@koderlabs/tasks-sdk-nextjs 0.1.0

package/dist/index.cjs

@@ -0,0 +1,214 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  InstantTasksSourceMapsPlugin: () => InstantTasksSourceMapsPlugin,
+  withInstantTasks: () => withInstantTasks
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/sourcemaps-upload.ts
+var fs = __toESM(require("fs"), 1);
+var path = __toESM(require("path"), 1);
+var DEFAULT_MAX_BYTES = 50 * 1024 * 1024;
+var MAX_RETRIES = 2;
+var RETRY_BASE_MS = 1e3;
+var InstantTasksSourceMapsPlugin = class {
+  constructor(opts) {
+    this.opts = {
+      distDir: ".next",
+      maxFileBytes: DEFAULT_MAX_BYTES,
+      strict: opts.strict ?? process.env.CI === "true",
+      ...opts
+    };
+  }
+  apply(compiler) {
+    const isProduction = compiler.options?.mode === "production";
+    const isClientCompiler = !compiler.name || compiler.name === "client" || compiler.name === "browser";
+    if (!isProduction || !isClientCompiler) return;
+    compiler.hooks.afterEmit.tapAsync(
+      "InstantTasksSourceMapsPlugin",
+      async (compilation, callback) => {
+        try {
+          const failed = await this._uploadMaps(compilation.outputPath ?? this.opts.distDir);
+          if (failed.length > 0 && this.opts.strict) {
+            const summary = failed.map((f) => `  ${f.file}: ${f.status ? `HTTP ${f.status}` : f.error ?? "unknown"}`).join("\n");
+            callback(new Error(`[InstantTasks] ${failed.length} source-map upload(s) failed:
+${summary}`));
+            return;
+          }
+        } catch (err) {
+          if (this.opts.strict) {
+            callback(err);
+            return;
+          }
+          console.warn("[InstantTasks] source-map upload failed:", err);
+        }
+        callback();
+      }
+    );
+  }
+  async _uploadMaps(outputPath) {
+    const resolvedRoot = path.resolve(outputPath);
+    const mapFiles = this._findMapFiles(resolvedRoot);
+    if (mapFiles.length === 0) {
+      console.log("[InstantTasks] No .map files found to upload in", resolvedRoot);
+      return [];
+    }
+    console.log(`[InstantTasks] Uploading ${mapFiles.length} source map(s)\u2026`);
+    const uploadUrl = `${this.opts.endpoint}/api/v1/sdk/source-maps`;
+    const results = await Promise.all(mapFiles.map((f) => this._uploadOne(uploadUrl, resolvedRoot, f)));
+    const failed = results.filter((r) => !r.ok);
+    const ok = results.length - failed.length;
+    console.log(`[InstantTasks] Source map upload complete \u2014 ${ok} ok, ${failed.length} failed.`);
+    return failed;
+  }
+  async _uploadOne(uploadUrl, root, filePath) {
+    const resolved = path.resolve(filePath);
+    if (!resolved.startsWith(root + path.sep) && resolved !== root) {
+      return { file: filePath, ok: false, error: "path escapes dist root" };
+    }
+    const relativePath = path.relative(root, resolved);
+    if (!relativePath || relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+      return { file: filePath, ok: false, error: "invalid relative path" };
+    }
+    let stat;
+    try {
+      stat = await fs.promises.stat(resolved);
+    } catch (e) {
+      return { file: relativePath, ok: false, error: e.message };
+    }
+    if (stat.size > this.opts.maxFileBytes) {
+      console.warn(`[InstantTasks] Skipping ${relativePath} \u2014 ${stat.size} bytes exceeds cap ${this.opts.maxFileBytes}`);
+      return { file: relativePath, ok: false, error: `file too large (${stat.size} bytes)` };
+    }
+    let content;
+    try {
+      content = await fs.promises.readFile(resolved, "utf-8");
+    } catch (e) {
+      return { file: relativePath, ok: false, error: e.message };
+    }
+    let lastErr;
+    let lastStatus;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        const res = await fetch(uploadUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${this.opts.secretKey}`
+          },
+          body: JSON.stringify({ path: relativePath, content })
+        });
+        if (res.ok) return { file: relativePath, ok: true, status: res.status };
+        lastStatus = res.status;
+        if (res.status < 500 || res.status >= 600) break;
+      } catch (e) {
+        lastErr = e.message;
+      }
+      if (attempt < MAX_RETRIES) {
+        await new Promise((r) => setTimeout(r, RETRY_BASE_MS * Math.pow(2, attempt)));
+      }
+    }
+    console.warn(`[InstantTasks] Failed to upload ${relativePath}: ${lastStatus ? `HTTP ${lastStatus}` : lastErr ?? "unknown"}`);
+    return { file: relativePath, ok: false, status: lastStatus, error: lastErr };
+  }
+  _findMapFiles(dir) {
+    if (!fs.existsSync(dir)) return [];
+    const results = [];
+    const root = path.resolve(dir);
+    const walk = (current) => {
+      for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+        const full = path.join(current, entry.name);
+        if (entry.isSymbolicLink()) continue;
+        if (entry.isDirectory()) {
+          walk(full);
+        } else if (entry.isFile() && entry.name.endsWith(".map")) {
+          const resolved = path.resolve(full);
+          if (resolved.startsWith(root + path.sep) || resolved === root) results.push(full);
+        }
+      }
+    };
+    walk(root);
+    return results;
+  }
+};
+
+// src/plugin.ts
+function withInstantTasks(opts = {}) {
+  return function applyInstantTasks(nextConfig) {
+    if (typeof nextConfig === "function") {
+      return async (phase, args) => {
+        const resolved = await nextConfig(phase, args);
+        return applyConfig(resolved, opts);
+      };
+    }
+    return applyConfig(nextConfig, opts);
+  };
+}
+function applyConfig(config, opts) {
+  for (const key of Object.keys(process.env)) {
+    if (/^NEXT_PUBLIC_.*INSTANTTASKS.*SECRET/i.test(key)) {
+      throw new Error(
+        `[InstantTasks] ${key} is exposed via NEXT_PUBLIC_* and will leak into the client bundle. Move the value to a non-NEXT_PUBLIC env (e.g. .env.local or CI secret) and read via INSTANTTASKS_SECRET_KEY.`
+      );
+    }
+  }
+  const secretKey = opts.secretKey ?? process.env["INSTANTTASKS_SECRET_KEY"] ?? "";
+  const endpoint = opts.endpoint ?? "https://tasks.koderlabs.net";
+  const distDir = opts.distDir ?? config.distDir ?? ".next";
+  const merged = {
+    ...config,
+    // Always emit browser source maps in production — required for meaningful
+    // stack traces in the Issues dashboard.
