@autter/runtime-cli 1.2.0 → 1.3.0

package/dist/cli.js

@@ -9,7 +9,7 @@ import { parseArgs } from "util";
 
 // src/build.ts
 import { existsSync as existsSync2 } from "fs";
-import { relative as relative2, sep as sep2 } from "path";
+import { isAbsolute, relative as relative2, sep as sep2 } from "path";
 
 // src/files.ts
 import { existsSync } from "fs";
@@ -700,9 +700,56 @@ function servedFilename(urlPrefix, path) {
   if (!/^[a-z][\w+.-]*:\/\//i.test(prefix) && !prefix.startsWith("/")) prefix = `/${prefix}`;
   return `${prefix.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
 }
-function storedMapJson(map) {
-  const { sourcesContent: _omitted, ...safe } = map;
-  return JSON.stringify(safe);
+var NOT_IN_APP_PATH_PARTS = ["node_modules/", "/site-packages/", "/dist-packages/", "/vendor/", "/.pnpm/"];
+var NOT_IN_APP_PATH_PREFIXES = ["node:", "internal/"];
+var EXTENSION_SCHEMES = ["chrome-extension:", "moz-extension:", "safari-extension:", "safari-web-extension:", "webkit-masked-url:"];
+function isInAppSource(path) {
+  if (!path) return true;
+  const normalized = path.replace(/\\/g, "/");
+  if (NOT_IN_APP_PATH_PARTS.some((part) => normalized.includes(part))) return false;
+  if (NOT_IN_APP_PATH_PREFIXES.some((prefix) => normalized.startsWith(prefix))) return false;
+  const lower = normalized.toLowerCase();
+  return !EXTENSION_SCHEMES.some((scheme) => lower.startsWith(scheme));
+}
+var SOURCES_CONTENT_WRAPPER_BYTES = Buffer.byteLength(',"sourcesContent":[]');
+var NULL_ENTRY_BYTES = 4;
+function storedSourcesContent(fields, baseBytes, limit = MAX_MAP_CHARS) {
+  const { sources, sourcesContent } = fields;
+  if (!Array.isArray(sources) || !Array.isArray(sourcesContent) || sources.length === 0) return null;
+  const ignored = /* @__PURE__ */ new Set();
+  for (const list of [fields.ignoreList, fields.x_google_ignoreList]) {
+    if (!Array.isArray(list)) continue;
+    for (const index of list) if (Number.isInteger(index)) ignored.add(index);
+  }
+  const count = sources.length;
+  const candidates = [];
+  for (let index = 0; index < count; index++) {
+    const source = sources[index];
+    const content = sourcesContent[index];
+    if (typeof source !== "string" || typeof content !== "string") continue;
+    if (ignored.has(index) || !isInAppSource(source)) continue;
+    candidates.push({ index, content, bytes: Buffer.byteLength(JSON.stringify(content)) });
+  }
+  if (candidates.length === 0) return null;
+  candidates.sort((a, b) => a.bytes - b.bytes || a.index - b.index);
+  let remaining = limit - baseBytes - SOURCES_CONTENT_WRAPPER_BYTES - NULL_ENTRY_BYTES * count - (count - 1);
+  const kept = new Array(count).fill(null);
+  let any = false;
+  for (const candidate of candidates) {
+    const extra = candidate.bytes - NULL_ENTRY_BYTES;
+    if (extra > remaining) break;
+    remaining -= extra;
+    kept[candidate.index] = candidate.content;
+    any = true;
+  }
+  return any ? kept : null;
+}
+function storedMapJson(map, options = {}) {
+  const { sourcesContent: _content, ...rest } = map;
+  const base = JSON.stringify(rest);
+  if (options.sourcesContent === false) return base;
+  const content = storedSourcesContent(map, Buffer.byteLength(base));
+  return content ? JSON.stringify({ ...rest, sourcesContent: content }) : base;
 }
 function bytesOf(buffer) {
   return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
@@ -713,7 +760,7 @@ function fits(json, body) {
 function uploadBody(release, filename, debugId, json) {
   return `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
 }
-async function prepare(bundle, urlPrefix, release, log, compress) {
+async function prepare(bundle, urlPrefix, release, log, compress, sourcesContent) {
   let map;
   try {
     map = JSON.parse(await readFile3(bundle.map, "utf8"));
@@ -728,9 +775,10 @@ async function prepare(bundle, urlPrefix, release, log, compress) {
   const filename = servedFilename(urlPrefix, bundle.path);
   const { [SCOPES_KEY]: _stale, ...plain } = map;
   const scopes = computeScopes(code, map);
-  let json = storedMapJson(plain);
+  const stored = { sourcesContent };
+  let json = storedMapJson(plain, stored);
   if ("scopes" in scopes) {
-    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes });
+    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes }, stored);
     if (fits(scoped, uploadBody(release, filename, debugId, scoped))) json = scoped;
     else if (fits(json, uploadBody(release, filename, debugId, json))) {
       log(`warning: ${bundle.path}: its map is over 32 MB with function scopes, so it is uploaded without them (frames keep call-site names)`);
@@ -777,7 +825,7 @@ async function uploadDir(dir, options = {}) {
