@getmonitor/cli 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,84 @@
+# @getmonitor/cli
+
+Framework-agnostic source map upload tool for GetMonitor error tracking. Used directly, or via
+`@getmonitor/nextjs-config` / `@getmonitor/nuxt`, which call its programmatic API automatically
+as part of a customer's build.
+
+## What it does
+
+For every `*.js` file with a resolvable source map under a directory, `processSourceMaps`:
+
+1. Generates a debug ID and injects it into both the JS file and its source map.
+2. Uploads the tagged source map to `{apiHost}/api/v1/sourcemaps`.
+3. On a successful upload: deletes the `.map` file and strips the `//# sourceMappingURL=`
+   comment from the JS file, so nothing readable ships publicly.
+4. On a failed upload: leaves both files untouched, so the artifact can be retried.
+
+A source map is resolved primarily via the JS file's `//# sourceMappingURL=` comment, falling
+back to same-basename-plus-`.map` when there's no comment, it's a `data:` URI, or the referenced
+file doesn't exist — this matters because bundlers don't always name maps predictably (content
+hashes, CDN rewrites).
+
+See the [Phase 2 design spec](../../docs/superpowers/specs/2026-08-09-phase-2-source-maps-design.md)
+for the full architecture and upload contract.
+
+## CLI usage
+
+```bash
+npm install --save-dev @getmonitor/cli
+```
+
+```bash
+getmonitor sourcemaps upload ./dist \
+  --api-host https://ingest.getmonitor.com \
+  --release 1.4.2 \
+  --auth-token $GETMONITOR_AUTH_TOKEN
+```
+
+`--release` and `--auth-token` are optional if `GETMONITOR_RELEASE` / `GETMONITOR_AUTH_TOKEN`
+are set, or (for release) if the directory is inside a git working tree or has a reachable
+`package.json` with a `version` field. Release resolution precedence: `--release` flag >
+`GETMONITOR_RELEASE` env var > current git commit SHA > nearest `package.json`'s `version` field.
+
+The auth token is a **secret credential**, separate from the public `gm_xxx` key the SDKs use —
+never commit it or expose it client-side.
+
+## Programmatic usage
+
+```ts
+import { processSourceMaps } from '@getmonitor/cli'
+
+const result = await processSourceMaps({
+  directory: './dist',
+  apiHost: 'https://ingest.getmonitor.com',
+  authToken: process.env.GETMONITOR_AUTH_TOKEN,
+})
+
+console.log(result.uploaded, result.failed)
+```
+
+This is what `@getmonitor/nextjs-config` and `@getmonitor/nuxt` call from their bundler's
+build-finished hook — see those packages for the build-tool-integrated version of this flow.
+
+## API reference
+
+| Export | Signature |
+| --- | --- |
+| `processSourceMaps(options)` | `(ProcessSourceMapsOptions) => Promise<ProcessSourceMapsResult>` |
+
+`ProcessSourceMapsOptions` = `{ directory: string; apiHost: string; release?: string; authToken?: string; fetchImpl?: typeof fetch }`
+(`fetchImpl` is a test/dependency-injection hook — most consumers won't need it).
+`ProcessSourceMapsResult` = `{ uploaded: string[]; failed: string[] }` — full on-disk paths of
+each processed artifact, split by outcome.
+
+## Development
+
+```bash
+pnpm --filter @getmonitor/cli build     # rollup -> dist/ (library ESM+CJS+.d.ts, plus dist/bin.js)
+pnpm --filter @getmonitor/cli test      # vitest run (excludes e2e/)
+pnpm --filter @getmonitor/cli test:e2e  # vitest run e2e/processSourceMaps.spec.ts — real esbuild output + real HTTP server
+pnpm --filter @getmonitor/cli lint      # tsc --noEmit (src/) + tsc --noEmit -p e2e
+```
+
+The `e2e/` suite builds a real fixture through `esbuild`, runs `processSourceMaps` against the
+real output, and asserts against a real (in-process) mock ingestion server — no mocked `fetch`.

