@vinktarhq/cli 0.1.0

package/dist/upload.js

@@ -0,0 +1,383 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { basename, isAbsolute, relative, sep } from 'node:path';
+import { gzipSync } from 'node:zlib';
+import { deriveDebugId, existingDebugId, injectIntoMap, mapDebugId } from './debug-id.js';
+import { isEmptyMap } from './discover.js';
+import { backoffMs, RETRIABLE_STATUS, retriable, send as request, timeoutFor } from './http.js';
+import { CONSERVATIVE_BATCH_BYTES, DEFAULT_HOST, MAX_FILE_BYTES, MAX_REQUEST_BYTES, RECOMMENDED_BATCH_BYTES, REQUIRED_SCOPE, } from './limits.js';
+import { multipart, overheadFor } from './multipart.js';
+import { toUrl } from './url.js';
+export class UploadError extends Error {
+    status;
+    code;
+    hint;
+    constructor(message, status, code, hint) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.hint = hint;
+        this.name = 'UploadError';
+    }
+}
+/**
+ * Index one artifact: what it is, what it hashes to, and how big it will be on the wire.
+ *
+ * The body is built and then DISCARDED. Holding it would mean the whole build sitting in memory
+ * before the first request left — a few hundred chunks of a real application is hundreds of
+ * megabytes — and it is cheap to rebuild from a local file at the moment it is actually sent.
+ *
+ * Returns null when there is nothing to upload, rather than throwing: a directory of chunks where
+ * only some have maps is normal, not an error.
+ */
+export async function index(artifact, urlPrefix, options = {}) {
+    if (artifact.map === null)
+        return null;
+    const { body, injected, raw } = await build(artifact, options);
+    const bytes = Buffer.byteLength(body);
+    return {
+        entry: {
+            name: basename(artifact.map),
+            url: toUrl(urlPrefix, artifact.relative),
+            debugId: debugIdOf(body),
+            bytes,
+            sha256: createHash('sha256').update(body).digest('hex'),
+            mapSha256: createHash('sha256').update(raw).digest('hex'),
+            injected,
+        },
+        // Reported, not thrown. One 20 MB chunk used to abort the whole upload, so a single
+        // pathological bundle cost symbolication for every other file in the build.
+        oversized: bytes > MAX_FILE_BYTES,
+        // A map with no mappings and no sources answers no question; Vite emits one per HTML entry.
+        empty: isEmptyMap(raw),
+    };
+}
+/**
+ * The exact bytes that go on the wire for this artifact.
+ *
+ * Deterministic, which is what lets `index` throw the body away and this rebuild it later: the id
+ * already injected into the chunk wins, so a second call cannot produce a different map than the
+ * one that was hashed.
+ */
+export async function materialise(artifact, options = {}) {
+    return (await build(artifact, options)).body;
+}
+async function build(artifact, options) {
+    if (artifact.map === null)
+        throw new Error(`${artifact.relative} has no source map`);
+    const [code, rawMap] = await Promise.all([
+        readFile(artifact.file, 'utf8'),
+        readFile(artifact.map, 'utf8'),
+    ]);
+    // Prefer the id already injected into the chunk: that is the one the SDK will report, and
+    // deriving a fresh one here would produce a map nothing ever asks for. The map's own id is the
+    // next best thing — a bundler that stamps ids natively writes it there and nowhere else.
+    const injected = existingDebugId(code);
+    const debugId = injected ?? mapDebugId(rawMap) ?? deriveDebugId(code);
+    const prepared = options.rewriteSources === false ? rawMap : rewrite(rawMap, options.root);
+    return { body: injectIntoMap(prepared, debugId), injected: injected !== null, raw: rawMap };
+}
+const SCHEME = /^(?:webpack|rollup|vite|ng|rspack|turbopack|file):\/{0,3}/i;
+/**
+ * Tidy `sources` in the uploaded copy, never on disk.
+ *
+ * Two things come out of a bundler that should not reach a server. `webpack:///./src/App.tsx` is
+ * a protocol nothing can open, and it is what the UI would print beside every frame. And an
+ * absolute path is the build machine's directory layout — `/home/runner/work/acme/acme/src/…`, or
+ * worse, someone's home directory — which is both noise and information the ingest never asked
+ * for.
+ *
+ * The uploaded copy only. Rewriting the file would change bytes another tool may already have
+ * hashed, and the map on disk is the one a developer opens locally, where an absolute path is
+ * exactly what they want.
+ */
+export function rewrite(mapJson, root) {
+    let parsed;
+    try {
+        parsed = JSON.parse(mapJson);
+    }
+    catch {
+        return mapJson;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return mapJson;
+    const map = parsed;
+    const sources = map['sources'];
+    if (!Array.isArray(sources))
+        return mapJson;
+    return JSON.stringify({
+        ...map,
+        sources: sources.map((source) => {
+            if (typeof source !== 'string')
+                return source;
+            let value = source.replace(SCHEME, '');
+            if (root !== undefined && root !== '' && isAbsolute(value)) {
+                const inside = relative(root, value);
+                // Only when it is genuinely inside the root: `../../../home/other` is not a tidier path,
+                // it is the same path spelled less clearly.
