@salesforce/uibundle-sourcemap-validator-engine 11.35.0

package/dist/rules.js

@@ -0,0 +1,108 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { COMMON_TAGS, SeverityLevel, } from "@salesforce/code-analyzer-engine-api";
+export const RULES = [
+    {
+        name: "missing-sourcemap",
+        severityLevel: SeverityLevel.High,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: "Every compiled .js file in the build output must have a corresponding sourcemap (co-located .js.map or //# sourceMappingURL). Missing sourcemaps prevent source-to-compiled verification during security review.",
+        resourceUrls: [
+            "https://developer.mozilla.org/en-US/docs/Tools/Debugger/How_to/Use_a_source_map",
+        ],
+    },
+    {
+        name: "path-leakage",
+        severityLevel: SeverityLevel.Moderate,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: "Sourcemap sources[] entries must be relative paths. Absolute paths leak developer environment details (usernames, filesystem layout) into shipped artifacts.",
+        resourceUrls: [],
+    },
+    {
+        name: "invalid-source-references",
+        severityLevel: SeverityLevel.High,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: "Every file referenced by a sourcemap sources[] entry (that does not have inline sourcesContent) must exist on disk. Missing files indicate tampering or an incomplete submission.",
+        resourceUrls: [],
+    },
+    {
+        name: "vlq-integrity",
+        severityLevel: SeverityLevel.High,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: 'Sourcemap "mappings" field must be valid Base64 VLQ and reference in-range source/name indices. Malformed mappings signal a fabricated or corrupted sourcemap.',
+        resourceUrls: ["https://tc39.es/ecma426/#sec-mapping-groups"],
+    },
+    {
+        name: "source-content-verification",
+        severityLevel: SeverityLevel.Critical,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: "AST-based verification that the compiled JS actually traces back to the submitted source. Parses compiled output with @babel/parser, collects significant AST nodes, and checks each has a sourcemap mapping into a source file present on disk. Also enforces byte-equal sourcesContent, a virtual-source ratio cap, an AST type-mismatch threshold, and flags dangerous API patterns in unmapped regions.",
+        resourceUrls: ["https://tc39.es/source-map/"],
+    },
+    {
+        name: "coverage-analysis",
+        severityLevel: SeverityLevel.Info,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: "Character-level coverage analysis (informational). Flags per-line unmapped regions of 50+ chars and raises a cumulative finding when more than 2% of the compiled file (line-1 preamble discounted up to 150 chars) has no sourcemap coverage.",
+        resourceUrls: [],
+    },
+    {
+        name: "structural-coherence",
+        severityLevel: SeverityLevel.Info,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: "Structural coherence checks on sourcemap tokens (informational). Flags out-of-bounds mappings, sample-based whitespace/comment-only mappings above 80%, and cross-file jump ratios above 50% on consecutive same-line tokens.",
+        resourceUrls: [],
+    },
+    {
+        name: "token-consistency",
+        severityLevel: SeverityLevel.Info,
+        tags: [
+            COMMON_TAGS.RECOMMENDED,
+            COMMON_TAGS.CATEGORIES.SECURITY,
+            COMMON_TAGS.LANGUAGES.JAVASCRIPT,
+            "UIBundleIntegrity",
+        ],
+        description: "Token-type consistency checks on sampled sourcemap tokens (informational). Every 20th mapping is compared between compiled and source positions; verifies names[] entries exist near the claimed source position (±3 col tolerance); flags scores below 85% (warning) and below 70% (suspicious).",