package/dist/bin.d.ts

@@ -0,0 +1,9 @@
+interface ParsedArgs {
+    directory: string;
+    apiHost: string;
+    release?: string;
+    authToken?: string;
+}
+/** Exported (not just used internally) so it's unit-testable without spawning a process. */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export {};

package/dist/bin.js

@@ -0,0 +1,321 @@
+#!/usr/bin/env node
+import { randomUUID } from 'node:crypto';
+import { readdirSync, existsSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { join, dirname, relative } from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+// packages/cli/src/discoverArtifacts.ts
+const SOURCE_MAPPING_URL = /^\s*\/\/#\s*sourceMappingURL=(\S+)\s*$/gm;
+// Node recognizes three JS module extensions with runtime meaning (`.js`, `.mjs` for explicit
+// ESM, `.cjs` for explicit CommonJS regardless of the nearest package.json's "type") — all three
+// show up as real build output. Nitro's node-server preset (used by `@getmonitor/nuxt`'s e2e
+// test), for one, emits `.output/server/**/*.mjs` unconditionally: verified against a real
+// `nuxt build`, where a `.js`-only match left every server chunk's `.map` file undiscovered and
+// unstripped even though `.output/` itself was already fully written by the time discovery ran.
+const JS_EXTENSIONS = ['.js', '.mjs', '.cjs'];
+/** Recursively finds every JS file (`.js`, `.mjs`, `.cjs`) under `directory` and resolves its
+ * source map path primarily via its `//# sourceMappingURL=` comment (resolved relative to the
+ * JS file's own directory), falling back to same-basename-plus-`.map` when there's no comment,
+ * the comment references a data: URI, or the referenced file doesn't exist. A JS file with no
+ * resolvable map either way is skipped. */
+function discoverArtifacts(directory) {
+    const artifacts = [];
+    walk(directory, artifacts);
+    return artifacts;
+}
+function walk(dir, artifacts) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(fullPath, artifacts);
+        }
+        else if (entry.isFile() && JS_EXTENSIONS.some((ext) => entry.name.endsWith(ext))) {
+            const mapPath = resolveMapPath(fullPath);
+            if (mapPath)
+                artifacts.push({ jsPath: fullPath, mapPath });
+        }
+    }
+}
+function resolveMapPath(jsPath) {
+    const commentMapPath = readSourceMappingUrlComment(jsPath);
+    if (commentMapPath && existsSync(commentMapPath))
+        return commentMapPath;
+    const fallbackMapPath = `${jsPath}.map`;
+    if (existsSync(fallbackMapPath))
+        return fallbackMapPath;
+    return undefined;
+}
+function readSourceMappingUrlComment(jsPath) {
+    let content;
+    try {
+        content = readFileSync(jsPath, 'utf8');
+    }
+    catch {
+        // Unreadable file (permission denied, broken symlink, deleted mid-walk, etc.) — treat it
+        // like "no comment found" rather than aborting the whole discoverArtifacts() walk.
+        return undefined;
+    }
+    const matches = [...content.matchAll(SOURCE_MAPPING_URL)];
+    if (matches.length === 0)
+        return undefined;
+    // The LAST sourceMappingURL comment in the file wins, matching how bundlers/browsers treat
+    // concatenated/reprocessed output — later comments supersede earlier ones.
+    const reference = matches.at(-1)[1];
+    if (reference.startsWith('data:'))
+        return undefined; // embedded map, nothing to discover on disk
+    return join(dirname(jsPath), reference);
+}
+
+// packages/cli/src/injectDebugId.ts
+/** Computes the debug-ID-injected JS content and the debug-ID-tagged source map JSON, in
+ * memory — callers decide whether/when to persist the result to disk (processSourceMaps
+ * only writes it after a successful upload, so a failed upload never leaves partially
+ * mutated files behind). The injected JS also has its `//# sourceMappingURL=` comment(s)
+ * removed, since the source map it names is only ever kept in GetMonitor's backend after
+ * a successful upload — never served publicly alongside it.
