@getexception/cli 0.1.23 → 0.1.25

package/dist/index.js

@@ -8,27 +8,9 @@ var __export = (target, all) => {
 // packages/cli/src/index.ts
 import { parseArgs } from "util";
 
-// packages/cli/src/prepare.ts
-import { createHash, randomUUID } from "crypto";
-import {
-  lstat,
-  mkdir,
-  readdir,
-  readFile,
-  realpath,
-  rename,
-  unlink,
-  writeFile
-} from "fs/promises";
-import {
-  basename,
-  dirname,
-  isAbsolute,
-  join,
-  relative,
-  resolve,
-  sep
-} from "path";
+// packages/cli/src/source-map-delivery.ts
+import { mkdir as mkdir3, realpath as realpath2, readdir as readdir3, rm as rm2 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve2, relative as relative4, isAbsolute as isAbsolute2, sep as sep3, join as join4 } from "path";
 
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -1841,18 +1823,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse5 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse3(schema, value, ctx, finalizeParams(fn, _params));
+    return parse5(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse5 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse3(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse5(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -18906,7 +18888,12 @@ var SOURCE_MAP_LIMITS = {
   diskReserveBytes: 5 * 1024 * 1024 * 1024,
   manifestBytes: 64 * 1024
 };
-var releaseNameSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,79}@[a-f0-9]{40}$/);
+var releaseNameSchema = external_exports.string().max(160).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*(?:@[A-Za-z0-9][A-Za-z0-9._+-]*)?$/).refine((value) => !/^[^@]+@[a-zA-Z][^@]*\.[a-zA-Z]{2,}$/.test(value));
+var environmentNameSchema = external_exports.string().max(64).regex(/^[a-z][a-z0-9_-]{0,63}$/).refine(
+  (value) => !["all", "constructor", "prototype", "__proto__"].includes(value)
+);
+var buildIdSchema = external_exports.string().max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/);
+var environmentListSchema = external_exports.array(environmentNameSchema).max(20).refine((values) => new Set(values).size === values.length);
 var artifactPathSchema = external_exports.string().max(512).regex(/^[a-zA-Z0-9_@~.-]+(?:\/[a-zA-Z0-9_@~.-]+)*\.(?:js|mjs)$/).refine(
   (value) => !value.split("/").some((part) => part === "." || part === "..")
 );
@@ -18918,9 +18905,13 @@ var sourceArtifactSchema = external_exports.object({
 }).strict();
 var sourceUploadSchema = external_exports.object({
   release: releaseNameSchema,
+  environment: environmentNameSchema.optional(),
+  buildId: buildIdSchema.optional(),
+  batchIndex: external_exports.number().int().min(0).max(4095).optional(),
+  batchCount: external_exports.number().int().min(1).max(4096).optional(),
   artifacts: external_exports.array(sourceArtifactSchema).min(1).max(SOURCE_MAP_LIMITS.files)
 }).strict().superRefine((value, ctx) => {
-  if (value.artifacts.reduce((sum, file2) => sum + file2.size, 0) > SOURCE_MAP_LIMITS.releaseBytes || new Set(value.artifacts.map((file2) => file2.path)).size !== value.artifacts.length || new Set(value.artifacts.map((file2) => file2.debugId)).size !== value.artifacts.length) {
+  if ((value.batchIndex !== void 0 || value.batchCount !== void 0) && (value.batchIndex === void 0 || value.batchCount === void 0 || value.batchIndex >= value.batchCount) || value.artifacts.reduce((sum, file2) => sum + file2.size, 0) > SOURCE_MAP_LIMITS.releaseBytes || new Set(value.artifacts.map((file2) => file2.path)).size !== value.artifacts.length || new Set(value.artifacts.map((file2) => file2.debugId)).size !== value.artifacts.length) {
     ctx.addIssue({ code: "custom", message: "Invalid artifact manifest" });
   }
 });
@@ -18938,20 +18929,18 @@ var originalFrameSchema = external_exports.object({
 var appVersionSchema = external_exports.string().max(64).refine((value) => value.trim() === value).regex(
   /^(0|[1-9][0-9]{0,9})\.(0|[1-9][0-9]{0,9})\.(0|[1-9][0-9]{0,9})(?:-(?:0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/
 );
-var RELEASE_ENVIRONMENTS = [
