@autter/runtime-cli 1.1.0 → 1.3.0

package/dist/index.cjs

@@ -21,26 +21,33 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   BUNDLE_RE: () => BUNDLE_RE,
+  CLIENT_KEY_PREFIX: () => CLIENT_KEY_PREFIX,
   DEBUG_ID_RE: () => DEBUG_ID_RE,
   DEBUG_ID_REGISTRY: () => DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT: () => DEFAULT_ENDPOINT,
   FatalUploadError: () => FatalUploadError,
+  KEY_ADVICE: () => KEY_ADVICE,
   MAX_MAP_CHARS: () => MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES: () => MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS: () => RELEASE_ENV_VARS,
   RELEASE_RE: () => RELEASE_RE,
   SCOPES_KEY: () => SCOPES_KEY,
   SCOPES_VERSION: () => SCOPES_VERSION,
+  SERVER_KEY_PREFIX: () => SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY: () => SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX: () => UPLOAD_KEY_PREFIX,
   computeScopes: () => computeScopes,
   debugIdFor: () => debugIdFor,
   debugIdSnippet: () => debugIdSnippet,
   findBundles: () => findBundles,
   formatUploadSummary: () => formatUploadSummary,
+  formatVerify: () => formatVerify,
   gitHead: () => gitHead,
+  globToRegExp: () => globToRegExp,
   hasDebugIdSnippet: () => hasDebugIdSnippet,
   injectBundle: () => injectBundle,
   injectDir: () => injectDir,
+  isInAppSource: () => isInAppSource,
   mapPathFor: () => mapPathFor,
   normalizeDebugId: () => normalizeDebugId,
   processBuildOutput: () => processBuildOutput,
@@ -49,11 +56,14 @@ __export(src_exports, {
   resolveEndpoint: () => resolveEndpoint,
   resolveRelease: () => resolveRelease,
   servedFilename: () => servedFilename,
+  serverUrlPrefix: () => serverUrlPrefix,
   shiftMappings: () => shiftMappings,
   snippetLine: () => snippetLine,
   storedMapJson: () => storedMapJson,
+  storedSourcesContent: () => storedSourcesContent,
   stripSourceMappingUrl: () => stripSourceMappingUrl,
-  uploadDir: () => uploadDir
+  uploadDir: () => uploadDir,
+  verifyDir: () => verifyDir
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -723,6 +733,10 @@ var DEFAULT_ENDPOINT = "https://otlp.autter.dev";
 var MAX_MAP_CHARS = 32 * 1024 * 1024;
 var MAX_UPLOAD_BYTES = MAX_MAP_CHARS + 1024 * 1024;
 var LEGACY_MAX_BYTES = 5 * 1024 * 1024;
+var UPLOAD_KEY_PREFIX = "autter_rtu_";
+var SERVER_KEY_PREFIX = "autter_rt_";
+var CLIENT_KEY_PREFIX = "autter_rtc_";
+var KEY_ADVICE = "set AUTTER_RUNTIME_KEY to an upload-only key (autter_rtu_\u2026, recommended for CI: it can only upload source maps) or the full server key (autter_rt_\u2026, also works)";
 var gzip = (0, import_node_util.promisify)(import_node_zlib.gzip);
 var CHECK_BATCH = 500;
 var MAX_ATTEMPTS = 3;
@@ -736,9 +750,56 @@ function servedFilename(urlPrefix, path) {
   if (!/^[a-z][\w+.-]*:\/\//i.test(prefix) && !prefix.startsWith("/")) prefix = `/${prefix}`;
   return `${prefix.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
 }
-function storedMapJson(map) {
-  const { sourcesContent: _omitted, ...safe } = map;
-  return JSON.stringify(safe);
+var NOT_IN_APP_PATH_PARTS = ["node_modules/", "/site-packages/", "/dist-packages/", "/vendor/", "/.pnpm/"];
+var NOT_IN_APP_PATH_PREFIXES = ["node:", "internal/"];
+var EXTENSION_SCHEMES = ["chrome-extension:", "moz-extension:", "safari-extension:", "safari-web-extension:", "webkit-masked-url:"];
+function isInAppSource(path) {
+  if (!path) return true;
+  const normalized = path.replace(/\\/g, "/");
+  if (NOT_IN_APP_PATH_PARTS.some((part) => normalized.includes(part))) return false;
+  if (NOT_IN_APP_PATH_PREFIXES.some((prefix) => normalized.startsWith(prefix))) return false;
+  const lower = normalized.toLowerCase();
+  return !EXTENSION_SCHEMES.some((scheme) => lower.startsWith(scheme));
+}
+var SOURCES_CONTENT_WRAPPER_BYTES = Buffer.byteLength(',"sourcesContent":[]');
+var NULL_ENTRY_BYTES = 4;
+function storedSourcesContent(fields, baseBytes, limit = MAX_MAP_CHARS) {
+  const { sources, sourcesContent } = fields;
+  if (!Array.isArray(sources) || !Array.isArray(sourcesContent) || sources.length === 0) return null;
+  const ignored = /* @__PURE__ */ new Set();
+  for (const list of [fields.ignoreList, fields.x_google_ignoreList]) {
+    if (!Array.isArray(list)) continue;
+    for (const index of list) if (Number.isInteger(index)) ignored.add(index);
+  }
+  const count = sources.length;