+                if (!inside.startsWith('..') && !isAbsolute(inside))
+                    value = inside;
+            }
+            return value.split(sep).join('/').replace(/^\.\//, '');
+        }),
+    });
+}
+function debugIdOf(body) {
+    const parsed = JSON.parse(body);
+    return typeof parsed === 'object' && parsed !== null
+        ? String(parsed['debugId'] ?? '')
+        : '';
+}
+/**
+ * Ask the server which of these bodies it already holds, and what it will accept.
+ *
+ * The dedupe half is purely an optimisation, so every failure mode answers "none": an older ingest
+ * with no such route, a proxy in the way, a network blip. Uploading something the server already
+ * has is a wasted request; NOT uploading something it does not have is a build with no
+ * symbolication, and those are not the same mistake.
+ *
+ * The limits half matters more than it looks. The protocol says 20 MiB per file and 60 MiB per
+ * request, but what a deployment actually accepts is the smaller of that and its PHP
+ * `upload_max_filesize` / `post_max_size` — and a POST over `post_max_size` is not rejected, the
+ * body is silently dropped and the server answers `missing_release`, which reads like a CLI bug.
+ * Asking is the difference between a clear message and an afternoon.
+ */
+export async function preflight(options, hashes) {
+    try {
+        const reply = await request({
+            method: 'POST',
+            url: `${options.host}/v1/sourcemaps/check`,
+            key: options.key,
+            headers: { 'Content-Type': 'application/json', ...options.headers },
+            body: JSON.stringify({ sha256: hashes }),
+            timeoutMs: options.timeoutMs ?? REQUEST_TIMEOUT_MS,
+            ...(options.plugin === undefined ? {} : { plugin: options.plugin }),
+            ...(options.env === undefined ? {} : { env: options.env }),
+        });
+        if (reply.status < 200 || reply.status >= 300)
+            return { stored: new Set(), limits: null };
+        const payload = JSON.parse(reply.text);
+        const stored = payload['stored'];
+        return {
+            stored: Array.isArray(stored) ? new Set(stored.filter((v) => typeof v === 'string')) : new Set(),
+            limits: readLimits(payload['limits']),
+        };
+    }
+    catch {
+        return { stored: new Set(), limits: null };
+    }
+}
+/**
+ * Read the server's limits defensively.
+ *
+ * Every field falls back to the compiled-in protocol value, so a deployment that publishes half
+ * the object, or an older one that publishes none of it, still gets a working client rather than
+ * a batch sized `NaN`.
+ */
+function readLimits(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const raw = value;
+    const number = (name, fallback) => {
+        const found = raw[name];
+        return typeof found === 'number' && Number.isFinite(found) && found > 0 ? found : fallback;
+    };
+    const maxFileBytes = number('maxFileBytes', MAX_FILE_BYTES);
+    return {
+        maxFileBytes,
+        // `maxPartBytes` is the ini-aware one: the same deployment can advertise a 20 MiB protocol
+        // ceiling and a 2 MiB `upload_max_filesize`, and only one of those is true of the socket.
+        maxPartBytes: number('maxPartBytes', maxFileBytes),
+        maxRequestBytes: number('maxRequestBytes', MAX_REQUEST_BYTES),
+        // The server calls it `maxBatchBytes`; the older draft of the protocol called it
+        // `recommendedBatchBytes`, and both spellings are read so the deploy order of the two halves
+        // is not load-bearing.
+        recommendedBatchBytes: number('maxBatchBytes', number('recommendedBatchBytes', RECOMMENDED_BATCH_BYTES)),
+        concurrency: number('concurrency', DEFAULT_CONCURRENCY),
+        compression: Array.isArray(raw['compression'])
+            ? raw['compression'].filter((entry) => typeof entry === 'string')
+            : [],
+    };
+}
+/** Four at a time: enough to hide the latency, few enough not to trip the ingest rate limit. */
+export const DEFAULT_CONCURRENCY = 4;
+/**
+ * Send one batch.
+ *
+ * Batches are bounded by the request ceiling rather than by count: maps vary from kilobytes to
+ * megabytes, so a fixed count would either waste requests or overshoot.
+ *
+ * Each part is gzipped when the server says it accepts that. `Content-Encoding` does NOT survive
+ * multipart parsing — PHP hands the handler the raw part and nothing else — so a compressed part
+ * is simply a part whose bytes are gzip, which the server detects by its magic number. Source maps
+ * are JSON with long runs of repeated source text and compress by 80–90%, which is the difference
+ * between one request and six.
+ */
+export async function send(options, batch, limits = null) {
+    const compress = limits?.compression.includes('gzip') === true;
+    const parts = [
+        { name: 'release', value: options.release },
+        ...(options.dist === undefined || options.dist === '' ? [] : [{ name: 'dist', value: options.dist }]),
+    ];
+    for (const { entry, body } of batch) {
+        parts.push({
+            name: 'files[]',
+            value: compress ? gzipSync(Buffer.from(body, 'utf8'), { level: 6 }) : body,
+            filename: entry.name,
+            contentType: 'application/json',
+        });
+        parts.push({ name: 'urls[]', value: entry.url });
+        parts.push({ name: 'debug_ids[]', value: entry.debugId });
+    }
+    const { body, contentType } = multipart(parts);
+    const attempts = Math.max(1, options.maxRetries ?? MAX_ATTEMPTS);
+    const isDefaultHost = options.host === DEFAULT_HOST;
+    // Bounded and retried. A deploy step that hangs on a half-open socket, or fails its whole run
+    // on one 502 from a proxy in front of ingest, is worse than a build without symbolication;
+    // the response table says these are transient, so they get the protocol's retry, with backoff.