-  "production",
-  "staging",
-  "development"
-];
 var deploymentSchema = external_exports.object({
-  environment: external_exports.enum(RELEASE_ENVIRONMENTS),
+  environment: environmentNameSchema,
   review: external_exports.object({
-    provider: external_exports.literal("gitlab"),
-    repositoryId: external_exports.number().int().min(1).max(2147483647),
+    provider: external_exports.enum(["gitlab", "github", "other"]),
+    repositoryId: external_exports.union([
+      external_exports.number().int().min(1).max(2147483647),
+      external_exports.string().max(200).regex(/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)+$/)
+    ]),
     number: external_exports.number().int().min(1).max(2147483647)
   }).strict().optional()
-}).strict().refine((value) => !value.review || value.environment === "staging", {
-  message: "Merge requests belong to staging"
+}).strict().refine((value) => !value.review || value.environment !== "production", {
+  message: "Reviews belong to non-production environments"
 });
 var releaseRegistrationSchema = external_exports.object({
   release: releaseNameSchema,
@@ -19075,7 +19064,7 @@ var safeEventSchema = external_exports.object({
   message: external_exports.string().max(1024),
   exceptionType: external_exports.string().max(120),
   handled: external_exports.boolean(),
-  environment: external_exports.enum(["production", "staging", "development"]),
+  environment: environmentNameSchema,
   release: external_exports.string().max(160).optional(),
   appVersion: appVersionSchema.optional(),
   dist: external_exports.string().max(64).optional(),
@@ -19087,7 +19076,43 @@ var safeEventSchema = external_exports.object({
   breadcrumbs: external_exports.array(safeBreadcrumbSchema).max(50)
 }).strict();
 
+// packages/cli/src/prepare-build.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  copyFile,
+  lstat as lstat3,
+  mkdir as mkdir2,
+  readFile as readFile3,
+  rename as rename2,
+  rm,
+  stat,
+  unlink as unlink2,
+  writeFile as writeFile2
+} from "fs/promises";
+import { dirname as dirname2, join as join3, relative as relative3 } from "path";
+
 // packages/cli/src/prepare.ts
+import { createHash, randomUUID } from "crypto";
+import { parse as parse3 } from "acorn";
+import {
+  lstat,
+  mkdir,
+  readdir,
+  readFile,
+  realpath,
+  rename,
+  unlink,
+  writeFile
+} from "fs/promises";
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+  sep
+} from "path";
 function checksum(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
@@ -19114,7 +19139,7 @@ async function files(root, directory = root, result = []) {
   }
   return result;
 }
-async function prepareMaps(directory, output2, release, prefix = "") {
+async function prepareMaps(directory, output2, release, prefix = "", options = {}) {
   const root = await realpath(directory);
   const destination = join(
     await realpath(dirname(resolve(output2))),
@@ -19122,6 +19147,9 @@ async function prepareMaps(directory, output2, release, prefix = "") {
   );
   const child = relative(root, destination);
   releaseNameSchema.parse(release);
+  if (options.buildId) {
+    buildIdSchema.parse(options.buildId);
+  }
   if (!child || !isAbsolute(child) && child !== ".." && !child.startsWith(`..${sep}`)) {
     throw new Error(
       "Private artifacts must be outside the public build directory"
@@ -19147,7 +19175,7 @@ async function prepareMaps(directory, output2, release, prefix = "") {
       (await regular(join(root, mapPath), SOURCE_MAP_LIMITS.fileBytes)).toString("utf8")
     );
     const source = (await regular(join(root, jsPath), SOURCE_MAP_LIMITS.fileBytes)).toString("utf8");
-    if (map2.version !== 3 || typeof map2.mappings !== "string" || map2.sections || map2.debug_id || source.startsWith(
+    if (map2.version !== 3 || typeof map2.mappings !== "string" || map2.sections || map2.debug_id || source.startsWith("#!") || source.startsWith(
       ";(globalThis.__GETEXCEPTION_DEBUG_IDS__??=Object.create(null))"
     )) {