+        resourceUrls: [],
+    },
+];
+export const RULE_NAMES = new Set(RULES.map((r) => r.name));
+//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACN,WAAW,EACX,aAAa,GAEb,MAAM,sCAAsC,CAAC;AAE9C,MAAM,CAAC,MAAM,KAAK,GAAsB;IACvC;QACC,IAAI,EAAE,mBAAmB;QACzB,aAAa,EAAE,aAAa,CAAC,IAAI;QACjC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,kNAAkN;QACnN,YAAY,EAAE;YACb,iFAAiF;SACjF;KACD;IACD;QACC,IAAI,EAAE,cAAc;QACpB,aAAa,EAAE,aAAa,CAAC,QAAQ;QACrC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,8JAA8J;QAC/J,YAAY,EAAE,EAAE;KAChB;IACD;QACC,IAAI,EAAE,2BAA2B;QACjC,aAAa,EAAE,aAAa,CAAC,IAAI;QACjC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,mLAAmL;QACpL,YAAY,EAAE,EAAE;KAChB;IACD;QACC,IAAI,EAAE,eAAe;QACrB,aAAa,EAAE,aAAa,CAAC,IAAI;QACjC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,gKAAgK;QACjK,YAAY,EAAE,CAAC,6CAA6C,CAAC;KAC7D;IACD;QACC,IAAI,EAAE,6BAA6B;QACnC,aAAa,EAAE,aAAa,CAAC,QAAQ;QACrC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,6YAA6Y;QAC9Y,YAAY,EAAE,CAAC,6BAA6B,CAAC;KAC7C;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,aAAa,EAAE,aAAa,CAAC,IAAI;QACjC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,gPAAgP;QACjP,YAAY,EAAE,EAAE;KAChB;IACD;QACC,IAAI,EAAE,sBAAsB;QAC5B,aAAa,EAAE,aAAa,CAAC,IAAI;QACjC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,+NAA+N;QAChO,YAAY,EAAE,EAAE;KAChB;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,aAAa,EAAE,aAAa,CAAC,IAAI;QACjC,IAAI,EAAE;YACL,WAAW,CAAC,WAAW;YACvB,WAAW,CAAC,UAAU,CAAC,QAAQ;YAC/B,WAAW,CAAC,SAAS,CAAC,UAAU;YAChC,mBAAmB;SACnB;QACD,WAAW,EACV,mSAAmS;QACpS,YAAY,EAAE,EAAE;KAChB;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/dist/validators/classification.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+/**
+ * Strip common relative prefixes and bundler URL schemes so paths can be
+ * compared against the submitted source tree.
+ *
+ * Ported from lib.rs::normalize_source_path.
+ */
+export declare function normalizeSourcePath(p: string): string;
+/**
+ * Virtual bundler pseudo-source — not a real file, but not automatically
+ * malicious either. High aggregate ratios (>20%) trigger a bypass-attempt gate.
+ *
+ * Ported from lib.rs::is_virtual_source. Note the Rust check uses a null byte
+ * (`'\0'`); we test for that same character via its escape.
+ */
+export declare function isVirtualSource(p: string): boolean;
+/**
+ * Third-party dependency — sources under node_modules are not part of the
+ * submitted source tree and are excluded from byte-equal and missing-source
+ * gates.
+ *
+ * Ported from lib.rs::is_dependency.
+ */
+export declare function isDependency(p: string): boolean;
+/**
+ * Static asset — image/font/audio/video files that bundlers inline as sources
+ * but are not text and shouldn't participate in the byte-equal gate.
+ *
+ * Ported from lib.rs::is_asset.
+ */
+export declare function isAsset(p: string): boolean;
+/**
+ * Substring markers of dangerous browser/runtime APIs. This is a SCANNER
+ * PATTERN LIST — the strings appear here only so we can detect them in
+ * arbitrary compiled JS. None of these APIs are invoked by this file.
+ *
+ * Ported from lib.rs::contains_dangerous_apis and
+ * ast_validator.rs::contains_dangerous_pattern.
+ */
+export declare const DANGEROUS_API_PATTERNS: readonly string[];
+/** Extra patterns the AST validator flags on unmapped node snippets, in addition
+ *  to the base DANGEROUS_API_PATTERNS. Ported from ast_validator.rs.
+ */
+export declare const DANGEROUS_AST_EXTRA_PATTERNS: readonly string[];
+export declare function containsDangerousApi(content: string): boolean;
+export declare function containsDangerousPattern(snippet: string): boolean;
+//# sourceMappingURL=classification.d.ts.map

