@basementstudio/mitt-next-plugin 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,15 @@
+Copyright (c) 2026 basement.studio. All rights reserved.
+
+This software and its source code are proprietary and confidential to
+basement.studio. No license, express or implied, is granted to use, copy,
+modify, merge, publish, distribute, sublicense or sell this software, in
+whole or in part, except under a separate written agreement with
+basement.studio.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/config.d.ts

@@ -0,0 +1,44 @@
+export declare const CONFIG_FILE = "mitt.config.json";
+export declare const DEFAULT_SECRET_ENV = "MITT_SECRET";
+/**
+ * Used whenever no secret is configured outside production builds. It is public by definition, so
+ * IDs made with it only hide paths from casual readers: real deployments must set their own.
+ */
+export declare const DEV_SECRET = "mitt-dev-secret-not-for-production";
+/**
+ * Short one-way digest of the secret. Loader options carry it instead of the secret because Next
+ * writes the whole config to `.next/required-server-files.json`; it still changes Turbopack's cache
+ * key whenever the secret changes.
+ */
+export declare function secretFingerprint(secret: string): string;
+export type Env = Readonly<Record<string, string | undefined>>;
+export interface ResolvedSecret {
+    /** Null only when the variable is unset and the dev fallback isn't allowed. */
+    secret: string | null;
+    secretEnv: string;
+    /** The variable is unset and the public dev secret stands in. */
+    devFallback: boolean;
+}
+/**
+ * The one rule for which secret keys the IDs, shared by withMitt, the loader and the CLI so they
+ * can never disagree. An empty variable counts as unset.
+ */
+export declare function resolveSecret(secretEnv: string, env: Env, options: {
+    allowDev: true;
+}): ResolvedSecret & {
+    secret: string;
+};
+export declare function resolveSecret(secretEnv: string, env: Env, options: {
+    allowDev: boolean;
+}): ResolvedSecret;
+export interface MittConfig {
+    /** Name of the environment variable holding the HMAC secret. */
+    secretEnv: string;
+    /** The raw `"project"` value, unvalidated: only the CLI uses it, and validates it itself. */
+    project: unknown;
+}
+/**
+ * Reads `mitt.config.json` from the app root, the one place both the plugin and the CLI take their
+ * settings from so they always derive the same IDs. A missing file means defaults.
+ */
+export declare function readMittConfig(appRoot: string): MittConfig;

package/dist/config.js

@@ -0,0 +1,63 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const CONFIG_FILE = 'mitt.config.json';
+export const DEFAULT_SECRET_ENV = 'MITT_SECRET';
+const DEFAULT_INCLUDE = '**/*.{tsx,jsx}';
+/**
+ * Used whenever no secret is configured outside production builds. It is public by definition, so
+ * IDs made with it only hide paths from casual readers: real deployments must set their own.
+ */
+export const DEV_SECRET = 'mitt-dev-secret-not-for-production';
+/**
+ * Short one-way digest of the secret. Loader options carry it instead of the secret because Next
+ * writes the whole config to `.next/required-server-files.json`; it still changes Turbopack's cache
+ * key whenever the secret changes.
+ */
+export function secretFingerprint(secret) {
+    return createHash('sha256').update(`mitt-fp\0${secret}`).digest('hex').slice(0, 16);
+}
+export function resolveSecret(secretEnv, env, { allowDev }) {
+    const fromEnv = env[secretEnv];
+    if (fromEnv)
+        return { secret: fromEnv, secretEnv, devFallback: false };
+    return allowDev
+        ? { secret: DEV_SECRET, secretEnv, devFallback: true }
+        : { secret: null, secretEnv, devFallback: false };
+}
+function invalid(file, reason) {
+    return new Error(`[mitt] ${file}: ${reason}`);
+}
+/**
+ * Reads `mitt.config.json` from the app root, the one place both the plugin and the CLI take their
+ * settings from so they always derive the same IDs. A missing file means defaults.
+ */
+export function readMittConfig(appRoot) {
+    const file = join(appRoot, CONFIG_FILE);
+    let raw;
+    try {
+        raw = readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return { secretEnv: DEFAULT_SECRET_ENV, project: undefined };
+        }
+        throw error;
+    }
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw invalid(file, 'expected a JSON object');
+    }
+    const { secretEnv = DEFAULT_SECRET_ENV, include, project } = parsed;
+    if (typeof secretEnv !== 'string' || !/^[A-Z_][A-Z0-9_]*$/.test(secretEnv)) {
+        throw invalid(file, '"secretEnv" must be an environment variable name');
+    }
+    // The loader is registered for `*.tsx`/`*.jsx` and the manifest scans the same set. Custom globs
+    // would have to be honored identically by both, so until then only the default is accepted.
+    if (include !== undefined &&
+        !(Array.isArray(include) && include.length === 1 && include[0] === DEFAULT_INCLUDE)) {
+        throw invalid(file, `"include" only supports ["${DEFAULT_INCLUDE}"] for now`);
+    }
+    return { secretEnv, project };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAC/C,MAAM,eAAe,GAAG,gBAAgB,CAAA;AAExC;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAA;AAE9D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACrF,CAAC;AA0BD,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAQ,EACR,EAAE,QAAQ,EAAyB;IAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9B,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;IACtE,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE;QACtD,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC;AASD,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACvC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QAC9D,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,EAAE,SAAS,GAAG,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAiC,CAAA;IAC9F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAA;IACzE,CAAC;IACD,iGAAiG;IACjG,4FAA4F;IAC5F,IACE,OAAO,KAAK,SAAS;QACrB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,EACnF,CAAC;QACD,MAAM,OAAO,CAAC,IAAI,EAAE,6BAA6B,eAAe,YAAY,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC/B,CAAC"}