       throw new Error("Expected a fresh, non-indexed v3 source map");
@@ -19172,12 +19200,29 @@ async function prepareMaps(directory, output2, release, prefix = "") {
       /(?:^|\n)[ \t]*(?:\/\/[#@][ \t]*sourceMappingURL=[^\r\n]*|\/\*[#@][ \t]*sourceMappingURL=[^\r\n]*?\*\/)[ \t]*(?:\r?\n)?$/,
       (comment) => comment.replace(/[^\r\n]/g, " ")
     );
-    const js = `;(globalThis.__GETEXCEPTION_DEBUG_IDS__??=Object.create(null))[import.meta.url]=${JSON.stringify(debugId)};
+    const directives = [];
+    if (options.format === "classic") {
+      const program = parse3(source, {
+        ecmaVersion: "latest",
+        sourceType: "script"
+      });
+      for (const statement of program.body) {
+        if (!("directive" in statement) || typeof statement.directive !== "string") {
+          break;
+        }
+        directives.push(statement.directive);
+      }
+    }
+    const injection = options.format === "classic" ? `${directives.map((value) => JSON.stringify(value) + ";").join("")};(()=>{const s=typeof document!=="undefined"?document.currentScript?.src:undefined;if(s)(globalThis.__GETEXCEPTION_DEBUG_IDS__??=Object.create(null))[s]=${JSON.stringify(debugId)};})();` : `;(globalThis.__GETEXCEPTION_DEBUG_IDS__??=Object.create(null))[import.meta.url]=${JSON.stringify(debugId)};`;
+    const js = `${injection}
 ${body}`;
     prepared.push({ mapPath, jsPath, bytes, js, entry });
   }
   const manifest = sourceUploadSchema.parse({
     release,
+    ...options.buildId ? { buildId: options.buildId } : {},
+    ...options.environment ? { environment: options.environment } : {},
+    ...options.batchIndex !== void 0 ? { batchIndex: options.batchIndex, batchCount: options.batchCount } : {},
     artifacts: prepared.map((item) => item.entry)
   });
   await mkdir(destination, { mode: 448 });
@@ -19222,8 +19267,193 @@ async function readPreparedMap(directory, entry) {
   return bytes;
 }
 
-// packages/cli/src/upload.ts
+// packages/cli/src/public-output.ts
+import { lstat as lstat2, readFile as readFile2, readdir as readdir2 } from "fs/promises";
+import { basename as basename2, extname, join as join2, relative as relative2, sep as sep2 } from "path";
+import { brotliDecompress, gunzip } from "zlib";
 import { promisify } from "util";
+import { parse as parse4 } from "acorn";
+import postcss from "postcss";
+var gunzipAsync = promisify(gunzip);
+var brotliAsync = promisify(brotliDecompress);
+var maxPublicFileBytes = 128 * 1024 * 1024;
+var inlineMap = /[#@]\s*sourceMappingURL\s*=\s*data:/i;
+var debugHeader = ";(globalThis.__GETEXCEPTION_DEBUG_IDS__??=Object.create(null))";
+async function listPublicFiles(root, directory = root) {
+  if (!(await lstat2(directory)).isDirectory()) {
+    throw new Error("Public output must be a directory");
+  }
+  const paths = [];
+  for (const entry of await readdir2(directory, { withFileTypes: true })) {
+    const file2 = join2(directory, entry.name);
+    if (entry.isSymbolicLink() || !entry.isFile() && !entry.isDirectory()) {
+      throw new Error("Public output must contain only regular files");
+    }
+    if (/^\.getexception-(?:maps|work)$/.test(entry.name)) {
+      throw new Error("Private source map directory in public output");
+    }
+    if (entry.isDirectory()) {
+      paths.push(...await listPublicFiles(root, file2));
+    } else {
+      paths.push(file2);
+    }
+  }
+  return paths;
+}
+function hasInlineMap(source, extension) {
+  if (!inlineMap.test(source)) {
+    return false;
+  }
+  if (extension === ".css") {
+    let found2 = false;
+    postcss.parse(source, { map: false }).walkComments((comment) => {
+      found2 ||= inlineMap.test(comment.text);
+    });
+    return found2;
+  }
+  let found = false;
+  parse4(source, {
+    ecmaVersion: "latest",
+    sourceType: extension === ".cjs" ? "script" : "module",
+    onComment: (_block, comment) => {
+      found ||= inlineMap.test(comment);
+    }
+  });
+  return found;
+}
+async function assertPublicOutput(root, options = {}) {
+  for (const file2 of await listPublicFiles(root)) {
