?.type === "Identifier" && node.object.name === "module" && node.property?.type === "Identifier" && node.property.name === "exports";
+function findExport(ast) {
+  const sites = [];
+  for (const statement of ast.body) {
+    if (statement.type === "ExportDefaultDeclaration") {
+      const declaration = statement.declaration;
+      if (declaration.type === "FunctionDeclaration" || declaration.type === "ClassDeclaration") {
+        return { error: "the default export is a function or class declaration" };
+      }
+      sites.push({ kind: "esm", expr: declaration });
+    } else if (statement.type === "ExpressionStatement" && statement.expression.type === "AssignmentExpression" && statement.expression.operator === "=" && isModuleExports(statement.expression.left)) {
+      sites.push({ kind: "cjs", expr: statement.expression.right });
+    }
+  }
+  if (sites.length === 0) return { error: "no `export default` or `module.exports =` found" };
+  if (sites.length > 1) return { error: "the config is exported more than once" };
+  return sites[0];
+}
+function resolveBinding(ast, name) {
+  let init = null;
+  for (const statement of ast.body) {
+    const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+    if (declaration?.type !== "VariableDeclaration") continue;
+    for (const declarator of declaration.declarations) {
+      if (declarator.id?.type === "Identifier" && declarator.id.name === name) init = declarator.init ?? null;
+    }
+  }
+  if (!init) return null;
+  let reassigned = false;
+  walk2(ast, (node) => {
+    if (node.type === "AssignmentExpression" && node.left?.type === "Identifier" && node.left.name === name) reassigned = true;
+  });
+  return reassigned ? null : init;
+}
+function returnedObject(fn) {
+  const body = fn.body;
+  if (body.type !== "BlockStatement") {
+    const value2 = unwrap(body);
+    return value2?.type === "ObjectExpression" ? value2 : null;
+  }
+  const returns = [];
+  walk2(body, (node) => {
+    if (node.type === "ReturnStatement") returns.push(node);
+  });
+  if (returns.length !== 1) return null;
+  const last = body.body.at(-1);
+  if (last !== returns[0]) return null;
+  const value = unwrap(returns[0].argument);
+  return value?.type === "ObjectExpression" ? value : null;
+}
+function configObject(ast, expr, depth = 0) {
+  const node = unwrap(expr);
+  if (!node || depth > 4) return null;
+  switch (node.type) {
+    case "ObjectExpression":
+      return node;
+    case "Identifier": {
+      const init = resolveBinding(ast, node.name);
+      return init ? configObject(ast, init, depth + 1) : null;
+    }
+    case "CallExpression":
+      if (node.callee?.type === "Identifier" && /^define\w*Config$/.test(node.callee.name) && node.arguments.length === 1) {
+        return configObject(ast, node.arguments[0], depth + 1);
+      }
+      return null;
+    case "ArrowFunctionExpression":
+    case "FunctionExpression":
+      return returnedObject(node);
+    default:
+      return null;
+  }
+}
+function findProperty(obj, name) {
+  const matches = obj.properties.filter(
+    (p) => p.type === "Property" && !p.computed && (p.key.type === "Identifier" && p.key.name === name || p.key.type === "Literal" && p.key.value === name)
+  );
+  if (matches.length > 1) return "ambiguous";
+  const [match] = matches;
+  if (!match) return null;
+  if (match.kind !== "init" || match.method) return "ambiguous";
+  return match;
+}
+function literalProperty(obj, path) {
+  let node = obj;
+  for (const [i, name] of path.entries()) {
+    if (!node || node.type !== "ObjectExpression") return void 0;
+    const property = findProperty(node, name);
+    if (!property || property === "ambiguous") return void 0;
+    node = unwrap(property.value);
+    if (i === path.length - 1) {
+      if (node?.type === "Literal" && (typeof node.value !== "object" || node.value === null)) return node.value;
+      if (node?.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0].value.cooked;
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function applyEdits(code, edits) {
+  let out = code;
+  for (const edit of [...edits].sort((a, b) => b.start - a.start)) out = `${out.slice(0, edit.start)}${edit.text}${out.slice(edit.end)}`;
+  return out;
+}
+function lineIndent(code, pos) {
+  const lineStart = code.lastIndexOf("\n", pos - 1) + 1;
+  return /^[ \t]*/.exec(code.slice(lineStart))[0];
+}
+var spansLines = (code, node) => code.slice(node.start, node.end).includes("\n");
+function appendAfter(code, container, last, text) {
+  if (!spansLines(code, container)) return { start: last.end, end: last.end, text: `, ${text}` };
+  const indent = lineIndent(code, last.start);
+  const trailing = /^[^\S\n]*,[^\S\n]*(?:\/\/[^\n]*|\/\*[^\n]*?\*\/)?[^\S\n]*(?=\n)/.exec(code.slice(last.end, container.end));
+  if (trailing) {
+    const at = last.end + trailing[0].length;
+    return { start: at, end: at, text: `
+${indent}${text},` };
+  }
+  return { start: last.end, end: last.end, text: `,
+${indent}${text}` };
+}
+function appendElement(code, array, text) {
+  const elements = array.elements.filter((e) => !!e);
+  const last = elements.at(-1);
+  if (!last) {
+    const inner = code.slice(array.start + 1, array.end - 1);
+    return inner.trim() === "" ? { start: array.start + 1, end: array.end - 1, text } : { start: array.end - 1, end: array.end - 1, text };
+  }
+  return appendAfter(code, array, last, text);
+}
+function appendProperty(code, obj, text) {
+  const last = obj.properties.at(-1);
+  if (!last) {
+    if (code.slice(obj.start + 1, obj.end - 1).trim() !== "") return null;
+    return { start: obj.start, end: obj.end, text: `{ ${text} }` };
+  }
+  return appendAfter(code, obj, last, text);
+}
+function addPluginEdit(code, obj, element, container) {
+  let target = obj;
+  if (container) {
+    const property = findProperty(obj, container);
+    if (property === "ambiguous") return { error: `\`${container}\` is defined more than once or as a method` };
+    if (!property) {
+      if (obj.properties.some((p) => p.type === "SpreadElement")) {
+        return { error: `the config spreads another object, which may already set \`${container}\`` };
+      }
+      return appendProperty(code, obj, `${container}: { plugins: [${element}] }`) ?? { error: "the config object holds only comments" };
+    }
+    const value2 = unwrap(property.value);
+    if (value2?.type !== "ObjectExpression") return { error: `\`${container}\` is not an object literal` };
+    target = value2;
+  }
+  const plugins = findProperty(target, "plugins");
+  if (plugins === "ambiguous") return { error: "`plugins` is defined more than once or as a method" };
+  if (!plugins) {
+    if (target.properties.some((p) => p.type === "SpreadElement")) {
+      return { error: "the config spreads another object, which may already set `plugins`" };
+    }
+    return appendProperty(code, target, `plugins: [${element}]`) ?? { error: "the config object holds only comments" };
+  }
+  const value = unwrap(plugins.value);
+  if (value?.type !== "ArrayExpression") return { error: "`plugins` is not an array literal" };
+  return appendElement(code, value, element);
+}
+function requireCall(init) {
+  let node = unwrap(init);
+  while (node) {
+    if (node.type === "CallExpression") {
+      if (node.callee?.type === "Identifier" && node.callee.name === "require") return node;
+      node = unwrap(node.callee);
+    } else if (node.type === "MemberExpression") node = unwrap(node.object);
+    else return null;
+  }
+  return null;
+}
+function importEdit(code, ast, name, spec, kind) {
+  const body = ast.body;
+  let last;
+  let source = null;
+  if (kind === "esm") {
+    last = body.filter((s) => s.type === "ImportDeclaration").at(-1);
+    source = last?.source ?? null;
+  } else {
+    last = body.filter((s) => s.type === "VariableDeclaration" && s.declarations.every((d) => requireCall(d.init))).at(-1);
+    source = last ? requireCall(last.declarations[0].init)?.arguments[0] ?? null : null;
+  }
+  const quote = source && code[source.start] === "'" ? "'" : '"';
+  const semi = last ? code[last.end - 1] === ";" ? ";" : "" : ";";
+  const line = kind === "esm" ? `import { ${name} } from ${quote}${spec}${quote}${semi}` : `const { ${name} } = require(${quote}${spec}${quote})${semi}`;
+  if (last) return { start: last.end, end: last.end, text: `
+${line}` };
+  const first = body.find((s) => !(s.type === "ExpressionStatement" && typeof s.directive === "string"));
+  if (!first) return { start: code.length, end: code.length, text: `${code.endsWith("\n") || !code ? "" : "\n"}${line}
+` };
+  let at = first.start;
+  const comments = (ast.comments ?? []).filter((c) => c.end <= first.start);
+  for (let i = comments.length - 1; i >= 0; i--) {
+    const gap = code.slice(comments[i].end, at);
+    if (gap.trim() !== "" || (gap.match(/\n/g) ?? []).length > 1) break;
+    at = comments[i].start;
+  }
+  at = code.lastIndexOf("\n", at - 1) + 1;
+  return { start: at, end: at, text: `${line}
+
+` };
+}
+function calls(ast, name) {
+  const found = [];
+  walk2(ast, (node) => {
+    if ((node.type === "CallExpression" || node.type === "NewExpression") && node.callee?.type === "Identifier" && node.callee.name === name) {
+      found.push(node);
+    }
+  });
+  return found;
+}
+function finish(original, file, edits, name) {
+  const code = applyEdits(original, edits);
+  const ast = parseFile(code, file);
+  if (!ast || calls(ast, name).length === 0) return { status: "manual", reason: "the edited file did not parse back as expected" };
+  return { status: "edited", code };
+}
+function addBundlerPlugin(code, file, plugin) {
+  const ast = parseFile(code, file);
+  if (!ast) return { status: "manual", reason: `${file} does not parse as ${isTypeScriptFile(file) ? "TypeScript" : "JavaScript"}` };
+  if (calls(ast, plugin.name).length) return { status: "already" };
+  if (code.includes(plugin.spec)) return { status: "manual", reason: `${file} imports ${plugin.spec} but never uses ${plugin.name}` };
+  const site = findExport(ast);
+  if ("error" in site) return { status: "manual", reason: site.error };
+  const obj = configObject(ast, site.expr);
+  if (!obj) return { status: "manual", reason: "the exported config is not an object literal, a define\u2026Config({...}) call, a variable holding one, or a function returning one" };
+  const edit = addPluginEdit(code, obj, plugin.element, plugin.container);
+  if ("error" in edit) return { status: "manual", reason: edit.error };
+  return finish(code, file, [edit, importEdit(code, ast, plugin.name, plugin.spec, site.kind)], plugin.name);
+}