   };
   const items = [];
   for (const bundle of await findBundles(dir, options.files)) {
-    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun);
+    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun, options.sourcesContent !== false);
     if ("error" in prepared) {
       summary.failed.push({ path: bundle.path, filename: servedFilename(options.urlPrefix, bundle.path), error: prepared.error });
     } else if (prepared.mapChars > MAX_MAP_CHARS || prepared.bytes > MAX_UPLOAD_BYTES) {
@@ -2368,6 +2416,9 @@ var CHECK_BATCH2 = 500;
 var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
 var NOT_BUNDLES = [
   [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  // .next/server: middleware-build-manifest.js, next-font-manifest.js,
+  // server-reference-manifest.js, page_client-reference-manifest.js, …
+  [/(^|\/)[\w.-]*[-_]manifest\.js$/, "Next.js server manifest"],
   [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
   [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
   [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
@@ -2419,6 +2470,7 @@ async function verifyDir(dir, options = {}) {
     ok: true,
     bundles: [],
     maps: [],
+    ...options.server ? { server: true } : {},
     upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
     failures: []
   };
@@ -2427,7 +2479,7 @@ async function verifyDir(dir, options = {}) {
     const path = relPath(file);
     if (file.endsWith(".map")) {
       result.maps.push(path);
-      if (!options.allowMaps) {
+      if (!options.allowMaps && !options.server) {
         fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
       }
       continue;
@@ -2470,14 +2522,16 @@ async function verifyDir(dir, options = {}) {
       bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
     } else if (!hasDebugIdSnippet(code)) {
       bundle.reasons.push(
-        "has a //# debugId= comment but no registration snippet, so the browser SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+        "has a //# debugId= comment but no registration snippet, so the SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
       );
     } else if (snippetId && snippetId !== commentId) {
       bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
     }
     const url = readSourceMappingUrl(code);
     if (url?.startsWith("data:")) {
-      bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+      if (!options.server) {
+        bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+      }
     } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
       let target = url.split(/[?#]/)[0];
       try {
@@ -2586,7 +2640,9 @@ function formatVerify(result) {
   }
   for (const map of result.maps) {
     const failure = result.failures.find((f) => f.path === map);
-    lines.push(failure ? `FAILED  ${map}: ${failure.reason}` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`);
+    lines.push(
+      failure ? `FAILED  ${map}: ${failure.reason}` : result.server ? `note    ${map}: source map in the server output (browsers never load it)` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`
+    );
   }
   for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
   const u = result.upload;
@@ -2595,7 +2651,7 @@ function formatVerify(result) {
   );
   const counted = result.bundles.filter((b) => b.status !== "skipped");
   lines.push(
-    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (--allow-maps)` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (${result.server ? "server output" : "--allow-maps"})` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
   );
   return lines;
 }
@@ -2606,11 +2662,11 @@ var USAGE = `autter-runtime \u2014 readable stack traces for Autter Runtime
 Usage:
   autter-runtime sourcemaps setup [dir] [--dry-run] [--install] [--json]
   autter-runtime sourcemaps verify <dir> [--endpoint <url>] [--url-prefix <prefix>]
-                [--ignore <glob>]... [--allow-maps] [--json]
+                [--ignore <glob>]... [--allow-maps] [--server] [--json]
   autter-runtime sourcemaps inject <dir> [--dry-run] [--json]
   autter-runtime sourcemaps upload <dir> [--release <r>] [--url-prefix <prefix>]
                 [--endpoint <url>] [--concurrency <n>] [--delete-after-upload]
-                [--best-effort] [--dry-run] [--json]
+                [--no-sources-content] [--best-effort] [--dry-run] [--json]
   autter-runtime doctor ...      (provided by @autter/runtime-node)
 
 setup   Wires source map upload into the project in [dir] (default "."):
@@ -2626,23 +2682,31 @@ verify  Checks a production build before deploy: every bundle has a debug
         ingester. Exit 0: ok (upload unverified without a key); 1: problems.