package/dist/git.d.ts

@@ -0,0 +1,33 @@
+import { DIRTY_SUFFIX } from '@basementstudio/mitt-shared/formats';
+export { DIRTY_SUFFIX };
+export interface GitOptions {
+    input?: string;
+    /** `buffer` returns raw bytes, for output that mixes headers and blob contents. */
+    encoding?: 'utf8' | 'buffer';
+}
+export declare function git(cwd: string, args: string[], options?: GitOptions & {
+    encoding?: 'utf8';
+}): string;
+export declare function git(cwd: string, args: string[], options: GitOptions & {
+    encoding: 'buffer';
+}): Buffer;
+export interface RepoLayout {
+    /** The repository's top level, realpath'd. */
+    root: string;
+    /** The app's directory relative to the repo root, POSIX; empty when they are the same. */
+    appPrefix: string;
+}
+/** Throws when `appRoot` is not inside a git repository. */
+export declare function repoLayout(appRoot: string): RepoLayout;
+export interface ResolveCommitOptions {
+    /**
+     * The served code is the live working tree (e.g. `next dev`), so a clean SHA would point the
+     * manifest at a tree that stops matching on the first edit.
+     */
+    live?: boolean;
+}
+/**
+ * `VERCEL_GIT_COMMIT_SHA`, else `HEAD` plus `-dirty` when the app's tree has changes, else null.
+ * Never throws: a missing git only means comments can't be pinned to a commit.
+ */
+export declare function resolveCommit(appRoot: string, options?: ResolveCommitOptions): string | null;