+    productionBrowserSourceMaps: true
+  };
+  const previousWebpack = config.webpack;
+  merged.webpack = (webpackConfig, context) => {
+    let finalConfig = previousWebpack ? previousWebpack(webpackConfig, context) : webpackConfig;
+    const { isServer, dev } = context;
+    const shouldUpload = !dev && !isServer && !opts.disableSourceMapUpload && Boolean(secretKey);
+    if (shouldUpload) {
+      finalConfig.plugins = [
+        ...finalConfig.plugins ?? [],
+        new InstantTasksSourceMapsPlugin({ endpoint, secretKey, distDir })
+      ];
+    }
+    return finalConfig;
+  };
+  return merged;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  InstantTasksSourceMapsPlugin,
+  withInstantTasks
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/sourcemaps-upload.ts","../src/plugin.ts"],"sourcesContent":["// Main entry — re-exports the plugin for next.config.js usage.\n// For client-component hooks, import from '@koderlabs/tasks-sdk-nextjs/client'.\n// For server-side usage, import from '@koderlabs/tasks-sdk-nextjs/server'.\n\nexport { withInstantTasks } from './plugin';\nexport type { WithInstantTasksOptions } from './plugin';\n\nexport { InstantTasksSourceMapsPlugin } from './sourcemaps-upload';\nexport type { SourceMapsUploadOptions } from './sourcemaps-upload';\n","import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * Options for the source-maps upload webpack plugin.\n */\nexport interface SourceMapsUploadOptions {\n  /** InstantTasks API base URL (e.g. \"https://tasks.koderlabs.net\") */\n  endpoint: string;\n  /** Project access key with upload permissions */\n  secretKey: string;\n  /** Directory to scan for .map files (defaults to \".next\") */\n  distDir?: string;\n  /**\n   * When true (or `process.env.CI === 'true'`), exit the build with a non-zero\n   * code if ANY map fails to upload. Default: opt-in via env so existing\n   * pipelines don't break on rollout — set explicitly once stable.\n   */\n  strict?: boolean;\n  /**\n   * Skip files larger than this (bytes). Default 50MB — beyond which the upload\n   * is almost certainly going to OOM or time out anyway.\n   */\n  maxFileBytes?: number;\n}\n\nconst DEFAULT_MAX_BYTES = 50 * 1024 * 1024;\nconst MAX_RETRIES = 2;\nconst RETRY_BASE_MS = 1_000;\n\ninterface UploadOutcome { file: string; ok: boolean; status?: number; error?: string }\n\n/**\n * Webpack plugin that uploads source maps to the InstantTasks SDK endpoint\n * after a **production** build completes.\n *\n * Failure handling: when `strict` is true (or `CI=true`), any failed upload\n * fails the build. Otherwise failures are warned but the build continues\n * — same as before, but with a much louder report (per-file + summary).\n *\n * Path safety: the relative path stored alongside the map is validated to\n * never contain `..` or be absolute — defends against a misconfigured\n * `outputPath` accidentally letting the plugin walk symlinked files outside\n * the dist directory and store them under attacker-influenced keys.\n */\nexport class InstantTasksSourceMapsPlugin {\n  private readonly opts: Required<Omit<SourceMapsUploadOptions, 'strict'>> & { strict: boolean };\n\n  constructor(opts: SourceMapsUploadOptions) {\n    this.opts = {\n      distDir: '.next',\n      maxFileBytes: DEFAULT_MAX_BYTES,\n      strict: opts.strict ?? process.env.CI === 'true',\n      ...opts,\n    };\n  }\n\n  apply(compiler: any) {\n    // Skip in any environment other than a production client build.\n    const isProduction = compiler.options?.mode === 'production';\n    const isClientCompiler =\n      !compiler.name || compiler.name === 'client' || compiler.name === 'browser';\n\n    if (!isProduction || !isClientCompiler) return;\n\n    compiler.hooks.afterEmit.tapAsync(\n      'InstantTasksSourceMapsPlugin',\n      async (compilation: any, callback: (err?: Error) => void) => {\n        try {\n          const failed = await this._uploadMaps(compilation.outputPath ?? this.opts.distDir);\n          if (failed.length > 0 && this.opts.strict) {\n            const summary = failed\n              .map((f) => `  ${f.file}: ${f.status ? `HTTP ${f.status}` : f.error ?? 'unknown'}`)\n              .join('\\n');\n            callback(new Error(`[InstantTasks] ${failed.length} source-map upload(s) failed:\\n${summary}`));\n            return;\n          }\n        } catch (err) {\n          if (this.opts.strict) {\n            callback(err as Error);\n            return;\n          }\n          console.warn('[InstantTasks] source-map upload failed:', err);\n        }\n        callback();\n      },\n    );\n  }\n\n  private async _uploadMaps(outputPath: string): Promise<UploadOutcome[]> {\n    const resolvedRoot = path.resolve(outputPath);\n    const mapFiles = this._findMapFiles(resolvedRoot);\n    if (mapFiles.length === 0) {\n      console.log('[InstantTasks] No .map files found to upload in', resolvedRoot);\n      return [];\n    }\n\n    console.log(`[InstantTasks] Uploading ${mapFiles.length} source map(s)…`);\n\n    const uploadUrl = `${this.opts.endpoint}/api/v1/sdk/source-maps`;\n    const results = await Promise.all(mapFiles.map((f) => this._uploadOne(uploadUrl, resolvedRoot, f)));\n    const failed = results.filter((r) => !r.ok);\n    const ok = results.length - failed.length;\n    console.log(`[InstantTasks] Source map upload complete — ${ok} ok, ${failed.length} failed.`);\n    return failed;\n  }\n\n  private async _uploadOne(uploadUrl: string, root: string, filePath: string): Promise<UploadOutcome> {\n    // Path traversal defense — the on-disk file path must resolve inside the\n    // dist root, and the stored relative key must not climb above it.\n    const resolved = path.resolve(filePath);\n    if (!resolved.startsWith(root + path.sep) && resolved !== root) {\n      return { file: filePath, ok: false, error: 'path escapes dist root' };\n    }\n    const relativePath = path.relative(root, resolved);\n    if (!relativePath || relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n      return { file: filePath, ok: false, error: 'invalid relative path' };\n    }\n\n    let stat: fs.Stats;\n    try {\n      stat = await fs.promises.stat(resolved);\n    } catch (e) {\n      return { file: relativePath, ok: false, error: (e as Error).message };\n    }\n    if (stat.size > this.opts.maxFileBytes) {\n      console.warn(`[InstantTasks] Skipping ${relativePath} — ${stat.size} bytes exceeds cap ${this.opts.maxFileBytes}`);\n      return { file: relativePath, ok: false, error: `file too large (${stat.size} bytes)` };\n    }\n\n    let content: string;\n    try {\n      content = await fs.promises.readFile(resolved, 'utf-8');\n    } catch (e) {\n      return { file: relativePath, ok: false, error: (e as Error).message };\n    }\n\n    let lastErr: string | undefined;\n    let lastStatus: number | undefined;\n    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {\n      try {\n        const res = await fetch(uploadUrl, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            Authorization: `Bearer ${this.opts.secretKey}`,\n          },\n          body: JSON.stringify({ path: relativePath, content }),\n        });\n        if (res.ok) return { file: relativePath, ok: true, status: res.status };\n        lastStatus = res.status;\n        // Retry only transient 5xx; 4xx is configuration — fail fast.