+var NEXT_WRAPPABLE = /* @__PURE__ */ new Set(["ObjectExpression", "Identifier", "CallExpression", "ArrowFunctionExpression", "FunctionExpression", "MemberExpression"]);
+function wrapNextConfig(code, file) {
+  const name = "withAutterSourceMaps";
+  const spec = "@autter/runtime-cli/next";
+  const ast = parseFile(code, file);
+  if (!ast) return { status: "manual", reason: `${file} does not parse as ${isTypeScriptFile(file) ? "TypeScript" : "JavaScript"}` };
+  const site = findExport(ast);
+  const existing = calls(ast, name);
+  if (existing.length) {
+    if (!("error" in site) && unwrap(site.expr) === existing[0]) return { status: "already" };
+    return {
+      status: "manual",
+      reason: `${name} is not the outermost wrapper of the exported config, so other wrappers' webpack and runAfterProductionCompile hooks may not be chained`
+    };
+  }
+  if (code.includes(spec)) return { status: "manual", reason: `${file} imports ${spec} but never calls ${name}` };
+  if ("error" in site) return { status: "manual", reason: site.error };
+  const target = unwrap(site.expr);
+  if (!target || !NEXT_WRAPPABLE.has(target.type)) {
+    return { status: "manual", reason: "the exported config is not an object, a variable, a wrapper call or a function" };
+  }
+  const edits = [
+    { start: site.expr.start, end: site.expr.start, text: `${name}(` },
+    { start: site.expr.end, end: site.expr.end, text: ")" },
+    importEdit(code, ast, name, spec, site.kind)
+  ];
+  return finish(code, file, edits, name);
+}
+function nextConfigObject(ast) {
+  const site = findExport(ast);
+  if ("error" in site) return null;
+  let node = unwrap(site.expr);
+  for (let depth = 0; node && depth < 6; depth++) {
+    const obj = configObject(ast, node);
+    if (obj) return obj;
+    if (node.type === "CallExpression" && node.arguments.length) node = unwrap(node.arguments[0]);
+    else return null;
+  }
+  return null;
+}
+function exportedConfigObject(ast) {
+  const site = findExport(ast);
+  return "error" in site ? null : configObject(ast, site.expr);
+}
+
+// src/setup-detect.ts
+var posix = (path) => path.split(sep3).join("/");
+var rel = (from, to) => posix(relative3(from, to)) || ".";
+function readText(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function readJson(path) {
+  const text = readText(path);
+  if (text === null) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+var firstExisting = (dir, names) => names.find((name) => existsSync3(join2(dir, name))) ?? null;
+function ancestors(dir, stop) {
+  const out = [];
+  for (let current = dir; ; current = dirname2(current)) {
+    out.push(current);
+    if (current === stop || dirname2(current) === current) break;
+  }
+  return out;
+}
+function gitRoot(dir) {
+  for (const current of ancestors(dir, null)) if (existsSync3(join2(current, ".git"))) return current;
+  return null;
+}
+function githubRepo(root) {
+  if (!root) return null;
+  const git = (args) => {
+    try {
+      return execFileSync2("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }).trim();
+    } catch {
+      return "";
+    }
+  };
+  const remotes = git(["remote"]).split("\n").filter(Boolean);
+  for (const remote of remotes.includes("origin") ? ["origin", ...remotes.filter((r) => r !== "origin")] : remotes) {
+    const url = git(["remote", "get-url", remote]);
+    const match = /github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url);
+    if (match) return `${match[1]}/${match[2]}`;
+  }
+  return null;
+}
+function semver(version) {
+  const match = version ? /(\d+)\.(\d+)\.(\d+)/.exec(version) : null;
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+function atLeast(version, minimum) {
+  const a = semver(version);
+  const b = semver(minimum);
+  if (!a) return null;
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+function installedVersion(dir, name) {
+  for (const current of ancestors(dir, null)) {
+    const manifest = readJson(join2(current, "node_modules", ...name.split("/"), "package.json"));
+    if (manifest?.version) return manifest.version;
+  }
+  return null;
+}
+function packageManager(dir, pkg, stop) {
+  for (const current of ancestors(dir, stop)) {
+    const manifest = current === dir ? pkg : readJson(join2(current, "package.json"));
+    const declared = /^(npm|pnpm|yarn|bun)@(\S+)/.exec(manifest?.packageManager ?? "");
+    if (declared) {
+      const name = declared[1];
+      const lockfile2 = lockfileIn(current);
+      return { name, lockfile: lockfile2 ? rel(dir, join2(current, lockfile2)) : null, ...name === "yarn" ? { yarnBerry: !declared[2].startsWith("1.") } : {} };
+    }
+    const lockfile = lockfileIn(current);
+    if (lockfile) {
+      const name = lockfile.startsWith("pnpm") ? "pnpm" : lockfile === "yarn.lock" ? "yarn" : lockfile.startsWith("bun") ? "bun" : "npm";
+      const berry = name === "yarn" && (existsSync3(join2(current, ".yarnrc.yml")) || (readText(join2(current, lockfile)) ?? "").includes("__metadata:"));
+      return { name, lockfile: rel(dir, join2(current, lockfile)), ...name === "yarn" ? { yarnBerry: berry } : {} };
+    }
+  }
+  return { name: "npm", lockfile: null };
+}
+function lockfileIn(dir) {
+  return firstExisting(dir, ["pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb", "package-lock.json", "npm-shrinkwrap.json"]);
+}
+function scriptFlag(script, ...flags) {
+  if (!script) return null;
+  for (const flag of flags) {
+    const match = new RegExp(`(?:^|\\s)${flag.replace(/[-]/g, "\\-")}(?:=|\\s+)(?:"([^"]+)"|'([^']+)'|([^\\s&|;]+))`).exec(script);
+    if (match) return match[1] ?? match[2] ?? match[3] ?? null;
+  }
+  return null;
+}
+var CONFIG_NAMES = {
+  vite: ["vite.config.ts", "vite.config.mts", "vite.config.js", "vite.config.mjs", "vite.config.cts", "vite.config.cjs"],
+  next: ["next.config.ts", "next.config.mts", "next.config.mjs", "next.config.js", "next.config.cjs"],
+  webpack: ["webpack.config.js", "webpack.config.cjs", "webpack.config.mjs", "webpack.config.ts"],
+  rollup: ["rollup.config.js", "rollup.config.mjs", "rollup.config.cjs", "rollup.config.ts"],
+  nuxt: ["nuxt.config.ts", "nuxt.config.js", "nuxt.config.mjs"],
+  astro: ["astro.config.mjs", "astro.config.ts", "astro.config.js", "astro.config.mts", "astro.config.cjs"],
+  "vue-cli": ["vue.config.js", "vue.config.cjs", "vue.config.mjs"],
+  "solid-start": ["app.config.ts", "app.config.js"]
+};
+function buildTool(dir, pkg) {
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const has = (name) => typeof deps[name] === "string";
+  const buildScript = pkg.scripts?.build ?? null;
+  const scriptConfig = (tool2) => {
+    if (!buildScript || !new RegExp(`\\b${tool2}\\b`).test(buildScript)) return null;
+    const file = scriptFlag(buildScript, "--config", "-c");
+    return file && existsSync3(join2(dir, file)) ? file : null;
+  };
+  const tool = (id, framework, config, versionOf) => ({
+    id,
+    framework,
+    config,
+    version: deps[versionOf] ?? null,
+    buildScript
+  });
+  if (has("next")) return tool("next", null, firstExisting(dir, [...CONFIG_NAMES.next]), "next");
+  if (has("react-scripts")) return tool("cra", has("@craco/craco") ? "craco" : null, null, "react-scripts");
+  if (existsSync3(join2(dir, "angular.json")) && (has("@angular/core") || has("@angular/cli"))) {
+    return tool("angular", null, "angular.json", has("@angular/cli") ? "@angular/cli" : "@angular/core");
+  }
+  const viteConfig = scriptConfig("vite") ?? firstExisting(dir, [...CONFIG_NAMES.vite]);
+  if (has("nuxt")) return tool("vite", "nuxt", firstExisting(dir, [...CONFIG_NAMES.nuxt]), "nuxt");
+  if (has("astro")) return tool("vite", "astro", firstExisting(dir, [...CONFIG_NAMES.astro]), "astro");
+  if (has("@solidjs/start")) return tool("vite", "solid-start", firstExisting(dir, [...CONFIG_NAMES["solid-start"]]), "@solidjs/start");
+  const viteFrameworks = [
+    ["@sveltejs/kit", "sveltekit"],
+    ["@remix-run/dev", "remix"],
+    ["@react-router/dev", "react-router"],
+    ["@builder.io/qwik", "qwik"],
+    ["vite-plugin-solid", "solid"]
+  ];
+  for (const [dep, framework] of viteFrameworks) {
+    if (has(dep) && (viteConfig || has("vite"))) return tool("vite", framework, viteConfig, has("vite") ? "vite" : dep);
+  }
+  const builds = (name) => has(name) && new RegExp(`\\b${name}\\b`).test(buildScript ?? "");
+  if (viteConfig || builds("vite")) return tool("vite", null, viteConfig, "vite");
+  if (has("@vue/cli-service")) return tool("webpack", "vue-cli", firstExisting(dir, [...CONFIG_NAMES["vue-cli"]]), "@vue/cli-service");
+  const webpackConfig = scriptConfig("webpack") ?? firstExisting(dir, [...CONFIG_NAMES.webpack]);
+  if (webpackConfig || builds("webpack")) return tool("webpack", null, webpackConfig, "webpack");
+  const rollupConfig = scriptConfig("rollup") ?? firstExisting(dir, [...CONFIG_NAMES.rollup]);
+  if (rollupConfig || builds("rollup")) return tool("rollup", null, rollupConfig, "rollup");
+  if (has("parcel") || /\bparcel\b/.test(buildScript ?? "")) return tool("parcel", null, null, "parcel");
+  if (/\besbuild\b/.test(buildScript ?? "")) return tool("esbuild", null, null, "esbuild");
+  return tool("unknown", null, null, "");
+}
+function ciProviders(dir, root, env) {
+  const found = [];
+  const top = root ?? dir;
+  const near = (names) => {
+    for (const current of ancestors(dir, top)) {
+      const name = firstExisting(current, names);
+      if (name) return rel(dir, join2(current, name));
+    }
+    return null;
+  };
+  const workflows = join2(top, ".github", "workflows");
+  let workflowFile = null;
+  try {
+    workflowFile = readdirSync(workflows).filter((f) => /\.ya?ml$/.test(f)).sort()[0] ?? null;
+  } catch {
+  }
+  if (workflowFile) {
+    found.push({ id: "github", name: "GitHub Actions", evidence: rel(dir, join2(workflows, workflowFile)), repo: githubRepo(root) });
+  } else if (env.GITHUB_ACTIONS === "true") {
+    found.push({ id: "github", name: "GitHub Actions", evidence: "GITHUB_ACTIONS", repo: env.GITHUB_REPOSITORY ?? githubRepo(root) });
+  }
+  const vercel = near(["vercel.json", ".vercel"]);
+  if (vercel || env.VERCEL) found.push({ id: "vercel", name: "Vercel", evidence: vercel ?? "VERCEL" });
+  const netlify = near(["netlify.toml"]);
+  if (netlify || env.NETLIFY) found.push({ id: "netlify", name: "Netlify", evidence: netlify ?? "NETLIFY" });
+  const wrangler = near(["wrangler.toml", "wrangler.json", "wrangler.jsonc"]);
+  const pagesConfig = wrangler && /pages_build_output_dir/.test(readText(join2(dir, wrangler)) ?? "") ? wrangler : null;
+  const pkg = readJson(join2(dir, "package.json"));