+  const candidates = [];
+  for (let index = 0; index < count; index++) {
+    const source = sources[index];
+    const content = sourcesContent[index];
+    if (typeof source !== "string" || typeof content !== "string") continue;
+    if (ignored.has(index) || !isInAppSource(source)) continue;
+    candidates.push({ index, content, bytes: Buffer.byteLength(JSON.stringify(content)) });
+  }
+  if (candidates.length === 0) return null;
+  candidates.sort((a, b) => a.bytes - b.bytes || a.index - b.index);
+  let remaining = limit - baseBytes - SOURCES_CONTENT_WRAPPER_BYTES - NULL_ENTRY_BYTES * count - (count - 1);
+  const kept = new Array(count).fill(null);
+  let any = false;
+  for (const candidate of candidates) {
+    const extra = candidate.bytes - NULL_ENTRY_BYTES;
+    if (extra > remaining) break;
+    remaining -= extra;
+    kept[candidate.index] = candidate.content;
+    any = true;
+  }
+  return any ? kept : null;
+}
+function storedMapJson(map, options = {}) {
+  const { sourcesContent: _content, ...rest } = map;
+  const base = JSON.stringify(rest);
+  if (options.sourcesContent === false) return base;
+  const content = storedSourcesContent(map, Buffer.byteLength(base));
+  return content ? JSON.stringify({ ...rest, sourcesContent: content }) : base;
 }
 function bytesOf(buffer) {
   return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
@@ -749,7 +810,7 @@ function fits(json, body) {
 function uploadBody(release, filename, debugId, json) {
   return `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
 }
-async function prepare(bundle, urlPrefix, release, log, compress) {
+async function prepare(bundle, urlPrefix, release, log, compress, sourcesContent) {
   let map;
   try {
     map = JSON.parse(await (0, import_promises3.readFile)(bundle.map, "utf8"));
@@ -764,9 +825,10 @@ async function prepare(bundle, urlPrefix, release, log, compress) {
   const filename = servedFilename(urlPrefix, bundle.path);
   const { [SCOPES_KEY]: _stale, ...plain } = map;
   const scopes = computeScopes(code, map);
-  let json = storedMapJson(plain);
+  const stored = { sourcesContent };
+  let json = storedMapJson(plain, stored);
   if ("scopes" in scopes) {
-    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes });
+    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes }, stored);
     if (fits(scoped, uploadBody(release, filename, debugId, scoped))) json = scoped;
     else if (fits(json, uploadBody(release, filename, debugId, json))) {
       log(`warning: ${bundle.path}: its map is over 32 MB with function scopes, so it is uploaded without them (frames keep call-site names)`);
@@ -791,7 +853,7 @@ async function prepare(bundle, urlPrefix, release, log, compress) {
 var FatalUploadError = class extends Error {
 };
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function uploadDir(dir, options = {}) {
   const env = options.env ?? process.env;
@@ -813,7 +875,7 @@ async function uploadDir(dir, options = {}) {
   };
   const items = [];
   for (const bundle of await findBundles(dir, options.files)) {
-    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun);
+    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun, options.sourcesContent !== false);
     if ("error" in prepared) {
       summary.failed.push({ path: bundle.path, filename: servedFilename(options.urlPrefix, bundle.path), error: prepared.error });
     } else if (prepared.mapChars > MAX_MAP_CHARS || prepared.bytes > MAX_UPLOAD_BYTES) {
@@ -831,10 +893,13 @@ async function uploadDir(dir, options = {}) {
     return summary;
   }
   const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
-  if (!key) throw new FatalUploadError("no ingest key: set AUTTER_RUNTIME_KEY to a server key (autter_rt_\u2026)");
-  if (key.startsWith("autter_rtc_")) {
-    throw new FatalUploadError("AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026); uploads need a server key (autter_rt_\u2026)");
+  if (!key) throw new FatalUploadError(`no ingest key: ${KEY_ADVICE}`);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    throw new FatalUploadError(`AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which cannot upload source maps: ${KEY_ADVICE}`);
   }
+  const rejected = (status, detail) => new FatalUploadError(