\n        if (res.status < 500 || res.status >= 600) break;\n      } catch (e) {\n        lastErr = (e as Error).message;\n      }\n      if (attempt < MAX_RETRIES) {\n        await new Promise((r) => setTimeout(r, RETRY_BASE_MS * Math.pow(2, attempt)));\n      }\n    }\n    console.warn(`[InstantTasks] Failed to upload ${relativePath}: ${lastStatus ? `HTTP ${lastStatus}` : lastErr ?? 'unknown'}`);\n    return { file: relativePath, ok: false, status: lastStatus, error: lastErr };\n  }\n\n  private _findMapFiles(dir: string): string[] {\n    if (!fs.existsSync(dir)) return [];\n    const results: string[] = [];\n    const root = path.resolve(dir);\n    const walk = (current: string) => {\n      for (const entry of fs.readdirSync(current, { withFileTypes: true })) {\n        const full = path.join(current, entry.name);\n        // Refuse to follow symlinks — they could point outside dist root.\n        if (entry.isSymbolicLink()) continue;\n        if (entry.isDirectory()) {\n          walk(full);\n        } else if (entry.isFile() && entry.name.endsWith('.map')) {\n          const resolved = path.resolve(full);\n          if (resolved.startsWith(root + path.sep) || resolved === root) results.push(full);\n        }\n      }\n    };\n    walk(root);\n    return results;\n  }\n}\n","import { InstantTasksSourceMapsPlugin } from './sourcemaps-upload';\nimport type { InitOptions } from '@koderlabs/tasks-sdk';\n\nexport interface WithInstantTasksOptions {\n  /** Matches InitOptions.endpoint — where to POST source maps */\n  endpoint?: string;\n  /**\n   * Management secret key for source-map uploads.\n   * Defaults to process.env.INSTANTTASKS_SECRET_KEY.\n   */\n  secretKey?: string;\n  /**\n   * Skip source-map upload even in production. Useful during CI dry-runs.\n   * @default false\n   */\n  disableSourceMapUpload?: boolean;\n  /**\n   * Relative path to Next.js output directory.\n   * @default '.next'\n   */\n  distDir?: string;\n}\n\ntype NextConfig = Record<string, any>;\ntype NextConfigFn = (phase: string, args: Record<string, any>) => NextConfig | Promise<NextConfig>;\n\n/**\n * `withInstantTasks(opts)(nextConfig)` — higher-order wrapper for next.config.js/ts.\n *\n * What it does:\n *  1. Enables `productionBrowserSourceMaps: true` so Next.js emits browser .map files.\n *  2. In production builds only, injects `InstantTasksSourceMapsPlugin` into the\n *     Webpack config so source maps are uploaded after the client bundle is emitted.\n *\n * Turbopack v1 decision: Next.js 15 ships Turbopack as the **dev** bundler only;\n * production builds continue to use Webpack. We hook into `webpack` here (v1).\n * Turbopack plugin support is deferred to v1.1 once the `experimental.turbopack`\n * plugin API stabilises.\n *\n * @example\n * ```js\n * // next.config.js\n * const { withInstantTasks } = require('@koderlabs/tasks-sdk-nextjs/plugin');\n * module.exports = withInstantTasks({ secretKey: process.env.IT_KEY })({});\n * ```\n */\nexport function withInstantTasks(opts: WithInstantTasksOptions = {}) {\n  return function applyInstantTasks(nextConfig: NextConfig | NextConfigFn): NextConfig | NextConfigFn {\n    // Support next.config.js that exports a function (phase-based config).\n    if (typeof nextConfig === 'function') {\n      return async (phase: string, args: Record<string, any>) => {\n        const resolved = await (nextConfig as NextConfigFn)(phase, args);\n        return applyConfig(resolved, opts);\n      };\n    }\n    return applyConfig(nextConfig, opts);\n  };\n}\n\nfunction applyConfig(config: NextConfig, opts: WithInstantTasksOptions): NextConfig {\n  // Refuse to read the secret from a NEXT_PUBLIC_* env. Next.js inlines those into\n  // the client bundle; any value present there is already compromised. Crashing\n  // the build is the only safe response.\n  for (const key of Object.keys(process.env)) {\n    if (/^NEXT_PUBLIC_.*INSTANTTASKS.*SECRET/i.test(key)) {\n      throw new Error(\n        `[InstantTasks] ${key} is exposed via NEXT_PUBLIC_* and will leak into the client bundle. ` +\n          'Move the value to a non-NEXT_PUBLIC env (e.g. .env.local or CI secret) and read via INSTANTTASKS_SECRET_KEY.',\n      );\n    }\n  }\n  const secretKey =\n    opts.secretKey ?? process.env['INSTANTTASKS_SECRET_KEY'] ?? '';\n  const endpoint =\n    opts.endpoint ?? 'https://tasks.koderlabs.net';\n  const distDir = opts.distDir ?? config.distDir ?? '.next';\n\n  const merged: NextConfig = {\n    ...config,\n    // Always emit browser source maps in production — required for meaningful\n    // stack traces in the Issues dashboard.\n    productionBrowserSourceMaps: true,\n  };\n\n  // Wrap the existing webpack config function (or create one).\n  const previousWebpack = config.webpack;\n\n  merged.webpack = (webpackConfig: any, context: any) => {\n    // Call any pre-existing webpack customisation first.\n    let finalConfig = previousWebpack\n      ? previousWebpack(webpackConfig, context)\n      : webpackConfig;\n\n    // Only upload in production builds; skip in dev and in the server compiler.\n    const { isServer, dev } = context;\n    const shouldUpload =\n      !dev &&\n      !isServer &&\n      !opts.disableSourceMapUpload &&\n      Boolean(secretKey);\n\n    if (shouldUpload) {\n      finalConfig.plugins = [\n        ...