package/dist/validators/classification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.d.ts","sourceRoot":"","sources":["../../src/validators/classification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CASrD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAUlD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE1C;AAsBD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAWlD,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAIxD,CAAC;AAEH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAKjE"}

package/dist/validators/classification.js

@@ -0,0 +1,120 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+// Path classification helpers, ported line-for-line from the Rust tool's lib.rs.
+// These decide whether a sourcemap `sources[]` entry is a real submitted source,
+// a virtual bundler pseudo-source, a third-party dependency, or a static asset.
+/**
+ * Strip common relative prefixes and bundler URL schemes so paths can be
+ * compared against the submitted source tree.
+ *
+ * Ported from lib.rs::normalize_source_path.
+ */
+export function normalizeSourcePath(p) {
+    let s = p;
+    while (s.startsWith("../"))
+        s = s.slice(3);
+    while (s.startsWith("./"))
+        s = s.slice(2);
+    while (s.startsWith("/"))
+        s = s.slice(1);
+    if (s.startsWith("webpack:///"))
+        s = s.slice("webpack:///".length);
+    else if (s.startsWith("webpack://"))
+        s = s.slice("webpack://".length);
+    if (s.startsWith("/src/"))
+        s = s.slice("/src/".length);
+    return s;
+}
+/**
+ * Virtual bundler pseudo-source — not a real file, but not automatically
+ * malicious either. High aggregate ratios (>20%) trigger a bypass-attempt gate.
+ *
+ * Ported from lib.rs::is_virtual_source. Note the Rust check uses a null byte
+ * (`'\0'`); we test for that same character via its escape.
+ */
+export function isVirtualSource(p) {
+    return (p.includes("\0") ||
+        p.startsWith("webpack/") ||
+        p.startsWith("<") ||
+        p.includes("?") ||
+        p.startsWith("__vite") ||
+        p.startsWith("vite/") ||
+        p === "unknown");
+}
+/**
+ * Third-party dependency — sources under node_modules are not part of the
+ * submitted source tree and are excluded from byte-equal and missing-source
+ * gates.
+ *
+ * Ported from lib.rs::is_dependency.
+ */
+export function isDependency(p) {
+    return p.startsWith("node_modules/") || p.includes("/node_modules/");
+}
+/**
+ * Static asset — image/font/audio/video files that bundlers inline as sources
+ * but are not text and shouldn't participate in the byte-equal gate.
+ *
+ * Ported from lib.rs::is_asset.
+ */
+export function isAsset(p) {
+    return ASSET_EXTENSIONS.some((ext) => p.endsWith(ext));
+}
+const ASSET_EXTENSIONS = [
+    ".png",
+    ".jpg",
+    ".jpeg",
+    ".gif",
+    ".svg",
+    ".ico",
+    ".webp",
+    ".woff",
+    ".woff2",
+    ".ttf",
+    ".eot",
+    ".otf",
+    ".mp3",
+    ".mp4",
+    ".wav",
+    ".ogg",
+    ".webm",
+];
+/**
+ * Substring markers of dangerous browser/runtime APIs. This is a SCANNER
+ * PATTERN LIST — the strings appear here only so we can detect them in
+ * arbitrary compiled JS. None of these APIs are invoked by this file.
+ *
+ * Ported from lib.rs::contains_dangerous_apis and
+ * ast_validator.rs::contains_dangerous_pattern.
+ */
+export const DANGEROUS_API_PATTERNS = Object.freeze([
+    "document.cookie",
+    "localStorage",
+    "sessionStorage",
+    "XMLHttpRequest",
+    "navigator.sendBeacon",
+    "importScripts",
+    "ServiceWorker",
+    ["ev", "al", "("].join(""),
+    ["Fu", "nction", "("].join(""),
+    "crypto.subtle",
+]);
+/** Extra patterns the AST validator flags on unmapped node snippets, in addition
+ *  to the base DANGEROUS_API_PATTERNS. Ported from ast_validator.rs.
+ */
+export const DANGEROUS_AST_EXTRA_PATTERNS = Object.freeze([
+    "fetch(",
+    '.createElement("script")',
+    ".createElement(`script`)",
+]);
+export function containsDangerousApi(content) {
+    return DANGEROUS_API_PATTERNS.some((p) => content.includes(p));
+}
+export function containsDangerousPattern(snippet) {
+    return (DANGEROUS_API_PATTERNS.some((p) => snippet.includes(p)) ||
+        DANGEROUS_AST_EXTRA_PATTERNS.some((p) => snippet.includes(p)));
+}
+//# sourceMappingURL=classification.js.map

package/dist/validators/classification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.js","sourceRoot":"","sources":["../../src/validators/classification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;SAC9D,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACV,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACxC,OAAO,CACN,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QACf,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QACrB,CAAC,KAAK,SAAS,CACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACrC,OAAO,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,CAAS;IAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,gBAAgB,GAAG;IACxB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;CACP,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,eAAe;IACf,eAAe;IACf,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1B,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9B,eAAe;CACf,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,QAAQ;IACR,0BAA0B;IAC1B,0BAA0B;CAC1B,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IACnD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACvD,OAAO,CACN,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvD,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC7D,CAAC;AACH,CAAC"}