+  const pagesScript = Object.values(pkg?.scripts ?? {}).some((s) => /wrangler\s+pages\b/.test(s)) ? "package.json (wrangler pages)" : null;
+  if (pagesConfig || pagesScript || env.CF_PAGES) {
+    found.push({ id: "cloudflare-pages", name: "Cloudflare Pages", evidence: pagesConfig ?? pagesScript ?? "CF_PAGES" });
+  }
+  const gitlab = near([".gitlab-ci.yml"]);
+  if (gitlab || env.GITLAB_CI) found.push({ id: "gitlab", name: "GitLab CI", evidence: gitlab ?? "GITLAB_CI" });
+  return found;
+}
+function workflowsPassKey(dir, root) {
+  const workflows = join2(root ?? dir, ".github", "workflows");
+  try {
+    return readdirSync(workflows).some((f) => /\.ya?ml$/.test(f) && /secrets\.AUTTER_RUNTIME_KEY\b/.test(readText(join2(workflows, f)) ?? ""));
+  } catch {
+    return false;
+  }
+}
+function angularInfo(json) {
+  const projects = json.projects ?? {};
+  const names = Object.keys(projects);
+  const name = (typeof json.defaultProject === "string" && projects[json.defaultProject] ? json.defaultProject : null) ?? names.find((n) => projects[n].projectType === "application") ?? names[0];
+  if (!name) return null;
+  const project = projects[name];
+  const build = (project.architect ?? project.targets)?.build;
+  if (!build) return null;
+  const options = build.options ?? {};
+  const production = build.configurations?.production ?? {};
+  const application = typeof build.builder === "string" && /:application$/.test(build.builder);
+  const outputPath = production.outputPath ?? options.outputPath ?? `dist/${name}`;
+  let outputDir;
+  if (outputPath && typeof outputPath === "object") {
+    const { base, browser } = outputPath;
+    outputDir = browser === "" ? String(base) : `${base}/${browser ?? "browser"}`;
+  } else {
+    outputDir = application ? `${outputPath}/browser` : String(outputPath);
+  }
+  const prefix = production.deployUrl ?? options.deployUrl ?? production.baseHref ?? options.baseHref;
+  return {
+    project: name,
+    outputDir,
+    sourceMap: "sourceMap" in production ? production.sourceMap : options.sourceMap,
+    urlPrefix: typeof prefix === "string" && prefix.startsWith("/") ? prefix : "/"
+  };
+}
+function mapStateFromLiteral(value, onTrue = "public") {
+  if (value === true) return onTrue;
+  if (value === false) return "off";
+  if (value === "hidden") return "hidden";
+  if (value === "inline") return "inline";
+  return "unknown";
+}
+var CRA_ENV_FILES = [".env.production.local", ".env.local", ".env.production", ".env"];
+function craEnv(dir, name) {
+  for (const file of CRA_ENV_FILES) {
+    const match = new RegExp(`^\\s*${name}\\s*=\\s*["']?([^"'\\s#]*)`, "m").exec(readText(join2(dir, file)) ?? "");
+    if (match) return { value: match[1], file };
+  }
+  return null;
+}
+function parseConfig(dir, config) {
+  if (!config) return null;
+  const code = readText(join2(dir, config));
+  return code === null ? null : parseFile(code, config);
+}
+function outputFacts(dir, pkg, tool) {
+  const script = tool.buildScript;
+  const none = (state, setting = null, file = null) => ({ state, setting, file });
+  switch (tool.id) {
+    case "vite": {
+      const ast = parseConfig(dir, tool.config);
+      const obj = ast ? exportedConfigObject(ast) : null;
+      const base = tool.framework === "nuxt" || tool.framework === "astro" ? ["vite"] : [];
+      const sourcemap = literalProperty(obj, [...base, "build", "sourcemap"]);
+      const viteBase = literalProperty(obj, [...base, "base"]);
+      const outDir = (tool.framework === "astro" ? literalProperty(obj, ["outDir"]) : literalProperty(obj, [...base, "build", "outDir"])) ?? scriptFlag(script, "--outDir");
+      const defaults = {
+        nuxt: ".output/public",
+        "solid-start": ".output/public",
+        sveltekit: "build",
+        remix: "build/client",
+        "react-router": "build/client"
+      };
+      return {
+        outputDir: typeof outDir === "string" ? outDir : defaults[tool.framework ?? ""] ?? "dist",
+        urlPrefix: typeof viteBase === "string" && viteBase.startsWith("/") ? viteBase : "/",
+        sourceMaps: sourcemap === void 0 ? none(obj || !tool.config ? "default-off" : "unknown") : none(mapStateFromLiteral(sourcemap), `build.sourcemap: ${JSON.stringify(sourcemap)}`, tool.config)
+      };
+    }
+    case "next": {
+      const ast = parseConfig(dir, tool.config);
+      const obj = ast ? nextConfigObject(ast) : null;
+      const distDir = literalProperty(obj, ["distDir"]);
+      const exported = literalProperty(obj, ["output"]) === "export";
+      const publicMaps = literalProperty(obj, ["productionBrowserSourceMaps"]);
+      const basePath = literalProperty(obj, ["assetPrefix"]) ?? literalProperty(obj, ["basePath"]);
+      return {
+        outputDir: exported ? "out" : `${typeof distDir === "string" ? distDir : ".next"}/static`,
+        urlPrefix: exported ? `${typeof basePath === "string" ? basePath.replace(/\/+$/, "") : ""}/` : `${typeof basePath === "string" ? basePath.replace(/\/+$/, "") : ""}/_next/static/`,
+        sourceMaps: publicMaps === true ? none("public", "productionBrowserSourceMaps: true", tool.config) : none(obj || !tool.config ? "default-off" : "unknown")
+      };
+    }
+    case "webpack":
+    case "rollup": {
+      const ast = parseConfig(dir, tool.config);
+      const obj = ast ? exportedConfigObject(ast) : null;
+      if (tool.framework === "vue-cli") {
+        const productionSourceMap = literalProperty(obj, ["productionSourceMap"]);
+        const outputDir = literalProperty(obj, ["outputDir"]);
+        const publicPath = literalProperty(obj, ["publicPath"]);
+        return {
+          outputDir: typeof outputDir === "string" ? outputDir : "dist",
+          urlPrefix: typeof publicPath === "string" && publicPath.startsWith("/") ? publicPath : "/",
+          sourceMaps: productionSourceMap === false ? none("off", "productionSourceMap: false", tool.config) : none("default-public", productionSourceMap === true ? "productionSourceMap: true" : null, tool.config)
+        };
+      }
+      if (tool.id === "webpack") {
+        const devtool = literalProperty(obj, ["devtool"]);
+        const path = obj ? outputPathOf(obj) : null;
+        const publicPath = literalProperty(obj, ["output", "publicPath"]);
+        return {
+          outputDir: path ?? "dist",
+          urlPrefix: typeof publicPath === "string" && publicPath.startsWith("/") ? publicPath : "/",
+          sourceMaps: devtool === void 0 ? none(obj || !tool.config ? "default-off" : "unknown") : none(
+            devtool === false ? "off" : typeof devtool === "string" ? devtool.includes("hidden") ? "hidden" : devtool.includes("inline") || devtool.startsWith("eval") ? "inline" : "public" : "unknown",
+            `devtool: ${JSON.stringify(devtool)}`,
+            tool.config
+          )
+        };
+      }
+      const outDir = literalProperty(obj, ["output", "dir"]);
+      const outFile = literalProperty(obj, ["output", "file"]);
+      const sourcemap = literalProperty(obj, ["output", "sourcemap"]);
+      return {
+        outputDir: typeof outDir === "string" ? outDir : typeof outFile === "string" ? posix(dirname2(outFile)) : "dist",
+        urlPrefix: "/",
+        sourceMaps: sourcemap === void 0 ? none(obj || !tool.config ? "default-off" : "unknown") : none(mapStateFromLiteral(sourcemap), `output.sourcemap: ${JSON.stringify(sourcemap)}`, tool.config)
+      };
+    }
+    case "cra": {
+      const buildPath = (script && /BUILD_PATH=(\S+)/.exec(script)?.[1]) ?? craEnv(dir, "BUILD_PATH")?.value;
+      const inScript = script ? /GENERATE_SOURCEMAP=(\w+)/.exec(script) : null;
+      const fromEnv = craEnv(dir, "GENERATE_SOURCEMAP");
+      const homepage = pkg.homepage ? homepagePath(pkg.homepage) : "/";
+      const setting = inScript ? { value: inScript[1], file: "package.json" } : fromEnv;
+      return {
+        outputDir: buildPath || "build",
+        urlPrefix: homepage,
+        sourceMaps: setting ? none(setting.value === "false" ? "off" : "default-public", `GENERATE_SOURCEMAP=${setting.value}`, setting.file) : none("default-public")
+      };
+    }
+    case "angular": {
+      const json = readJson(join2(dir, "angular.json"));
+      const info = json ? angularInfo(json) : null;
+      if (!info) return { outputDir: null, urlPrefix: "/", sourceMaps: none("unknown", null, "angular.json") };
+      const sm = info.sourceMap;
+      const state = sm === void 0 ? "default-off" : sm === false ? "off" : sm === true ? "public" : sm.scripts === false ? "off" : sm.hidden ? "hidden" : "public";
+      return {
+        outputDir: info.outputDir,
+        urlPrefix: info.urlPrefix,
+        sourceMaps: none(state, sm === void 0 ? null : `sourceMap: ${JSON.stringify(sm)}`, "angular.json")
+      };
+    }
+    case "parcel": {
+      const off = /--no-source-maps\b/.test(script ?? "");
+      const publicUrl = scriptFlag(script, "--public-url");
+      return {
+        outputDir: scriptFlag(script, "--dist-dir") ?? "dist",
+        urlPrefix: publicUrl && publicUrl.startsWith("/") ? publicUrl : "/",
+        sourceMaps: off ? none("off", "--no-source-maps", "package.json") : none("default-public")
+      };
+    }
+    case "esbuild": {
+      const flag = script ? /--sourcemap(?:=(\w+))?/.exec(script) : null;
+      const outfile = scriptFlag(script, "--outfile");
+      return {
+        outputDir: scriptFlag(script, "--outdir") ?? (outfile ? posix(dirname2(outfile)) : "dist"),
+        urlPrefix: "/",
+        sourceMaps: flag ? none(flag[1] === "external" ? "hidden" : flag[1] === "inline" ? "inline" : "public", flag[0], "package.json") : none(script && /\besbuild\b/.test(script) ? "off" : "unknown")
+      };
+    }
+    default: {
+      const existing = ["dist", "build", "out"].find((d) => existsSync3(join2(dir, d)) && statSync(join2(dir, d)).isDirectory());
+      return { outputDir: existing ?? null, urlPrefix: "/", sourceMaps: none("unknown") };
+    }
+  }
+}
+function outputPathOf(obj) {
+  const output = findProperty(obj, "output");
+  if (!output || output === "ambiguous") return null;
+  const value = unwrap(output.value);
+  if (value?.type !== "ObjectExpression") return null;
+  const path = findProperty(value, "path");
+  if (!path || path === "ambiguous") return null;
+  const node = unwrap(path.value);
+  if (node?.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node?.type === "CallExpression" && node.callee?.type === "MemberExpression" && ["resolve", "join"].includes(node.callee.property?.name)) {
+    const parts = node.arguments.filter((a) => !(a.type === "Identifier" && a.name === "__dirname"));