 inject  Gives every .js/.mjs/.cjs bundle that has a source map a debug id
         derived from its bytes: a "//# debugId=" comment, a one-line snippet
-        that registers it for @autter/runtime-browser, and "debugId" in the
-        .map. Running it again changes nothing.
+        that registers it for the Autter SDKs (browser, Node and edge), and
+        "debugId" in the .map. Works on browser and server output alike
+        (Vite, webpack, Next.js, tsup, esbuild). Running it again changes
+        nothing.
 upload  Sends every map to <endpoint>/v1/sourcemaps with AUTTER_RUNTIME_KEY,
         in parallel, skipping maps the ingester already has. Each map carries
         the bundle's function scopes ("x_autter_scopes"), so stack frames are
-        named after the function they are in, not the call site.
+        named after the function they are in, not the call site, and the
+        original source of your own files ("sourcesContent", never your
+        dependencies'), so issues show the lines around each frame.
 
 Options:
   --release <r>          Default: $GITHUB_SHA, $VERCEL_GIT_COMMIT_SHA,
                          $CF_PAGES_COMMIT_SHA, $GIT_SHA, then git rev-parse HEAD
   --url-prefix <prefix>  Where <dir> is served from: "/" (default), "/static/",
-                         or "https://cdn.example.com/app/"
+                         or "https://cdn.example.com/app/". For server output,
+                         any tail of the path the server runs it from
+                         ("/dist/" for /app/dist/server.js) or "/"
   --endpoint <url>       Ingester base URL. Default: $AUTTER_ENDPOINT,
                          $AUTTER_RUNTIME_ENDPOINT, $OTEL_EXPORTER_OTLP_ENDPOINT,
                          then https://otlp.autter.dev
   --concurrency <n>      Parallel uploads (default 8)
   --delete-after-upload  Delete each .map once the ingester has it
+  --no-sources-content   upload: send maps without your files' source (issues
+                         then show no lines around a frame)
   --best-effort          For build scripts: never fail. Without a key, or when
                          the upload fails, report it and exit 0; with
                          --delete-after-upload, every .map under <dir> is then
@@ -2650,6 +2714,8 @@ Options:
   --install              setup: also run the package manager's install
   --ignore <glob>        verify: JS files that are not bundles (repeatable)
   --allow-maps           verify: report leftover .map files without failing
+  --server               verify: <dir> is server output (tsup, esbuild, webpack
+                         or Next server bundles): leftover maps are fine there
   --dry-run              Show what would change or be uploaded; write and send nothing
   --json                 Print the result as JSON
   -h, --help             Show this help
@@ -2692,6 +2758,8 @@ var SOURCEMAPS_OPTIONS = {
   install: { type: "boolean" },
   ignore: { type: "string", multiple: true },
   "allow-maps": { type: "boolean" },
+  server: { type: "boolean" },
+  "no-sources-content": { type: "boolean" },
   "dry-run": { type: "boolean" },
   json: { type: "boolean" },
   help: { type: "boolean", short: "h" }
@@ -2699,8 +2767,8 @@ var SOURCEMAPS_OPTIONS = {
 var ACTION_FLAGS = {
   setup: ["dry-run", "install"],
   inject: ["dry-run"],
-  upload: ["release", "url-prefix", "endpoint", "concurrency", "delete-after-upload", "best-effort", "dry-run"],
-  verify: ["endpoint", "url-prefix", "release", "ignore", "allow-maps"]