+    `the ingester rejected the key (${status}): ${detail}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later; the server key works with any)" : "")
+  );
   const headers = { "content-type": "application/json", authorization: `Bearer ${key}` };
   const uploadHeaders = { ...headers, "content-encoding": "gzip" };
   const skipped = /* @__PURE__ */ new Set();
@@ -856,9 +921,7 @@ async function uploadDir(dir, options = {}) {
         );
         break;
       }
-      if (res.status === 401 || res.status === 403) {
-        throw new FatalUploadError(`the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}`);
-      }
+      if (res.status === 401 || res.status === 403) throw rejected(res.status, (await res.text()).slice(0, 300));
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const body = await res.json();
       const present = new Set(Array.isArray(body.present) ? body.present : []);
@@ -889,7 +952,7 @@ async function uploadDir(dir, options = {}) {
         detail = err.message;
       }
       if (status === 401 || status === 403) {
-        fatal = new FatalUploadError(`the ingester rejected the key (${status}): ${detail}`);
+        fatal = rejected(status, detail);
         return;
       }
       const retryable = status === 0 || status === 429 || status >= 500;
@@ -930,9 +993,261 @@ function strip(item) {
   return { path, filename, debugId, hash, bytes };
 }
 
-// src/build.ts
+// src/verify.ts
 var import_node_fs2 = require("fs");
+var import_promises4 = require("fs/promises");
 var import_node_path2 = require("path");
+var CHECK_BATCH2 = 500;
+var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
+var NOT_BUNDLES = [
+  [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  // .next/server: middleware-build-manifest.js, next-font-manifest.js,
+  // server-reference-manifest.js, page_client-reference-manifest.js, …
+  [/(^|\/)[\w.-]*[-_]manifest\.js$/, "Next.js server manifest"],
+  [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
+  [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
+  [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
+];
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") {
+      re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(glob.includes("/") ? `^${re.replace(/^\.\//, "")}$` : `(^|/)${re}$`);
+}
+async function walk2(dir, out) {
+  let entries;
+  try {
+    entries = await (0, import_promises4.readdir)(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === "node_modules") continue;
+    const full = (0, import_node_path2.join)(dir, entry.name);
+    if (entry.isDirectory()) await walk2(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+}
+function staticRoots(dir) {
+  for (let current = (0, import_node_path2.dirname)(dir); (0, import_node_path2.dirname)(current) !== current; current = (0, import_node_path2.dirname)(current)) {
+    if ((0, import_node_fs2.existsSync)((0, import_node_path2.join)(current, "package.json"))) return ["public", "static", "src"].map((name) => (0, import_node_path2.join)(current, name));
+  }
+  return [];
+}
+async function verifyDir(dir, options = {}) {
+  const root = (0, import_node_path2.resolve)(dir);
+  const env = options.env ?? process.env;
+  const files = [];
+  await walk2(root, files);
+  files.sort();
+  const relPath = (path) => (0, import_node_path2.relative)(root, path).split(import_node_path2.sep).join("/");
+  const ignore = (options.ignore ?? []).map(globToRegExp);
+  const roots = staticRoots(root);
+  const result = {
+    dir: root,
+    ok: true,
+    bundles: [],
+    maps: [],
+    ...options.server ? { server: true } : {},
+    upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
+    failures: []
+  };
+  const fail = (path, reason) => result.failures.push({ path, reason });
+  for (const file of files) {
+    const path = relPath(file);
+    if (file.endsWith(".map")) {
+      result.maps.push(path);
+      if (!options.allowMaps && !options.server) {
+        fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
+      }
+      continue;
+    }
+    if (!BUNDLE_RE.test(file)) continue;
+    const bytes = await (0, import_promises4.readFile)(file);
+    const bundle = { path, status: "ok", debugId: null, reasons: [], uploaded: null };
+    result.bundles.push(bundle);
+    const skip = (reason) => {
+      bundle.status = "skipped";
+      bundle.reasons.push(reason);