+    for (let attempt = 0;; attempt += 1) {
+        let reply;
+        try {
+            reply = await request({
+                method: 'POST',
+                url: `${options.host}/v1/sourcemaps`,
+                key: options.key,
+                headers: { 'Content-Type': contentType, ...options.headers },
+                body,
+                timeoutMs: timeoutFor(body.length, options.timeoutMs ?? REQUEST_TIMEOUT_MS),
+                ...(options.plugin === undefined ? {} : { plugin: options.plugin }),
+                ...(options.env === undefined ? {} : { env: options.env }),
+            });
+        }
+        catch (error) {
+            if (attempt < attempts - 1 && retriable(error, isDefaultHost)) {
+                await sleep(backoffMs(attempt));
+                continue;
+            }
+            throw new UploadError(`Could not reach ${options.host}${attempt > 0 ? ` after ${attempt + 1} attempts` : ''}: ${error instanceof Error ? error.message : String(error)}`, 0, 'network', 'Check the host and that the machine running this can reach it.');
+        }
+        let payload = {};
+        try {
+            payload = JSON.parse(reply.text);
+        }
+        catch {
+            // A non-JSON body means something in front of the app answered — a proxy, a WAF, a 502 page.
+        }
+        if (reply.status === 201) {
+            return {
+                stored: Number(payload['stored'] ?? batch.length),
+                artifacts: Array.isArray(payload['artifacts']) ? payload['artifacts'] : [],
+            };
+        }
+        if (RETRIABLE_STATUS.has(reply.status) && attempt < attempts - 1) {
+            await sleep(backoffMs(attempt, reply.header('retry-after')));
+            continue;
+        }
+        throw describe(reply.status, payload, reply.text);
+    }
+}
+/** Three tries: one for the blip, one for the restart, then the truth. */
+const MAX_ATTEMPTS = 3;
+const REQUEST_TIMEOUT_MS = 30_000;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Turn a rejection into something actionable.
+ *
+ * Every one of these is a mistake someone will make, and the raw code alone tells them nothing.
+ * `cli_scope_required` in particular looks like a bad key when it is really the right key with the
+ * wrong scope, and without the hint that is a long afternoon.
+ */
+function describe(status, payload, raw) {
+    const code = String(payload['error'] ?? payload['message'] ?? '') || `http_${status}`;
+    switch (code) {
+        case 'cli_scope_required':
+            return new UploadError('That key cannot upload source maps.', status, code, `Source-map upload needs a key with the "${REQUIRED_SCOPE}" scope. A write key is not enough — create one in project settings.`);
+        case 'missing_api_key':
+        case 'invalid_api_key':
+            return new UploadError('The write key was rejected.', status, code, 'Check --key, or the VINKTAR_CLI_KEY environment variable.');
+        case 'missing_release':
+            return new UploadError('A release is required.', status, code, 
+            // The second sentence is the one that saves the afternoon: an oversized POST is not
+            // rejected by PHP, the body is dropped, and the server then honestly reports no release.
+            'Pass --release with the same value your SDK reports. If you did pass one, the request was over the server\'s post_max_size and its body was discarded before PHP saw it — lower the batch size or raise post_max_size.');
+        case 'invalid_release':
+        case 'invalid_dist':
+            return new UploadError(`The ${code === 'invalid_release' ? 'release' : 'dist'} name was rejected.`, status, code, 'It must be at most 64 bytes and contain no slashes, control characters, or leading or trailing whitespace.');
+        case 'missing_url_or_debug_id':
+            return new UploadError('A file had neither a URL nor a debug id, so the whole upload was rejected.', status, code, 'This is a bug in the CLI — please report it with the command you ran.');
+        case 'quota_exceeded': {
+            const quota = Number(payload['quota_bytes'] ?? 0);
+            const used = Number(payload['used_bytes'] ?? 0);
+            return new UploadError(`Source-map storage is full: ${mb(used)} of ${mb(quota)} used.`, status, code, 'Delete old releases from project settings, or upgrade the plan for more storage.');
+        }
+        case 'file_too_large':
+            return new UploadError(`A map is over the ${mb(Number(payload['max_bytes'] ?? MAX_FILE_BYTES))} per-file limit.`, status, code, 'Split the bundle, or exclude that chunk with --ignore.');
+        case 'payload_too_large':
+            return new UploadError(`The request was too large${payload['max_bytes'] === undefined ? '' : ` (the server accepts ${mb(Number(payload['max_bytes']))})`}.`, status, code, 'Lower --concurrency, or raise the server\'s post_max_size.');
+        default:
+            return new UploadError(`Ingest rejected the upload (HTTP ${status}).`, status, code, raw.slice(0, 200) || undefined);
+    }
+}
+/**
+ * Group indexed maps into requests that fit.