+    if (parts.every((a) => a.type === "Literal" && typeof a.value === "string")) return parts.map((a) => a.value).join("/") || null;
+  }
+  return null;
+}
+function homepagePath(homepage) {
+  if (homepage === "." || homepage === "./") return "/";
+  try {
+    const path = new URL(homepage, "https://autter.invalid").pathname;
+    return path.endsWith("/") ? path : `${path}/`;
+  } catch {
+    return "/";
+  }
+}
+var SOURCE_EXTENSIONS = /\.(?:[cm]?[jt]sx?|vue|svelte|astro)$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "public", "static", "storybook-static"]);
+function releaseFacts(dir, skip) {
+  const found = [];
+  const visit = (current) => {
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue;
+      const full = join2(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name) && !skip.has(full)) visit(full);
+      } else if (entry.isFile() && SOURCE_EXTENSIONS.test(entry.name)) {
+        const code = readText(full);
+        if (!code?.includes("initAutterBrowser")) continue;
+        for (const passed of initCalls(code)) found.push({ file: rel(dir, full), passed });
+      }
+    }
+  };
+  visit(dir);
+  if (!found.length) return { file: null, passed: null };
+  const missing = found.find((f) => f.passed === false);
+  const unknown = found.find((f) => f.passed === null);
+  const pick = missing ?? unknown ?? found[0];
+  return { file: pick.file, passed: missing ? false : unknown ? null : true };
+}
+function initCalls(code) {
+  const out = [];
+  const re = /\binitAutterBrowser\s*\(/g;
+  for (let match = re.exec(code); match; match = re.exec(code)) {
+    let i = match.index + match[0].length;
+    while (/\s/.test(code[i] ?? "")) i++;
+    if (code[i] !== "{") {
+      out.push(code[i] === ")" ? false : null);
+      continue;
+    }
+    let depth = 0;
+    let quote = null;
+    let sawRelease = false;
+    let sawSpread = false;
+    for (; i < code.length; i++) {
+      const ch = code[i];
+      if (quote) {
+        if (ch === "\\") i++;
+        else if (ch === quote) quote = null;
+        continue;
+      }
+      if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+      else if (ch === "{" || ch === "(" || ch === "[") depth++;
+      else if (ch === "}" || ch === ")" || ch === "]") {
+        depth--;
+        if (depth === 0) break;
+      } else if (depth === 1) {
+        if (code.startsWith("...", i)) sawSpread = true;
+        if (/[\s{,]/.test(code[i - 1] ?? "") && /^release\s*[:,}(]/.test(code.slice(i, i + 20))) sawRelease = true;
+      }
+    }
+    out.push(sawRelease ? true : sawSpread ? null : false);
+  }
+  return out;
+}
+function detect(dir, env = process.env) {
+  const root = resolve2(dir);
+  const pkg = readJson(join2(root, "package.json"));
+  if (!pkg) throw new Error(`no readable package.json in ${root}`);
+  const git = gitRoot(root);
+  const tool = buildTool(root, pkg);
+  const facts = outputFacts(root, pkg, tool);
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const sdkPackage = deps["@autter/runtime-next"] ? "@autter/runtime-next" : deps["@autter/runtime-browser"] ? "@autter/runtime-browser" : null;
+  const sdkInstalled = sdkPackage ? installedVersion(root, sdkPackage) : null;
+  const skip = new Set(facts.outputDir ? [resolve2(root, facts.outputDir.split("/")[0])] : []);
+  return {
+    dir: root,
+    buildTool: tool,
+    packageManager: packageManager(root, pkg, git),
+    ci: ciProviders(root, git, env),
+    outputDir: facts.outputDir,
+    urlPrefix: facts.urlPrefix,
+    sourceMaps: facts.sourceMaps,
+    sdk: {
+      package: sdkPackage,
+      range: sdkPackage ? deps[sdkPackage] : null,
+      installed: sdkInstalled,
+      debugIds: sdkPackage ? atLeast(sdkInstalled ?? deps[sdkPackage], "1.6.0") : null
+    },
+    release: releaseFacts(root, skip),
+    cli: { range: deps["@autter/runtime-cli"] ?? null, installed: installedVersion(root, "@autter/runtime-cli") },
+    gitRoot: git
+  };
+}
+
+// src/setup.ts
+var PKG = "@autter/runtime-cli";
+var KEY_TEXT = "An upload-only key (autter_rtu_\u2026) is recommended: it can only upload source maps. The full server key (autter_rt_\u2026) also works.";
+var MIN_CLI = "1.2.0";
+function ownVersion() {
+  try {
+    return JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return MIN_CLI;
+  }
+}
+var Changes = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  dir;
+  files = /* @__PURE__ */ new Map();
+  read(file) {
+    const path = join3(this.dir, file);
+    return this.files.get(path) ?? readText(path);
+  }
+  write(file, content) {
+    this.files.set(join3(this.dir, file), content);
+  }
+};
+function rewriteJson(text, value) {
+  const indent = /^\{\r?\n([ \t]+)"/.exec(text)?.[1] ?? "  ";
+  return `${JSON.stringify(value, null, indent)}${text.endsWith("\n") ? "\n" : ""}`;
+}
+function insertAfter(obj, after, key, value) {
+  const out = {};
+  let placed = false;
+  for (const [k, v] of Object.entries(obj)) {
+    out[k] = v;
+    if (k === after) {
+      out[key] = value;
+      placed = true;
+    }
+  }
+  if (!placed) out[key] = value;
+  return out;
+}
+function addCommand(detected, spec, dev = true) {
+  const pm = detected.packageManager.name;
+  const verb = pm === "npm" ? "install" : "add";
+  const flag = pm === "npm" || pm === "pnpm" ? "--save-dev" : "--dev";
+  const argv = [pm, verb, ...dev ? [flag] : [], spec];
+  return { command: argv.join(" "), argv };
+}
+var shellArg = (value) => /^[\w./@:~-]+$/.test(value) ? value : JSON.stringify(value);
+function sourcemapsScript(outputDir, urlPrefix) {
+  const out = shellArg(outputDir);
+  return `autter-runtime sourcemaps inject ${out} && autter-runtime sourcemaps upload ${out}${urlPrefix && urlPrefix !== "/" ? ` --url-prefix ${shellArg(urlPrefix)}` : ""} --delete-after-upload --best-effort`;
+}
+function commitVars(ci) {
+  const byCi = {
+    vercel: "VERCEL_GIT_COMMIT_SHA",
+    netlify: "COMMIT_REF",
+    "cloudflare-pages": "CF_PAGES_COMMIT_SHA",
+    gitlab: "CI_COMMIT_SHA",
+    github: "GITHUB_SHA"
+  };
+  const order = ["vercel", "netlify", "cloudflare-pages", "gitlab", "github"];
+  const vars = order.filter((id) => ci.some((c) => c.id === id)).map((id) => byCi[id]);
+  return [...vars, "GIT_SHA"];
+}
+function releaseSnippet(detected) {
+  const vars = commitVars(detected.ci);
+  const expr = `${vars.map((v) => `process.env.${v}`).join(" ?? ")} ?? ""`;
+  const shellVar = `$${vars[0]}`;
+  const init = detected.release.file ?? "the file that calls initAutterBrowser";
+  const tool = detected.buildTool;
+  const config = tool.config ?? void 0;
+  const call = (value) => `// ${init}
+initAutterBrowser({ /* existing options */ release: ${value} });`;
+  switch (tool.id) {
+    case "vite": {
+      const define = `define: {
+  "import.meta.env.VITE_AUTTER_RELEASE": JSON.stringify(${expr}),
+},`;
+      const wrapped = tool.framework === "nuxt" || tool.framework === "astro" ? `vite: {
+  ${define.replace(/\n/g, "\n  ")}
+},` : define;
+      return {
+        file: config,
+        snippet: `// ${config ?? "vite.config.ts"}: the commit SHA is not a secret
+${wrapped}
+
+${call("import.meta.env.VITE_AUTTER_RELEASE")}`
+      };
+    }
+    case "next":
+      return {
+        file: config,
+        snippet: `// ${config ?? "next.config.mjs"}: the commit SHA is not a secret
+env: { NEXT_PUBLIC_AUTTER_RELEASE: ${expr} },
+
+${call("process.env.NEXT_PUBLIC_AUTTER_RELEASE")}`
+      };
+    case "webpack":
+      return {
+        file: config,
+        snippet: `// ${config ?? "webpack.config.js"}
+new webpack.DefinePlugin({ "process.env.AUTTER_RELEASE": JSON.stringify(${expr}) }),
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    case "rollup":
+      return {
+        file: config,
+        snippet: `// ${config ?? "rollup.config.js"} (@rollup/plugin-replace)
+replace({ preventAssignment: true, "process.env.AUTTER_RELEASE": JSON.stringify(${expr}) }),
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    case "cra":
+      return {
+        file: "package.json",
+        snippet: `// package.json: CRA inlines REACT_APP_* variables
+"build": "REACT_APP_AUTTER_RELEASE=${shellVar} react-scripts build",
+
+${call("process.env.REACT_APP_AUTTER_RELEASE")}`
+      };
+    case "angular":
+      return {
+        file: "package.json",
+        snippet: `// package.json (Angular 17.2+ application builder)
+"build": "ng build --define \\"AUTTER_RELEASE='${shellVar}'\\"",
+
+// ${init}
+declare const AUTTER_RELEASE: string | undefined;
+initAutterBrowser({ /* existing options */ release: typeof AUTTER_RELEASE === "string" ? AUTTER_RELEASE : undefined });`
+      };
+    case "parcel":
+      return {
+        file: "package.json",
+        snippet: `// package.json: Parcel inlines process.env values at build time
+"build": "AUTTER_RELEASE=${shellVar} ${tool.buildScript ?? "parcel build"}",
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    case "esbuild":
+      return {
+        file: "package.json",
+        snippet: `// the esbuild command
+--define:process.env.AUTTER_RELEASE=\\"${shellVar}\\"
+
+${call("process.env.AUTTER_RELEASE")}`
+      };
+    default:
+      return {
+        file: void 0,
+        snippet: `// Inline the commit SHA (${vars.join(", ")}) into the browser bundle with your build tool's define/env mechanism, then:
+${call("<the inlined commit SHA>")}`
+      };
+  }
+}
+function secretTargets(detected) {
+  const where = [];
+  for (const ci of detected.ci) {
+    switch (ci.id) {
+      case "github":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          command: `gh secret set AUTTER_RUNTIME_KEY${ci.repo ? ` --repo ${ci.repo}` : ""}`,
+          note: "gh prompts for the value (or reads it from stdin), so the key never reaches your shell history. Then pass it to the step that runs the production build: env: AUTTER_RUNTIME_KEY: ${{ secrets.AUTTER_RUNTIME_KEY }}"
+        });
+        break;
+      case "vercel":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          command: "vercel env add AUTTER_RUNTIME_KEY production",
+          note: "vercel prompts for the value (or reads it from stdin). Add it for preview too (vercel env add AUTTER_RUNTIME_KEY preview) if preview builds should upload."
+        });
+        break;
+      case "netlify":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          command: 'netlify env:set AUTTER_RUNTIME_KEY "$(cat)" --context production --scope builds --secret',
+          note: "Paste the key, press Enter, then Ctrl-D: $(cat) reads it from stdin, so it stays out of your shell history. netlify env:set has no prompt; without a value it stores an empty one."