+  upload: ["release", "url-prefix", "endpoint", "concurrency", "delete-after-upload", "no-sources-content", "best-effort", "dry-run"],
+  verify: ["endpoint", "url-prefix", "release", "ignore", "allow-maps", "server"]
 };
 async function sourcemaps(argv) {
   let parsed;
@@ -2756,7 +2824,8 @@ ${USAGE}`);
       urlPrefix: values["url-prefix"],
       release: values.release,
       ignore: values.ignore,
-      allowMaps: Boolean(values["allow-maps"])
+      allowMaps: Boolean(values["allow-maps"]),
+      server: Boolean(values.server)
     });
     if (values.json) console.log(JSON.stringify(result, null, 2));
     else for (const line of formatVerify(result)) console.log(line);
@@ -2794,6 +2863,7 @@ ${USAGE}`);
     concurrency,
     dryRun,
     deleteAfterUpload,
+    ...values["no-sources-content"] ? { sourcesContent: false } : {},
     log: (line) => console.error(line)
   });
   if (!bestEffort) summary = await run();

package/dist/index.cjs

@@ -47,6 +47,7 @@ __export(src_exports, {
   hasDebugIdSnippet: () => hasDebugIdSnippet,
   injectBundle: () => injectBundle,
   injectDir: () => injectDir,
+  isInAppSource: () => isInAppSource,
   mapPathFor: () => mapPathFor,
   normalizeDebugId: () => normalizeDebugId,
   processBuildOutput: () => processBuildOutput,
@@ -55,9 +56,11 @@ __export(src_exports, {
   resolveEndpoint: () => resolveEndpoint,
   resolveRelease: () => resolveRelease,
   servedFilename: () => servedFilename,
+  serverUrlPrefix: () => serverUrlPrefix,
   shiftMappings: () => shiftMappings,
   snippetLine: () => snippetLine,
   storedMapJson: () => storedMapJson,
+  storedSourcesContent: () => storedSourcesContent,
   stripSourceMappingUrl: () => stripSourceMappingUrl,
   uploadDir: () => uploadDir,
   verifyDir: () => verifyDir
@@ -747,9 +750,56 @@ function servedFilename(urlPrefix, path) {
   if (!/^[a-z][\w+.-]*:\/\//i.test(prefix) && !prefix.startsWith("/")) prefix = `/${prefix}`;
   return `${prefix.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
 }
-function storedMapJson(map) {
-  const { sourcesContent: _omitted, ...safe } = map;
-  return JSON.stringify(safe);
+var NOT_IN_APP_PATH_PARTS = ["node_modules/", "/site-packages/", "/dist-packages/", "/vendor/", "/.pnpm/"];
+var NOT_IN_APP_PATH_PREFIXES = ["node:", "internal/"];
+var EXTENSION_SCHEMES = ["chrome-extension:", "moz-extension:", "safari-extension:", "safari-web-extension:", "webkit-masked-url:"];
+function isInAppSource(path) {
+  if (!path) return true;
+  const normalized = path.replace(/\\/g, "/");
+  if (NOT_IN_APP_PATH_PARTS.some((part) => normalized.includes(part))) return false;
+  if (NOT_IN_APP_PATH_PREFIXES.some((prefix) => normalized.startsWith(prefix))) return false;
+  const lower = normalized.toLowerCase();
+  return !EXTENSION_SCHEMES.some((scheme) => lower.startsWith(scheme));
+}
+var SOURCES_CONTENT_WRAPPER_BYTES = Buffer.byteLength(',"sourcesContent":[]');
+var NULL_ENTRY_BYTES = 4;
+function storedSourcesContent(fields, baseBytes, limit = MAX_MAP_CHARS) {
+  const { sources, sourcesContent } = fields;
+  if (!Array.isArray(sources) || !Array.isArray(sourcesContent) || sources.length === 0) return null;
+  const ignored = /* @__PURE__ */ new Set();
+  for (const list of [fields.ignoreList, fields.x_google_ignoreList]) {
+    if (!Array.isArray(list)) continue;
+    for (const index of list) if (Number.isInteger(index)) ignored.add(index);
+  }
+  const count = sources.length;
+  const candidates = [];
+  for (let index = 0; index < count; index++) {
+    const source = sources[index];
+    const content = sourcesContent[index];
+    if (typeof source !== "string" || typeof content !== "string") continue;
