@autter/runtime-cli 1.1.0 → 1.3.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SNIPPET_LINE_KEY, U as UploadItem, e as UploadOptions, f as UploadSummary, g as findBundles, h as formatUploadSummary, i as injectBundle, j as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, k as resolveEndpoint, s as servedFilename, l as shiftMappings, n as snippetLine, o as storedMapJson, q as stripSourceMappingUrl, u as uploadDir } from './build-CPXR9Xd3.js';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as isInAppSource, n as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, o as resolveEndpoint, s as servedFilename, q as serverUrlPrefix, t as shiftMappings, u as snippetLine, v as storedMapJson, w as storedSourcesContent, x as stripSourceMappingUrl, y as uploadDir } from './build-DGeoDkTh.js';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -14,13 +14,16 @@ declare function debugIdFor(bytes: Uint8Array | string): string;
 /** The id in the bundle's last `//# debugId=` comment, if any (ours, or one
  * a bundler wrote natively). */
 declare function readDebugIdComment(code: string): string | null;
-/** Property the browser SDK reads: `globalThis._autterDebugIds[stack] = id`. */
+/** Property the SDKs read: `globalThis._autterDebugIds[stack] = id` (the
+ * browser SDK, and the Node and edge SDKs' `autter.debug_ids`, RF-05). */
 declare const DEBUG_ID_REGISTRY = "_autterDebugIds";
 /**
  * One line of ES5 that records this bundle's id under the stack of an Error
  * created inside it — the stack's first frame names the script URL the
- * browser actually loaded, which the SDK maps back to the id. `g.Error` keeps
- * working when the bundle shadows `Error` at top level. Never throws.
+ * browser loaded, or the file Node or an edge runtime ran, which the SDK
+ * maps back to the id. `g.Error` keeps working when the bundle shadows
+ * `Error` at top level. Never throws. The same snippet goes into browser
+ * and server bundles.
  */
 declare function debugIdSnippet(id: string): string;
 /** Whether the bundle already carries our registration snippet. (The
@@ -28,6 +31,66 @@ declare function debugIdSnippet(id: string): string;
  * contains it too.) */
 declare function hasDebugIdSnippet(code: string): boolean;
 
+interface VerifyOptions {
+    /** Ingester base URL (default as for upload). */
+    endpoint?: string;
+    /** Default: $AUTTER_RUNTIME_KEY. */
+    key?: string;
+    /** Sent with the check (a debug id check ignores it). */
+    release?: string;
+    urlPrefix?: string;
+    /** Globs (relative to the directory) of JS files that are not bundles. */
+    ignore?: string[];
+    /** Report leftover .map files without failing (a step that runs before they are removed). */
+    allowMaps?: boolean;
+    /** A server bundle directory (tsup, esbuild, webpack or Next server
+     * output): leftover maps are reported, not failures — browsers never load
+     * them, and Node's own `--enable-source-maps` may use them. */
+    server?: boolean;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    fetch?: typeof fetch;
+}
+interface VerifyBundle {
+    /** Relative to the directory. */
+    path: string;
+    status: "ok" | "failed" | "skipped";
+    debugId: string | null;
+    /** Why it failed, or why it was skipped. */
+    reasons: string[];
+    /** Whether the ingester has a map for its debug id (null: not checked). */
+    uploaded: boolean | null;
+}
+interface VerifyResult {
+    dir: string;
+    ok: boolean;
+    bundles: VerifyBundle[];
+    /** `.map` files in the directory (deploy risks unless allowMaps or server). */
+    maps: string[];
+    /** True when checked as server output (`--server`). */
+    server?: boolean;
+    upload: {
+        /** verified: every checked bundle's map is on the ingester; missing: some are not;
+         * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */
+        status: "verified" | "missing" | "unverified" | "error";
+        endpoint: string | null;
+        reason: string | null;
+        checked: number;
+        missing: number;
+    };
+    /** Every failure, one per file and reason. */
+    failures: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
+/** A tiny glob: `**` any path, `*` any name part, `?` one character. A
+ * pattern without "/" matches the file name anywhere. */
+declare function globToRegExp(glob: string): RegExp;
+declare function verifyDir(dir: string, options?: VerifyOptions): Promise<VerifyResult>;
+/** Human-readable report. */
+declare function formatVerify(result: VerifyResult): string[];
+
 /**
  * Function scopes for scope-based frame names (like Sentry's
  * js-source-scopes and PostHog cymbal's `token.scope()`).