+        });
+        break;
+      case "cloudflare-pages":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          note: "Cloudflare dashboard \u2192 Workers & Pages \u2192 your project \u2192 Settings \u2192 Variables and Secrets \u2192 Add: type Secret, name AUTTER_RUNTIME_KEY, for Production (and Preview if preview builds should upload). Builds read it from the environment."
+        });
+        break;
+      case "gitlab":
+        where.push({
+          ci: ci.id,
+          name: ci.name,
+          note: "GitLab \u2192 Settings \u2192 CI/CD \u2192 Variables \u2192 Add variable: key AUTTER_RUNTIME_KEY, visibility Masked (and Protected when only protected branches deploy). Jobs get it as an environment variable."
+        });
+        break;
+    }
+  }
+  if (!where.length) {
+    where.push({
+      ci: "other",
+      name: "your build environment",
+      note: "Add AUTTER_RUNTIME_KEY as a secret environment variable wherever the production build runs. Never in a committed .env file, and never under a public prefix (VITE_, NEXT_PUBLIC_, REACT_APP_, PUBLIC_)."
+    });
+  }
+  return where;
+}
+var PLUGINS = {
+  vite: { name: "autterSourceMaps", spec: "@autter/runtime-cli/vite", element: "autterSourceMaps()" },
+  rollup: { name: "autterSourceMaps", spec: "@autter/runtime-cli/rollup", element: "autterSourceMaps()" },
+  webpack: { name: "AutterSourceMapsWebpackPlugin", spec: "@autter/runtime-cli/webpack", element: "new AutterSourceMapsWebpackPlugin()" }
+};
+function pluginSnippet(kind, container, cjs) {
+  const plugin = PLUGINS[kind];
+  const importLine = cjs ? `const { ${plugin.name} } = require("${plugin.spec}");` : `import { ${plugin.name} } from "${plugin.spec}";`;
+  const plugins = `plugins: [/* existing plugins */ ${plugin.element}],`;
+  const body = container ? `${container}: {
+    ${plugins}
+  },` : plugins;
+  return `${importLine}
+
+// in the exported config object:
+  ${body}`;
+}
+function runSetup(dir, options = {}) {
+  const env = options.env ?? process.env;
+  const detected = detect(dir, env);
+  const changes = new Changes(detected.dir);
+  const actions = [];
+  const next = [];
+  const tool = detected.buildTool;
+  const pkgText = changes.read("package.json");
+  let pkg = JSON.parse(pkgText);
+  const version = ownVersion();
+  const range = `^${atLeast(version, MIN_CLI) ? version : MIN_CLI}`;
+  const install = addCommand(detected, `${PKG}@${range}`);
+  const manual = (description, file, snippet, command) => actions.push({ type: "manual", ...file ? { file } : {}, description, ...snippet ? { snippet } : {}, ...command ? { command } : {} });
+  const savePkg = () => changes.write("package.json", rewriteJson(changes.read("package.json"), pkg));
+  if (tool.id === "unknown" && !pkg.scripts?.build) {
+    manual(
+      "No build tool and no build script: if this app ships hand-written, unminified scripts there is nothing to upload. If another step builds its JavaScript, run this after it, on the output directory",
+      "package.json",
+      sourcemapsScript("<output dir>", "/")
+    );
+    return {
+      dir: detected.dir,
+      dryRun: Boolean(options.dryRun),
+      detected,
+      actions,
+      secret: { name: "AUTTER_RUNTIME_KEY", key: KEY_TEXT, where: [] },
+      next: ["Nothing was changed."],
+      exitCode: 2
+    };
+  }
+  const current = pkg.devDependencies?.[PKG] ?? pkg.dependencies?.[PKG];
+  let dependencyChanged = false;
+  if (!current) {
+    const devDependencies = { ...pkg.devDependencies };
+    const keys = Object.keys(devDependencies);
+    const sorted = keys.every((k, i) => i === 0 || keys[i - 1].localeCompare(k) <= 0);
+    devDependencies[PKG] = range;
+    pkg = {
+      ...pkg,
+      devDependencies: sorted ? Object.fromEntries(Object.entries(devDependencies).sort(([a], [b]) => a.localeCompare(b))) : devDependencies
+    };
+    if (!("devDependencies" in JSON.parse(pkgText))) pkg = insertAfter(pkg, "dependencies", "devDependencies", pkg.devDependencies);
+    dependencyChanged = true;
+    actions.push({ type: "add-dependency", file: "package.json", description: `Add ${PKG}@${range} to devDependencies`, command: install.command });
+  } else if (atLeast(current, MIN_CLI) === false) {
+    const section = pkg.devDependencies?.[PKG] ? "devDependencies" : "dependencies";
+    pkg = { ...pkg, [section]: { ...pkg[section], [PKG]: range } };
+    dependencyChanged = true;
+    actions.push({
+      type: "add-dependency",
+      file: "package.json",
+      description: `Raise ${PKG} from ${current} to ${range} (setup, verify and upload --best-effort need ${MIN_CLI})`,
+      command: install.command
+    });
+  }
+  if (dependencyChanged) savePkg();
+  const applyEdit = (result, file, description, fallback) => {
+    if (result.status === "edited") {
+      changes.write(file, result.code);
+      actions.push({ type: "edit", file, description });
+    } else if (result.status === "manual") {
+      manual(`${result.reason}: ${description[0].toLowerCase()}${description.slice(1)} by hand`, file, fallback);
+    } else if (result.note) {
+      next.push(result.note);
+    }
+  };
+  const addScript = () => {
+    const out = detected.outputDir;
+    const scripts = { ...pkg.scripts };
+    if (Object.values(scripts).some((s) => /autter-runtime\s+sourcemaps\s+(inject|upload)/.test(s))) return;
+    if (!out) {
+      manual("Could not tell where the build writes its output: after the production build, inject and upload from that directory", void 0, sourcemapsScript("<output dir>", "/"));
+      return;
+    }
+    const script = sourcemapsScript(out, detected.urlPrefix);
+    if (!scripts.build) {
+      manual(`No build script in package.json: run this after the production build (it writes ${out})`, "package.json", script);
+      return;
+    }
+    const { name: pm, yarnBerry } = detected.packageManager;
+    const post = pm === "npm" || pm === "yarn" && !yarnBerry;
+    if (post) {
+      pkg = { ...pkg, scripts: scripts.postbuild ? { ...scripts, postbuild: `${scripts.postbuild} && ${script}` } : insertAfter(scripts, "build", "postbuild", script) };
+      actions.push({
+        type: "add-script",
+        file: "package.json",
+        description: `${scripts.postbuild ? "Extend" : "Add"} the postbuild script: inject debug ids into ${out}, upload its maps, then delete them (with or without a key, so maps are never deployed; never fails the build)`,
+        snippet: `"postbuild": ${JSON.stringify(pkg.scripts.postbuild)}`
+      });
+    } else {
+      pkg = { ...pkg, scripts: { ...scripts, build: `${scripts.build} && ${script}` } };
+      actions.push({
+        type: "add-script",
+        file: "package.json",
+        description: `Append to the build script (${pm}${pm === "yarn" ? " 2+" : ""} does not run postbuild): inject debug ids into ${out}, upload its maps, then delete them (never fails the build)`,
+        snippet: `"build": ${JSON.stringify(pkg.scripts.build)}`
+      });
+    }
+    savePkg();
+  };
+  switch (tool.id) {
+    case "vite":
+    case "rollup": {
+      const kind = tool.id;
+      const container = tool.framework === "nuxt" || tool.framework === "astro" ? "vite" : void 0;
+      if (tool.framework === "solid-start") {
+        manual(
+          "SolidStart's app.config wraps Vite through vinxi: add the plugin to the client router's Vite config by hand",
+          tool.config ?? "app.config.ts",
+          pluginSnippet("vite", "vite", false)
+        );
+        break;
+      }
+      if (!tool.config) {
+        if (kind === "vite" && !tool.framework) {
+          const file = existsSync4(join3(detected.dir, "tsconfig.json")) ? "vite.config.ts" : "vite.config.js";
+          changes.write(
+            file,
+            `import { defineConfig } from "vite";
+import { autterSourceMaps } from "@autter/runtime-cli/vite";
+
+export default defineConfig({
+	plugins: [autterSourceMaps()],
+});
+`
+          );
+          actions.push({ type: "edit", file, description: `Create ${file} with the autterSourceMaps() plugin (the project had no Vite config)` });
+        } else {
+          manual(`No ${tool.framework ?? kind} config file found: create one with the plugin`, void 0, pluginSnippet(kind, container, false));
+        }
+        break;
+      }
+      const code = changes.read(tool.config);
+      const cjs = /\bmodule\.exports\b/.test(code);
+      applyEdit(
+        addBundlerPlugin(code, tool.config, { ...PLUGINS[kind], container }),
+        tool.config,
+        `Add ${PLUGINS[kind].element} to the ${container ? `${container}.` : ""}plugins in ${tool.config}`,
+        pluginSnippet(kind, container, cjs)
+      );
+      if (detected.sourceMaps.state === "inline") {
+        manual(
+          `${tool.config} writes inline source maps (${detected.sourceMaps.setting}): there are no map files to upload. Use "hidden"`,
+          tool.config,
+          kind === "vite" ? `build: { sourcemap: "hidden" },` : `output: { sourcemap: "hidden" },`
+        );
+      }
+      break;
+    }
+    case "webpack": {
+      const container = tool.framework === "vue-cli" ? "configureWebpack" : void 0;
+      if (!tool.config) {
+        manual(
+          `No ${tool.framework === "vue-cli" ? "vue.config.js" : "webpack config"} found: add the plugin to the config your build uses`,
+          void 0,
+          pluginSnippet("webpack", container, true)
+        );
+        break;
+      }
+      const code = changes.read(tool.config);
+      const cjs = /\bmodule\.exports\b/.test(code) || !/\b(import|export)\b/.test(code);
+      applyEdit(
+        addBundlerPlugin(code, tool.config, { ...PLUGINS.webpack, container }),
+        tool.config,
+        `Add new AutterSourceMapsWebpackPlugin() to the ${container ? `${container}.` : ""}plugins in ${tool.config}`,
+        pluginSnippet("webpack", container, cjs)
+      );
+      if (detected.sourceMaps.state === "inline") {
+        manual(`${tool.config} uses an inline/eval devtool: there are no map files to upload. Use "hidden-source-map" for production`, tool.config, `devtool: "hidden-source-map",`);
+      }
+      break;
+    }
+    case "next": {
+      const snippet = `import { withAutterSourceMaps } from "@autter/runtime-cli/next";
+
+// outermost, around any other wrappers:
+export default withAutterSourceMaps(withOtherPlugins(nextConfig));`;
+      if (!tool.config) {
+        changes.write("next.config.mjs", `import { withAutterSourceMaps } from "@autter/runtime-cli/next";
+
+/** @type {import("next").NextConfig} */
+const nextConfig = {};
+
+export default withAutterSourceMaps(nextConfig);
+`);
+        actions.push({ type: "edit", file: "next.config.mjs", description: "Create next.config.mjs exporting withAutterSourceMaps(nextConfig) (the project had none)" });
+      } else {
+        applyEdit(wrapNextConfig(changes.read(tool.config), tool.config), tool.config, `Wrap the exported config in withAutterSourceMaps(...), outermost, in ${tool.config}`, snippet);
+      }
+      if (/--turbo(pack)?\b/.test(tool.buildScript ?? "") && atLeast(tool.version, "15.4.1") === false) {
+        next.push(`Next.js ${tool.version} builds with Turbopack: withAutterSourceMaps covers Turbopack production builds from Next.js 15.4.1 (runAfterProductionCompile). Upgrade Next.js, or build with webpack.`);