+    };
+    if (ignore.some((re) => re.test(path))) {
+      skip("matches --ignore");
+      continue;
+    }
+    const known = NOT_BUNDLES.find(([re]) => re.test(path));
+    if (known) {
+      skip(known[1]);
+      continue;
+    }
+    let copied = null;
+    for (const staticRoot of roots) {
+      const candidate = (0, import_node_path2.join)(staticRoot, path);
+      if ((0, import_node_fs2.existsSync)(candidate) && (await (0, import_promises4.readFile)(candidate)).equals(bytes)) copied = (0, import_node_path2.relative)((0, import_node_path2.dirname)(staticRoot), candidate).split(import_node_path2.sep).join("/");
+    }
+    if (copied) {
+      skip(`copied unchanged from ${copied}, not built`);
+      continue;
+    }
+    const code = bytes.toString("utf8");
+    const commentId = readDebugIdComment(code);
+    const snippetId = SNIPPET_ID_RE.exec(code)?.[1] ?? null;
+    bundle.debugId = commentId;
+    if (!commentId && !hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "no debug id: its errors can't be matched to a source map. Run `autter-runtime sourcemaps inject` on the build output (or use the bundler plugin with AUTTER_RUNTIME_KEY set) before deploying"
+      );
+    } else if (!commentId) {
+      bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
+    } else if (!hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "has a //# debugId= comment but no registration snippet, so the SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+      );
+    } else if (snippetId && snippetId !== commentId) {
+      bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
+    }
+    const url = readSourceMappingUrl(code);
+    if (url?.startsWith("data:")) {
+      if (!options.server) {
+        bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+      }
+    } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
+      let target = url.split(/[?#]/)[0];
+      try {
+        target = decodeURIComponent(target);
+      } catch {
+      }
+      if (!(0, import_node_fs2.existsSync)((0, import_node_path2.resolve)((0, import_node_path2.dirname)(file), target))) {
+        bundle.reasons.push(
+          `its sourceMappingURL points at ${url}, which is not in the output (browsers' devtools request it and get a 404). Remove the comment: upload --delete-after-upload does`
+        );
+      }
+    }
+    if (bundle.reasons.length) {
+      bundle.status = "failed";
+      for (const reason of bundle.reasons) fail(path, reason);
+    }
+  }
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  if (!counted.length) fail(".", `no .js/.mjs/.cjs bundles under ${dir}: is this the build output?`);
+  await checkUploads(result, counted, options, env);
+  result.ok = result.failures.length === 0;
+  return result;
+}
+async function checkUploads(result, bundles, options, env) {
+  const upload = result.upload;
+  const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
+  if (!key) {
+    upload.reason = "AUTTER_RUNTIME_KEY is not set: only the local checks ran";
+    return;
+  }
+  upload.endpoint = resolveEndpoint(options.endpoint, env);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    upload.status = "error";
+    upload.reason = "AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which can't check source maps: use an upload key (autter_rtu_\u2026) or the server key (autter_rt_\u2026)";
+    result.failures.push({ path: ".", reason: upload.reason });
+    return;
+  }
+  const withIds = bundles.filter((b) => b.debugId);
+  if (!withIds.length) {
+    upload.reason = "no bundle has a debug id to check";
+    return;
+  }
+  let release = "verify";
+  try {
+    release = resolveRelease(options.release, env, options.cwd).release;
+  } catch {
+  }
+  const doFetch = options.fetch ?? fetch;
+  const missing = [];
+  for (let start = 0; start < withIds.length; start += CHECK_BATCH2) {
+    const batch = withIds.slice(start, start + CHECK_BATCH2);
+    let res;
+    try {
+      res = await doFetch(`${upload.endpoint}/v1/sourcemaps/check`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+        body: JSON.stringify({ release, files: batch.map((b) => ({ filename: servedFilename(options.urlPrefix, b.path), debugId: b.debugId })) })
+      });
+    } catch (err) {
+      upload.status = "error";