+ *
+ * The budget is approached with headroom, because multipart framing and the field names add bytes
+ * the file sizes do not account for, and an oversized request costs the whole batch. Sized on the
+ * UNCOMPRESSED bodies even when the parts will be gzipped: compression only ever makes the request
+ * smaller, so the bound stays true and one batch's worth of maps is still what sits in memory.
+ *
+ * Generic over whatever the caller is carrying alongside the entry, so a batch can hold the
+ * artifact each map came from and the body can be read back from disk as its batch is sent —
+ * nothing here pins the build in memory.
+ */
+export function batch(items, limits = null) {
+    // Without a word from the server this stays deliberately small — see CONSERVATIVE_BATCH_BYTES.
+    const budget = limits === null
+        ? CONSERVATIVE_BATCH_BYTES
+        : Math.max(1, Math.min(limits.recommendedBatchBytes, Math.floor(limits.maxRequestBytes * 0.9)));
+    const framing = overheadFor({ name: 'files[]', value: '', filename: 'x'.repeat(64), contentType: 'application/json' });
+    const batches = [];
+    let current = [];
+    let size = 0;
+    for (const item of items) {
+        const cost = item.entry.bytes + framing;
+        if (current.length > 0 && size + cost > budget) {
+            batches.push(current);
+            current = [];
+            size = 0;
+        }
+        current.push(item);
+        size += cost;
+    }
+    if (current.length > 0)
+        batches.push(current);
+    return batches;
+}
+/**
+ * Run `work` over `items` with a bounded number in flight.
+ *
+ * Source maps are large and the server is usually far away, so a build of two hundred chunks spent
+ * most of its upload waiting on a socket. Bounded rather than unbounded: an unbounded fan-out of
+ * 6 MB requests is how a deploy step gets itself rate-limited.
+ */
+export async function pooled(items, limit, work) {
+    const results = new Array(items.length);
+    let next = 0;
+    const runner = async () => {
+        for (;;) {
+            const i = next;
+            next += 1;
+            if (i >= items.length)
+                return;
+            results[i] = await work(items[i], i);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, runner));
+    return results;
+}
+export function mb(bytes) {
+    return `${(bytes / 1_048_576).toFixed(1)} MB`;
+}
+//# sourceMappingURL=upload.js.map

package/dist/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../src/upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAiB,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,IAAI,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAa,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AA0EjC,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGzB;IACA;IACA;IAJX,YACE,OAAe,EACN,MAAc,EACd,IAAY,EACZ,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAS;QAGtB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,QAAkB,EAClB,SAAiB,EACjB,UAA0D,EAAE;IAE5D,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEtC,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;YACxC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;YACxB,KAAK;YACL,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACvD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACzD,QAAQ;SACT;QACD,oFAAoF;QACpF,4EAA4E;QAC5E,SAAS,EAAE,KAAK,GAAG,cAAc;QACjC,4FAA4F;QAC5F,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAkB,EAClB,UAA0D,EAAE;IAE5D,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,QAAkB,EAClB,OAAuD;IAEvD,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,QAAQ,oBAAoB,CAAC,CAAC;IAErF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KAC/B,CAAC,CAAC;IAEH,0FAA0F;IAC1F,+FAA+F;IAC/F,yFAAyF;IACzF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,MAAM,GAAG,4DAA4D,CAAC;AAE5E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,IAAa;IACpD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAE3F,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE5C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,GAAG;QACN,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAe,EAAE,EAAE;YACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAE9C,IAAI,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACrC,yFAAyF;gBACzF,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,KAAK,GAAG,MAAM,CAAC;YACtE,CAAC;YAED,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEzC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAClD,CAAC,CAAC,MAAM,CAAE,MAAkC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AASD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB,EAAE,MAAyB;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,sBAAsB;YAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;YACnE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACxC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;YAClD,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAE1F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE;YAC7G,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAU,EAAE;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QAExB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7F,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAE5D,OAAO;QACL,YAAY;QACZ,2FAA2F;QAC3F,0FAA0F;QAC1F,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC;QAClD,eAAe,EAAE,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;QAC7D,iFAAiF;QACjF,6FAA6F;QAC7F,uBAAuB;QACvB,qBAAqB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;QACxG,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC;QACvD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAClF,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,OAAsB,EACtB,KAA0D,EAC1D,SAAwB,IAAI;IAE5B,MAAM,QAAQ,GAAG,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAE/D,MAAM,KAAK,GAAW;QACpB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;QAC3C,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;KACtG,CAAC;IAEF,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1E,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC;IAEpD,8FAA8F;IAC9F,2FAA2F;IAC3F,+FAA+F;IAC/F,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC;gBACpB,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,gBAAgB;gBACpC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;gBAC5D,IAAI;gBACJ,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;gBAC3E,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9D,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,WAAW,CACnB,mBAAmB,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClJ,CAAC,EACD,SAAS,EACT,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,GAA4B,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;QAC/F,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;gBACjD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;aAC3E,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,MAAc,EAAE,OAAgC,EAAE,GAAW;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,QAAQ,MAAM,EAAE,CAAC;IAEtF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,oBAAoB;YACvB,OAAO,IAAI,WAAW,CACpB,qCAAqC,EACrC,MAAM,EACN,IAAI,EACJ,2CAA2C,cAAc,sEAAsE,CAChI,CAAC;QAEJ,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB;YACpB,OAAO,IAAI,WAAW,CACpB,6BAA6B,EAC7B,MAAM,EACN,IAAI,EACJ,2DAA2D,CAC5D,CAAC;QAEJ,KAAK,iBAAiB;YACpB,OAAO,IAAI,WAAW,CACpB,wBAAwB,EACxB,MAAM,EACN,IAAI;YACJ,oFAAoF;YACpF,yFAAyF;YACzF,wNAAwN,CACzN,CAAC;QAEJ,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc;YACjB,OAAO,IAAI,WAAW,CACpB,OAAO,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,EAC3E,MAAM,EACN,IAAI,EACJ,4GAA4G,CAC7G,CAAC;QAEJ,KAAK,yBAAyB;YAC5B,OAAO,IAAI,WAAW,CACpB,4EAA4E,EAC5E,MAAM,EACN,IAAI,EACJ,uEAAuE,CACxE,CAAC;QAEJ,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAEhD,OAAO,IAAI,WAAW,CACpB,+BAA+B,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAC/D,MAAM,EACN,IAAI,EACJ,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,KAAK,gBAAgB;YACnB,OAAO,IAAI,WAAW,CACpB,qBAAqB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,CAAC,kBAAkB,EACzF,MAAM,EACN,IAAI,EACJ,wDAAwD,CACzD,CAAC;QAEJ,KAAK,mBAAmB;YACtB,OAAO,IAAI,WAAW,CACpB,4BAA4B,OAAO,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,EACpI,MAAM,EACN,IAAI,EACJ,4DAA4D,CAC7D,CAAC;QAEJ;YACE,OAAO,IAAI,WAAW,CACpB,oCAAoC,MAAM,IAAI,EAC9C,MAAM,EACN,IAAI,EACJ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,CAC/B,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,KAAK,CACnB,KAAmB,EACnB,SAAwB,IAAI;IAE5B,+FAA+F;IAC/F,MAAM,MAAM,GACV,MAAM,KAAK,IAAI;QACb,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEvH,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAQ,EAAE,CAAC;IACtB,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,IAAI,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,KAAmB,EACnB,KAAa,EACb,IAA4C;IAE5C,MAAM,OAAO,GAAQ,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,CAAC;YACf,IAAI,IAAI,CAAC,CAAC;YACV,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO;YAC9B,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAE9F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,KAAa;IAC9B,OAAO,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC","sourcesContent":["import { createHash } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nimport { basename, isAbsolute, relative, sep } from 'node:path';\nimport { gzipSync } from 'node:zlib';\n\nimport { deriveDebugId, existingDebugId, injectIntoMap, mapDebugId } from './debug-id.js';\nimport { isEmptyMap, type Artifact } from './discover.js';\nimport { backoffMs, RETRIABLE_STATUS, retriable, send as request, timeoutFor } from './http.js';\nimport {\n  CONSERVATIVE_BATCH_BYTES,\n  DEFAULT_HOST,\n  MAX_FILE_BYTES,\n  MAX_REQUEST_BYTES,\n  RECOMMENDED_BATCH_BYTES,\n  REQUIRED_SCOPE,\n} from './limits.js';\nimport { multipart, overheadFor, type Part } from './multipart.js';\nimport { toUrl } from './url.js';\n\n/**\n * Uploads source maps to `POST /v1/sourcemaps`.\n *\n * `files[]`, `urls[]` and `debug_ids[]` are **positional parallel arrays**: the server pairs them\n * by index, so appending to one without the others silently mis-pairs every entry after it. They\n * are therefore built in one loop and never separately.\n */\n\nexport interface UploadOptions {\n  readonly host: string;\n  readonly key: string;\n  readonly release: string;\n  readonly dist?: string;\n  readonly urlPrefix: string;\n  /** Per request, before the size allowance. Default 30 s. */\n  timeoutMs?: number;\n  /** Requests in flight. Default 4, or whatever the server asks for. */\n  concurrency?: number;\n  /** Attempts per request, including the first. Default 3. */\n  maxRetries?: number;\n  /** Extra headers, for a gateway that wants one. Never allowed to displace the key. */\n  headers?: Readonly<Record<string, string>>;\n  /** Appended to the User-Agent, so an ingest log can tell a plugin from a CI script. */\n  plugin?: string;\n  /**\n   * Rewrite `sources` in the uploaded copy. Default true — see {@link rewrite}.\n   * The file on disk is never touched.