+      }
+      break;
+    }
+    case "cra": {
+      addScript();
+      const sm = detected.sourceMaps;
+      if (sm.state === "off" && sm.file && CRA_ENV_FILES.includes(sm.file)) {
+        const text = changes.read(sm.file);
+        changes.write(sm.file, text.replace(/^(\s*GENERATE_SOURCEMAP\s*=\s*)["']?false["']?/m, "$1true"));
+        actions.push({
+          type: "edit",
+          file: sm.file,
+          description: `Set GENERATE_SOURCEMAP=true in ${sm.file}: the postbuild step uploads the maps and deletes them, so they are never deployed`
+        });
+      } else if (sm.state === "off") {
+        manual("The build script sets GENERATE_SOURCEMAP=false: remove it (or set true) so there are maps to upload; the postbuild step deletes them", "package.json", `"build": "react-scripts build"`);
+      }
+      break;
+    }
+    case "angular": {
+      addScript();
+      const text = changes.read("angular.json");
+      let json = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      const info = json ? angularInfo(json) : null;
+      const hidden = { scripts: true, styles: false, hidden: true, vendor: false };
+      const sm = detected.sourceMaps.state;
+      if (!json || !info) {
+        manual("angular.json could not be read: turn on hidden script source maps for the production build", "angular.json", `"sourceMap": ${JSON.stringify(hidden)}`);
+      } else if (sm === "default-off" || sm === "off") {
+        const architect = json.projects[info.project].architect ?? json.projects[info.project].targets;
+        const build = architect.build;
+        const configurations = build.configurations ?? {};
+        if (configurations.production) configurations.production.sourceMap = hidden;
+        else build.options = { ...build.options, sourceMap: hidden };
+        changes.write("angular.json", rewriteJson(text, json));
+        actions.push({
+          type: "edit",
+          file: "angular.json",
+          description: `Turn on hidden script source maps for ${info.project}'s ${configurations.production ? "production " : ""}build (written next to the bundles, not referenced by them; the postbuild step uploads and deletes them)`,
+          snippet: `"sourceMap": ${JSON.stringify(hidden)}`
+        });
+      } else if (sm === "public") {
+        next.push('angular.json emits public source maps (referenced by the bundles); the postbuild step deletes them after upload. Use "sourceMap": { "scripts": true, "hidden": true } to stop referencing them.');
+      }
+      break;
+    }
+    case "parcel":
+      addScript();
+      if (detected.sourceMaps.state === "off") {
+        manual("The build script passes --no-source-maps: remove it so there are maps to upload (the postbuild step deletes them)", "package.json", (tool.buildScript ?? "").replace(/\s*--no-source-maps\b/, ""));
+      }
+      break;
+    case "esbuild":
+      addScript();
+      if (detected.sourceMaps.state === "off" || detected.sourceMaps.state === "unknown") {
+        manual(
+          'Make esbuild write external source maps (written next to the bundles, not referenced by them): add --sourcemap=external to the esbuild command, or sourcemap: "external" to its build() options',
+          "package.json",
+          "--sourcemap=external"
+        );
+      } else if (detected.sourceMaps.state === "inline") {
+        manual("esbuild writes inline source maps: there are no map files to upload. Use --sourcemap=external", "package.json", "--sourcemap=external");
+      }
+      break;
+    default:
+      if (detected.outputDir && pkg.scripts?.build) {
+        addScript();
+        manual(
+          `Build tool not recognised: make sure the production build writes source maps (hidden if it can) into ${detected.outputDir}, and that ${detected.outputDir} is the deployed output`,
+          void 0
+        );
+      } else {
+        manual(
+          "Build tool not recognised: after the production build, inject debug ids and upload the maps from the output directory",
+          void 0,
+          sourcemapsScript(detected.outputDir ?? "<output dir>", "/")
+        );
+      }
+  }
+  if (detected.sdk.package && detected.release.file && detected.release.passed === false) {
+    const { file, snippet } = releaseSnippet(detected);
+    manual(
+      `initAutterBrowser in ${detected.release.file} gets no release: pass the commit SHA through ${tool.id === "unknown" ? "your build tool's" : `${tool.id}'s`} public env or define mechanism, so release-based features match the upload (debug ids match maps either way)`,
+      file ?? detected.release.file,
+      snippet
+    );
+  } else if (detected.sdk.package && detected.release.file && detected.release.passed === null) {
+    next.push(`Check that initAutterBrowser in ${detected.release.file} passes release: the commit SHA (setup could not read its options).`);
+  }
+  if (detected.sdk.package && detected.sdk.debugIds === false) {
+    manual(
+      `${detected.sdk.package} ${detected.sdk.installed ?? detected.sdk.range} predates 1.6.0, so exceptions carry no debug ids: upgrade it`,
+      "package.json",
+      void 0,
+      addCommand(detected, `${detected.sdk.package}@latest`, false).command
+    );
+  }
+  if (!detected.sdk.package) {
+    next.push("No Autter browser SDK in package.json: source maps resolve browser errors that @autter/runtime-browser (or @autter/runtime-next) 1.6.0+ reports. Set it up first, or alongside.");
+  }
+  if (detected.sourceMaps.state === "public" && tool.id !== "angular") {
+    next.push(
+      `${detected.sourceMaps.file ?? "The build"} emits public source maps (${detected.sourceMaps.setting}): your source is downloadable from production. Switch to hidden maps, or set deleteAfterUpload: true on the plugin, if you don't publish them on purpose.`
+    );
+  }
+  const where = secretTargets(detected);
+  for (const target of where) {
+    actions.push({
+      type: "set-secret",
+      description: `Store AUTTER_RUNTIME_KEY in ${target.name}${target.command ? "" : `: ${target.note}`}`,
+      ...target.command ? { command: target.command } : {}
+    });
+  }
+  const hosting = detected.ci.some((c) => c.id === "vercel" || c.id === "netlify" || c.id === "cloudflare-pages");
+  if (detected.ci.some((c) => c.id === "github") && !workflowsPassKey(detected.dir, detected.gitRoot)) {
+    const snippet = `- run: ${detected.packageManager.name === "npm" ? "npm run" : detected.packageManager.name} build
+  env:
+    AUTTER_RUNTIME_KEY: \${{ secrets.AUTTER_RUNTIME_KEY }}`;
+    if (hosting) {
+      next.push(`If a GitHub workflow builds the deployed output, give that step the key:
+${snippet}`);
+    } else {
+      manual(
+        "Pass the secret to the GitHub Actions step that runs the production build (only that job; never to jobs that run untrusted pull request code)",
+        detected.ci.find((c) => c.id === "github").evidence,
+        snippet
+      );
+    }
+  }
+  if (!options.dryRun) {
+    for (const [path, content] of changes.files) writeFileSync(path, content);
+  }
+  const needsInstall = dependencyChanged || !detected.cli.installed;
+  if (needsInstall && options.install && !options.dryRun) {
+    const [command, ...args] = install.argv;
+    const result = spawnSync(command, args, {
+      cwd: detected.dir,
+      stdio: options.installOutput === "stderr" ? ["ignore", 2, 2] : "inherit",
+      shell: process.platform === "win32"
+    });
+    if (result.status !== 0) throw new Error(`${install.command} failed (exit ${result.status ?? result.signal ?? "unknown"})`);
+  } else if (needsInstall) {
+    next.push(`Install it: ${install.command}`);
+  }
+  next.push(
+    "Get an upload-only key (autter_rtu_\u2026) for this repository from Autter: it can only upload source maps, so it is the right key for CI. The full server key (autter_rt_\u2026) also works. Never paste it into chat or commit it.",
+    `Store it as AUTTER_RUNTIME_KEY where the production build runs (see secret.where). Without it, builds still pass and upload nothing.`
+  );
+  if (detected.outputDir) {
+    next.push(`After a production build with the key set, check it: npx autter-runtime sourcemaps verify ${shellArg(detected.outputDir)}`);
+  }
+  return {
+    dir: detected.dir,
+    dryRun: Boolean(options.dryRun),
+    detected,
+    actions,
+    secret: {
+      name: "AUTTER_RUNTIME_KEY",
+      key: KEY_TEXT,
+      where
+    },
+    next,
+    exitCode: actions.some((a) => a.type === "manual") ? 2 : 0
+  };
+}
+var LABEL = {
+  edit: "edit",
+  "add-dependency": "dependency",
+  "add-script": "script",
+  manual: "manual",
+  "set-secret": "secret"
+};
+function formatSetup(result) {
+  const d = result.detected;
+  const lines = [`autter-runtime sourcemaps setup${result.dryRun ? " (dry run: nothing written)" : ""}: ${d.dir}`, "", "Detected"];
+  const row = (label, value) => lines.push(`  ${label.padEnd(16)} ${value}`);
+  const tool = d.buildTool;
+  row("build tool", `${tool.id}${tool.framework ? ` (${tool.framework})` : ""}${tool.config ? `, ${tool.config}` : ""}${tool.version ? `, ${tool.version}` : ""}`);
+  row("package manager", `${d.packageManager.name}${d.packageManager.lockfile ? ` (${d.packageManager.lockfile})` : ""}`);
+  row("CI", d.ci.length ? d.ci.map((c) => `${c.name} (${c.evidence}${c.repo ? `, ${c.repo}` : ""})`).join("; ") : "none found");
+  row("output", `${d.outputDir ?? "unknown"}${d.urlPrefix !== "/" ? `, served from ${d.urlPrefix}` : ""}`);
+  row("source maps", `${d.sourceMaps.state}${d.sourceMaps.setting ? ` (${d.sourceMaps.setting})` : ""}`);
+  row(
+    "browser SDK",
+    d.sdk.package ? `${d.sdk.package} ${d.sdk.installed ?? d.sdk.range}${d.sdk.debugIds === false ? " (no debug ids: needs 1.6.0+)" : ""}` : "none in package.json"
+  );
+  row(
+    "release",
+    d.release.file ? `${d.release.file}: ${d.release.passed === true ? "passed" : d.release.passed === false ? "not passed" : "could not tell"}` : "no initAutterBrowser call found"
+  );
+  row("runtime-cli", d.cli.range ? `${d.cli.range}${d.cli.installed ? ` (installed ${d.cli.installed})` : " (not installed)"}` : "not in package.json");
+  lines.push("", "Actions");
+  if (!result.actions.length) lines.push("  nothing to do");
+  for (const action of result.actions) {
+    const status = action.type === "manual" ? "TODO" : action.type === "set-secret" ? "KEY " : result.dryRun ? "PLAN" : "DONE";
+    lines.push(`  ${status} ${LABEL[action.type].padEnd(10)} ${action.file ? `${action.file}: ` : ""}${action.description}`);
+    if (action.command) lines.push(`         run: ${action.command}`);
+    if (action.snippet && action.type === "manual") for (const line of action.snippet.split("\n")) lines.push(`         | ${line}`);
+  }
+  lines.push("", `Secret: ${result.secret.name}. ${result.secret.key}`);
+  for (const target of result.secret.where) {
+    lines.push(`  ${target.name}: ${target.command ?? ""}${target.command ? "" : target.note}`);
+    if (target.command) lines.push(`    ${target.note}`);
+  }
+  lines.push("", "Next");
+  result.next.forEach((item, i) => lines.push(`  ${i + 1}. ${item.replace(/\n/g, "\n     ")}`));
+  return lines;
+}
+
+// src/verify.ts
+import { existsSync as existsSync5 } from "fs";
+import { readdir as readdir2, readFile as readFile4 } from "fs/promises";