+ *
+ * `originalMapJson` must be valid JSON — this is a pure function with no fallback to
+ * degrade to (unlike discoverArtifacts, which can skip an unreadable file, this function's
+ * caller expects a definite result), so a malformed map is left to throw via JSON.parse
+ * rather than being swallowed here. */
+function injectDebugId(originalJs, originalMapJson, debugId) {
+    const withoutMapComment = originalJs
+        .split('\n')
+        .filter((line) => !line.trimStart().startsWith('//# sourceMappingURL='))
+        .join('\n');
+    const map = JSON.parse(originalMapJson);
+    map.debugId = debugId;
+    return {
+        js: `${withoutMapComment}\n${buildInjectedSnippet(debugId)}`,
+        map: JSON.stringify(map),
+    };
+}
+/** At load time, captures this statement's own `Error().stack`, extracts this file's
+ * identity from it using the same frame-shape @getmonitor/core's parseStackTrace parses for
+ * real errors (V8's `at ... (file:line:col)`, V8's bare `at file:line:col`, and Gecko's
+ * `fn@file:line:col`), and registers the debug ID under that identity. Like parseStackTrace,
+ * it scans every stack line and takes the first one that matches any of those shapes, rather
+ * than assuming a fixed line index — V8 prefixes an `"ErrorType: message"` header line that
+ * Gecko and Safari don't emit, so a fixed index would grab the wrong frame (or the wrong
+ * file's identity) on non-V8 engines; the header line simply fails to match any frame regex
+ * and is skipped automatically. A later real error whose frame.filename is parsed from the
+ * same JS-engine stack serialization will look up the same key. Wrapped in try/catch so any
+ * parsing edge case can never break the host app; wrapped in an IIFE so its locals don't leak
+ * into the file's module scope.
+ *
+ * `debugId` is interpolated unescaped into the generated snippet's string literal. That's
+ * safe today because every caller in this system sources `debugId` from
+ * `crypto.randomUUID()` (a later task), which can never contain a quote or backslash — but
+ * this function itself doesn't enforce that shape, so a caller passing an arbitrary string
+ * containing `'` or `\` would produce invalid/injected JS here. Flagged, not fixed, since
+ * validating/escaping isn't part of this function's specified contract. */
+function buildInjectedSnippet(debugId) {
+    return (";(function(){try{var s=(new Error()).stack||'';var ls=s.split('\\n');var m=null;" +
+        'for(var i=0;i<ls.length&&!m;i++){var l=ls[i];' +
+        "m=l.match(/\\((.*):(\\d+):(\\d+)\\)\\s*$/)||l.match(/at (.*):(\\d+):(\\d+)\\s*$/)||l.match(/@(.*):(\\d+):(\\d+)\\s*$/)}" +
+        "var f=m&&m[1];if(f){var g=(typeof globalThis!=='undefined'?globalThis:self);" +
+        `g.__getmonitorDebugIds=g.__getmonitorDebugIds||{};g.__getmonitorDebugIds[f]='${debugId}';` +
+        '}}catch(e){}})();');
+}
+
+// packages/cli/src/resolveRelease.ts
+/** Resolves the release identifier to tag uploaded source maps with. Precedence: explicit
+ * argument -> GETMONITOR_RELEASE env var -> current git commit SHA (if `directory` is inside
+ * a git working tree) -> `version` field of the nearest package.json walking up from
+ * `directory`. Matches the SDKs' own optional `release` field so events and source maps
+ * for the same deploy carry the same value. */
+function resolveRelease(directory, explicit) {
+    if (explicit)
+        return explicit;
+    if (process.env.GETMONITOR_RELEASE)
+        return process.env.GETMONITOR_RELEASE;
+    const gitSha = tryGitSha(directory);
+    if (gitSha)
+        return gitSha;
+    const packageVersion = tryPackageVersion(directory);
+    if (packageVersion)
+        return packageVersion;
+    throw new Error('Could not resolve a release. Pass --release, set GETMONITOR_RELEASE, run inside a git repository, or add a package.json with a "version" field.');
+}
+function tryGitSha(directory) {
+    try {
+        return execFileSync('git', ['rev-parse', 'HEAD'], {