+    if (ignored.has(index) || !isInAppSource(source)) continue;
+    candidates.push({ index, content, bytes: Buffer.byteLength(JSON.stringify(content)) });
+  }
+  if (candidates.length === 0) return null;
+  candidates.sort((a, b) => a.bytes - b.bytes || a.index - b.index);
+  let remaining = limit - baseBytes - SOURCES_CONTENT_WRAPPER_BYTES - NULL_ENTRY_BYTES * count - (count - 1);
+  const kept = new Array(count).fill(null);
+  let any = false;
+  for (const candidate of candidates) {
+    const extra = candidate.bytes - NULL_ENTRY_BYTES;
+    if (extra > remaining) break;
+    remaining -= extra;
+    kept[candidate.index] = candidate.content;
+    any = true;
+  }
+  return any ? kept : null;
+}
+function storedMapJson(map, options = {}) {
+  const { sourcesContent: _content, ...rest } = map;
+  const base = JSON.stringify(rest);
+  if (options.sourcesContent === false) return base;
+  const content = storedSourcesContent(map, Buffer.byteLength(base));
+  return content ? JSON.stringify({ ...rest, sourcesContent: content }) : base;
 }
 function bytesOf(buffer) {
   return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
@@ -760,7 +810,7 @@ function fits(json, body) {
 function uploadBody(release, filename, debugId, json) {
   return `{"release":${JSON.stringify(release)},"filename":${JSON.stringify(filename)},${debugId ? `"debugId":${JSON.stringify(debugId)},` : ""}"map":${json}}`;
 }
-async function prepare(bundle, urlPrefix, release, log, compress) {
+async function prepare(bundle, urlPrefix, release, log, compress, sourcesContent) {
   let map;
   try {
     map = JSON.parse(await (0, import_promises3.readFile)(bundle.map, "utf8"));
@@ -775,9 +825,10 @@ async function prepare(bundle, urlPrefix, release, log, compress) {
   const filename = servedFilename(urlPrefix, bundle.path);
   const { [SCOPES_KEY]: _stale, ...plain } = map;
   const scopes = computeScopes(code, map);
-  let json = storedMapJson(plain);
+  const stored = { sourcesContent };
+  let json = storedMapJson(plain, stored);
   if ("scopes" in scopes) {
-    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes });
+    const scoped = storedMapJson({ ...plain, [SCOPES_KEY]: scopes.scopes }, stored);
     if (fits(scoped, uploadBody(release, filename, debugId, scoped))) json = scoped;
     else if (fits(json, uploadBody(release, filename, debugId, json))) {
       log(`warning: ${bundle.path}: its map is over 32 MB with function scopes, so it is uploaded without them (frames keep call-site names)`);
@@ -824,7 +875,7 @@ async function uploadDir(dir, options = {}) {
   };
   const items = [];
   for (const bundle of await findBundles(dir, options.files)) {
-    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun);
+    const prepared = await prepare(bundle, options.urlPrefix, release, log, !options.dryRun, options.sourcesContent !== false);
     if ("error" in prepared) {
       summary.failed.push({ path: bundle.path, filename: servedFilename(options.urlPrefix, bundle.path), error: prepared.error });
     } else if (prepared.mapChars > MAX_MAP_CHARS || prepared.bytes > MAX_UPLOAD_BYTES) {
@@ -950,6 +1001,9 @@ var CHECK_BATCH2 = 500;
 var SNIPPET_ID_RE = /\(g\._autterDebugIds=g\._autterDebugIds\|\|\{\}\)\[s\]="([0-9a-f-]{36})"/;
 var NOT_BUNDLES = [
   [/(^|\/)_(build|ssg|middleware|clientMiddleware)Manifest\.js$/, "Next.js build manifest"],
+  // .next/server: middleware-build-manifest.js, next-font-manifest.js,
+  // server-reference-manifest.js, page_client-reference-manifest.js, …
+  [/(^|\/)[\w.-]*[-_]manifest\.js$/, "Next.js server manifest"],