@@ -102,4 +165,4 @@ declare function gitHead(cwd?: string): string | null;
  */
 declare function resolveRelease(explicit?: string | null, env?: NodeJS.ProcessEnv, cwd?: string): ResolvedRelease;
 
-export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, computeScopes, debugIdFor, debugIdSnippet, gitHead, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease };
+export { DEBUG_ID_RE, DEBUG_ID_REGISTRY, RELEASE_ENV_VARS, RELEASE_RE, type ResolvedRelease, SCOPES_KEY, SCOPES_VERSION, type ScopesResult, type SourceMapScopes, type VerifyBundle, type VerifyOptions, type VerifyResult, computeScopes, debugIdFor, debugIdSnippet, formatVerify, gitHead, globToRegExp, hasDebugIdSnippet, normalizeDebugId, readDebugIdComment, resolveRelease, verifyDir };

package/dist/index.js

@@ -1,16 +1,20 @@
 import {
   BUNDLE_RE,
+  CLIENT_KEY_PREFIX,
   DEBUG_ID_RE,
   DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT,
   FatalUploadError,
+  KEY_ADVICE,
   MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS,
   RELEASE_RE,
   SCOPES_KEY,
   SCOPES_VERSION,
+  SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX,
   computeScopes,
   debugIdFor,
   debugIdSnippet,
@@ -20,6 +24,7 @@ import {
   hasDebugIdSnippet,
   injectBundle,
   injectDir,
+  isInAppSource,
   mapPathFor,
   normalizeDebugId,
   processBuildOutput,
@@ -28,34 +33,291 @@ import {
   resolveEndpoint,
   resolveRelease,
   servedFilename,
+  serverUrlPrefix,
   shiftMappings,
   snippetLine,
   storedMapJson,
+  storedSourcesContent,
   stripSourceMappingUrl,
   uploadDir
-} from "./chunk-DQLLM2NT.js";
+} from "./chunk-Q23FB5X3.js";
+
+// src/verify.ts
+import { existsSync } from "fs";
+import { readdir, readFile } from "fs/promises";
+import { dirname, join, relative, resolve, sep } from "path";
+var CHECK_BATCH = 500;
+var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
+var NOT_BUNDLES = [
+  [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  // .next/server: middleware-build-manifest.js, next-font-manifest.js,
+  // server-reference-manifest.js, page_client-reference-manifest.js, …
+  [/(^|\/)[\w.-]*[-_]manifest\.js$/, "Next.js server manifest"],
+  [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
+  [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
+  [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
+];
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*") {
+      re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (ch === "*") re += "[^/]*";
+    else if (ch === "?") re += "[^/]";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(glob.includes("/") ? `^${re.replace(/^\.\//, "")}$` : `(^|/)${re}$`);
+}
+async function walk(dir, out) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === "node_modules") continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) await walk(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+}
+function staticRoots(dir) {
+  for (let current = dirname(dir); dirname(current) !== current; current = dirname(current)) {
+    if (existsSync(join(current, "package.json"))) return ["public", "static", "src"].map((name) => join(current, name));
+  }
+  return [];
+}
+async function verifyDir(dir, options = {}) {
+  const root = resolve(dir);
+  const env = options.env ?? process.env;
+  const files = [];
+  await walk(root, files);
+  files.sort();
+  const relPath = (path) => relative(root, path).split(sep).join("/");
+  const ignore = (options.ignore ?? []).map(globToRegExp);
+  const roots = staticRoots(root);
+  const result = {
+    dir: root,
+    ok: true,
+    bundles: [],
+    maps: [],
+    ...options.server ? { server: true } : {},
+    upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
+    failures: []
+  };
+  const fail = (path, reason) => result.failures.push({ path, reason });
+  for (const file of files) {
+    const path = relPath(file);
+    if (file.endsWith(".map")) {
+      result.maps.push(path);
+      if (!options.allowMaps && !options.server) {
+        fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
+      }
+      continue;
+    }
+    if (!BUNDLE_RE.test(file)) continue;
+    const bytes = await readFile(file);
+    const bundle = { path, status: "ok", debugId: null, reasons: [], uploaded: null };