(finalConfig.plugins ?? []),\n        new InstantTasksSourceMapsPlugin({ endpoint, secretKey, distDir }),\n      ];\n    }\n\n    return finalConfig;\n  };\n\n  return merged;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAoB;AACpB,WAAsB;AAyBtB,IAAM,oBAAoB,KAAK,OAAO;AACtC,IAAM,cAAc;AACpB,IAAM,gBAAgB;AAiBf,IAAM,+BAAN,MAAmC;AAAA,EAGxC,YAAY,MAA+B;AACzC,SAAK,OAAO;AAAA,MACV,SAAS;AAAA,MACT,cAAc;AAAA,MACd,QAAQ,KAAK,UAAU,QAAQ,IAAI,OAAO;AAAA,MAC1C,GAAG;AAAA,IACL;AAAA,EACF;AAAA,EAEA,MAAM,UAAe;AAEnB,UAAM,eAAe,SAAS,SAAS,SAAS;AAChD,UAAM,mBACJ,CAAC,SAAS,QAAQ,SAAS,SAAS,YAAY,SAAS,SAAS;AAEpE,QAAI,CAAC,gBAAgB,CAAC,iBAAkB;AAExC,aAAS,MAAM,UAAU;AAAA,MACvB;AAAA,MACA,OAAO,aAAkB,aAAoC;AAC3D,YAAI;AACF,gBAAM,SAAS,MAAM,KAAK,YAAY,YAAY,cAAc,KAAK,KAAK,OAAO;AACjF,cAAI,OAAO,SAAS,KAAK,KAAK,KAAK,QAAQ;AACzC,kBAAM,UAAU,OACb,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,EAAE,SAAS,QAAQ,EAAE,MAAM,KAAK,EAAE,SAAS,SAAS,EAAE,EACjF,KAAK,IAAI;AACZ,qBAAS,IAAI,MAAM,kBAAkB,OAAO,MAAM;AAAA,EAAkC,OAAO,EAAE,CAAC;AAC9F;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,KAAK,KAAK,QAAQ;AACpB,qBAAS,GAAY;AACrB;AAAA,UACF;AACA,kBAAQ,KAAK,4CAA4C,GAAG;AAAA,QAC9D;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,YAA8C;AACtE,UAAM,eAAoB,aAAQ,UAAU;AAC5C,UAAM,WAAW,KAAK,cAAc,YAAY;AAChD,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ,IAAI,mDAAmD,YAAY;AAC3E,aAAO,CAAC;AAAA,IACV;AAEA,YAAQ,IAAI,4BAA4B,SAAS,MAAM,sBAAiB;AAExE,UAAM,YAAY,GAAG,KAAK,KAAK,QAAQ;AACvC,UAAM,UAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,CAAC,MAAM,KAAK,WAAW,WAAW,cAAc,CAAC,CAAC,CAAC;AAClG,UAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;AAC1C,UAAM,KAAK,QAAQ,SAAS,OAAO;AACnC,YAAQ,IAAI,oDAA+C,EAAE,QAAQ,OAAO,MAAM,UAAU;AAC5F,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WAAW,WAAmB,MAAc,UAA0C;AAGlG,UAAM,WAAgB,aAAQ,QAAQ;AACtC,QAAI,CAAC,SAAS,WAAW,OAAY,QAAG,KAAK,aAAa,MAAM;AAC9D,aAAO,EAAE,MAAM,UAAU,IAAI,OAAO,OAAO,yBAAyB;AAAA,IACtE;AACA,UAAM,eAAoB,cAAS,MAAM,QAAQ;AACjD,QAAI,CAAC,gBAAgB,aAAa,WAAW,IAAI,KAAU,gBAAW,YAAY,GAAG;AACnF,aAAO,EAAE,MAAM,UAAU,IAAI,OAAO,OAAO,wBAAwB;AAAA,IACrE;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAS,YAAS,KAAK,QAAQ;AAAA,IACxC,SAAS,GAAG;AACV,aAAO,EAAE,MAAM,cAAc,IAAI,OAAO,OAAQ,EAAY,QAAQ;AAAA,IACtE;AACA,QAAI,KAAK,OAAO,KAAK,KAAK,cAAc;AACtC,cAAQ,KAAK,2BAA2B,YAAY,WAAM,KAAK,IAAI,sBAAsB,KAAK,KAAK,YAAY,EAAE;AACjH,aAAO,EAAE,MAAM,cAAc,IAAI,OAAO,OAAO,mBAAmB,KAAK,IAAI,UAAU;AAAA,IACvF;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAS,YAAS,SAAS,UAAU,OAAO;AAAA,IACxD,SAAS,GAAG;AACV,aAAO,EAAE,MAAM,cAAc,IAAI,OAAO,OAAQ,EAAY,QAAQ;AAAA,IACtE;AAEA,QAAI;AACJ,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AACvD,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,WAAW;AAAA,UACjC,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,eAAe,UAAU,KAAK,KAAK,SAAS;AAAA,UAC9C;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,QACtD,CAAC;AACD,YAAI,IAAI,GAAI,QAAO,EAAE,MAAM,cAAc,IAAI,MAAM,QAAQ,IAAI,OAAO;AACtE,qBAAa,IAAI;AAEjB,YAAI,IAAI,SAAS,OAAO,IAAI,UAAU,IAAK;AAAA,MAC7C,SAAS,GAAG;AACV,kBAAW,EAAY;AAAA,MACzB;AACA,UAAI,UAAU,aAAa;AACzB,cAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,YAAQ,KAAK,mCAAmC,YAAY,KAAK,aAAa,QAAQ,UAAU,KAAK,WAAW,SAAS,EAAE;AAC3H,WAAO,EAAE,MAAM,cAAc,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ;AAAA,EAC7E;AAAA,EAEQ,cAAc,KAAuB;AAC3C,QAAI,CAAI,cAAW,GAAG,EAAG,QAAO,CAAC;AACjC,UAAM,UAAoB,CAAC;AAC3B,UAAM,OAAY,aAAQ,GAAG;AAC7B,UAAM,OAAO,CAAC,YAAoB;AAChC,iBAAW,SAAY,eAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACpE,cAAM,OAAY,UAAK,SAAS,MAAM,IAAI;AAE1C,YAAI,MAAM,eAAe,EAAG;AAC5B,YAAI,MAAM,YAAY,GAAG;AACvB,eAAK,IAAI;AAAA,QACX,WAAW,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,MAAM,GAAG;AACxD,gBAAM,WAAgB,aAAQ,IAAI;AAClC,cAAI,SAAS,WAAW,OAAY,QAAG,KAAK,aAAa,KAAM,SAAQ,KAAK,IAAI;AAAA,QAClF;AAAA,MACF;AAAA,IACF;AACA,SAAK,IAAI;AACT,WAAO;AAAA,EACT;AACF;;;AC1IO,SAAS,iBAAiB,OAAgC,CAAC,GAAG;AACnE,SAAO,SAAS,kBAAkB,YAAkE;AAElG,QAAI,OAAO,eAAe,YAAY;AACpC,aAAO,OAAO,OAAe,SAA8B;AACzD,cAAM,WAAW,MAAO,WAA4B,OAAO,IAAI;AAC/D,eAAO,YAAY,UAAU,IAAI;AAAA,MACnC;AAAA,IACF;AACA,WAAO,YAAY,YAAY,IAAI;AAAA,EACrC;AACF;AAEA,SAAS,YAAY,QAAoB,MAA2C;AAIlF,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAG,GAAG;AAC1C,QAAI,uCAAuC,KAAK,GAAG,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,kBAAkB,GAAG;AAAA,MAEvB;AAAA,IACF;AAAA,EACF;AACA,QAAM,YACJ,KAAK,aAAa,QAAQ,IAAI,yBAAyB,KAAK;AAC9D,QAAM,WACJ,KAAK,YAAY;AACnB,QAAM,UAAU,KAAK,WAAW,OAAO,WAAW;AAElD,QAAM,SAAqB;AAAA,IACzB,GAAG;AAAA;AAAA;AAAA,IAGH,6BAA6B;AAAA,EAC/B;AAGA,QAAM,kBAAkB,OAAO;AAE/B,SAAO,UAAU,CAAC,eAAoB,YAAiB;AAErD,QAAI,cAAc,kBACd,gBAAgB,eAAe,OAAO,IACtC;AAGJ,UAAM,EAAE,UAAU,IAAI,IAAI;AAC1B,UAAM,eACJ,CAAC,OACD,CAAC,YACD,CAAC,KAAK,0BACN,QAAQ,SAAS;AAEnB,QAAI,cAAc;AAChB,kBAAY,UAAU;AAAA,QACpB,GAAI,YAAY,WAAW,CAAC;AAAA,QAC5B,IAAI,6BAA6B,EAAE,UAAU,WAAW,QAAQ,CAAC;AAAA,MACnE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,47 @@
+export { WithInstantTasksOptions, withInstantTasks } from './plugin.cjs';
+
+/**
+ * Options for the source-maps upload webpack plugin.
+ */
+interface SourceMapsUploadOptions {
+    /** InstantTasks API base URL (e.g. "https://tasks.koderlabs.net") */
+    endpoint: string;
+    /** Project access key with upload permissions */
+    secretKey: string;
+    /** Directory to scan for .map files (defaults to ".next") */
+    distDir?: string;
+    /**
+     * When true (or `process.env.CI === 'true'`), exit the build with a non-zero
+     * code if ANY map fails to upload. Default: opt-in via env so existing
+     * pipelines don't break on rollout — set explicitly once stable.
+     */
+    strict?: boolean;
+    /**
+     * Skip files larger than this (bytes). Default 50MB — beyond which the upload
+     * is almost certainly going to OOM or time out anyway.
+     */
+    maxFileBytes?: number;
+}
+/**
+ * Webpack plugin that uploads source maps to the InstantTasks SDK endpoint
+ * after a **production** build completes.
+ *
+ * Failure handling: when `strict` is true (or `CI=true`), any failed upload
+ * fails the build. Otherwise failures are warned but the build continues
+ * — same as before, but with a much louder report (per-file + summary).
+ *
+ * Path safety: the relative path stored alongside the map is validated to
+ * never contain `..` or be absolute — defends against a misconfigured
+ * `outputPath` accidentally letting the plugin walk symlinked files outside
+ * the dist directory and store them under attacker-influenced keys.
+ */
+declare class InstantTasksSourceMapsPlugin {
+    private readonly opts;
+    constructor(opts: SourceMapsUploadOptions);
+    apply(compiler: any): void;
+    private _uploadMaps;
+    private _uploadOne;
+    private _findMapFiles;
+}
+
+export { InstantTasksSourceMapsPlugin, type SourceMapsUploadOptions };

package/dist/index.d.ts

@@ -0,0 +1,47 @@
+export { WithInstantTasksOptions, withInstantTasks } from './plugin.js';
+
+/**
+ * Options for the source-maps upload webpack plugin.
+ */
+interface SourceMapsUploadOptions {
+    /** InstantTasks API base URL (e.g. "https://tasks.koderlabs.net") */
+    endpoint: string;
+    /** Project access key with upload permissions */
+    secretKey: string;
+    /** Directory to scan for .map files (defaults to ".next") */
+    distDir?: string;
+    /**
+     * When true (or `process.env.CI === 'true'`), exit the build with a non-zero
+     * code if ANY map fails to upload. Default: opt-in via env so existing
+     * pipelines don't break on rollout — set explicitly once stable.
+     */
+    strict?: boolean;
+    /**
+     * Skip files larger than this (bytes). Default 50MB — beyond which the upload
+     * is almost certainly going to OOM or time out anyway.