package/dist/git.js

@@ -0,0 +1,52 @@
+import { execFileSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { relative, sep } from 'node:path';
+import { DIRTY_SUFFIX, SHA_PATTERN } from '@basementstudio/mitt-shared/formats';
+export { DIRTY_SUFFIX };
+export function git(cwd, args, options = {}) {
+    return execFileSync('git', args, {
+        cwd,
+        // `undefined` returns a Buffer; Node rejects 'buffer' once there is `input` to encode.
+        encoding: options.encoding === 'buffer' ? undefined : 'utf8',
+        input: options.input,
+        maxBuffer: 1024 * 1024 * 1024,
+        stdio: ['pipe', 'pipe', 'ignore'],
+    });
+}
+/** Throws when `appRoot` is not inside a git repository. */
+export function repoLayout(appRoot) {
+    const root = realpathSync(git(appRoot, ['rev-parse', '--show-toplevel']).trim());
+    return { root, appPrefix: relative(root, realpathSync(appRoot)).split(sep).join('/') };
+}
+/**
+ * `VERCEL_GIT_COMMIT_SHA`, else `HEAD` plus `-dirty` when the app's tree has changes, else null.
+ * Never throws: a missing git only means comments can't be pinned to a commit.
+ */
+export function resolveCommit(appRoot, options = {}) {
+    const suffix = options.live ? DIRTY_SUFFIX : '';
+    const vercel = process.env.VERCEL_GIT_COMMIT_SHA?.trim();
+    if (vercel && SHA_PATTERN.test(vercel))
+        return `${vercel}${suffix}`;
+    let sha;
+    try {
+        sha = git(appRoot, ['rev-parse', 'HEAD']).trim();
+    }
+    catch {
+        return null;
+    }
+    if (!SHA_PATTERN.test(sha))
+        return null;
+    if (options.live)
+        return `${sha}${DIRTY_SUFFIX}`;
+    let dirty;
+    try {
+        // Scoped to the app: changes elsewhere in a monorepo don't alter the files the manifest reads.
+        dirty = git(appRoot, ['status', '--porcelain', '--', '.']).trim() !== '';
+    }
+    catch {
+        // Unknown state: the working tree is the only source guaranteed to match this build.
+        dirty = true;
+    }
+    return dirty ? `${sha}${DIRTY_SUFFIX}` : sha;
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAE/E,OAAO,EAAE,YAAY,EAAE,CAAA;AAkBvB,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,OAAO,GAAe,EAAE;IACvE,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,GAAG;QACH,uFAAuF;QACvF,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;QAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI;QAC7B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC;AASD,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAChF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AACxF,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAO,GAAyB,EAAE;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;IAEnE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,GAAG,GAAG,GAAG,YAAY,EAAE,CAAA;IAEhD,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACH,+FAA+F;QAC/F,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,KAAK,GAAG,IAAI,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;AAC9C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+import type { NextConfig } from 'next';
+export type { Entry, TransformOptions, TransformResult } from './transform.js';
+export interface NextConfigContext {
+    defaultConfig: NextConfig;
+}
+export type NextConfigFunction = (phase: string, context: NextConfigContext) => NextConfig | Promise<NextConfig>;
+export interface MittOptions {
+    /**
+     * Lets `next build` fall back to the public dev secret when the secret env var is unset. Only
+     * for builds that are never deployed (e.g. a local e2e target); the IDs it produces can be
+     * reversed by anyone who can guess file paths.
+     */
+    allowDevSecretInBuild?: boolean;
+    /**
+     * The Next app directory. Defaults to the cwd, which is the app directory whenever Next runs
+     * from its package scripts. Next doesn't chdir, so `next build <dir>` from elsewhere needs this.
+     */
+    root?: string;
+    /**
+     * Serve the setup checklist at `/__mitt` under `next dev` (ADR 0013). Default true. Never part
+     * of a production build, whatever this says.
+     */
+    setupPage?: boolean;
+}
+/**
+ * Adds opaque `data-fb` IDs to every host element, in dev and in builds alike (#7): production
+ * comments need them to resolve (#2). No path, line or stega ever reaches the output (#3, #4).
+ *
+ * Returns a config function because the secret policy depends on the phase, and Next only passes
+ * the phase to config functions (`NEXT_PHASE` is set too late in `next build` to rely on). The
+ * secret itself never enters the config: Next writes the config into the server build output.
+ */
+export declare function withMitt(nextConfig?: NextConfig | NextConfigFunction, options?: MittOptions): NextConfigFunction;