+      upload.reason = `could not reach the ingester: ${err.message}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (res.status === 404 || res.status === 400) {
+      upload.status = "unverified";
+      upload.reason = res.status === 404 ? "the ingester predates 1.6.0 (no /v1/sourcemaps/check), so uploads can't be checked: upgrade it" : "the ingester predates 1.7.0, which checks maps by debug id alone, so uploads can't be checked after the maps were deleted: upgrade it";
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      upload.status = "error";
+      upload.reason = `the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later)" : "");
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (!res.ok) {
+      upload.status = "error";
+      upload.reason = `the source map check failed: HTTP ${res.status}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    const body = await res.json();
+    const present = new Set(Array.isArray(body.present) ? body.present : []);
+    batch.forEach((bundle, index) => {
+      bundle.uploaded = present.has(index);
+      if (!bundle.uploaded) missing.push(bundle);
+    });
+  }
+  upload.checked = withIds.length;
+  upload.missing = missing.length;
+  upload.status = missing.length ? "missing" : "verified";
+  upload.reason = missing.length ? `${missing.length} of ${withIds.length} bundle(s) have no map on the ingester` : null;
+  for (const bundle of missing) {
+    const reason = `no map with debug id ${bundle.debugId} on the ingester for this key's repository: upload this build's maps (autter-runtime sourcemaps upload, or the bundler plugin with AUTTER_RUNTIME_KEY set)`;
+    bundle.status = "failed";
+    bundle.reasons.push(reason);
+    result.failures.push({ path: bundle.path, reason });
+  }
+}
+function formatVerify(result) {
+  const lines = [];
+  for (const bundle of result.bundles) {
+    if (bundle.status === "ok") lines.push(`ok      ${bundle.path} (debug id ${bundle.debugId}${bundle.uploaded ? ", map uploaded" : ""})`);
+    else if (bundle.status === "skipped") lines.push(`skipped ${bundle.path}: ${bundle.reasons.join("; ")}`);
+    else for (const reason of bundle.reasons) lines.push(`FAILED  ${bundle.path}: ${reason}`);
+  }
+  for (const map of result.maps) {
+    const failure = result.failures.find((f) => f.path === map);
+    lines.push(
+      failure ? `FAILED  ${map}: ${failure.reason}` : result.server ? `note    ${map}: source map in the server output (browsers never load it)` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`
+    );
+  }
+  for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
+  const u = result.upload;
+  lines.push(
+    u.status === "verified" ? `upload: verified, ${u.checked} bundle map(s) on the ingester (${u.endpoint})` : u.status === "missing" ? `upload: ${u.reason} (${u.endpoint})` : `upload: ${u.status}${u.reason ? `, ${u.reason}` : ""}`
+  );
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  lines.push(
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (${result.server ? "server output" : "--allow-maps"})` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+  );
+  return lines;
+}
+
+// src/build.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+function serverUrlPrefix(projectRoot, dir) {
+  const rel = (0, import_node_path3.relative)(projectRoot, dir).split(import_node_path3.sep).join("/");
+  return !rel || rel.startsWith("..") || (0, import_node_path3.isAbsolute)(rel) ? "/" : `/${rel.replace(/\/+$/, "")}/`;
+}
 function buildKey(options) {
   const key = (options.key ?? process.env.AUTTER_RUNTIME_KEY ?? "").trim();
   return key || null;
@@ -987,12 +1302,13 @@ async function processBuildOutput(input) {
       result.upload = await uploadDir(input.dir, {
         files: input.files,
         release: options.release,
-        urlPrefix: options.urlPrefix ?? input.urlPrefix,
+        urlPrefix: input.server ? input.urlPrefix : options.urlPrefix ?? input.urlPrefix,
         endpoint: options.endpoint,
         key: key ?? void 0,
         dryRun: options.dryRun,
         concurrency: options.concurrency,
         deleteAfterUpload: options.deleteAfterUpload ?? input.deleteAfterUpload,
+        ...options.sourcesContent === false ? { sourcesContent: false } : {},
         log
       });
       for (const line of formatUploadSummary(result.upload)) log(line);