+import { dirname as dirname3, join as join4, relative as relative4, resolve as resolve3, sep as sep4 } from "path";
+var CHECK_BATCH2 = 500;
+var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
+var NOT_BUNDLES = [
+  [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  // .next/server: middleware-build-manifest.js, next-font-manifest.js,
+  // server-reference-manifest.js, page_client-reference-manifest.js, …
+  [/(^|\/)[\w.-]*[-_]manifest\.js$/, "Next.js server manifest"],
+  [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
+  [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
+  [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
+];
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") {
+      re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(glob.includes("/") ? `^${re.replace(/^\.\//, "")}$` : `(^|/)${re}$`);
+}
+async function walk3(dir, out) {
+  let entries;
+  try {
+    entries = await readdir2(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === "node_modules") continue;
+    const full = join4(dir, entry.name);
+    if (entry.isDirectory()) await walk3(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+}
+function staticRoots(dir) {
+  for (let current = dirname3(dir); dirname3(current) !== current; current = dirname3(current)) {
+    if (existsSync5(join4(current, "package.json"))) return ["public", "static", "src"].map((name) => join4(current, name));
+  }
+  return [];
+}
+async function verifyDir(dir, options = {}) {
+  const root = resolve3(dir);
+  const env = options.env ?? process.env;
+  const files = [];
+  await walk3(root, files);
+  files.sort();
+  const relPath = (path) => relative4(root, path).split(sep4).join("/");
+  const ignore = (options.ignore ?? []).map(globToRegExp);
+  const roots = staticRoots(root);
+  const result = {
+    dir: root,
+    ok: true,
+    bundles: [],
+    maps: [],
+    ...options.server ? { server: true } : {},
+    upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
+    failures: []
+  };
+  const fail = (path, reason) => result.failures.push({ path, reason });
+  for (const file of files) {
+    const path = relPath(file);
+    if (file.endsWith(".map")) {
+      result.maps.push(path);
+      if (!options.allowMaps && !options.server) {
+        fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
+      }
+      continue;
+    }
+    if (!BUNDLE_RE.test(file)) continue;
+    const bytes = await readFile4(file);
+    const bundle = { path, status: "ok", debugId: null, reasons: [], uploaded: null };
+    result.bundles.push(bundle);
+    const skip = (reason) => {
+      bundle.status = "skipped";
+      bundle.reasons.push(reason);
+    };
+    if (ignore.some((re) => re.test(path))) {
+      skip("matches --ignore");
+      continue;
+    }
+    const known = NOT_BUNDLES.find(([re]) => re.test(path));
+    if (known) {
+      skip(known[1]);
+      continue;
+    }
+    let copied = null;
+    for (const staticRoot of roots) {
+      const candidate = join4(staticRoot, path);
+      if (existsSync5(candidate) && (await readFile4(candidate)).equals(bytes)) copied = relative4(dirname3(staticRoot), candidate).split(sep4).join("/");
+    }
+    if (copied) {
+      skip(`copied unchanged from ${copied}, not built`);
+      continue;
+    }
+    const code = bytes.toString("utf8");
+    const commentId = readDebugIdComment(code);
+    const snippetId = SNIPPET_ID_RE.exec(code)?.[1] ?? null;
+    bundle.debugId = commentId;
+    if (!commentId && !hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "no debug id: its errors can't be matched to a source map. Run `autter-runtime sourcemaps inject` on the build output (or use the bundler plugin with AUTTER_RUNTIME_KEY set) before deploying"
+      );
+    } else if (!commentId) {
+      bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
+    } else if (!hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "has a //# debugId= comment but no registration snippet, so the SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+      );
+    } else if (snippetId && snippetId !== commentId) {
+      bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
+    }
+    const url = readSourceMappingUrl(code);
+    if (url?.startsWith("data:")) {
+      if (!options.server) {
+        bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+      }
+    } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
+      let target = url.split(/[?#]/)[0];
+      try {
+        target = decodeURIComponent(target);
+      } catch {
+      }
+      if (!existsSync5(resolve3(dirname3(file), target))) {
+        bundle.reasons.push(
+          `its sourceMappingURL points at ${url}, which is not in the output (browsers' devtools request it and get a 404). Remove the comment: upload --delete-after-upload does`
+        );
+      }
+    }
+    if (bundle.reasons.length) {
+      bundle.status = "failed";
+      for (const reason of bundle.reasons) fail(path, reason);
+    }
+  }
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  if (!counted.length) fail(".", `no .js/.mjs/.cjs bundles under ${dir}: is this the build output?`);
+  await checkUploads(result, counted, options, env);
+  result.ok = result.failures.length === 0;
+  return result;
+}
+async function checkUploads(result, bundles, options, env) {
+  const upload = result.upload;
+  const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
+  if (!key) {
+    upload.reason = "AUTTER_RUNTIME_KEY is not set: only the local checks ran";
+    return;
+  }
+  upload.endpoint = resolveEndpoint(options.endpoint, env);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    upload.status = "error";
+    upload.reason = "AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which can't check source maps: use an upload key (autter_rtu_\u2026) or the server key (autter_rt_\u2026)";
+    result.failures.push({ path: ".", reason: upload.reason });
+    return;
+  }
+  const withIds = bundles.filter((b) => b.debugId);
+  if (!withIds.length) {
+    upload.reason = "no bundle has a debug id to check";
+    return;
+  }
+  let release = "verify";
+  try {
+    release = resolveRelease(options.release, env, options.cwd).release;
+  } catch {
+  }
+  const doFetch = options.fetch ?? fetch;
+  const missing = [];
+  for (let start = 0; start < withIds.length; start += CHECK_BATCH2) {
+    const batch = withIds.slice(start, start + CHECK_BATCH2);
+    let res;
+    try {
+      res = await doFetch(`${upload.endpoint}/v1/sourcemaps/check`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+        body: JSON.stringify({ release, files: batch.map((b) => ({ filename: servedFilename(options.urlPrefix, b.path), debugId: b.debugId })) })
+      });
+    } catch (err) {
+      upload.status = "error";
+      upload.reason = `could not reach the ingester: ${err.message}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (res.status === 404 || res.status === 400) {
+      upload.status = "unverified";
+      upload.reason = res.status === 404 ? "the ingester predates 1.6.0 (no /v1/sourcemaps/check), so uploads can't be checked: upgrade it" : "the ingester predates 1.7.0, which checks maps by debug id alone, so uploads can't be checked after the maps were deleted: upgrade it";
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      upload.status = "error";
+      upload.reason = `the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later)" : "");
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (!res.ok) {
+      upload.status = "error";
+      upload.reason = `the source map check failed: HTTP ${res.status}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    const body = await res.json();
+    const present = new Set(Array.isArray(body.present) ? body.present : []);
+    batch.forEach((bundle, index) => {
+      bundle.uploaded = present.has(index);
+      if (!bundle.uploaded) missing.push(bundle);
+    });
+  }
+  upload.checked = withIds.length;
+  upload.missing = missing.length;
+  upload.status = missing.length ? "missing" : "verified";
+  upload.reason = missing.length ? `${missing.length} of ${withIds.length} bundle(s) have no map on the ingester` : null;
+  for (const bundle of missing) {
+    const reason = `no map with debug id ${bundle.debugId} on the ingester for this key's repository: upload this build's maps (autter-runtime sourcemaps upload, or the bundler plugin with AUTTER_RUNTIME_KEY set)`;
+    bundle.status = "failed";
+    bundle.reasons.push(reason);
+    result.failures.push({ path: bundle.path, reason });
+  }
+}
+function formatVerify(result) {
+  const lines = [];
+  for (const bundle of result.bundles) {
+    if (bundle.status === "ok") lines.push(`ok      ${bundle.path} (debug id ${bundle.debugId}${bundle.uploaded ? ", map uploaded" : ""})`);
+    else if (bundle.status === "skipped") lines.push(`skipped ${bundle.path}: ${bundle.reasons.join("; ")}`);
+    else for (const reason of bundle.reasons) lines.push(`FAILED  ${bundle.path}: ${reason}`);
+  }
+  for (const map of result.maps) {
+    const failure = result.failures.find((f) => f.path === map);
+    lines.push(
+      failure ? `FAILED  ${map}: ${failure.reason}` : result.server ? `note    ${map}: source map in the server output (browsers never load it)` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`
+    );
+  }
+  for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
+  const u = result.upload;
+  lines.push(
+    u.status === "verified" ? `upload: verified, ${u.checked} bundle map(s) on the ingester (${u.endpoint})` : u.status === "missing" ? `upload: ${u.reason} (${u.endpoint})` : `upload: ${u.status}${u.reason ? `, ${u.reason}` : ""}`
+  );
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  lines.push(
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (${result.server ? "server output" : "--allow-maps"})` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+  );
+  return lines;
+}
+
 // src/cli.ts
 var USAGE = `autter-runtime \u2014 readable stack traces for Autter Runtime
 
 Usage:
-  autter-runtime sourcemaps inject <dir> [--dry-run]
+  autter-runtime sourcemaps setup [dir] [--dry-run] [--install] [--json]
+  autter-runtime sourcemaps verify <dir> [--endpoint <url>] [--url-prefix <prefix>]
+                [--ignore <glob>]... [--allow-maps] [--server] [--json]
+  autter-runtime sourcemaps inject <dir> [--dry-run] [--json]
   autter-runtime sourcemaps upload <dir> [--release <r>] [--url-prefix <prefix>]
-                [--endpoint <url>] [--concurrency <n>] [--delete-after-upload] [--dry-run]
+                [--endpoint <url>] [--concurrency <n>] [--delete-after-upload]
+                [--no-sources-content] [--best-effort] [--dry-run] [--json]
   autter-runtime doctor ...      (provided by @autter/runtime-node)
 
+setup   Wires source map upload into the project in [dir] (default "."):
+        detects the build tool, package manager, CI and browser SDK, adds
+        @autter/runtime-cli to devDependencies, adds the Vite/Rollup, webpack
+        or Next.js plugin when the config is safe to edit (else a postbuild
+        step), turns on hidden maps, and prints what is left to do by hand,
+        including where to store AUTTER_RUNTIME_KEY. Never writes a key.
+        Safe to re-run. Exit 0: all applied; 2: manual actions remain; 1: error.