package/dist/index.js

@@ -0,0 +1,121 @@
+import { existsSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readMittConfig, resolveSecret, secretFingerprint } from './config.js';
+import { resolveCommit } from './git.js';
+// Values of `next/constants`, inlined so the plugin doesn't load Next at config time.
+const PHASE_DEVELOPMENT_SERVER = 'phase-development-server';
+const PHASE_PRODUCTION_BUILD = 'phase-production-build';
+const LOADER_PATH = fileURLToPath(new URL('./loader.js', import.meta.url));
+const JSX_GLOBS = ['*.tsx', '*.jsx'];
+const NEXT_CONFIG_FILES = ['next.config.ts', 'next.config.mts', 'next.config.mjs', 'next.config.js'];
+let warnedDevSecret = false;
+// Next loads the config several times per build; git's answer doesn't change in between.
+const commits = new Map();
+function commitFor(root, live) {
+    const key = `${root}\0${live}\0${process.env.VERCEL_GIT_COMMIT_SHA ?? ''}`;
+    let commit = commits.get(key);
+    if (commit === undefined) {
+        commit = resolveCommit(root, { live });
+        commits.set(key, commit);
+    }
+    return commit;
+}
+// IDs are keyed by paths relative to this directory and the CLI rebuilds them from the same root,
+// so a wrong guess would make every comment unresolvable (#2): fail the build instead.
+function resolveRoot(option) {
+    const root = realpathSync(resolve(option ?? process.cwd()));
+    if (!NEXT_CONFIG_FILES.some((file) => existsSync(join(root, file)))) {
+        throw new Error(`[mitt] ${root} has no next.config file. Run Next from the app directory or pass ` +
+            'withMitt(config, { root }).');
+    }
+    return root;
+}
+// Only a fingerprint leaves this function; the loader re-reads the secret from the environment.
+function secretOptions(secretEnv, allowDevSecret) {
+    const options = { secretEnv, allowDevSecret };
+    const { secret, devFallback } = resolveSecret(secretEnv, process.env, {
+        allowDev: allowDevSecret,
+    });
+    // No secret and no fallback: the loader fails the build when it first runs. Throwing here would
+    // also break `next typegen`, which loads the config in the build phase but never compiles.
+    if (secret === null)
+        return options;
+    if (devFallback && !warnedDevSecret) {
+        warnedDevSecret = true;
+        console.warn(`[mitt] ${secretEnv} is not set; using the public dev secret for data-fb IDs.`);
+    }
+    return { ...options, fingerprint: secretFingerprint(secret) };
+}
+function onlyLoaders(items) {
+    return items.every((item) => typeof item === 'string' || 'loader' in item);
+}
+// Ours goes first so it sees the file exactly as it is on disk (and in git): IDs are keyed by
+// line and column, and the manifest rebuilds them from the raw source.
+function prependRule(existing, rule) {
+    if (existing === undefined)
+        return rule;
+    if (!Array.isArray(existing))
+        return [rule, existing];
+    // A plain list of loaders is shorthand for one rule; keep it as one rule.
+    if (onlyLoaders(existing))
+        return [rule, { loaders: existing }];
+    return [rule, ...existing];
+}
+function withTurbopackRules(config, loader) {
+    const rules = { ...config.turbopack?.rules };
+    for (const glob of JSX_GLOBS) {
+        rules[glob] = prependRule(rules[glob], {
+            condition: { not: 'foreign' },
+            loaders: [{ loader: LOADER_PATH, options: { ...loader } }],
+        });
+    }
+    return { ...config, turbopack: { ...config.turbopack, rules } };
+}
+function withWebpackRule(config, loader) {
+    const userWebpack = config.webpack;
+    const webpack = (webpackConfig, context) => {
+        const target = webpackConfig;
+        target.module ??= {};
+        target.module.rules ??= [];
+        target.module.rules.push({
+            test: /\.[jt]sx$/,
+            exclude: /node_modules/,
+            enforce: 'pre',
+            use: [{ loader: LOADER_PATH, options: { ...loader } }],
+        });
+        return userWebpack ? userWebpack(webpackConfig, context) : webpackConfig;
+    };
+    return { ...config, webpack };
+}
+/**
+ * Adds opaque `data-fb` IDs to every host element, in dev and in builds alike (#7): production
+ * comments need them to resolve (#2). No path, line or stega ever reaches the output (#3, #4).
+ *
+ * Returns a config function because the secret policy depends on the phase, and Next only passes
+ * the phase to config functions (`NEXT_PHASE` is set too late in `next build` to rely on). The
+ * secret itself never enters the config: Next writes the config into the server build output.
+ */