+            cwd: directory,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function tryPackageVersion(directory) {
+    let dir = directory;
+    for (let i = 0; i < 20; i++) {
+        const pkgPath = join(dir, 'package.json');
+        if (existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+                return typeof pkg.version === 'string' ? pkg.version : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+    return undefined;
+}
+
+// packages/cli/src/uploadSourceMap.ts
+/** POSTs a single source map artifact to the (not-yet-implemented) backend contract
+ * documented in docs/superpowers/specs/2026-08-09-phase-2-source-maps-design.md. Throws on
+ * any non-2xx response or network failure — the caller (processSourceMaps) decides what
+ * "failed" means for its own result reporting and disk-write ordering. */
+async function uploadSourceMap(params) {
+    // Must bind to globalThis, mirroring @getmonitor/core's HttpTransport: browsers' native
+    // fetch() throws "Illegal invocation" if called with a `this` other than
+    // Window/WorkerGlobalScope. Here fetchImpl is invoked as a plain function call below
+    // (`fetchImpl(url, init)`, never `params.fetchImpl(...)` or `this.fetchImpl(...)`), so this
+    // bind is defensive/consistent rather than load-bearing for this particular call site — but
+    // keeping the same default expression as HttpTransport avoids a divergent default if this
+    // code is ever refactored into a method.
+    const fetchImpl = params.fetchImpl ?? fetch.bind(globalThis);
+    const form = new FormData();
+    form.set('release', params.release);
+    form.set('debugId', params.debugId);
+    form.set('filename', params.filename);
+    form.set('sourcemap', new Blob([params.mapContent], { type: 'application/json' }), `${params.filename}.map`);
+    const response = await fetchImpl(`${params.apiHost}/api/v1/sourcemaps`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${params.authToken}` },
+        body: form,
+    });
+    if (!response.ok) {
+        throw new Error(`Source map upload failed for ${params.filename}: ${response.status} ${response.statusText}`);
+    }
+}
+
+// packages/cli/src/processSourceMaps.ts
+/** Finds every JS/map artifact pair under `options.directory`, and for each one: injects a
+ * debug ID, uploads the tagged source map, and — only on a successful upload — writes the
+ * debug-ID-injected JS back to disk and deletes the `.map` file. An artifact whose upload
+ * fails is left completely untouched on disk, so it can be retried by re-running this
+ * function against the same directory. */
+async function processSourceMaps(options) {
+    const authToken = options.authToken ?? process.env.GETMONITOR_AUTH_TOKEN;
+    if (!authToken) {
+        throw new Error('Missing auth token. Pass --auth-token or set GETMONITOR_AUTH_TOKEN.');
+    }
+    const release = resolveRelease(options.directory, options.release);
+    const artifacts = discoverArtifacts(options.directory);
+    const result = { uploaded: [], failed: [] };
+    for (const artifact of artifacts) {
+        const debugId = randomUUID();
+        let injected;
+        try {
+            const originalJs = readFileSync(artifact.jsPath, 'utf8');
+            const originalMap = readFileSync(artifact.mapPath, 'utf8');
+            // injectDebugId is a pure function that throws on malformed map JSON (by design — see
+            // its own doc comment). That's deliberately caught here, alongside upload failures: one
+            // corrupt/unreadable artifact on disk must not abort processing of every other artifact
+            // in the directory, the same failure-isolation principle discoverArtifacts applies to
+            // unreadable files during its walk. Nothing has been uploaded or written yet at this
+            // point, so a thrown injectDebugId or upload failure leaves the artifact's files
+            // completely untouched, and it's safe to report it as `failed` for a retry.