+    result.bundles.push(bundle);
+    const skip = (reason) => {
+      bundle.status = "skipped";
+      bundle.reasons.push(reason);
+    };
+    if (ignore.some((re) => re.test(path))) {
+      skip("matches --ignore");
+      continue;
+    }
+    const known = NOT_BUNDLES.find(([re]) => re.test(path));
+    if (known) {
+      skip(known[1]);
+      continue;
+    }
+    let copied = null;
+    for (const staticRoot of roots) {
+      const candidate = join(staticRoot, path);
+      if (existsSync(candidate) && (await readFile(candidate)).equals(bytes)) copied = relative(dirname(staticRoot), candidate).split(sep).join("/");
+    }
+    if (copied) {
+      skip(`copied unchanged from ${copied}, not built`);
+      continue;
+    }
+    const code = bytes.toString("utf8");
+    const commentId = readDebugIdComment(code);
+    const snippetId = SNIPPET_ID_RE.exec(code)?.[1] ?? null;
+    bundle.debugId = commentId;
+    if (!commentId && !hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "no debug id: its errors can't be matched to a source map. Run `autter-runtime sourcemaps inject` on the build output (or use the bundler plugin with AUTTER_RUNTIME_KEY set) before deploying"
+      );
+    } else if (!commentId) {
+      bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
+    } else if (!hasDebugIdSnippet(code)) {
+      bundle.reasons.push(
+        "has a //# debugId= comment but no registration snippet, so the SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+      );
+    } else if (snippetId && snippetId !== commentId) {
+      bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
+    }
+    const url = readSourceMappingUrl(code);
+    if (url?.startsWith("data:")) {
+      if (!options.server) {
+        bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+      }
+    } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
+      let target = url.split(/[?#]/)[0];
+      try {
+        target = decodeURIComponent(target);
+      } catch {
+      }
+      if (!existsSync(resolve(dirname(file), target))) {
+        bundle.reasons.push(
+          `its sourceMappingURL points at ${url}, which is not in the output (browsers' devtools request it and get a 404). Remove the comment: upload --delete-after-upload does`
+        );
+      }
+    }
+    if (bundle.reasons.length) {
+      bundle.status = "failed";
+      for (const reason of bundle.reasons) fail(path, reason);
+    }
+  }
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  if (!counted.length) fail(".", `no .js/.mjs/.cjs bundles under ${dir}: is this the build output?`);
+  await checkUploads(result, counted, options, env);
+  result.ok = result.failures.length === 0;
+  return result;
+}
+async function checkUploads(result, bundles, options, env) {
+  const upload = result.upload;
+  const key = (options.key ?? env.AUTTER_RUNTIME_KEY ?? "").trim();
+  if (!key) {
+    upload.reason = "AUTTER_RUNTIME_KEY is not set: only the local checks ran";
+    return;
+  }
+  upload.endpoint = resolveEndpoint(options.endpoint, env);
+  if (key.startsWith(CLIENT_KEY_PREFIX)) {
+    upload.status = "error";
+    upload.reason = "AUTTER_RUNTIME_KEY is a publishable client key (autter_rtc_\u2026), which can't check source maps: use an upload key (autter_rtu_\u2026) or the server key (autter_rt_\u2026)";
+    result.failures.push({ path: ".", reason: upload.reason });
+    return;
+  }
+  const withIds = bundles.filter((b) => b.debugId);
+  if (!withIds.length) {
+    upload.reason = "no bundle has a debug id to check";
+    return;
+  }
+  let release = "verify";
+  try {
+    release = resolveRelease(options.release, env, options.cwd).release;
+  } catch {
+  }
+  const doFetch = options.fetch ?? fetch;
+  const missing = [];
+  for (let start = 0; start < withIds.length; start += CHECK_BATCH) {
+    const batch = withIds.slice(start, start + CHECK_BATCH);
+    let res;
+    try {
+      res = await doFetch(`${upload.endpoint}/v1/sourcemaps/check`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+        body: JSON.stringify({ release, files: batch.map((b) => ({ filename: servedFilename(options.urlPrefix, b.path), debugId: b.debugId })) })
+      });
+    } catch (err) {