+export function withMitt(nextConfig = {}, options = {}) {
+    return async (phase, context) => {
+        const config = typeof nextConfig === 'function' ? await nextConfig(phase, context) : nextConfig;
+        // Only these phases compile code; `next start` and friends never run the loader.
+        if (phase !== PHASE_DEVELOPMENT_SERVER && phase !== PHASE_PRODUCTION_BUILD)
+            return config;
+        const root = resolveRoot(options.root);
+        const { secretEnv } = readMittConfig(root);
+        const allowDevSecret = phase === PHASE_DEVELOPMENT_SERVER || Boolean(options.allowDevSecretInBuild);
+        const loader = { ...secretOptions(secretEnv, allowDevSecret), root };
+        const commit = commitFor(root, phase === PHASE_DEVELOPMENT_SERVER);
+        // Loader options must be plain JSON without nulls, so a missing commit is simply omitted.
+        if (commit)
+            loader.commit = commit;
+        const withLoader = withWebpackRule(withTurbopackRules(config, loader), loader);
+        if (phase !== PHASE_DEVELOPMENT_SERVER || options.setupPage === false)
+            return withLoader;
+        // Loaded only here, so builds never even import it.
+        const { setupServerFor, withSetupRewrites } = await import('./setup.js');
+        return withSetupRewrites(withLoader, (await setupServerFor(root)).target);
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAKxC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,0BAA0B,CAAA;AAC3D,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAoCvD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC1E,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACpC,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAA;AAEpG,IAAI,eAAe,GAAG,KAAK,CAAA;AAC3B,yFAAyF;AACzF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;AAEhD,SAAS,SAAS,CAAC,IAAY,EAAE,IAAa;IAC5C,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAA;IAC1E,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,kGAAkG;AAClG,uFAAuF;AACvF,SAAS,WAAW,CAAC,MAA0B;IAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,oEAAoE;YAChF,6BAA6B,CAChC,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CACpB,SAAiB,EACjB,cAAuB;IAEvB,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,CAAA;IAC7C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;QACpE,QAAQ,EAAE,cAAc;KACzB,CAAC,CAAA;IACF,gGAAgG;IAChG,2FAA2F;IAC3F,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IACnC,IAAI,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;QACpC,eAAe,GAAG,IAAI,CAAA;QACtB,OAAO,CAAC,IAAI,CAAC,UAAU,SAAS,2DAA2D,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC,CAAA;AAC5E,CAAC;AAED,8FAA8F;AAC9F,uEAAuE;AACvE,SAAS,WAAW,CAAC,QAAoC,EAAE,IAAc;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrD,0EAA0E;IAC1E,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC/D,OAAO,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAkB,EAAE,MAAyB;IACvE,MAAM,KAAK,GAAU,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,CAAA;IACnD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACrC,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;YAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;SAC3D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB,EAAE,MAAyB;IACpE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAA;IAClC,MAAM,OAAO,GAAG,CAAC,aAAsB,EAAE,OAAuB,EAAW,EAAE;QAC3E,MAAM,MAAM,GAAG,aAAmD,CAAA;QAClE,MAAM,CAAC,MAAM,KAAK,EAAE,CAAA;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAA;QAC1B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YACvB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;SACvD,CAAC,CAAA;QACF,OAAO,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IAC1E,CAAC,CAAA;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,UAAU,GAAoC,EAAE,EAChD,OAAO,GAAgB,EAAE;IAEzB,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;QAC/F,iFAAiF;QACjF,IAAI,KAAK,KAAK,wBAAwB,IAAI,KAAK,KAAK,sBAAsB;YAAE,OAAO,MAAM,CAAA;QAEzF,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,cAAc,GAClB,KAAK,KAAK,wBAAwB,IAAI,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAsB,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,CAAA;QACvF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,KAAK,wBAAwB,CAAC,CAAA;QAClE,0FAA0F;QAC1F,IAAI,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;QAClC,MAAM,UAAU,GAAG,eAAe,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QAC9E,IAAI,KAAK,KAAK,wBAAwB,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK;YAAE,OAAO,UAAU,CAAA;QACxF,oDAAoD;QACpD,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;QACxE,OAAO,iBAAiB,CAAC,UAAU,EAAE,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC,CAAA;AACH,CAAC"}