+     */
+    maxFileBytes?: number;
+}
+/**
+ * Webpack plugin that uploads source maps to the InstantTasks SDK endpoint
+ * after a **production** build completes.
+ *
+ * Failure handling: when `strict` is true (or `CI=true`), any failed upload
+ * fails the build. Otherwise failures are warned but the build continues
+ * — same as before, but with a much louder report (per-file + summary).
+ *
+ * Path safety: the relative path stored alongside the map is validated to
+ * never contain `..` or be absolute — defends against a misconfigured
+ * `outputPath` accidentally letting the plugin walk symlinked files outside
+ * the dist directory and store them under attacker-influenced keys.
+ */
+declare class InstantTasksSourceMapsPlugin {
+    private readonly opts;
+    constructor(opts: SourceMapsUploadOptions);
+    apply(compiler: any): void;
+    private _uploadMaps;
+    private _uploadOne;
+    private _findMapFiles;
+}
+
+export { InstantTasksSourceMapsPlugin, type SourceMapsUploadOptions };

package/dist/index.js

@@ -0,0 +1,9 @@
+import {
+  InstantTasksSourceMapsPlugin,
+  withInstantTasks
+} from "./chunk-2YRBUQGE.js";
+export {
+  InstantTasksSourceMapsPlugin,
+  withInstantTasks
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/plugin.cjs

@@ -0,0 +1,212 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugin.ts
+var plugin_exports = {};
+__export(plugin_exports, {
+  withInstantTasks: () => withInstantTasks
+});
+module.exports = __toCommonJS(plugin_exports);
+
+// src/sourcemaps-upload.ts
+var fs = __toESM(require("fs"), 1);
+var path = __toESM(require("path"), 1);
+var DEFAULT_MAX_BYTES = 50 * 1024 * 1024;
+var MAX_RETRIES = 2;
+var RETRY_BASE_MS = 1e3;
+var InstantTasksSourceMapsPlugin = class {
+  constructor(opts) {
+    this.opts = {
+      distDir: ".next",
+      maxFileBytes: DEFAULT_MAX_BYTES,
+      strict: opts.strict ?? process.env.CI === "true",
+      ...opts
+    };
+  }
+  apply(compiler) {
+    const isProduction = compiler.options?.mode === "production";
+    const isClientCompiler = !compiler.name || compiler.name === "client" || compiler.name === "browser";
+    if (!isProduction || !isClientCompiler) return;
+    compiler.hooks.afterEmit.tapAsync(
+      "InstantTasksSourceMapsPlugin",
+      async (compilation, callback) => {
+        try {
+          const failed = await this._uploadMaps(compilation.outputPath ?? this.opts.distDir);
+          if (failed.length > 0 && this.opts.strict) {
+            const summary = failed.map((f) => `  ${f.file}: ${f.status ? `HTTP ${f.status}` : f.error ?? "unknown"}`).join("\n");
+            callback(new Error(`[InstantTasks] ${failed.length} source-map upload(s) failed:
+${summary}`));
+            return;
+          }
+        } catch (err) {
+          if (this.opts.strict) {
+            callback(err);
+            return;
+          }
+          console.warn("[InstantTasks] source-map upload failed:", err);
+        }
+        callback();
+      }
+    );
+  }
+  async _uploadMaps(outputPath) {
+    const resolvedRoot = path.resolve(outputPath);
+    const mapFiles = this._findMapFiles(resolvedRoot);
+    if (mapFiles.length === 0) {
+      console.log("[InstantTasks] No .map files found to upload in", resolvedRoot);
+      return [];
+    }
+    console.log(`[InstantTasks] Uploading ${mapFiles.length} source map(s)\u2026`);
+    const uploadUrl = `${this.opts.endpoint}/api/v1/sdk/source-maps`;
+    const results = await Promise.all(mapFiles.map((f) => this._uploadOne(uploadUrl, resolvedRoot, f)));
+    const failed = results.filter((r) => !r.ok);
+    const ok = results.length - failed.length;
+    console.log(`[InstantTasks] Source map upload complete \u2014 ${ok} ok, ${failed.length} failed.`);
+    return failed;
+  }
+  async _uploadOne(uploadUrl, root, filePath) {
+    const resolved = path.resolve(filePath);
+    if (!resolved.startsWith(root + path.sep) && resolved !== root) {
+      return { file: filePath, ok: false, error: "path escapes dist root" };
+    }
+    const relativePath = path.relative(root, resolved);
+    if (!relativePath || relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+      return { file: filePath, ok: false, error: "invalid relative path" };
+    }
+    let stat;
+    try {
+      stat = await fs.promises.stat(resolved);
+    } catch (e) {
+      return { file: relativePath, ok: false, error: e.message };
+    }
+    if (stat.size > this.opts.maxFileBytes) {
+      console.warn(`[InstantTasks] Skipping ${relativePath} \u2014 ${stat.size} bytes exceeds cap ${this.opts.maxFileBytes}`);
+      return { file: relativePath, ok: false, error: `file too large (${stat.size} bytes)` };
+    }
+    let content;
+    try {
+      content = await fs.promises.readFile(resolved, "utf-8");
+    } catch (e) {
+      return { file: relativePath, ok: false, error: e.message };
+    }
+    let lastErr;
+    let lastStatus;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        const res = await fetch(uploadUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${this.opts.secretKey}`
+          },
+          body: JSON.stringify({ path: relativePath, content })
+        });
+        if (res.ok) return { file: relativePath, ok: true, status: res.status };
+        lastStatus = res.status;
+        if (res.status < 500 || res.status >= 600) break;
+      } catch (e) {
+        lastErr = e.message;
+      }
+      if (attempt < MAX_RETRIES) {
+        await new Promise((r) => setTimeout(r, RETRY_BASE_MS * Math.pow(2, attempt)));
+      }
+    }
+    console.warn(`[InstantTasks] Failed to upload ${relativePath}: ${lastStatus ? `HTTP ${lastStatus}` : lastErr ?? "unknown"}`);
+    return { file: relativePath, ok: false, status: lastStatus, error: lastErr };
+  }
+  _findMapFiles(dir) {
+    if (!fs.existsSync(dir)) return [];
+    const results = [];
+    const root = path.resolve(dir);
+    const walk = (current) => {
+      for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+        const full = path.join(current, entry.name);
+        if (entry.isSymbolicLink()) continue;
+        if (entry.isDirectory()) {
+          walk(full);
+        } else if (entry.isFile() && entry.name.endsWith(".map")) {
+          const resolved = path.resolve(full);
+          if (resolved.startsWith(root + path.sep) || resolved === root) results.push(full);
+        }
+      }
+    };
+    walk(root);
+    return results;
+  }
+};
+
+// src/plugin.ts
+function withInstantTasks(opts = {}) {
+  return function applyInstantTasks(nextConfig) {
+    if (typeof nextConfig === "function") {
+      return async (phase, args) => {
+        const resolved = await nextConfig(phase, args);
+        return applyConfig(resolved, opts);
+      };
+    }
+    return applyConfig(nextConfig, opts);
+  };
+}
+function applyConfig(config, opts) {
+  for (const key of Object.keys(process.env)) {
+    if (/^NEXT_PUBLIC_.*INSTANTTASKS.*SECRET/i.test(key)) {
+      throw new Error(
+        `[InstantTasks] ${key} is exposed via NEXT_PUBLIC_* and will leak into the client bundle. Move the value to a non-NEXT_PUBLIC env (e.g. .env.local or CI secret) and read via INSTANTTASKS_SECRET_KEY.`
+      );
+    }
+  }
+  const secretKey = opts.secretKey ?? process.env["INSTANTTASKS_SECRET_KEY"] ?? "";
+  const endpoint = opts.endpoint ?? "https://tasks.koderlabs.net";
+  const distDir = opts.distDir ?? config.distDir ?? ".next";
+  const merged = {
+    ...config,
+    // Always emit browser source maps in production — required for meaningful
+    // stack traces in the Issues dashboard.