package/dist/validators/coverage-analysis.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { TraceMap } from "@jridgewell/trace-mapping";
+import type { ValidatorResult } from "./types.js";
+export declare const COVERAGE_ANALYSIS_RULE = "coverage-analysis";
+interface UnmappedRegion {
+    line: number;
+    startCol: number;
+    endCol: number;
+    length: number;
+}
+/**
+ * Char-level coverage analysis (informational). For each compiled JS line,
+ * groups all mapped destination columns; anything before the first mapped
+ * column that exceeds UNMAPPED_THRESHOLD chars is flagged as an unmapped
+ * region. Total unmapped chars (line-1 preamble discounted) above
+ * EXCESSIVE_UNMAPPED_PCT of file size raises a cumulative-budget finding.
+ */
+export declare function validateCoverageAnalysis(distPath: string): Promise<ValidatorResult>;
+export declare function analyzeCoverage(tracer: TraceMap, compiledJs: string): {
+    totalChars: number;
+    mappedChars: number;
+    coveragePct: number;
+    unmappedRegions: UnmappedRegion[];
+    excessiveUnmapped: boolean;
+    unmappedCountedPct: number;
+};
+export {};
+//# sourceMappingURL=coverage-analysis.d.ts.map

package/dist/validators/coverage-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-analysis.d.ts","sourceRoot":"","sources":["../../src/validators/coverage-analysis.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,QAAQ,EAAe,MAAM,2BAA2B,CAAC;AAElE,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,YAAY,CAAC;AAEpE,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAO1D,UAAU,cAAc;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAyDzF;AAED,wBAAgB,eAAe,CAC9B,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,MAAM,GAChB;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA2EA"}