@@ -1017,9 +1333,9 @@ async function processBuildOutput(input) {
   async function cleanUp() {
     if (!input.ownMaps) return;
     const maps = /* @__PURE__ */ new Set([...input.maps ?? [], ...owners.keys()]);
-    const rel = (path) => (0, import_node_path2.relative)(input.dir, path).split(import_node_path2.sep).join("/");
+    const rel = (path) => (0, import_node_path3.relative)(input.dir, path).split(import_node_path3.sep).join("/");
     if (options.upload === false || options.deleteAfterUpload === false) {
-      const kept = [...maps].filter((map) => (0, import_node_fs2.existsSync)(map));
+      const kept = [...maps].filter((map) => (0, import_node_fs3.existsSync)(map));
       if (kept.length) {
         log(
           `kept ${kept.length} source map(s) this plugin generated (${options.upload === false ? "upload: false" : "deleteAfterUpload: false"}): they expose your source, so upload them with \`autter-runtime sourcemaps upload --delete-after-upload\` or keep them out of the deploy`
@@ -1034,7 +1350,7 @@ async function processBuildOutput(input) {
       if (options.failOnError) throw new Error(`[autter-runtime] ${message}`);
       if (!options.silent) console.warn(`[autter-runtime] ${message}`);
     }
-    result.removedMaps = [...maps].filter((map) => !(0, import_node_fs2.existsSync)(map)).map(rel).sort();
+    result.removedMaps = [...maps].filter((map) => !(0, import_node_fs3.existsSync)(map)).map(rel).sort();
     if (result.removedMaps.length) {
       log(`removed ${result.removedMaps.length} source map(s) this plugin generated, so they are not deployed: ${outcome}`);
     }
@@ -1043,26 +1359,33 @@ async function processBuildOutput(input) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BUNDLE_RE,
+  CLIENT_KEY_PREFIX,
   DEBUG_ID_RE,
   DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT,
   FatalUploadError,
+  KEY_ADVICE,
   MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS,
   RELEASE_RE,
   SCOPES_KEY,
   SCOPES_VERSION,
+  SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX,
   computeScopes,
   debugIdFor,
   debugIdSnippet,
   findBundles,
   formatUploadSummary,
+  formatVerify,
   gitHead,
+  globToRegExp,
   hasDebugIdSnippet,
   injectBundle,
   injectDir,
+  isInAppSource,
   mapPathFor,
   normalizeDebugId,
   processBuildOutput,
@@ -1071,9 +1394,12 @@ async function processBuildOutput(input) {
   resolveEndpoint,
   resolveRelease,
   servedFilename,
+  serverUrlPrefix,
   shiftMappings,
   snippetLine,
   storedMapJson,
+  storedSourcesContent,
   stripSourceMappingUrl,
-  uploadDir
+  uploadDir,
+  verifyDir
 });

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SNIPPET_LINE_KEY, U as UploadItem, e as UploadOptions, f as UploadSummary, g as findBundles, h as formatUploadSummary, i as injectBundle, j as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, k as resolveEndpoint, s as servedFilename, l as shiftMappings, n as snippetLine, o as storedMapJson, q as stripSourceMappingUrl, u as uploadDir } from './build-CPXR9Xd3.cjs';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as isInAppSource, n as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, o as resolveEndpoint, s as servedFilename, q as serverUrlPrefix, t as shiftMappings, u as snippetLine, v as storedMapJson, w as storedSourcesContent, x as stripSourceMappingUrl, y as uploadDir } from './build-DGeoDkTh.cjs';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -14,13 +14,16 @@ declare function debugIdFor(bytes: Uint8Array | string): string;
 /** The id in the bundle's last `//# debugId=` comment, if any (ours, or one
  * a bundler wrote natively). */
 declare function readDebugIdComment(code: string): string | null;
-/** Property the browser SDK reads: `globalThis._autterDebugIds[stack] = id`. */
+/** Property the SDKs read: `globalThis._autterDebugIds[stack] = id` (the
+ * browser SDK, and the Node and edge SDKs' `autter.debug_ids`, RF-05). */
 declare const DEBUG_ID_REGISTRY = "_autterDebugIds";
 /**
  * One line of ES5 that records this bundle's id under the stack of an Error
  * created inside it — the stack's first frame names the script URL the
- * browser actually loaded, which the SDK maps back to the id. `g.Error` keeps
- * working when the bundle shadows `Error` at top level. Never throws.