+    productionBrowserSourceMaps: true
+  };
+  const previousWebpack = config.webpack;
+  merged.webpack = (webpackConfig, context) => {
+    let finalConfig = previousWebpack ? previousWebpack(webpackConfig, context) : webpackConfig;
+    const { isServer, dev } = context;
+    const shouldUpload = !dev && !isServer && !opts.disableSourceMapUpload && Boolean(secretKey);
+    if (shouldUpload) {
+      finalConfig.plugins = [
+        ...finalConfig.plugins ?? [],
+        new InstantTasksSourceMapsPlugin({ endpoint, secretKey, distDir })
+      ];
+    }
+    return finalConfig;
+  };
+  return merged;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  withInstantTasks
+});
+//# sourceMappingURL=plugin.cjs.map

package/dist/plugin.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/plugin.ts","../src/sourcemaps-upload.ts"],"sourcesContent":["import { InstantTasksSourceMapsPlugin } from './sourcemaps-upload';\nimport type { InitOptions } from '@koderlabs/tasks-sdk';\n\nexport interface WithInstantTasksOptions {\n  /** Matches InitOptions.endpoint — where to POST source maps */\n  endpoint?: string;\n  /**\n   * Management secret key for source-map uploads.\n   * Defaults to process.env.INSTANTTASKS_SECRET_KEY.\n   */\n  secretKey?: string;\n  /**\n   * Skip source-map upload even in production. Useful during CI dry-runs.\n   * @default false\n   */\n  disableSourceMapUpload?: boolean;\n  /**\n   * Relative path to Next.js output directory.\n   * @default '.next'\n   */\n  distDir?: string;\n}\n\ntype NextConfig = Record<string, any>;\ntype NextConfigFn = (phase: string, args: Record<string, any>) => NextConfig | Promise<NextConfig>;\n\n/**\n * `withInstantTasks(opts)(nextConfig)` — higher-order wrapper for next.config.js/ts.\n *\n * What it does:\n *  1. Enables `productionBrowserSourceMaps: true` so Next.js emits browser .map files.\n *  2. In production builds only, injects `InstantTasksSourceMapsPlugin` into the\n *     Webpack config so source maps are uploaded after the client bundle is emitted.\n *\n * Turbopack v1 decision: Next.js 15 ships Turbopack as the **dev** bundler only;\n * production builds continue to use Webpack. We hook into `webpack` here (v1).\n * Turbopack plugin support is deferred to v1.1 once the `experimental.turbopack`\n * plugin API stabilises.\n *\n * @example\n * ```js\n * // next.config.js\n * const { withInstantTasks } = require('@koderlabs/tasks-sdk-nextjs/plugin');\n * module.exports = withInstantTasks({ secretKey: process.env.IT_KEY })({});\n * ```\n */\nexport function withInstantTasks(opts: WithInstantTasksOptions = {}) {\n  return function applyInstantTasks(nextConfig: NextConfig | NextConfigFn): NextConfig | NextConfigFn {\n    // Support next.config.js that exports a function (phase-based config).\n    if (typeof nextConfig === 'function') {\n      return async (phase: string, args: Record<string, any>) => {\n        const resolved = await (nextConfig as NextConfigFn)(phase, args);\n        return applyConfig(resolved, opts);\n      };\n    }\n    return applyConfig(nextConfig, opts);\n  };\n}\n\nfunction applyConfig(config: NextConfig, opts: WithInstantTasksOptions): NextConfig {\n  // Refuse to read the secret from a NEXT_PUBLIC_* env. Next.js inlines those into\n  // the client bundle; any value present there is already compromised. Crashing\n  // the build is the only safe response.\n  for (const key of Object.keys(process.env)) {\n    if (/^NEXT_PUBLIC_.*INSTANTTASKS.*SECRET/i.test(key)) {\n      throw new Error(\n        `[InstantTasks] ${key} is exposed via NEXT_PUBLIC_* and will leak into the client bundle. ` +\n          'Move the value to a non-NEXT_PUBLIC env (e.g. .env.local or CI secret) and read via INSTANTTASKS_SECRET_KEY.',\n      );\n    }\n  }\n  const secretKey =\n    opts.secretKey ?? process.env['INSTANTTASKS_SECRET_KEY'] ?? '';\n  const endpoint =\n    opts.endpoint ?? 'https://tasks.koderlabs.net';\n  const distDir = opts.distDir ?? config.distDir ?? '.next';\n\n  const merged: NextConfig = {\n    ...config,\n    // Always emit browser source maps in production — required for meaningful\n    // stack traces in the Issues dashboard.\n    productionBrowserSourceMaps: true,\n  };\n\n  // Wrap the existing webpack config function (or create one).\n  const previousWebpack = config.webpack;\n\n  merged.webpack = (webpackConfig: any, context: any) => {\n    // Call any pre-existing webpack customisation first.\n    let finalConfig = previousWebpack\n      ? previousWebpack(webpackConfig, context)\n      : webpackConfig;\n\n    // Only upload in production builds; skip in dev and in the server compiler.\n    const { isServer, dev } = context;\n    const shouldUpload =\n      !dev &&\n      !isServer &&\n      !opts.disableSourceMapUpload &&\n      Boolean(secretKey);\n\n    if (shouldUpload) {\n      finalConfig.plugins = [\n        ...(finalConfig.plugins ?? []),\n        new InstantTasksSourceMapsPlugin({ endpoint, secretKey, distDir }),\n      ];\n    }\n\n    return finalConfig;\n  };\n\n  return merged;\n}\n","import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * Options for the source-maps upload webpack plugin.\n */\nexport interface SourceMapsUploadOptions {\n  /** InstantTasks API base URL (e.g. \"https://tasks.koderlabs.net\") */\n  endpoint: string;\n  /** Project access key with upload permissions */\n  secretKey: string;\n  /** Directory to scan for .map files (defaults to \".next\") */\n  distDir?: string;\n  /**\n   * When true (or `process.env.CI === 'true'`), exit the build with a non-zero\n   * code if ANY map fails to upload. Default: opt-in via env so existing\n   * pipelines don't break on rollout — set explicitly once stable.\n   */\n  strict?: boolean;\n  /**\n   * Skip files larger than this (bytes). Default 50MB — beyond which the upload\n   * is almost certainly going to OOM or time out anyway.\n   */\n  maxFileBytes?: number;\n}\n\nconst DEFAULT_MAX_BYTES = 50 * 1024 * 1024;\nconst MAX_RETRIES = 2;\nconst RETRY_BASE_MS = 1_000;\n\ninterface UploadOutcome { file: string; ok: boolean; status?: number; error?: string }\n\n/**\n * Webpack plugin that uploads source maps to the InstantTasks SDK endpoint\n * after a **production** build completes.