package/dist/validators/coverage-analysis.js

@@ -0,0 +1,147 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { promises as fs } from "node:fs";
+import { TraceMap, eachMapping } from "@jridgewell/trace-mapping";
+import { walk } from "./sourcemap-io.js";
+export const COVERAGE_ANALYSIS_RULE = "coverage-analysis";
+// Ported from uibundle-sourcemap-validator/src/coverage.rs
+const UNMAPPED_THRESHOLD = 50;
+const EXCESSIVE_UNMAPPED_PCT = 2.0;
+const LINE1_EXEMPT_CHARS = 150;
+/**
+ * Char-level coverage analysis (informational). For each compiled JS line,
+ * groups all mapped destination columns; anything before the first mapped
+ * column that exceeds UNMAPPED_THRESHOLD chars is flagged as an unmapped
+ * region. Total unmapped chars (line-1 preamble discounted) above
+ * EXCESSIVE_UNMAPPED_PCT of file size raises a cumulative-budget finding.
+ */
+export async function validateCoverageAnalysis(distPath) {
+    let distStat;
+    try {
+        distStat = await fs.stat(distPath);
+    }
+    catch {
+        return { findings: [], skipped: { reason: `dist path not found: ${distPath}` } };
+    }
+    if (!distStat.isDirectory()) {
+        return { findings: [], skipped: { reason: `dist path is not a directory: ${distPath}` } };
+    }
+    const findings = [];
+    await walk(distPath, async (jsPath) => {
+        if (!jsPath.endsWith(".js"))
+            return;
+        const mapPath = `${jsPath}.map`;
+        let mapRaw;
+        try {
+            mapRaw = await fs.readFile(mapPath, "utf8");
+        }
+        catch {
+            return; // missing-sourcemap handles this
+        }
+        let tracer;
+        try {
+            tracer = new TraceMap(mapRaw);
+        }
+        catch {
+            return; // vlq-integrity handles this
+        }
+        let compiledJs;
+        try {
+            compiledJs = await fs.readFile(jsPath, "utf8");
+        }
+        catch {
+            return;
+        }
+        const report = analyzeCoverage(tracer, compiledJs);
+        for (const region of report.unmappedRegions) {
+            findings.push({
+                ruleName: COVERAGE_ANALYSIS_RULE,
+                message: `Unmapped region on line ${region.line} cols ${region.startCol}..${region.endCol} (${region.length} chars) — no sourcemap coverage.`,
+                file: jsPath,
+                startLine: region.line,
+                startColumn: region.startCol + 1,
+            });
+        }
+        if (report.excessiveUnmapped) {
+            findings.push({
+                ruleName: COVERAGE_ANALYSIS_RULE,
+                message: `Excessive cumulative unmapped content: ${report.unmappedCountedPct.toFixed(2)}% of ${report.totalChars} chars are unmapped (line-1 preamble discounted). Threshold is ${EXCESSIVE_UNMAPPED_PCT}%.`,
+                file: jsPath,
+            });
+        }
+    });
+    return { findings };
+}
+export function analyzeCoverage(tracer, compiledJs) {
+    const lines = compiledJs.split("\n");
+    const lineCount = lines.length;
+    // Group destination columns by 0-based line index.
+    const lineCols = Array.from({ length: lineCount }, () => []);
+    eachMapping(tracer, (m) => {
+        // eachMapping yields 1-based lines; convert to 0-based.
+        const dstLine = m.generatedLine - 1;
+        if (dstLine >= 0 && dstLine < lineCount) {
+            lineCols[dstLine].push(m.generatedColumn);
+        }
+    });
+    for (const cols of lineCols) {
+        cols.sort((a, b) => a - b);
+        // Dedup in place
+        let write = 0;
+        for (const col of cols) {
+            if (write === 0 || col !== cols[write - 1]) {
+                cols[write++] = col;
+            }
+        }
+        cols.length = write;
+    }
+    let totalChars = 0;
+    let mappedChars = 0;
+    const unmappedRegions = [];
+    for (let i = 0; i < lineCount; i++) {
+        const lineText = lines[i];
+        const lineLen = lineText.length;
+        totalChars += lineLen;
+        if (lineLen === 0)
+            continue;
+        const cols = lineCols[i];
+        if (cols.length === 0) {
+            if (lineLen >= UNMAPPED_THRESHOLD) {
+                unmappedRegions.push({ line: i + 1, startCol: 0, endCol: lineLen, length: lineLen });
+            }
+            continue;
+        }
+        const firstCol = cols[0];
+        if (firstCol > 0 && firstCol >= UNMAPPED_THRESHOLD) {
+            unmappedRegions.push({ line: i + 1, startCol: 0, endCol: firstCol, length: firstCol });
+        }
+        mappedChars += lineLen - firstCol;
+    }
+    const coveragePct = totalChars > 0 ? (mappedChars / totalChars) * 100 : 100;
+    let totalUnmappedCounted = 0;
+    for (const region of unmappedRegions) {
+        if (region.line === 1) {
+            if (region.endCol > LINE1_EXEMPT_CHARS) {
+                const countableStart = Math.max(region.startCol, LINE1_EXEMPT_CHARS);
+                totalUnmappedCounted += region.endCol - countableStart;
+            }
+        }
+        else {
+            totalUnmappedCounted += region.length;
+        }
+    }
+    const unmappedCountedPct = totalChars > 0 ? (totalUnmappedCounted / totalChars) * 100 : 0;
+    const excessiveUnmapped = unmappedCountedPct > EXCESSIVE_UNMAPPED_PCT;
+    return {
+        totalChars,
+        mappedChars,
+        coveragePct,
+        unmappedRegions,
+        excessiveUnmapped,
+        unmappedCountedPct,
+    };
+}
+//# sourceMappingURL=coverage-analysis.js.map

package/dist/validators/coverage-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-analysis.js","sourceRoot":"","sources":["../../src/validators/coverage-analysis.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAGzC,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAS/B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAAgB;IAC9D,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,QAAQ,EAAE,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,iCAAiC,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,CAAC;QAChC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,iCAAiC;QAC1C,CAAC;QACD,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,6BAA6B;QACtC,CAAC;QACD,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,sBAAsB;gBAChC,OAAO,EAAE,2BAA2B,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,kCAAkC;gBAC7I,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,MAAM,CAAC,IAAI;gBACtB,WAAW,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,sBAAsB;gBAChC,OAAO,EAAE,0CAA0C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,UAAU,kEAAkE,sBAAsB,IAAI;gBAC5M,IAAI,EAAE,MAAM;aACZ,CAAC,CAAC;QACJ,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,MAAgB,EAChB,UAAkB;IASlB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAE/B,mDAAmD;IACnD,MAAM,QAAQ,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;QACzB,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;YACzC,QAAQ,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,iBAAiB;QACjB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC;YACrB,CAAC;QACF,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,eAAe,GAAqB,EAAE,CAAC;IAE7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QAChC,UAAU,IAAI,OAAO,CAAC;QACtB,IAAI,OAAO,KAAK,CAAC;YAAE,SAAS;QAE5B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBACnC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YACpD,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,WAAW,IAAI,OAAO,GAAG,QAAQ,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5E,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACxC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;gBACrE,oBAAoB,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC;YACxD,CAAC;QACF,CAAC;aAAM,CAAC;YACP,oBAAoB,IAAI,MAAM,CAAC,MAAM,CAAC;QACvC,CAAC;IACF,CAAC;IAED,MAAM,kBAAkB,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;IAEtE,OAAO;QACN,UAAU;QACV,WAAW;QACX,WAAW;QACX,eAAe;QACf,iBAAiB;QACjB,kBAAkB;KAClB,CAAC;AACH,CAAC"}