+    const name = file2.replace(/\.(?:gz|br)$/i, "");
+    const extension = extname(name).toLowerCase();
+    const relativePath = relative2(root, file2).split(sep2).join("/");
+    if (/\.map$/i.test(name)) {
+      throw new Error("Source map in public output");
+    }
+    if (options.assetPrefix && [".js", ".mjs", ".cjs"].includes(extension) && !relativePath.startsWith(options.assetPrefix)) {
+      throw new Error("Public JavaScript outside verified asset prefix");
+    }
+    const info = await lstat2(file2);
+    if (!info.isFile() || info.size > maxPublicFileBytes) {
+      throw new Error("Unverifiable public output file");
+    }
+    let bytes = await readFile2(file2);
+    if (/\.gz$/i.test(file2)) {
+      bytes = await gunzipAsync(bytes, { maxOutputLength: maxPublicFileBytes });
+    } else if (/\.br$/i.test(file2)) {
+      bytes = await brotliAsync(bytes, { maxOutputLength: maxPublicFileBytes });
+    }
+    const source = bytes.toString("utf8");
+    if (options.credentials?.some(
+      (credential) => credential && source.includes(credential)
+    ) || /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/.test(source)) {
+      throw new Error("Credential in public output");
+    }
+    if (basename2(name) === "release.json") {
+      throw new Error("Private release metadata in public output");
+    }
+    if (extension === ".json") {
+      const value = JSON.parse(source);
+      if (value.release && Array.isArray(value.artifacts)) {
+        throw new Error("Source map manifest in public output");
+      }
+    }
+    if ([".js", ".mjs", ".cjs", ".css"].includes(extension) ? hasInlineMap(source, extension) : inlineMap.test(source)) {
+      throw new Error("Inline source map in public output");
+    }
+    if (!options.mapsEnabled && [".js", ".mjs"].includes(extension) && source.startsWith(debugHeader)) {
+      throw new Error("Prepared JavaScript in build without source maps");
+    }
+  }
+}
+
+// packages/cli/src/prepare-build.ts
+var maxBuildMaps = 4096;
+async function prepareBuild(output2, privateRoot, release, signal = AbortSignal.timeout(5 * 6e4), options = {}) {
+  signal.throwIfAborted();
+  const paths = await listPublicFiles(output2);
+  const maps = paths.filter((file2) => /\.(?:m?js)\.map$/i.test(file2)).sort();
+  if (!maps.length || maps.length > maxBuildMaps || paths.some(
+    (file2) => /\.map(?:\.(?:gz|br))?$/i.test(file2) && !maps.includes(file2)
+  ) || paths.some((file2) => /\.(?:gz|br)$/i.test(file2))) {
+    throw new Error("Expected fresh uncompressed JavaScript source maps");
+  }
+  const batches = [];
+  let batchBytes = 0;
+  let totalBytes = 0;
+  for (const map2 of maps) {
+    signal.throwIfAborted();
+    const js = map2.slice(0, -4);
+    const [mapInfo, jsInfo] = await Promise.all([stat(map2), stat(js)]);
+    const bytes = mapInfo.size + 4096;
+    if (!mapInfo.isFile() || !jsInfo.isFile() || bytes > SOURCE_MAP_LIMITS.fileBytes || jsInfo.size > SOURCE_MAP_LIMITS.fileBytes) {
+      throw new Error("Oversized source map or JavaScript");
+    }
+    if (!batches.length || batches[batches.length - 1].length >= SOURCE_MAP_LIMITS.files || batchBytes + bytes > SOURCE_MAP_LIMITS.releaseBytes) {
+      batches.push([]);
+      batchBytes = 0;
+    }
+    batches[batches.length - 1].push(map2);
+    batchBytes += bytes;
+    totalBytes += bytes;
+  }
+  if (totalBytes > SOURCE_MAP_LIMITS.projectBytes) {
+    throw new Error("Build exceeds project source map quota");
+  }
+  const work = join3(privateRoot, "work");
+  const privateMaps = join3(privateRoot, "maps");
+  await mkdir2(work, { mode: 448 });
+  await mkdir2(privateMaps, { mode: 448 });
+  const prepared = [];
+  for (const [index, batch] of batches.entries()) {
+    signal.throwIfAborted();
+    const name = `batch-${String(index + 1).padStart(3, "0")}`;
+    const staging = join3(work, name);
+    const destination = join3(privateMaps, name);
+    await mkdir2(staging, { mode: 448 });
+    for (const map2 of batch) {