package/dist/loader.d.ts

@@ -0,0 +1,21 @@
+import type { SourceMap } from 'magic-string';
+export interface MittLoaderOptions {
+    /** Environment variable the secret is read from, in the loader's own process. */
+    secretEnv: string;
+    /** `secretFingerprint` of the secret withMitt saw; absent when it saw none. */
+    fingerprint?: string;
+    /** Whether the public dev secret may stand in when `secretEnv` is unset. */
+    allowDevSecret: boolean;
+    commit?: string;
+    /** Absolute path of the Next app root; IDs are keyed by paths relative to it. */
+    root: string;
+}
+export interface MittLoaderContext {
+    resourcePath: string;
+    /** Whether the bundler consumes loader sourcemaps (Turbopack drops them when false). */
+    sourceMap?: boolean;
+    getOptions?: () => unknown;
+    emitWarning?: (warning: Error) => void;
+    callback?: (error: Error | null, content?: string, sourceMap?: SourceMap | unknown) => void;
+}
+export default function mittLoader(this: MittLoaderContext, source: string, inputMap?: unknown): string | undefined;

package/dist/loader.js

@@ -0,0 +1,71 @@
+import { basename, isAbsolute, relative, sep } from 'node:path';
+import { resolveSecret, secretFingerprint } from './config.js';
+import { transform } from './transform.js';
+function readOptions(raw) {
+    const invalid = new Error('[mitt] invalid loader options: register the loader with withMitt()');
+    if (typeof raw !== 'object' || raw === null)
+        throw invalid;
+    const { secretEnv, fingerprint, allowDevSecret, commit, root } = raw;
+    if (typeof secretEnv !== 'string' || secretEnv === '' || typeof root !== 'string')
+        throw invalid;
+    const options = { secretEnv, allowDevSecret: allowDevSecret === true, root };
+    if (typeof fingerprint === 'string')
+        options.fingerprint = fingerprint;
+    if (typeof commit === 'string')
+        options.commit = commit;
+    return options;
+}
+let lastVerified;
+// Here rather than at config load, so `next typegen` and `next start` (which load the config but
+// never compile) work without the secret; a build that would emit IDs fails instead.
+function loaderSecret({ secretEnv, fingerprint, allowDevSecret }) {
+    const { secret } = resolveSecret(secretEnv, process.env, { allowDev: allowDevSecret });
+    if (secret === null) {
+        throw new Error(`[mitt] ${secretEnv} is not set. Production builds need a per-project secret to key the ` +
+            'data-fb IDs; without one, anyone could recover file paths from the public HTML.');
+    }
+    if (fingerprint && `${fingerprint}:${secret}` !== lastVerified) {
+        // Turbopack caches output by options, which only carry the fingerprint: a secret that differs
+        // from the config's would mix IDs from two secrets in one build.
+        if (secretFingerprint(secret) !== fingerprint) {
+            throw new Error(`[mitt] ${secretEnv} changed after the config loaded. Restart Next so every data-fb ID ` +
+                'uses the same secret.');
+        }
+        lastVerified = `${fingerprint}:${secret}`;
+    }
+    return secret;
+}
+// A function of (source, options) plus the secret, which the fingerprint in the options pins:
+// Turbopack caches loader output by those inputs, so any other input or side effect would make
+// the cached output and the git-rebuilt manifest diverge.
+// Keep it a default export: loader-runner `require()`s Turbopack loaders and reads `.default`.
+export default function mittLoader(source, inputMap) {
+    const done = (code, map) => {
+        if (!this.callback)
+            return code;
+        this.callback(null, code, map);
+        return undefined;
+    };
+    const options = readOptions(this.getOptions?.());
+    const rel = relative(options.root, this.resourcePath);
+    // Defensive: the rules already exclude foreign code, but an ID for a path outside the app could
+    // never be resolved by the manifest.
+    if (rel === '' || rel.startsWith('..') || isAbsolute(rel))
+        return done(source, inputMap);
+    const segments = rel.split(sep);
+    if (segments.includes('node_modules'))
+        return done(source, inputMap);
+    const result = transform(source, {
+        relPath: segments.join('/'),
+        secret: loaderSecret(options),
+        commit: options.commit,
+        mapSource: basename(this.resourcePath),
+        sourceMap: this.sourceMap !== false,
+    });
+    if (result.warning)
+        this.emitWarning?.(new Error(result.warning));
+    if (result.code === source)
+        return done(source, inputMap);
+    return done(result.code, result.map ?? undefined);
+}
+//# sourceMappingURL=loader.js.map