+      upload.status = "error";
+      upload.reason = `could not reach the ingester: ${err.message}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (res.status === 404 || res.status === 400) {
+      upload.status = "unverified";
+      upload.reason = res.status === 404 ? "the ingester predates 1.6.0 (no /v1/sourcemaps/check), so uploads can't be checked: upgrade it" : "the ingester predates 1.7.0, which checks maps by debug id alone, so uploads can't be checked after the maps were deleted: upgrade it";
+      return;
+    }
+    if (res.status === 401 || res.status === 403) {
+      upload.status = "error";
+      upload.reason = `the ingester rejected the key (${res.status}): ${(await res.text()).slice(0, 300)}` + (key.startsWith(UPLOAD_KEY_PREFIX) ? " (upload keys, autter_rtu_\u2026, need ingester 1.7.0 or later)" : "");
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    if (!res.ok) {
+      upload.status = "error";
+      upload.reason = `the source map check failed: HTTP ${res.status}`;
+      result.failures.push({ path: ".", reason: upload.reason });
+      return;
+    }
+    const body = await res.json();
+    const present = new Set(Array.isArray(body.present) ? body.present : []);
+    batch.forEach((bundle, index) => {
+      bundle.uploaded = present.has(index);
+      if (!bundle.uploaded) missing.push(bundle);
+    });
+  }
+  upload.checked = withIds.length;
+  upload.missing = missing.length;
+  upload.status = missing.length ? "missing" : "verified";
+  upload.reason = missing.length ? `${missing.length} of ${withIds.length} bundle(s) have no map on the ingester` : null;
+  for (const bundle of missing) {
+    const reason = `no map with debug id ${bundle.debugId} on the ingester for this key's repository: upload this build's maps (autter-runtime sourcemaps upload, or the bundler plugin with AUTTER_RUNTIME_KEY set)`;
+    bundle.status = "failed";
+    bundle.reasons.push(reason);
+    result.failures.push({ path: bundle.path, reason });
+  }
+}
+function formatVerify(result) {
+  const lines = [];
+  for (const bundle of result.bundles) {
+    if (bundle.status === "ok") lines.push(`ok      ${bundle.path} (debug id ${bundle.debugId}${bundle.uploaded ? ", map uploaded" : ""})`);
+    else if (bundle.status === "skipped") lines.push(`skipped ${bundle.path}: ${bundle.reasons.join("; ")}`);
+    else for (const reason of bundle.reasons) lines.push(`FAILED  ${bundle.path}: ${reason}`);
+  }
+  for (const map of result.maps) {
+    const failure = result.failures.find((f) => f.path === map);
+    lines.push(
+      failure ? `FAILED  ${map}: ${failure.reason}` : result.server ? `note    ${map}: source map in the server output (browsers never load it)` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`
+    );
+  }
+  for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
+  const u = result.upload;
+  lines.push(
+    u.status === "verified" ? `upload: verified, ${u.checked} bundle map(s) on the ingester (${u.endpoint})` : u.status === "missing" ? `upload: ${u.reason} (${u.endpoint})` : `upload: ${u.status}${u.reason ? `, ${u.reason}` : ""}`
+  );
+  const counted = result.bundles.filter((b) => b.status !== "skipped");
+  lines.push(
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (${result.server ? "server output" : "--allow-maps"})` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+  );
+  return lines;
+}
 export {
   BUNDLE_RE,
+  CLIENT_KEY_PREFIX,
   DEBUG_ID_RE,
   DEBUG_ID_REGISTRY,
   DEFAULT_ENDPOINT,
   FatalUploadError,
+  KEY_ADVICE,
   MAX_MAP_CHARS,
   MAX_UPLOAD_BYTES,
   RELEASE_ENV_VARS,
   RELEASE_RE,
   SCOPES_KEY,
   SCOPES_VERSION,
+  SERVER_KEY_PREFIX,
   SNIPPET_LINE_KEY,
+  UPLOAD_KEY_PREFIX,
   computeScopes,
   debugIdFor,
   debugIdSnippet,
   findBundles,
   formatUploadSummary,
+  formatVerify,
   gitHead,
+  globToRegExp,
   hasDebugIdSnippet,
   injectBundle,
   injectDir,
+  isInAppSource,
   mapPathFor,
   normalizeDebugId,
   processBuildOutput,
@@ -64,9 +326,12 @@ export {
   resolveEndpoint,
   resolveRelease,
   servedFilename,
+  serverUrlPrefix,
   shiftMappings,
   snippetLine,
   storedMapJson,
+  storedSourcesContent,
   stripSourceMappingUrl,
-  uploadDir
+  uploadDir,
+  verifyDir
 };