+      for (const file2 of [map2, map2.slice(0, -4)]) {
+        signal.throwIfAborted();
+        const copy = join3(staging, relative3(output2, file2));
+        await mkdir2(dirname2(copy), { recursive: true, mode: 448 });
+        await copyFile(file2, copy);
+      }
+    }
+    await prepareMaps(staging, destination, release, options.urlPrefix, {
+      ...options,
+      ...options.buildId ? { batchIndex: index, batchCount: batches.length } : {}
+    });
+    signal.throwIfAborted();
+    for (const map2 of batch) {
+      const js = map2.slice(0, -4);
+      prepared.push({ from: join3(staging, relative3(output2, js)), to: js });
+    }
+  }
+  for (const { from, to } of prepared) {
+    signal.throwIfAborted();
+    const temporary = `${to}.${randomUUID2()}.tmp`;
+    try {
+      await writeFile2(temporary, await readFile3(from, { signal }), {
+        flag: "wx",
+        signal
+      });
+      signal.throwIfAborted();
+      await rename2(temporary, to);
+    } finally {
+      await rm(temporary, { force: true });
+    }
+  }
+  for (const map2 of maps) {
+    signal.throwIfAborted();
+    if (!(await lstat3(map2)).isFile()) {
+      throw new Error("Source map changed during preparation");
+    }
+    await unlink2(map2);
+  }
+  return privateMaps;
+}
+
+// packages/cli/src/upload.ts
+import { promisify as promisify2 } from "util";
 import { setTimeout as delay2 } from "timers/promises";
 import { constants, gzip } from "zlib";
 
@@ -19242,7 +19472,13 @@ var codeSchema = external_exports.enum([
   "HTTP_ERROR",
   "CONTRACT_JSON",
   "CONTRACT_RESPONSE",
-  "COMMAND_FAILED"
+  "COMMAND_FAILED",
+  "ENVIRONMENT_FORBIDDEN",
+  "BUILD_CONFLICT",
+  "INVALID_UPLOAD",
+  "STORAGE_FULL",
+  "RATE_LIMITED",
+  "UPLOAD_UNAVAILABLE"
 ]);
 var diagnosticSchema = external_exports.object({
   version: external_exports.literal(1),
@@ -19330,6 +19566,17 @@ function authorizationHeader(credential) {
 }
 
 // packages/cli/src/api-response.ts
+var uploadFailureSchema = external_exports.object({
+  code: external_exports.enum([
+    "ENVIRONMENT_FORBIDDEN",
+    "BUILD_CONFLICT",
+    "INVALID_UPLOAD",
+    "STORAGE_FULL",
+    "RATE_LIMITED",
+    "UPLOAD_UNAVAILABLE"
+  ]),
+  requestId: external_exports.string().uuid()
+});
 async function responseJson(response) {
   const reader = response.body?.getReader();
   const chunks = [];
@@ -19379,6 +19626,14 @@ async function httpError(response) {
           result.data.requestId
         );
       }
+      const upload = uploadFailureSchema.safeParse(candidate);
+      if (upload.success) {
+        return new CliError(
+          upload.data.code,
+          response.status,
+          upload.data.requestId
+        );
+      }
     }
   } catch {
   }
@@ -19413,6 +19668,9 @@ function projectApi(address, project, token, transport = fetch, options = {}) {
   const requestTimeout = options.requestTimeoutMs ?? 3e4;
   return async function request(path, method = "GET", body, contentEncoding) {
     for (let attempt = 0; attempt < 3; attempt++) {
+      if (options.signal?.aborted) {
+        throw new CliError("NETWORK_TIMEOUT");
+      }
       if (Date.now() >= deadline) {
         throw new CliError("NETWORK_TIMEOUT");
       }
@@ -19428,14 +19686,21 @@ function projectApi(address, project, token, transport = fetch, options = {}) {
           body,
           redirect: "error",
           credentials: "omit",
-          signal: AbortSignal.timeout(
-            Math.min(requestTimeout, deadline - Date.now())
-          )
+          signal: AbortSignal.any([
+            AbortSignal.timeout(
+              Math.min(requestTimeout, deadline - Date.now())
+            ),
+            ...options.signal ? [options.signal] : []
+          ])
         });
       } catch (error61) {
         const failure = networkError(error61);
         if (retryableNetworkError(failure) && attempt < 2) {
-          await delay(1e3 * 2 ** attempt);
+          await delay(
+            Math.min(1e3 * 2 ** attempt, Math.max(1, deadline - Date.now())),