package/dist/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AA0B1C,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IAC/F,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,OAAO,CAAA;IAC1D,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAA8B,CAAA;IAC/F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,OAAO,CAAA;IAChG,MAAM,OAAO,GAAsB,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,KAAK,IAAI,EAAE,IAAI,EAAE,CAAA;IAC/F,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAA;IACtE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAA;IACvD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,IAAI,YAAgC,CAAA;AAEpC,iGAAiG;AACjG,qFAAqF;AACrF,SAAS,YAAY,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAqB;IACjF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IACtF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,sEAAsE;YACvF,iFAAiF,CACpF,CAAA;IACH,CAAC;IACD,IAAI,WAAW,IAAI,GAAG,WAAW,IAAI,MAAM,EAAE,KAAK,YAAY,EAAE,CAAC;QAC/D,8FAA8F;QAC9F,iEAAiE;QACjE,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,qEAAqE;gBACtF,uBAAuB,CAC1B,CAAA;QACH,CAAC;QACD,YAAY,GAAG,GAAG,WAAW,IAAI,MAAM,EAAE,CAAA;IAC3C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8FAA8F;AAC9F,+FAA+F;AAC/F,0DAA0D;AAC1D,+FAA+F;AAC/F,MAAM,CAAC,OAAO,UAAU,UAAU,CAEhC,MAAc,EACd,QAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAa,EAAE,EAAE;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAC9B,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACrD,gGAAgG;IAChG,qCAAqC;IACrC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACxF,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAEpE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE;QAC/B,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QACtC,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;KACpC,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,OAAO;QAAE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,CAAA;AACnD,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,15 @@
+import { type Entry } from './transform.js';
+export * from './node.js';
+export type { Entry } from './transform.js';
+export interface BuildManifestOptions {
+    /** The Next app directory, the same root `withMitt` keys paths by. */
+    appRoot: string;
+    /** The commit a page reported in `data-fb-commit`; `-dirty` or null reads the working tree. */
+    commit: string | null;
+    secret: string;
+}
+/**
+ * Rebuilds the ID -> source map for a commit by running the loader's own transform over the files
+ * of that commit. Nothing is collected from the build, so a cached build can't make it wrong.
+ */
+export declare function buildManifest({ appRoot, commit, secret, }: BuildManifestOptions): Map<string, Entry>;