\n   */\n  rewriteSources?: boolean;\n  /** The build root, which absolute `sources` are made relative to. */\n  root?: string;\n  env?: Record<string, string | undefined>;\n}\n\n/** What this deployment will actually accept, as it reports it. */\nexport interface Limits {\n  readonly maxFileBytes: number;\n  readonly maxPartBytes: number;\n  readonly maxRequestBytes: number;\n  readonly recommendedBatchBytes: number;\n  readonly concurrency: number;\n  readonly compression: readonly string[];\n}\n\nexport interface UploadEntry {\n  readonly name: string;\n  readonly url: string;\n  readonly debugId: string;\n  readonly bytes: number;\n  /** Content hash of the exact body that would be uploaded. The server's dedupe key. */\n  readonly sha256: string;\n  /**\n   * Content hash of the map FILE as it sits on disk, which is a different string: the uploaded\n   * body carries the debug id and, when a line was inserted, a shifted `mappings`.\n   *\n   * Only the plugins use it, and only to answer one question before deleting a map: are these\n   * still the bytes that were uploaded? Turbopack rewrites files while later stages run, and a\n   * map deleted there is one the server never received.\n   */\n  readonly mapSha256: string;\n  /**\n   * Whether the chunk itself carries the id. When false the id was derived here for the map only,\n   * and no frame will ever report it: the map can then match by release + url alone.\n   */\n  readonly injected: boolean;\n}\n\nexport interface UploadResult {\n  readonly stored: number;\n  readonly artifacts: ReadonlyArray<{ file_url?: string; debug_id?: string; size?: number }>;\n}\n\nexport class UploadError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n    readonly code: string,\n    readonly hint?: string,\n  ) {\n    super(message);\n    this.name = 'UploadError';\n  }\n}\n\n/**\n * Index one artifact: what it is, what it hashes to, and how big it will be on the wire.\n *\n * The body is built and then DISCARDED. Holding it would mean the whole build sitting in memory\n * before the first request left — a few hundred chunks of a real application is hundreds of\n * megabytes — and it is cheap to rebuild from a local file at the moment it is actually sent.\n *\n * Returns null when there is nothing to upload, rather than throwing: a directory of chunks where\n * only some have maps is normal, not an error.\n */\nexport async function index(\n  artifact: Artifact,\n  urlPrefix: string,\n  options: Pick<UploadOptions, 'rewriteSources' | 'root'> = {},\n): Promise<{ entry: UploadEntry; oversized: boolean; empty: boolean } | null> {\n  if (artifact.map === null) return null;\n\n  const { body, injected, raw } = await build(artifact, options);\n  const bytes = Buffer.byteLength(body);\n\n  return {\n    entry: {\n      name: basename(artifact.map),\n      url: toUrl(urlPrefix, artifact.relative),\n      debugId: debugIdOf(body),\n      bytes,\n      sha256: createHash('sha256').update(body).digest('hex'),\n      mapSha256: createHash('sha256').update(raw).digest('hex'),\n      injected,\n    },\n    // Reported, not thrown. One 20 MB chunk used to abort the whole upload, so a single\n    // pathological bundle cost symbolication for every other file in the build.\n    oversized: bytes > MAX_FILE_BYTES,\n    // A map with no mappings and no sources answers no question; Vite emits one per HTML entry.\n    empty: isEmptyMap(raw),\n  };\n}\n\n/**\n * The exact bytes that go on the wire for this artifact.\n *\n * Deterministic, which is what lets `index` throw the body away and this rebuild it later: the id\n * already injected into the chunk wins, so a second call cannot produce a different map than the\n * one that was hashed.\n */\nexport async function materialise(\n  artifact: Artifact,\n  options: Pick<UploadOptions, 'rewriteSources' | 'root'> = {},\n): Promise<string> {\n  return (await build(artifact, options)).body;\n}\n\nasync function build(\n  artifact: Artifact,\n  options: Pick<UploadOptions, 'rewriteSources' | 'root'>,\n): Promise<{ body: string; injected: boolean; raw: string }> {\n  if (artifact.map === null) throw new Error(`${artifact.relative} has no source map`);\n\n  const [code, rawMap] = await Promise.all([\n    readFile(artifact.file, 'utf8'),\n    readFile(artifact.map, 'utf8'),\n  ]);\n\n  // Prefer the id already injected into the chunk: that is the one the SDK will report, and\n  // deriving a fresh one here would produce a map nothing ever asks for. The map's own id is the\n  // next best thing — a bundler that stamps ids natively writes it there and nowhere else.\n  const injected = existingDebugId(code);\n  const debugId = injected ?? mapDebugId(rawMap) ?? deriveDebugId(code);\n  const prepared = options.rewriteSources === false ? rawMap : rewrite(rawMap, options.root);\n\n  return { body: injectIntoMap(prepared, debugId), injected: injected !== null, raw: rawMap };\n}\n\nconst SCHEME = /^(?:webpack|rollup|vite|ng|rspack|turbopack|file):\\/{0,3}/i;\n\n/**\n * Tidy `sources` in the uploaded copy, never on disk.\n *\n * Two things come out of a bundler that should not reach a server. `webpack:///./src/App.tsx` is\n * a protocol nothing can open, and it is what the UI would print beside every frame. And an\n * absolute path is the build machine's directory layout — `/home/runner/work/acme/acme/src/…`, or\n * worse, someone's home directory — which is both noise and information the ingest never asked\n * for.\n *\n * The uploaded copy only. Rewriting the file would change bytes another tool may already have\n * hashed, and the map on disk is the one a developer opens locally, where an absolute path is\n * exactly what they want.