+            void 0,
+            { signal: options.signal }
+          );
           continue;
         }
         throw failure;
@@ -19445,7 +19710,11 @@ function projectApi(address, project, token, transport = fetch, options = {}) {
       }
       if ((response.status === 429 || response.status >= 500) && attempt < 2) {
         await response.body?.cancel().catch(() => void 0);
-        await delay(1e3 * 2 ** attempt);
+        await delay(
+          Math.min(1e3 * 2 ** attempt, Math.max(1, deadline - Date.now())),
+          void 0,
+          { signal: options.signal }
+        );
         continue;
       }
       throw await httpError(response);
@@ -19468,12 +19737,17 @@ var receiptSchema = external_exports.object({
 });
 var uploadConcurrency = 8;
 var uploadDeadlineMs = 20 * 6e4;
-var gzipAsync = promisify(gzip);
-async function uploadMaps(directory, address, project, token, transport = fetch) {
-  const manifest = await readPrepared(directory);
+var gzipAsync = promisify2(gzip);
+async function uploadMaps(directory, address, project, token, transport = fetch, options = {}) {
+  const prepared = await readPrepared(directory);
+  const manifest = sourceUploadSchema.parse({
+    ...prepared,
+    ...options.environment ? { environment: options.environment } : {}
+  });
   const api = projectApi(address, project, token, transport, {
-    deadlineMs: uploadDeadlineMs,
-    requestTimeoutMs: 6e4
+    deadlineMs: options.deadlineMs ?? uploadDeadlineMs,
+    requestTimeoutMs: 6e4,
+    signal: options.signal
   });
   const request = (path, method = "GET", body, contentEncoding) => api("/source-maps" + path, method, body, contentEncoding);
   const receipt = receiptSchema.parse(
@@ -19521,7 +19795,96 @@ async function uploadMaps(directory, address, project, token, transport = fetch)
     if (result.status === "failed") {
       throw new Error("Source map validation failed; rebuild the artifacts");
     }
-    await delay2(1e3);
+    await delay2(1e3, void 0, { signal: options.signal });
+  }
+}
+
+// packages/cli/src/source-map-delivery.ts
+async function prepareSourceMaps(options) {
+  releaseNameSchema.parse(options.release);
+  buildIdSchema.parse(options.buildId);
+  const directory = await realpath2(options.directory);
+  const target = resolve2(options.output);
+  const output2 = join4(
+    await realpath2(dirname3(target)),
+    target.slice(dirname3(target).length + 1)
+  );
+  const child = relative4(directory, output2);
+  if (!child || !isAbsolute2(child) && child !== ".." && !child.startsWith(`..${sep3}`)) {
+    throw new CliError("CLI_CONFIGURATION");
+  }
+  await mkdir3(output2, { mode: 448 });
+  try {
+    const maps = await prepareBuild(
+      directory,
+      output2,
+      options.release,
+      options.signal,
+      options
+    );
+    await assertPublicOutput(directory, {
+      mapsEnabled: true,
+      credentials: options.credentials
+    });
+    await rm2(join4(output2, "work"), { recursive: true });
+    return {
+      directory: maps,
+      release: options.release,
+      buildId: options.buildId
+    };
+  } catch (error61) {
+    await rm2(output2, { recursive: true, force: true });
+    throw error61;
+  }
+}
+async function uploadSourceMaps(options, transport = fetch) {
+  try {
+    options.signal?.throwIfAborted();
+    if (typeof options.token !== "string") {
+      throw new CliError("CLI_CONFIGURATION");
+    }
+    authorizationHeader(options.token);
+    const environment = environmentNameSchema.parse(options.environment);
+    const budget = options.timeoutMs ?? 30 * 6e4;
+    if (!Number.isInteger(budget) || budget < 1e3 || budget > 60 * 6e4) {
+      throw new CliError("CLI_CONFIGURATION");
+    }
+    const deadline = Date.now() + budget;
+    const entries = await readdir3(options.directory, { withFileTypes: true });
+    const batches = entries.filter((entry) => /^batch-[0-9]{3,4}$/.test(entry.name)).sort((a, b) => Number(a.name.slice(6)) - Number(b.name.slice(6)));