+            injected = injectDebugId(originalJs, originalMap, debugId);
+            await uploadSourceMap({
+                apiHost: options.apiHost,
+                authToken,
+                release,
+                debugId,
+                // Relative to options.directory, not the absolute on-disk path — the backend has no
+                // use for (and shouldn't see) the build machine's local filesystem layout.
+                filename: relative(options.directory, artifact.jsPath),
+                mapContent: injected.map,
+                fetchImpl: options.fetchImpl,
+            });
+        }
+        catch {
+            result.failed.push(artifact.jsPath);
+            continue;
+        }
+        try {
+            writeFileSync(artifact.jsPath, injected.js);
+            rmSync(artifact.mapPath);
+            result.uploaded.push(artifact.jsPath);
+        }
+        catch (cleanupError) {
+            // The upload above already succeeded, so this must never land in `failed` — a caller
+            // retrying failed artifacts would mint a fresh debugId and re-upload, orphaning this
+            // upload server-side under the old one with no way to reconcile the two. The local
+            // cleanup failure (disk full, permission error, file lock) is real and worth knowing
+            // about, so it's surfaced here rather than silently swallowed, but it doesn't change
+            // the artifact's outcome.
+            result.uploaded.push(artifact.jsPath);
+            console.error(`Uploaded ${artifact.jsPath} but failed to update local files:`, cleanupError);
+        }
+    }
+    return result;
+}
+
+// packages/cli/src/bin.ts
+/** Exported (not just used internally) so it's unit-testable without spawning a process. */
+function parseArgs(argv) {
+    const [command, subcommand, directory, ...rest] = argv;
+    if (command !== 'sourcemaps' || subcommand !== 'upload' || !directory) {
+        throw new Error('Usage: getmonitor sourcemaps upload <directory> --api-host <url> [--release <release>] [--auth-token <token>]');
+    }
+    let release;
+    let authToken;
+    let apiHost;
+    for (let i = 0; i < rest.length; i += 2) {
+        const flag = rest[i];
+        const value = rest[i + 1];
+        if (flag === '--release')
+            release = value;
+        else if (flag === '--auth-token')
+            authToken = value;
+        else if (flag === '--api-host')
+            apiHost = value;
+        else
+            throw new Error(`Unknown flag: ${flag}`);
+    }
+    if (!apiHost) {
+        throw new Error('Usage: getmonitor sourcemaps upload <directory> --api-host <url> [...]');
+    }
+    return { directory, apiHost, release, authToken };
+}
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    const result = await processSourceMaps({
+        directory: args.directory,
+        release: args.release,
+        authToken: args.authToken,
+        apiHost: args.apiHost,
+    });
+    console.log(`Uploaded ${result.uploaded.length} source map(s).`);
+    if (result.failed.length > 0) {
+        console.error(`Failed to upload ${result.failed.length} source map(s):`);
+        for (const file of result.failed)
+            console.error(`  ${file}`);
+        process.exitCode = 1;
+    }
+}
+// Skipped under Vitest (which imports this module to test parseArgs) — only run when
+// invoked directly as the built dist/bin.js executable. Confirmed empirically that Vitest
+// sets process.env.VITEST = 'true' in the process that loads this module, so this check
+// reliably prevents main() (which does real I/O and can set process.exitCode) from running
+// during `pnpm test`.
+if (process.env.VITEST === undefined) {
+    main().catch((error) => {
+        console.error(error instanceof Error ? error.message : error);
+        process.exitCode = 1;
+    });
+}
+
+export { parseArgs };
+//# sourceMappingURL=bin.js.map