+ * browser loaded, or the file Node or an edge runtime ran, which the SDK
+ * maps back to the id. `g.Error` keeps working when the bundle shadows
+ * `Error` at top level. Never throws. The same snippet goes into browser
+ * and server bundles.
  */
 declare function debugIdSnippet(id: string): string;
 /** Whether the bundle already carries our registration snippet. (The
@@ -28,6 +31,66 @@ declare function debugIdSnippet(id: string): string;
  * contains it too.) */
 declare function hasDebugIdSnippet(code: string): boolean;
 
+interface VerifyOptions {
+    /** Ingester base URL (default as for upload). */
+    endpoint?: string;
+    /** Default: $AUTTER_RUNTIME_KEY. */
+    key?: string;
+    /** Sent with the check (a debug id check ignores it). */
+    release?: string;
+    urlPrefix?: string;
+    /** Globs (relative to the directory) of JS files that are not bundles. */
+    ignore?: string[];
+    /** Report leftover .map files without failing (a step that runs before they are removed). */
+    allowMaps?: boolean;
+    /** A server bundle directory (tsup, esbuild, webpack or Next server
+     * output): leftover maps are reported, not failures — browsers never load
+     * them, and Node's own `--enable-source-maps` may use them. */
+    server?: boolean;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    fetch?: typeof fetch;
+}
+interface VerifyBundle {
+    /** Relative to the directory. */
+    path: string;
+    status: "ok" | "failed" | "skipped";
+    debugId: string | null;
+    /** Why it failed, or why it was skipped. */
+    reasons: string[];
+    /** Whether the ingester has a map for its debug id (null: not checked). */
+    uploaded: boolean | null;
+}
+interface VerifyResult {
+    dir: string;
+    ok: boolean;
+    bundles: VerifyBundle[];
+    /** `.map` files in the directory (deploy risks unless allowMaps or server). */
+    maps: string[];
+    /** True when checked as server output (`--server`). */
+    server?: boolean;
+    upload: {
+        /** verified: every checked bundle's map is on the ingester; missing: some are not;
+         * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */
+        status: "verified" | "missing" | "unverified" | "error";
+        endpoint: string | null;
+        reason: string | null;
+        checked: number;
+        missing: number;
+    };
+    /** Every failure, one per file and reason. */
+    failures: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
+/** A tiny glob: `**` any path, `*` any name part, `?` one character. A
+ * pattern without "/" matches the file name anywhere. */
+declare function globToRegExp(glob: string): RegExp;
+declare function verifyDir(dir: string, options?: VerifyOptions): Promise<VerifyResult>;
+/** Human-readable report. */
+declare function formatVerify(result: VerifyResult): string[];
+
 /**
  * Function scopes for scope-based frame names (like Sentry's
  * js-source-scopes and PostHog cymbal's `token.scope()`).
@@ -102,4 +165,4 @@ declare function gitHead(cwd?: string): string | null;
  */
 declare function resolveRelease(explicit?: string | null, env?: NodeJS.ProcessEnv, cwd?: string): ResolvedRelease;
 
-export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, computeScopes, debugIdFor, debugIdSnippet, gitHead, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease };
+export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, type VerifyBundle, type VerifyOptions, type VerifyResult, computeScopes, debugIdFor, debugIdSnippet, formatVerify, gitHead, globToRegExp, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease, verifyDir };