+    if (!batches.length || batches.length > 4096 || batches.some((entry) => !entry.isDirectory() || entry.isSymbolicLink()) || batches.length !== entries.length) {
+      throw new CliError("CLI_CONFIGURATION");
+    }
+    const manifests = await Promise.all(
+      batches.map((entry) => readPrepared(join4(options.directory, entry.name)))
+    );
+    const first = manifests[0];
+    if (!first.buildId || manifests.some(
+      (manifest, index) => manifest.buildId !== first.buildId || manifest.release !== first.release || manifest.batchCount !== batches.length || manifest.batchIndex !== index
+    )) {
+      throw new CliError("CLI_CONFIGURATION");
+    }
+    for (const batch of batches) {
+      options.signal?.throwIfAborted();
+      const remaining = deadline - Date.now();
+      if (remaining < 1) {
+        throw new CliError("NETWORK_TIMEOUT");
+      }
+      await uploadMaps(
+        join4(options.directory, batch.name),
+        options.url,
+        options.projectId,
+        options.token,
+        transport,
+        { environment, deadlineMs: remaining, signal: options.signal }
+      );
+    }
+    return { status: "ready", batches: batches.length };
+  } catch (error61) {
+    return {
+      status: "unavailable",
+      diagnostic: formatDiagnostic(error61).trim()
+    };
   }
 }
 
@@ -19556,10 +19919,16 @@ async function main() {
       dir: { type: "string" },
       output: { type: "string" },
       release: { type: "string" },
+      "build-id": { type: "string" },
+      format: { type: "string" },
+      "timeout-seconds": { type: "string" },
+      "app-version": { type: "string" },
+      "review-provider": { type: "string" },
       "url-prefix": { type: "string" },
       url: { type: "string" },
       project: { type: "string" },
       environment: { type: "string" },
+      "token-env": { type: "string" },
       "repository-id": { type: "string" },
       "merge-request": { type: "string" },
       help: { type: "boolean" }
@@ -19567,10 +19936,14 @@ async function main() {
   });
   if (values.help) {
     process.stdout.write(
-      "getexception sourcemaps prepare --dir dist --output ../private-maps --release app@<40-character-SHA> [--url-prefix assets]\ngetexception sourcemaps upload --dir ../private-maps --url https://dashboard.example --project <UUID>\ngetexception releases register --url https://dashboard.example --project <UUID> --release app@<40-character-SHA> --environment <production|staging|development> [--repository-id <GitLab project ID> --merge-request <IID>]\ngetexception ci context --url https://dashboard.example --project <UUID>\nAuthentication: GETEXCEPTION_UPLOAD_TOKEN or GETEXCEPTION_GITLAB_ID_TOKEN, never both. Prepare modifies ESM JavaScript and removes public .js.map files.\n"
+      "getexception sourcemaps prepare --dir dist --output ../private-maps --release web-app@1.2.3 --build-id build-001 [--format esm|classic] [--url-prefix assets]\ngetexception sourcemaps check --dir dist\ngetexception sourcemaps deliver --dir ../private-maps/maps --url https://monitor.example.com --project <UUID> --environment production --token-env MY_UPLOAD_KEY [--timeout-seconds 1800]\ngetexception releases register --url https://monitor.example.com --project <UUID> --release web-app@1.2.3 --environment production [--app-version 1.2.3]\nDeliver requires --token-env NAME to read the key from your chosen private environment variable. Never pass the key value as an argument. Prepare/check accept --token-env NAME to detect a leaked key in public output. Legacy upload/register/ci commands retain their existing credentials when no explicit variable is selected. Prepare modifies browser JavaScript and removes public .js.map files. Deliver reports monitoring failures without failing deployment; prepare/check errors must be handled before publishing. Legacy commands: sourcemaps upload, ci context.\n"
     );
     return;
   }
+  if (values["token-env"] && !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(values["token-env"])) {
+    throw new CliError("CLI_CONFIGURATION");