\n *\n * Failure handling: when `strict` is true (or `CI=true`), any failed upload\n * fails the build. Otherwise failures are warned but the build continues\n * — same as before, but with a much louder report (per-file + summary).\n *\n * Path safety: the relative path stored alongside the map is validated to\n * never contain `..` or be absolute — defends against a misconfigured\n * `outputPath` accidentally letting the plugin walk symlinked files outside\n * the dist directory and store them under attacker-influenced keys.\n */\nexport class InstantTasksSourceMapsPlugin {\n  private readonly opts: Required<Omit<SourceMapsUploadOptions, 'strict'>> & { strict: boolean };\n\n  constructor(opts: SourceMapsUploadOptions) {\n    this.opts = {\n      distDir: '.next',\n      maxFileBytes: DEFAULT_MAX_BYTES,\n      strict: opts.strict ?? process.env.CI === 'true',\n      ...opts,\n    };\n  }\n\n  apply(compiler: any) {\n    // Skip in any environment other than a production client build.\n    const isProduction = compiler.options?.mode === 'production';\n    const isClientCompiler =\n      !compiler.name || compiler.name === 'client' || compiler.name === 'browser';\n\n    if (!isProduction || !isClientCompiler) return;\n\n    compiler.hooks.afterEmit.tapAsync(\n      'InstantTasksSourceMapsPlugin',\n      async (compilation: any, callback: (err?: Error) => void) => {\n        try {\n          const failed = await this._uploadMaps(compilation.outputPath ?? this.opts.distDir);\n          if (failed.length > 0 && this.opts.strict) {\n            const summary = failed\n              .map((f) => `  ${f.file}: ${f.status ? `HTTP ${f.status}` : f.error ?? 'unknown'}`)\n              .join('\\n');\n            callback(new Error(`[InstantTasks] ${failed.length} source-map upload(s) failed:\\n${summary}`));\n            return;\n          }\n        } catch (err) {\n          if (this.opts.strict) {\n            callback(err as Error);\n            return;\n          }\n          console.warn('[InstantTasks] source-map upload failed:', err);\n        }\n        callback();\n      },\n    );\n  }\n\n  private async _uploadMaps(outputPath: string): Promise<UploadOutcome[]> {\n    const resolvedRoot = path.resolve(outputPath);\n    const mapFiles = this._findMapFiles(resolvedRoot);\n    if (mapFiles.length === 0) {\n      console.log('[InstantTasks] No .map files found to upload in', resolvedRoot);\n      return [];\n    }\n\n    console.log(`[InstantTasks] Uploading ${mapFiles.length} source map(s)…`);\n\n    const uploadUrl = `${this.opts.endpoint}/api/v1/sdk/source-maps`;\n    const results = await Promise.all(mapFiles.map((f) => this._uploadOne(uploadUrl, resolvedRoot, f)));\n    const failed = results.filter((r) => !r.ok);\n    const ok = results.length - failed.length;\n    console.log(`[InstantTasks] Source map upload complete — ${ok} ok, ${failed.length} failed.`);\n    return failed;\n  }\n\n  private async _uploadOne(uploadUrl: string, root: string, filePath: string): Promise<UploadOutcome> {\n    // Path traversal defense — the on-disk file path must resolve inside the\n    // dist root, and the stored relative key must not climb above it.\n    const resolved = path.resolve(filePath);\n    if (!resolved.startsWith(root + path.sep) && resolved !== root) {\n      return { file: filePath, ok: false, error: 'path escapes dist root' };\n    }\n    const relativePath = path.relative(root, resolved);\n    if (!relativePath || relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n      return { file: filePath, ok: false, error: 'invalid relative path' };\n    }\n\n    let stat: fs.Stats;\n    try {\n      stat = await fs.promises.stat(resolved);\n    } catch (e) {\n      return { file: relativePath, ok: false, error: (e as Error).message };\n    }\n    if (stat.size > this.opts.maxFileBytes) {\n      console.warn(`[InstantTasks] Skipping ${relativePath} — ${stat.size} bytes exceeds cap ${this.opts.maxFileBytes}`);\n      return { file: relativePath, ok: false, error: `file too large (${stat.size} bytes)` };\n    }\n\n    let content: string;\n    try {\n      content = await fs.promises.readFile(resolved, 'utf-8');\n    } catch (e) {\n      return { file: relativePath, ok: false, error: (e as Error).message };\n    }\n\n    let lastErr: string | undefined;\n    let lastStatus: number | undefined;\n    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {\n      try {\n        const res = await fetch(uploadUrl, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            Authorization: `Bearer ${this.opts.secretKey}`,\n          },\n          body: JSON.stringify({ path: relativePath, content }),\n        });\n        if (res.ok) return { file: relativePath, ok: true, status: res.status };\n        lastStatus = res.status;\n        // Retry only transient 5xx; 4xx is configuration — fail fast.\n        if (res.status < 500 || res.status >= 600) break;\n      } catch (e) {\n        lastErr = (e as Error).message;\n      }\n      if (attempt < MAX_RETRIES) {\n        await new Promise((r) => setTimeout(r, RETRY_BASE_MS * Math.pow(2, attempt)));\n      }\n    }\n    console.warn(`[InstantTasks] Failed to upload ${relativePath}: ${lastStatus ? `HTTP ${lastStatus}` : lastErr ?? 'unknown'}`);\n    return { file: relativePath, ok: false, status: lastStatus, error: lastErr };\n  }\n\n  private _findMapFiles(dir: string): string[] {\n    if (!fs.existsSync(dir)) return [];\n    const results: string[] = [];\n    const root = path.resolve(dir);\n    const walk = (current: string) => {\n      for (const entry of fs.readdirSync(current, { withFileTypes: true })) {\n        const full = path.join(current, entry.name);\n        // Refuse to follow symlinks — they could point outside dist root.