   [/(^|\/)chunks\/polyfills-[\w-]+\.js$/, "Next.js polyfills, copied prebuilt without a source map"],
   [/(^|\/)(sw|service-worker|serviceWorker|firebase-messaging-sw|mockServiceWorker)\.js$/, "service worker (the browser SDK doesn't run there)"],
   [/(^|\/)workbox-[\w-]+\.js$/, "service worker runtime (the browser SDK doesn't run there)"]
@@ -1001,6 +1055,7 @@ async function verifyDir(dir, options = {}) {
     ok: true,
     bundles: [],
     maps: [],
+    ...options.server ? { server: true } : {},
     upload: { status: "unverified", endpoint: null, reason: null, checked: 0, missing: 0 },
     failures: []
   };
@@ -1009,7 +1064,7 @@ async function verifyDir(dir, options = {}) {
     const path = relPath(file);
     if (file.endsWith(".map")) {
       result.maps.push(path);
-      if (!options.allowMaps) {
+      if (!options.allowMaps && !options.server) {
         fail(path, "source map in the deploy output: it exposes your original source. Delete it after upload (upload --delete-after-upload, or the bundler plugin) or keep it out of the deploy");
       }
       continue;
@@ -1052,14 +1107,16 @@ async function verifyDir(dir, options = {}) {
       bundle.reasons.push("has the debug id snippet but no //# debugId= comment: run `autter-runtime sourcemaps inject` on it again");
     } else if (!hasDebugIdSnippet(code)) {
       bundle.reasons.push(
-        "has a //# debugId= comment but no registration snippet, so the browser SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
+        "has a //# debugId= comment but no registration snippet, so the SDK can't report its id: run `autter-runtime sourcemaps inject` on it"
       );
     } else if (snippetId && snippetId !== commentId) {
       bundle.reasons.push(`its snippet registers debug id ${snippetId} but its comment says ${commentId}: run inject on the original build output`);
     }
     const url = readSourceMappingUrl(code);
     if (url?.startsWith("data:")) {
-      bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+      if (!options.server) {
+        bundle.reasons.push("carries an inline source map (data: URL): your original source ships with the bundle. Use hidden or external maps");
+      }
     } else if (url && !/^[a-z][\w+.-]*:/i.test(url) && !url.startsWith("/")) {
       let target = url.split(/[?#]/)[0];
       try {
@@ -1168,7 +1225,9 @@ function formatVerify(result) {
   }
   for (const map of result.maps) {
     const failure = result.failures.find((f) => f.path === map);
-    lines.push(failure ? `FAILED  ${map}: ${failure.reason}` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`);
+    lines.push(
+      failure ? `FAILED  ${map}: ${failure.reason}` : result.server ? `note    ${map}: source map in the server output (browsers never load it)` : `warning ${map}: source map in the output (allowed by --allow-maps; remove it before deploying)`
+    );
   }
   for (const failure of result.failures.filter((f) => f.path === ".")) lines.push(`FAILED  ${failure.reason}`);
   const u = result.upload;
@@ -1177,7 +1236,7 @@ function formatVerify(result) {
   );
   const counted = result.bundles.filter((b) => b.status !== "skipped");
   lines.push(
-    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (--allow-maps)` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
+    result.ok ? `ok: ${counted.length} bundle(s) with debug ids, ${result.maps.length ? `${result.maps.length} source map(s) left (${result.server ? "server output" : "--allow-maps"})` : "no source maps left"}${u.status === "unverified" ? ", upload not verified" : ""}` : `${result.failures.length} problem(s) in ${result.dir}`