+  }
+  const uploadToken = values["token-env"] ? process.env[values["token-env"]] : void 0;
   if (positionals.length === 2 && positionals[0] === "ci" && positionals[1] === "context" && values.url && values.project) {
     process.stdout.write(
       JSON.stringify(
@@ -19581,26 +19954,65 @@ async function main() {
   }
   if (positionals.length === 2 && positionals[0] === "releases" && positionals[1] === "register" && values.url && values.project) {
     const hasReview = values["repository-id"] !== void 0 || values["merge-request"] !== void 0;
-    await registerRelease(values.url, values.project, ciCredential(), {
-      release: values.release,
-      deployment: {
-        environment: values.environment,
-        ...hasReview ? {
-          review: {
-            provider: "gitlab",
-            repositoryId: Number(values["repository-id"]),
-            number: Number(values["merge-request"])
-          }
-        } : {}
+    await registerRelease(
+      values.url,
+      values.project,
+      values["token-env"] ? uploadToken ?? "" : ciCredential(),
+      {
+        release: values.release,
+        appVersion: values["app-version"],
+        deployment: {
+          environment: values.environment,
+          ...hasReview ? {
+            review: {
+              provider: values["review-provider"] ?? "gitlab",
+              repositoryId: /^\d+$/.test(values["repository-id"] ?? "") ? Number(values["repository-id"]) : values["repository-id"],
+              number: Number(values["merge-request"])
+            }
+          } : {}
+        }
       }
-    });
+    );
     process.stdout.write("Release environment registered.\n");
     return;
   }
   if (positionals.length !== 2 || positionals[0] !== "sourcemaps" || !values.dir) {
     throw new Error("Invalid command");
   }
-  if (positionals[1] === "prepare" && values.output && values.release) {
+  if (positionals[1] === "check") {
+    await assertPublicOutput(values.dir, {
+      mapsEnabled: true,
+      credentials: [uploadToken ?? ""]
+    });
+    process.stdout.write("Public output verified.\n");
+  } else if (positionals[1] === "deliver" && values.url && values.project && values.environment) {
+    const result = await uploadSourceMaps({
+      directory: values.dir,
+      url: values.url,
+      projectId: values.project,
+      token: uploadToken,
+      environment: values.environment,
+      timeoutMs: values["timeout-seconds"] ? Number(values["timeout-seconds"]) * 1e3 : void 0
+    });
+    process.stdout.write(
+      result.status === "ready" ? "[getexception] Source maps ready.\n" : `[getexception] ${values.environment === "production" ? "WARNING: " : ""}Source maps unavailable; deployment may continue. ${result.diagnostic}
+`
+    );
+  } else if (positionals[1] === "prepare" && values.output && values.release && values["build-id"]) {
+    if (values.format && !["esm", "classic"].includes(values.format)) {
+      throw new Error("Invalid format");
+    }
+    await prepareSourceMaps({
+      directory: values.dir,
+      output: values.output,
+      release: values.release,
+      buildId: values["build-id"],
+      urlPrefix: values["url-prefix"],
+      format: values.format,
+      credentials: [uploadToken ?? ""]
+    });
+    process.stdout.write("Prepared private source maps.\n");
+  } else if (positionals[1] === "prepare" && values.output && values.release) {
     const result = await prepareMaps(
       values.dir,
       values.output,
@@ -19612,7 +20024,14 @@ async function main() {
 `
     );
   } else if (positionals[1] === "upload" && values.url && values.project) {
-    await uploadMaps(values.dir, values.url, values.project, ciCredential());
+    await uploadMaps(
+      values.dir,
+      values.url,
+      values.project,
+      values["token-env"] ? uploadToken ?? "" : ciCredential(),
+      void 0,
+      { environment: values.environment }
+    );
     process.stdout.write("Source maps validated and ready.\n");
   } else {
     throw new Error("Invalid command");