\n */\nexport function rewrite(mapJson: string, root?: string): string {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(mapJson);\n  } catch {\n    return mapJson;\n  }\n\n  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return mapJson;\n\n  const map = parsed as Record<string, unknown>;\n  const sources = map['sources'];\n  if (!Array.isArray(sources)) return mapJson;\n\n  return JSON.stringify({\n    ...map,\n    sources: sources.map((source: unknown) => {\n      if (typeof source !== 'string') return source;\n\n      let value = source.replace(SCHEME, '');\n      if (root !== undefined && root !== '' && isAbsolute(value)) {\n        const inside = relative(root, value);\n        // Only when it is genuinely inside the root: `../../../home/other` is not a tidier path,\n        // it is the same path spelled less clearly.\n        if (!inside.startsWith('..') && !isAbsolute(inside)) value = inside;\n      }\n\n      return value.split(sep).join('/').replace(/^\\.\\//, '');\n    }),\n  });\n}\n\nfunction debugIdOf(body: string): string {\n  const parsed: unknown = JSON.parse(body);\n\n  return typeof parsed === 'object' && parsed !== null\n    ? String((parsed as Record<string, unknown>)['debugId'] ?? '')\n    : '';\n}\n\nexport interface Preflight {\n  /** sha256 of the bodies the server already holds. */\n  readonly stored: Set<string>;\n  /** What this deployment accepts, when it says. Null on an older ingest, or an unreachable one. */\n  readonly limits: Limits | null;\n}\n\n/**\n * Ask the server which of these bodies it already holds, and what it will accept.\n *\n * The dedupe half is purely an optimisation, so every failure mode answers \"none\": an older ingest\n * with no such route, a proxy in the way, a network blip. Uploading something the server already\n * has is a wasted request; NOT uploading something it does not have is a build with no\n * symbolication, and those are not the same mistake.\n *\n * The limits half matters more than it looks. The protocol says 20 MiB per file and 60 MiB per\n * request, but what a deployment actually accepts is the smaller of that and its PHP\n * `upload_max_filesize` / `post_max_size` — and a POST over `post_max_size` is not rejected, the\n * body is silently dropped and the server answers `missing_release`, which reads like a CLI bug.\n * Asking is the difference between a clear message and an afternoon.\n */\nexport async function preflight(options: UploadOptions, hashes: readonly string[]): Promise<Preflight> {\n  try {\n    const reply = await request({\n      method: 'POST',\n      url: `${options.host}/v1/sourcemaps/check`,\n      key: options.key,\n      headers: { 'Content-Type': 'application/json', ...options.headers },\n      body: JSON.stringify({ sha256: hashes }),\n      timeoutMs: options.timeoutMs ?? REQUEST_TIMEOUT_MS,\n      ...(options.plugin === undefined ? {} : { plugin: options.plugin }),\n      ...(options.env === undefined ? {} : { env: options.env }),\n    });\n\n    if (reply.status < 200 || reply.status >= 300) return { stored: new Set(), limits: null };\n\n    const payload = JSON.parse(reply.text) as Record<string, unknown>;\n    const stored = payload['stored'];\n\n    return {\n      stored: Array.isArray(stored) ? new Set(stored.filter((v): v is string => typeof v === 'string')) : new Set(),\n      limits: readLimits(payload['limits']),\n    };\n  } catch {\n    return { stored: new Set(), limits: null };\n  }\n}\n\n/**\n * Read the server's limits defensively.\n *\n * Every field falls back to the compiled-in protocol value, so a deployment that publishes half\n * the object, or an older one that publishes none of it, still gets a working client rather than\n * a batch sized `NaN`.\n */\nfunction readLimits(value: unknown): Limits | null {\n  if (typeof value !== 'object' || value === null) return null;\n\n  const raw = value as Record<string, unknown>;\n  const number = (name: string, fallback: number): number => {\n    const found = raw[name];\n\n    return typeof found === 'number' && Number.isFinite(found) && found > 0 ? found : fallback;\n  };\n\n  const maxFileBytes = number('maxFileBytes', MAX_FILE_BYTES);\n\n  return {\n    maxFileBytes,\n    // `maxPartBytes` is the ini-aware one: the same deployment can advertise a 20 MiB protocol\n    // ceiling and a 2 MiB `upload_max_filesize`, and only one of those is true of the socket.\n    maxPartBytes: number('maxPartBytes', maxFileBytes),\n    maxRequestBytes: number('maxRequestBytes', MAX_REQUEST_BYTES),\n    // The server calls it `maxBatchBytes`; the older draft of the protocol called it\n    // `recommendedBatchBytes`, and both spellings are read so the deploy order of the two halves\n    // is not load-bearing.\n    recommendedBatchBytes: number('maxBatchBytes', number('recommendedBatchBytes', RECOMMENDED_BATCH_BYTES)),\n    concurrency: number('concurrency', DEFAULT_CONCURRENCY),\n    compression: Array.isArray(raw['compression'])\n      ? raw['compression'].filter((entry): entry is string => typeof entry === 'string')\n      : [],\n  };\n}\n\n/** Four at a time: enough to hide the latency, few enough not to trip the ingest rate limit. */\nexport const DEFAULT_CONCURRENCY = 4;\n\n/**\n * Send one batch.\n *\n * Batches are bounded by the request ceiling rather than by count: maps vary from kilobytes to\n * megabytes, so a fixed count would either waste requests or overshoot.