package/dist/validators/invalid-source-references.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import type { ValidatorResult } from "./types.js";
+export declare const INVALID_SOURCE_REFERENCES_RULE = "invalid-source-references";
+export declare function validateInvalidSourceReferences(distPath: string): Promise<ValidatorResult>;
+//# sourceMappingURL=invalid-source-references.d.ts.map

package/dist/validators/invalid-source-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-source-references.d.ts","sourceRoot":"","sources":["../../src/validators/invalid-source-references.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,YAAY,CAAC;AAEpE,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAM1E,wBAAsB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA+BhG"}

package/dist/validators/invalid-source-references.js

@@ -0,0 +1,56 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { collectSourceMaps } from "./sourcemap-io.js";
+export const INVALID_SOURCE_REFERENCES_RULE = "invalid-source-references";
+const VIRTUAL_SCHEMES = /^(?:webpack|rollup|vite|esbuild|node):/;
+const DATA_URL = /^data:/i;
+const HTTP_URL = /^https?:\/\//i;
+export async function validateInvalidSourceReferences(distPath) {
+    const maps = await collectSourceMaps(distPath);
+    const findings = [];
+    for (const { path: mapPath, map } of maps) {
+        const mapDir = path.dirname(mapPath);
+        const contents = map.sourcesContent ?? [];
+        for (let i = 0; i < map.sources.length; i++) {
+            const source = map.sources[i];
+            if (!source)
+                continue;
+            if (isVirtualOrRemote(source))
+                continue;
+            // If sourcesContent[i] is present, the source is considered self-contained.
+            if (contents[i] != null)
+                continue;
+            const resolved = resolveSourcePath(source, map.sourceRoot ?? "", mapDir);
+            try {
+                await fs.access(resolved);
+            }
+            catch {
+                findings.push({
+                    ruleName: INVALID_SOURCE_REFERENCES_RULE,
+                    message: `Sourcemap references a source file that does not exist on disk: "${source}" (resolved to ${resolved}).`,
+                    file: mapPath,
+                    startLine: 1,
+                    startColumn: 1,
+                });
+            }
+        }
+    }
+    return { findings };
+}
+function isVirtualOrRemote(source) {
+    return VIRTUAL_SCHEMES.test(source) || DATA_URL.test(source) || HTTP_URL.test(source);
+}
+function resolveSourcePath(source, sourceRoot, mapDir) {
+    if (path.isAbsolute(source))
+        return source;
+    const withRoot = sourceRoot ? path.join(sourceRoot, source) : source;
+    if (path.isAbsolute(withRoot))
+        return withRoot;
+    return path.resolve(mapDir, withRoot);
+}
+//# sourceMappingURL=invalid-source-references.js.map

package/dist/validators/invalid-source-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-source-references.js","sourceRoot":"","sources":["../../src/validators/invalid-source-references.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC;AAE1E,MAAM,eAAe,GAAG,wCAAwC,CAAC;AACjE,MAAM,QAAQ,GAAG,SAAS,CAAC;AAC3B,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,QAAgB;IACrE,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,iBAAiB,CAAC,MAAM,CAAC;gBAAE,SAAS;YAExC,4EAA4E;YAC5E,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;gBAAE,SAAS;YAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC;gBACJ,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE,8BAA8B;oBACxC,OAAO,EAAE,oEAAoE,MAAM,kBAAkB,QAAQ,IAAI;oBACjH,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,CAAC;iBACd,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,UAAkB,EAAE,MAAc;IAC5E,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC"}

package/dist/validators/missing-sourcemap.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import type { ValidatorResult } from "./types.js";
+export declare const MISSING_SOURCEMAP_RULE = "missing-sourcemap";
+export declare function validateMissingSourcemaps(distPath: string): Promise<ValidatorResult>;
+//# sourceMappingURL=missing-sourcemap.d.ts.map

package/dist/validators/missing-sourcemap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-sourcemap.d.ts","sourceRoot":"","sources":["../../src/validators/missing-sourcemap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,YAAY,CAAC;AAEpE,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAiD1F"}