   );
   return lines;
 }
@@ -1185,6 +1244,10 @@ function formatVerify(result) {
 // src/build.ts
 var import_node_fs3 = require("fs");
 var import_node_path3 = require("path");
+function serverUrlPrefix(projectRoot, dir) {
+  const rel = (0, import_node_path3.relative)(projectRoot, dir).split(import_node_path3.sep).join("/");
+  return !rel || rel.startsWith("..") || (0, import_node_path3.isAbsolute)(rel) ? "/" : `/${rel.replace(/\/+$/, "")}/`;
+}
 function buildKey(options) {
   const key = (options.key ?? process.env.AUTTER_RUNTIME_KEY ?? "").trim();
   return key || null;
@@ -1239,12 +1302,13 @@ async function processBuildOutput(input) {
       result.upload = await uploadDir(input.dir, {
         files: input.files,
         release: options.release,
-        urlPrefix: options.urlPrefix ?? input.urlPrefix,
+        urlPrefix: input.server ? input.urlPrefix : options.urlPrefix ?? input.urlPrefix,
         endpoint: options.endpoint,
         key: key ?? void 0,
         dryRun: options.dryRun,
         concurrency: options.concurrency,
         deleteAfterUpload: options.deleteAfterUpload ?? input.deleteAfterUpload,
+        ...options.sourcesContent === false ? { sourcesContent: false } : {},
         log
       });
       for (const line of formatUploadSummary(result.upload)) log(line);
@@ -1321,6 +1385,7 @@ async function processBuildOutput(input) {
   hasDebugIdSnippet,
   injectBundle,
   injectDir,
+  isInAppSource,
   mapPathFor,
   normalizeDebugId,
   processBuildOutput,
@@ -1329,9 +1394,11 @@ async function processBuildOutput(input) {
   resolveEndpoint,
   resolveRelease,
   servedFilename,
+  serverUrlPrefix,
   shiftMappings,
   snippetLine,
   storedMapJson,
+  storedSourcesContent,
   stripSourceMappingUrl,
   uploadDir,
   verifyDir

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, n as resolveEndpoint, s as servedFilename, o as shiftMappings, q as snippetLine, t as storedMapJson, u as stripSourceMappingUrl, v as uploadDir } from './build-BqjqqeLg.cjs';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as isInAppSource, n as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, o as resolveEndpoint, s as servedFilename, q as serverUrlPrefix, t as shiftMappings, u as snippetLine, v as storedMapJson, w as storedSourcesContent, x as stripSourceMappingUrl, y as uploadDir } from './build-DGeoDkTh.cjs';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -14,13 +14,16 @@ declare function debugIdFor(bytes: Uint8Array | string): string;
 /** The id in the bundle's last `//# debugId=` comment, if any (ours, or one
  * a bundler wrote natively). */
 declare function readDebugIdComment(code: string): string | null;
-/** Property the browser SDK reads: `globalThis._autterDebugIds[stack] = id`. */
+/** Property the SDKs read: `globalThis._autterDebugIds[stack] = id` (the
+ * browser SDK, and the Node and edge SDKs' `autter.debug_ids`, RF-05). */
 declare const DEBUG_ID_REGISTRY = "_autterDebugIds";
 /**
  * One line of ES5 that records this bundle's id under the stack of an Error
  * created inside it — the stack's first frame names the script URL the
- * browser actually loaded, which the SDK maps back to the id. `g.Error` keeps
- * working when the bundle shadows `Error` at top level. Never throws.
+ * browser loaded, or the file Node or an edge runtime ran, which the SDK
+ * maps back to the id. `g.Error` keeps working when the bundle shadows
+ * `Error` at top level. Never throws. The same snippet goes into browser
+ * and server bundles.