\n        if (entry.isSymbolicLink()) continue;\n        if (entry.isDirectory()) {\n          walk(full);\n        } else if (entry.isFile() && entry.name.endsWith('.map')) {\n          const resolved = path.resolve(full);\n          if (resolved.startsWith(root + path.sep) || resolved === root) results.push(full);\n        }\n      }\n    };\n    walk(root);\n    return results;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAoB;AACpB,WAAsB;AAyBtB,IAAM,oBAAoB,KAAK,OAAO;AACtC,IAAM,cAAc;AACpB,IAAM,gBAAgB;AAiBf,IAAM,+BAAN,MAAmC;AAAA,EAGxC,YAAY,MAA+B;AACzC,SAAK,OAAO;AAAA,MACV,SAAS;AAAA,MACT,cAAc;AAAA,MACd,QAAQ,KAAK,UAAU,QAAQ,IAAI,OAAO;AAAA,MAC1C,GAAG;AAAA,IACL;AAAA,EACF;AAAA,EAEA,MAAM,UAAe;AAEnB,UAAM,eAAe,SAAS,SAAS,SAAS;AAChD,UAAM,mBACJ,CAAC,SAAS,QAAQ,SAAS,SAAS,YAAY,SAAS,SAAS;AAEpE,QAAI,CAAC,gBAAgB,CAAC,iBAAkB;AAExC,aAAS,MAAM,UAAU;AAAA,MACvB;AAAA,MACA,OAAO,aAAkB,aAAoC;AAC3D,YAAI;AACF,gBAAM,SAAS,MAAM,KAAK,YAAY,YAAY,cAAc,KAAK,KAAK,OAAO;AACjF,cAAI,OAAO,SAAS,KAAK,KAAK,KAAK,QAAQ;AACzC,kBAAM,UAAU,OACb,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,EAAE,SAAS,QAAQ,EAAE,MAAM,KAAK,EAAE,SAAS,SAAS,EAAE,EACjF,KAAK,IAAI;AACZ,qBAAS,IAAI,MAAM,kBAAkB,OAAO,MAAM;AAAA,EAAkC,OAAO,EAAE,CAAC;AAC9F;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,KAAK,KAAK,QAAQ;AACpB,qBAAS,GAAY;AACrB;AAAA,UACF;AACA,kBAAQ,KAAK,4CAA4C,GAAG;AAAA,QAC9D;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,YAA8C;AACtE,UAAM,eAAoB,aAAQ,UAAU;AAC5C,UAAM,WAAW,KAAK,cAAc,YAAY;AAChD,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ,IAAI,mDAAmD,YAAY;AAC3E,aAAO,CAAC;AAAA,IACV;AAEA,YAAQ,IAAI,4BAA4B,SAAS,MAAM,sBAAiB;AAExE,UAAM,YAAY,GAAG,KAAK,KAAK,QAAQ;AACvC,UAAM,UAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,CAAC,MAAM,KAAK,WAAW,WAAW,cAAc,CAAC,CAAC,CAAC;AAClG,UAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;AAC1C,UAAM,KAAK,QAAQ,SAAS,OAAO;AACnC,YAAQ,IAAI,oDAA+C,EAAE,QAAQ,OAAO,MAAM,UAAU;AAC5F,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WAAW,WAAmB,MAAc,UAA0C;AAGlG,UAAM,WAAgB,aAAQ,QAAQ;AACtC,QAAI,CAAC,SAAS,WAAW,OAAY,QAAG,KAAK,aAAa,MAAM;AAC9D,aAAO,EAAE,MAAM,UAAU,IAAI,OAAO,OAAO,yBAAyB;AAAA,IACtE;AACA,UAAM,eAAoB,cAAS,MAAM,QAAQ;AACjD,QAAI,CAAC,gBAAgB,aAAa,WAAW,IAAI,KAAU,gBAAW,YAAY,GAAG;AACnF,aAAO,EAAE,MAAM,UAAU,IAAI,OAAO,OAAO,wBAAwB;AAAA,IACrE;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAS,YAAS,KAAK,QAAQ;AAAA,IACxC,SAAS,GAAG;AACV,aAAO,EAAE,MAAM,cAAc,IAAI,OAAO,OAAQ,EAAY,QAAQ;AAAA,IACtE;AACA,QAAI,KAAK,OAAO,KAAK,KAAK,cAAc;AACtC,cAAQ,KAAK,2BAA2B,YAAY,WAAM,KAAK,IAAI,sBAAsB,KAAK,KAAK,YAAY,EAAE;AACjH,aAAO,EAAE,MAAM,cAAc,IAAI,OAAO,OAAO,mBAAmB,KAAK,IAAI,UAAU;AAAA,IACvF;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAS,YAAS,SAAS,UAAU,OAAO;AAAA,IACxD,SAAS,GAAG;AACV,aAAO,EAAE,MAAM,cAAc,IAAI,OAAO,OAAQ,EAAY,QAAQ;AAAA,IACtE;AAEA,QAAI;AACJ,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AACvD,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,WAAW;AAAA,UACjC,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,eAAe,UAAU,KAAK,KAAK,SAAS;AAAA,UAC9C;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,QACtD,CAAC;AACD,YAAI,IAAI,GAAI,QAAO,EAAE,MAAM,cAAc,IAAI,MAAM,QAAQ,IAAI,OAAO;AACtE,qBAAa,IAAI;AAEjB,YAAI,IAAI,SAAS,OAAO,IAAI,UAAU,IAAK;AAAA,MAC7C,SAAS,GAAG;AACV,kBAAW,EAAY;AAAA,MACzB;AACA,UAAI,UAAU,aAAa;AACzB,cAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,YAAQ,KAAK,mCAAmC,YAAY,KAAK,aAAa,QAAQ,UAAU,KAAK,WAAW,SAAS,EAAE;AAC3H,WAAO,EAAE,MAAM,cAAc,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ;AAAA,EAC7E;AAAA,EAEQ,cAAc,KAAuB;AAC3C,QAAI,CAAI,cAAW,GAAG,EAAG,QAAO,CAAC;AACjC,UAAM,UAAoB,CAAC;AAC3B,UAAM,OAAY,aAAQ,GAAG;AAC7B,UAAM,OAAO,CAAC,YAAoB;AAChC,iBAAW,SAAY,eAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACpE,cAAM,OAAY,UAAK,SAAS,MAAM,IAAI;AAE1C,YAAI,MAAM,eAAe,EAAG;AAC5B,YAAI,MAAM,YAAY,GAAG;AACvB,eAAK,IAAI;AAAA,QACX,WAAW,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,MAAM,GAAG;AACxD,gBAAM,WAAgB,aAAQ,IAAI;AAClC,cAAI,SAAS,WAAW,OAAY,QAAG,KAAK,aAAa,KAAM,SAAQ,KAAK,IAAI;AAAA,QAClF;AAAA,MACF;AAAA,IACF;AACA,SAAK,IAAI;AACT,WAAO;AAAA,EACT;AACF;;;AD1IO,SAAS,iBAAiB,OAAgC,CAAC,GAAG;AACnE,SAAO,SAAS,kBAAkB,YAAkE;AAElG,QAAI,OAAO,eAAe,YAAY;AACpC,aAAO,OAAO,OAAe,SAA8B;AACzD,cAAM,WAAW,MAAO,WAA4B,OAAO,IAAI;AAC/D,eAAO,YAAY,UAAU,IAAI;AAAA,MACnC;AAAA,IACF;AACA,WAAO,YAAY,YAAY,IAAI;AAAA,EACrC;AACF;AAEA,SAAS,YAAY,QAAoB,MAA2C;AAIlF,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAG,GAAG;AAC1C,QAAI,uCAAuC,KAAK,GAAG,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,kBAAkB,GAAG;AAAA,MAEvB;AAAA,IACF;AAAA,EACF;AACA,QAAM,YACJ,KAAK,aAAa,QAAQ,IAAI,yBAAyB,KAAK;AAC9D,QAAM,WACJ,KAAK,YAAY;AACnB,QAAM,UAAU,KAAK,WAAW,OAAO,WAAW;AAElD,QAAM,SAAqB;AAAA,IACzB,GAAG;AAAA;AAAA;AAAA,IAGH,6BAA6B;AAAA,EAC/B;AAGA,QAAM,kBAAkB,OAAO;AAE/B,SAAO,UAAU,CAAC,eAAoB,YAAiB;AAErD,QAAI,cAAc,kBACd,gBAAgB,eAAe,OAAO,IACtC;AAGJ,UAAM,EAAE,UAAU,IAAI,IAAI;AAC1B,UAAM,eACJ,CAAC,OACD,CAAC,YACD,CAAC,KAAK,0BACN,QAAQ,SAAS;AAEnB,QAAI,cAAc;AAChB,kBAAY,UAAU;AAAA,QACpB,GAAI,YAAY,WAAW,CAAC;AAAA,QAC5B,IAAI,6BAA6B,EAAE,UAAU,WAAW,QAAQ,CAAC;AAAA,MACnE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;","names":[]}

package/dist/plugin.d.cts

@@ -0,0 +1,44 @@
+interface WithInstantTasksOptions {
+    /** Matches InitOptions.endpoint — where to POST source maps */
+    endpoint?: string;
+    /**
+     * Management secret key for source-map uploads.
+     * Defaults to process.env.INSTANTTASKS_SECRET_KEY.
+     */
+    secretKey?: string;
+    /**
+     * Skip source-map upload even in production. Useful during CI dry-runs.
+     * @default false
+     */
+    disableSourceMapUpload?: boolean;
+    /**
+     * Relative path to Next.js output directory.
+     * @default '.next'
+     */
+    distDir?: string;
+}
+type NextConfig = Record<string, any>;
+type NextConfigFn = (phase: string, args: Record<string, any>) => NextConfig | Promise<NextConfig>;
+/**
+ * `withInstantTasks(opts)(nextConfig)` — higher-order wrapper for next.config.js/ts.
+ *
+ * What it does:
+ *  1. Enables `productionBrowserSourceMaps: true` so Next.js emits browser .map files.
+ *  2. In production builds only, injects `InstantTasksSourceMapsPlugin` into the
+ *     Webpack config so source maps are uploaded after the client bundle is emitted.
+ *
+ * Turbopack v1 decision: Next.js 15 ships Turbopack as the **dev** bundler only;
+ * production builds continue to use Webpack. We hook into `webpack` here (v1).
+ * Turbopack plugin support is deferred to v1.1 once the `experimental.turbopack`
+ * plugin API stabilises.
+ *
+ * @example
+ * ```js
+ * // next.config.js
+ * const { withInstantTasks } = require('@koderlabs/tasks-sdk-nextjs/plugin');
+ * module.exports = withInstantTasks({ secretKey: process.env.IT_KEY })({});
+ * ```
+ */
+declare function withInstantTasks(opts?: WithInstantTasksOptions): (nextConfig: NextConfig | NextConfigFn) => NextConfig | NextConfigFn;
+
+export { type WithInstantTasksOptions, withInstantTasks };