package/dist/manifest.js

@@ -0,0 +1,88 @@
+// Node-only, and private by design (#3): it maps opaque IDs back to files and lines. Client code
+// must never import it, and its output must never be served or bundled.
+import { readFileSync, realpathSync } from 'node:fs';
+import { DIRTY_SUFFIX, git, repoLayout } from './git.js';
+import { transform } from './transform.js';
+export * from './node.js';
+const JSX_FILE = /\.[jt]sx$/;
+function isSource(path) {
+    return JSX_FILE.test(path) && !path.split('/').includes('node_modules');
+}
+function workingTreeFiles(appRoot) {
+    // Paths come back relative to the cwd, i.e. the app root. Untracked files count: a dev server or
+    // dirty build serves them too.
+    const listed = git(appRoot, ['ls-files', '-z', '--cached', '--others', '--exclude-standard']);
+    const files = [];
+    for (const relPath of new Set(listed.split('\0'))) {
+        if (!relPath || !isSource(relPath))
+            continue;
+        let source;
+        try {
+            source = readFileSync(`${appRoot}/${relPath}`, 'utf8');
+        }
+        catch (error) {
+            // Tracked but deleted in the working tree: it isn't served either.
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        files.push({ relPath, source });
+    }
+    return files;
+}
+function commitFiles(repoRoot, appPrefix, sha) {
+    const pathspec = appPrefix ? [`${appPrefix}/`] : [];
+    const listed = git(repoRoot, ['ls-tree', '-r', '-z', '--name-only', sha, '--', ...pathspec]);
+    const paths = listed.split('\0').filter((path) => path && isSource(path));
+    if (paths.length === 0)
+        return [];
+    // One `cat-file --batch` process for every blob instead of a `git show` per file.
+    const output = git(repoRoot, ['cat-file', '--batch'], {
+        input: paths.map((path) => `${sha}:${path}\n`).join(''),
+        encoding: 'buffer',
+    });
+    const files = [];
+    let offset = 0;
+    for (const path of paths) {
+        const headerEnd = output.indexOf(0x0a, offset);
+        const header = output.toString('utf8', offset, headerEnd);
+        const size = Number(header.split(' ')[2]);
+        if (!header.includes(' blob ') || !Number.isInteger(size)) {
+            throw new Error(`[mitt] could not read ${path} at ${sha}: ${header}`);
+        }
+        const start = headerEnd + 1;
+        const source = output.toString('utf8', start, start + size);
+        offset = start + size + 1;
+        files.push({ relPath: appPrefix ? path.slice(appPrefix.length + 1) : path, source });
+    }
+    return files;
+}
+/**
+ * Rebuilds the ID -> source map for a commit by running the loader's own transform over the files
+ * of that commit. Nothing is collected from the build, so a cached build can't make it wrong.
+ */
+export function buildManifest({ appRoot, commit, secret, }) {
+    const root = realpathSync(appRoot);
+    let files;
+    if (commit === null || commit.endsWith(DIRTY_SUFFIX)) {
+        files = workingTreeFiles(root);
+    }
+    else {
+        const repo = repoLayout(root);
+        files = commitFiles(repo.root, repo.appPrefix, commit);
+    }
+    const manifest = new Map();
+    for (const { relPath, source } of files) {
+        for (const entry of transform(source, { relPath, secret, sourceMap: false }).entries) {
+            const existing = manifest.get(entry.id);
+            if (existing) {
+                // Would mean a truncated-HMAC collision; resolving either entry could misplace a comment.
+                throw new Error(`[mitt] duplicate data-fb ID ${entry.id}: ${existing.file}:${existing.line} and ` +
+                    `${entry.file}:${entry.line}`);
+            }
+            manifest.set(entry.id, entry);
+        }
+    }
+    return manifest;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,wEAAwE;AACxE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACxD,OAAO,EAAc,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAEtD,cAAc,WAAW,CAAA;AAWzB,MAAM,QAAQ,GAAG,WAAW,CAAA;AAE5B,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;AACzE,CAAC;AAQD,SAAS,gBAAgB,CAAC,OAAe;IACvC,iGAAiG;IACjG,+BAA+B;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAA;IAC7F,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC5C,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mEAAmE;YACnE,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YAChE,MAAM,KAAK,CAAA;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,SAAiB,EAAE,GAAW;IACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAEjC,kFAAkF;IAClF,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE;QACpD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAA;IACF,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,OAAO,GAAG,KAAK,MAAM,EAAE,CAAC,CAAA;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,GAAG,CAAC,CAAA;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAA;QAC3D,MAAM,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,CAAA;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,OAAO,EACP,MAAM,EACN,MAAM,GACe;IACrB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,KAAmB,CAAA;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QAC7B,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAA;IACzC,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACvC,IAAI,QAAQ,EAAE,CAAC;gBACb,0FAA0F;gBAC1F,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,OAAO;oBAC/E,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAChC,CAAA;YACH,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/node.d.ts

@@ -0,0 +1,2 @@
+export { CONFIG_FILE, DEFAULT_SECRET_ENV, DEV_SECRET, type Env, type MittConfig, type ResolvedSecret, readMittConfig, resolveSecret, secretFingerprint, } from './config.js';
+export { DIRTY_SUFFIX, type GitOptions, git, type RepoLayout, repoLayout } from './git.js';

package/dist/node.js

@@ -0,0 +1,5 @@
+// Node-only and light: settings, secret and git plumbing shared by the plugin and the CLI, without
+// the transform (oxc, magic-string) that `./manifest` adds on top.
+export { CONFIG_FILE, DEFAULT_SECRET_ENV, DEV_SECRET, readMittConfig, resolveSecret, secretFingerprint, } from './config.js';
+export { DIRTY_SUFFIX, git, repoLayout } from './git.js';
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,mEAAmE;AACnE,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EAIV,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,YAAY,EAAmB,GAAG,EAAmB,UAAU,EAAE,MAAM,UAAU,CAAA"}