+verify  Checks a production build before deploy: every bundle has a debug
+        id, no .map file is left, no sourceMappingURL points at a missing
+        map, and (with AUTTER_RUNTIME_KEY) every bundle's map is on the
+        ingester. Exit 0: ok (upload unverified without a key); 1: problems.
 inject  Gives every .js/.mjs/.cjs bundle that has a source map a debug id
         derived from its bytes: a "//# debugId=" comment, a one-line snippet
-        that registers it for @autter/runtime-browser, and "debugId" in the
-        .map. Running it again changes nothing.
+        that registers it for the Autter SDKs (browser, Node and edge), and
+        "debugId" in the .map. Works on browser and server output alike
+        (Vite, webpack, Next.js, tsup, esbuild). Running it again changes
+        nothing.
 upload  Sends every map to <endpoint>/v1/sourcemaps with AUTTER_RUNTIME_KEY,
         in parallel, skipping maps the ingester already has. Each map carries
         the bundle's function scopes ("x_autter_scopes"), so stack frames are
-        named after the function they are in, not the call site.
+        named after the function they are in, not the call site, and the
+        original source of your own files ("sourcesContent", never your
+        dependencies'), so issues show the lines around each frame.
 
 Options:
   --release <r>          Default: $GITHUB_SHA, $VERCEL_GIT_COMMIT_SHA,
                          $CF_PAGES_COMMIT_SHA, $GIT_SHA, then git rev-parse HEAD
   --url-prefix <prefix>  Where <dir> is served from: "/" (default), "/static/",
-                         or "https://cdn.example.com/app/"
+                         or "https://cdn.example.com/app/". For server output,
+                         any tail of the path the server runs it from
+                         ("/dist/" for /app/dist/server.js) or "/"
   --endpoint <url>       Ingester base URL. Default: $AUTTER_ENDPOINT,
                          $AUTTER_RUNTIME_ENDPOINT, $OTEL_EXPORTER_OTLP_ENDPOINT,
                          then https://otlp.autter.dev
   --concurrency <n>      Parallel uploads (default 8)
   --delete-after-upload  Delete each .map once the ingester has it
+  --no-sources-content   upload: send maps without your files' source (issues
+                         then show no lines around a frame)
+  --best-effort          For build scripts: never fail. Without a key, or when
+                         the upload fails, report it and exit 0; with
+                         --delete-after-upload, every .map under <dir> is then
+                         deleted anyway, so a build never ships maps
+  --install              setup: also run the package manager's install
+  --ignore <glob>        verify: JS files that are not bundles (repeatable)
+  --allow-maps           verify: report leftover .map files without failing
+  --server               verify: <dir> is server output (tsup, esbuild, webpack
+                         or Next server bundles): leftover maps are fine there
   --dry-run              Show what would change or be uploaded; write and send nothing
   --json                 Print the result as JSON
   -h, --help             Show this help
   -v, --version          Print the version
 
 Environment:
-  AUTTER_RUNTIME_KEY     Server ingest key (autter_rt_\u2026), required by upload`;
-function ownVersion() {
+  AUTTER_RUNTIME_KEY     Upload-only key (autter_rtu_\u2026, recommended for CI: it
+                         can only upload source maps) or the server key
+                         (autter_rt_\u2026, also works). Required by upload; used by
+                         verify to check the ingester. Never a client key.`;
+function ownVersion2() {
   try {
-    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+    return JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8")).version;
   } catch {
     return "unknown";
   }
@@ -909,16 +2736,16 @@ function ownVersion() {
 function delegate(pkg, args) {
   let manifest;
   try {
-    manifest = createRequire(join2(process.cwd(), "package.json")).resolve(`${pkg}/package.json`);
+    manifest = createRequire(join5(process.cwd(), "package.json")).resolve(`${pkg}/package.json`);
   } catch {
     return null;
   }
-  const bin = JSON.parse(readFileSync(manifest, "utf8")).bin;
-  const relative3 = typeof bin === "string" ? bin : bin?.["autter-runtime"];
-  if (!relative3) return null;
-  const script = resolve2(dirname2(manifest), relative3);
-  if (!existsSync3(script)) return null;
-  const result = spawnSync(process.execPath, [script, ...args], { stdio: "inherit" });
+  const bin = JSON.parse(readFileSync3(manifest, "utf8")).bin;
+  const relative6 = typeof bin === "string" ? bin : bin?.["autter-runtime"];
+  if (!relative6) return null;
+  const script = resolve4(dirname4(manifest), relative6);
+  if (!existsSync6(script)) return null;
+  const result = spawnSync2(process.execPath, [script, ...args], { stdio: "inherit" });
   return result.status ?? 1;
 }
 var SOURCEMAPS_OPTIONS = {
@@ -927,10 +2754,22 @@ var SOURCEMAPS_OPTIONS = {
   endpoint: { type: "string" },
   concurrency: { type: "string" },
   "delete-after-upload": { type: "boolean" },
+  "best-effort": { type: "boolean" },
+  install: { type: "boolean" },
+  ignore: { type: "string", multiple: true },
+  "allow-maps": { type: "boolean" },
+  server: { type: "boolean" },
+  "no-sources-content": { type: "boolean" },
   "dry-run": { type: "boolean" },
   json: { type: "boolean" },
   help: { type: "boolean", short: "h" }
 };
+var ACTION_FLAGS = {
+  setup: ["dry-run", "install"],
+  inject: ["dry-run"],
+  upload: ["release", "url-prefix", "endpoint", "concurrency", "delete-after-upload", "no-sources-content", "best-effort", "dry-run"],
+  verify: ["endpoint", "url-prefix", "release", "ignore", "allow-maps", "server"]
+};
 async function sourcemaps(argv) {
   let parsed;
   try {
@@ -942,22 +2781,56 @@ ${USAGE}`);
     return 64;
   }
   const { values, positionals } = parsed;
-  const [action, dir, ...extra] = positionals;
+  const [action, dirArg, ...extra] = positionals;
   if (values.help) {
     console.log(USAGE);
     return 0;
   }
-  if (action !== "inject" && action !== "upload" || !dir || extra.length) {
-    console.error(`${action && action !== "inject" && action !== "upload" ? `unknown command: sourcemaps ${action}
+  const known = action !== void 0 && action in ACTION_FLAGS;
+  const dir = dirArg ?? (action === "setup" ? "." : void 0);
+  if (!known || !dir || extra.length) {
+    console.error(`${action && !known ? `unknown command: sourcemaps ${action}
 
 ` : ""}${USAGE}`);
     return 64;
   }
-  if (!existsSync3(dir)) {
-    console.error(`autter-runtime: ${dir} does not exist`);
+  const allowed = /* @__PURE__ */ new Set([...ACTION_FLAGS[action], "json", "help"]);
+  const stray = Object.keys(values).filter((flag) => !allowed.has(flag));
+  if (stray.length) {
+    console.error(`autter-runtime: sourcemaps ${action} does not take --${stray.join(", --")}
+
+${USAGE}`);
     return 64;
   }
+  if (!existsSync6(dir)) {
+    console.error(`autter-runtime: ${dir} does not exist`);
+    return action === "setup" ? 1 : 64;
+  }
   const dryRun = Boolean(values["dry-run"]);
+  if (action === "setup") {
+    try {
+      const result = runSetup(dir, { dryRun, install: Boolean(values.install), installOutput: values.json ? "stderr" : "inherit" });
+      if (values.json) console.log(JSON.stringify(result, null, 2));
+      else for (const line of formatSetup(result)) console.log(line);
+      return result.exitCode;
+    } catch (err) {
+      console.error(`autter-runtime: sourcemaps setup: ${err instanceof Error ? err.message : String(err)}`);
+      return 1;
+    }
+  }
+  if (action === "verify") {
+    const result = await verifyDir(dir, {
+      endpoint: values.endpoint,
+      urlPrefix: values["url-prefix"],
+      release: values.release,
+      ignore: values.ignore,
+      allowMaps: Boolean(values["allow-maps"]),
+      server: Boolean(values.server)
+    });
+    if (values.json) console.log(JSON.stringify(result, null, 2));
+    else for (const line of formatVerify(result)) console.log(line);
+    return result.ok ? 0 : 1;
+  }
   if (action === "inject") {
     const results = await injectDir(dir, { dryRun });
     if (values.json) {
@@ -979,28 +2852,56 @@ ${USAGE}`);
     console.error("autter-runtime: --concurrency must be a positive integer");
     return 64;
   }
-  const summary = await uploadDir(dir, {
+  const deleteAfterUpload = Boolean(values["delete-after-upload"]);
+  const bestEffort = Boolean(values["best-effort"]);
+  let summary = null;
+  let error = null;
+  const run = () => uploadDir(dir, {
     release: values.release,
     urlPrefix: values["url-prefix"],
     endpoint: values.endpoint,
     concurrency,
     dryRun,
-    deleteAfterUpload: Boolean(values["delete-after-upload"]),
+    deleteAfterUpload,
+    ...values["no-sources-content"] ? { sourcesContent: false } : {},
     log: (line) => console.error(line)
   });
-  if (values.json) console.log(JSON.stringify(summary, null, 2));
+  if (!bestEffort) summary = await run();
+  else if (!dryRun && !(process.env.AUTTER_RUNTIME_KEY ?? "").trim()) error = `AUTTER_RUNTIME_KEY is not set, so nothing was uploaded (${KEY_ADVICE})`;
   else {
-    if (!summary.uploaded.length && !summary.skipped.length && !summary.failed.length) {
-      console.log(`no .js/.mjs/.cjs bundles with source maps under ${dir}`);
+    try {
+      summary = await run();
+    } catch (err) {
+      error = err instanceof Error ? err.message : String(err);
+    }
+  }
+  let removedMaps = [];
+  if (bestEffort && deleteAfterUpload && !dryRun) {
+    const owners = new Map((await findBundles(dir)).map((bundle) => [bundle.map, bundle.js]));
+    removedMaps = (await removeSourceMaps(await findMapFiles(dir), owners)).map((map) => relative5(resolve4(dir), map).split(sep5).join("/"));
+  }
+  if (values.json) {
+    console.log(JSON.stringify({ ...summary ?? { uploaded: [], skipped: [], failed: [] }, ...bestEffort ? { error, removedMaps } : {} }, null, 2));
+  } else {
+    if (summary) {
+      if (!summary.uploaded.length && !summary.skipped.length && !summary.failed.length) {
+        console.log(`no .js/.mjs/.cjs bundles with source maps under ${dir}`);
+      }
+      for (const line of formatUploadSummary(summary)) console.log(line);
+    }
+    if (error) console.error(`autter-runtime: ${error}`);
+    if (removedMaps.length) {
+      const why = error ? "the upload did not run" : summary?.failed.length ? `${summary.failed.length} could not be uploaded` : "they were uploaded";
+      console.log(`removed ${removedMaps.length} source map(s) under ${dir}, so they are not deployed: ${why}`);
     }
-    for (const line of formatUploadSummary(summary)) console.log(line);
+    if (bestEffort && (error || summary?.failed.length)) console.error("autter-runtime: --best-effort: the build continues");
   }
-  return summary.failed.length ? 1 : 0;
+  return bestEffort ? 0 : summary?.failed.length ? 1 : 0;
 }
 async function main(argv) {
   const [command, ...rest] = argv;
   if (command === "-v" || command === "--version") {
-    console.log(ownVersion());
+    console.log(ownVersion2());
     return 0;
   }
   if (command === void 0 || command === "-h" || command === "--help" || command === "help") {