  */
 declare function debugIdSnippet(id: string): string;
 /** Whether the bundle already carries our registration snippet. (The
@@ -40,6 +43,10 @@ interface VerifyOptions {
     ignore?: string[];
     /** Report leftover .map files without failing (a step that runs before they are removed). */
     allowMaps?: boolean;
+    /** A server bundle directory (tsup, esbuild, webpack or Next server
+     * output): leftover maps are reported, not failures — browsers never load
+     * them, and Node's own `--enable-source-maps` may use them. */
+    server?: boolean;
     env?: NodeJS.ProcessEnv;
     cwd?: string;
     fetch?: typeof fetch;
@@ -58,8 +65,10 @@ interface VerifyResult {
     dir: string;
     ok: boolean;
     bundles: VerifyBundle[];
-    /** `.map` files in the directory (deploy risks unless allowMaps). */
+    /** `.map` files in the directory (deploy risks unless allowMaps or server). */
     maps: string[];
+    /** True when checked as server output (`--server`). */
+    server?: boolean;
     upload: {
         /** verified: every checked bundle's map is on the ingester; missing: some are not;
          * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, n as resolveEndpoint, s as servedFilename, o as shiftMappings, q as snippetLine, t as storedMapJson, u as stripSourceMappingUrl, v as uploadDir } from './build-BqjqqeLg.js';
+export { A as AutterSourceMapsOptions, B as BUNDLE_RE, a as BuildOutputResult, b as BundleWithMap, C as CLIENT_KEY_PREFIX, D as DEFAULT_ENDPOINT, F as FatalUploadError, I as InjectOptions, c as InjectResult, K as KEY_ADVICE, M as MAX_MAP_CHARS, d as MAX_UPLOAD_BYTES, S as SERVER_KEY_PREFIX, e as SNIPPET_LINE_KEY, U as UPLOAD_KEY_PREFIX, f as UploadItem, g as UploadOptions, h as UploadSummary, i as findBundles, j as formatUploadSummary, k as injectBundle, l as injectDir, m as isInAppSource, n as mapPathFor, p as processBuildOutput, r as readSourceMappingUrl, o as resolveEndpoint, s as servedFilename, q as serverUrlPrefix, t as shiftMappings, u as snippetLine, v as storedMapJson, w as storedSourcesContent, x as stripSourceMappingUrl, y as uploadDir } from './build-DGeoDkTh.js';
 
 /** 8-4-4-4-12 hex: the debug id shape shared with Rollup, Turbopack, esbuild
  * and Sentry tooling, and what the ingester accepts. */
@@ -14,13 +14,16 @@ declare function debugIdFor(bytes: Uint8Array | string): string;
 /** The id in the bundle's last `//# debugId=` comment, if any (ours, or one
  * a bundler wrote natively). */
 declare function readDebugIdComment(code: string): string | null;
-/** Property the browser SDK reads: `globalThis._autterDebugIds[stack] = id`. */
+/** Property the SDKs read: `globalThis._autterDebugIds[stack] = id` (the
+ * browser SDK, and the Node and edge SDKs' `autter.debug_ids`, RF-05). */
 declare const DEBUG_ID_REGISTRY = "_autterDebugIds";
 /**
  * One line of ES5 that records this bundle's id under the stack of an Error
  * created inside it — the stack's first frame names the script URL the
- * browser actually loaded, which the SDK maps back to the id. `g.Error` keeps
- * working when the bundle shadows `Error` at top level. Never throws.
+ * browser loaded, or the file Node or an edge runtime ran, which the SDK
+ * maps back to the id. `g.Error` keeps working when the bundle shadows
+ * `Error` at top level. Never throws. The same snippet goes into browser
+ * and server bundles.
  */
 declare function debugIdSnippet(id: string): string;
 /** Whether the bundle already carries our registration snippet. (The
@@ -40,6 +43,10 @@ interface VerifyOptions {
     ignore?: string[];
     /** Report leftover .map files without failing (a step that runs before they are removed). */
     allowMaps?: boolean;
+    /** A server bundle directory (tsup, esbuild, webpack or Next server
+     * output): leftover maps are reported, not failures — browsers never load
+     * them, and Node's own `--enable-source-maps` may use them. */
+    server?: boolean;
     env?: NodeJS.ProcessEnv;
     cwd?: string;
     fetch?: typeof fetch;
@@ -58,8 +65,10 @@ interface VerifyResult {
     dir: string;
     ok: boolean;
     bundles: VerifyBundle[];
-    /** `.map` files in the directory (deploy risks unless allowMaps). */
+    /** `.map` files in the directory (deploy risks unless allowMaps or server). */
     maps: string[];
+    /** True when checked as server output (`--server`). */
+    server?: boolean;
     upload: {
         /** verified: every checked bundle's map is on the ingester; missing: some are not;
          * unverified: not checked (no key, or an ingester that can't answer); error: the check failed. */