\n *\n * Each part is gzipped when the server says it accepts that. `Content-Encoding` does NOT survive\n * multipart parsing — PHP hands the handler the raw part and nothing else — so a compressed part\n * is simply a part whose bytes are gzip, which the server detects by its magic number. Source maps\n * are JSON with long runs of repeated source text and compress by 80–90%, which is the difference\n * between one request and six.\n */\nexport async function send(\n  options: UploadOptions,\n  batch: ReadonlyArray<{ entry: UploadEntry; body: string }>,\n  limits: Limits | null = null,\n): Promise<UploadResult> {\n  const compress = limits?.compression.includes('gzip') === true;\n\n  const parts: Part[] = [\n    { name: 'release', value: options.release },\n    ...(options.dist === undefined || options.dist === '' ? [] : [{ name: 'dist', value: options.dist }]),\n  ];\n\n  for (const { entry, body } of batch) {\n    parts.push({\n      name: 'files[]',\n      value: compress ? gzipSync(Buffer.from(body, 'utf8'), { level: 6 }) : body,\n      filename: entry.name,\n      contentType: 'application/json',\n    });\n    parts.push({ name: 'urls[]', value: entry.url });\n    parts.push({ name: 'debug_ids[]', value: entry.debugId });\n  }\n\n  const { body, contentType } = multipart(parts);\n  const attempts = Math.max(1, options.maxRetries ?? MAX_ATTEMPTS);\n  const isDefaultHost = options.host === DEFAULT_HOST;\n\n  // Bounded and retried. A deploy step that hangs on a half-open socket, or fails its whole run\n  // on one 502 from a proxy in front of ingest, is worse than a build without symbolication;\n  // the response table says these are transient, so they get the protocol's retry, with backoff.\n  for (let attempt = 0; ; attempt += 1) {\n    let reply: Awaited<ReturnType<typeof request>>;\n    try {\n      reply = await request({\n        method: 'POST',\n        url: `${options.host}/v1/sourcemaps`,\n        key: options.key,\n        headers: { 'Content-Type': contentType, ...options.headers },\n        body,\n        timeoutMs: timeoutFor(body.length, options.timeoutMs ?? REQUEST_TIMEOUT_MS),\n        ...(options.plugin === undefined ? {} : { plugin: options.plugin }),\n        ...(options.env === undefined ? {} : { env: options.env }),\n      });\n    } catch (error) {\n      if (attempt < attempts - 1 && retriable(error, isDefaultHost)) {\n        await sleep(backoffMs(attempt));\n        continue;\n      }\n      throw new UploadError(\n        `Could not reach ${options.host}${attempt > 0 ? ` after ${attempt + 1} attempts` : ''}: ${error instanceof Error ? error.message : String(error)}`,\n        0,\n        'network',\n        'Check the host and that the machine running this can reach it.',\n      );\n    }\n\n    let payload: Record<string, unknown> = {};\n    try {\n      payload = JSON.parse(reply.text) as Record<string, unknown>;\n    } catch {\n      // A non-JSON body means something in front of the app answered — a proxy, a WAF, a 502 page.\n    }\n\n    if (reply.status === 201) {\n      return {\n        stored: Number(payload['stored'] ?? batch.length),\n        artifacts: Array.isArray(payload['artifacts']) ? payload['artifacts'] : [],\n      };\n    }\n\n    if (RETRIABLE_STATUS.has(reply.status) && attempt < attempts - 1) {\n      await sleep(backoffMs(attempt, reply.header('retry-after')));\n      continue;\n    }\n\n    throw describe(reply.status, payload, reply.text);\n  }\n}\n\n/** Three tries: one for the blip, one for the restart, then the truth. */\nconst MAX_ATTEMPTS = 3;\nconst REQUEST_TIMEOUT_MS = 30_000;\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Turn a rejection into something actionable.\n *\n * Every one of these is a mistake someone will make, and the raw code alone tells them nothing.\n * `cli_scope_required` in particular looks like a bad key when it is really the right key with the\n * wrong scope, and without the hint that is a long afternoon.\n */\nfunction describe(status: number, payload: Record<string, unknown>, raw: string): UploadError {\n  const code = String(payload['error'] ?? payload['message'] ?? '') || `http_${status}`;\n\n  switch (code) {\n    case 'cli_scope_required':\n      return new UploadError(\n        'That key cannot upload source maps.',\n        status,\n        code,\n        `Source-map upload needs a key with the \"${REQUIRED_SCOPE}\" scope. A write key is not enough — create one in project settings.`,\n      );\n\n    case 'missing_api_key':\n    case 'invalid_api_key':\n      return new UploadError(\n        'The write key was rejected.',\n        status,\n        code,\n        'Check --key, or the VINKTAR_CLI_KEY environment variable.',\n      );\n\n    case 'missing_release':\n      return new UploadError(\n        'A release is required.',\n        status,\n        code,\n        // The second sentence is the one that saves the afternoon: an oversized POST is not\n        // rejected by PHP, the body is dropped, and the server then honestly reports no release.\n        'Pass --release with the same value your SDK reports. If you did pass one, the request was over the server\\'s post_max_size and its body was discarded before PHP saw it — lower the batch size or raise post_max_size.',\n      );\n\n    case 'invalid_release':\n    case 'invalid_dist':\n      return new UploadError(\n        `The ${code === 'invalid_release' ? 'release' : 'dist'} name was rejected.`,\n        status,\n        code,\n        'It must be at most 64 bytes and contain no slashes, control characters, or leading or trailing whitespace.',\n      );\n\n    case 'missing_url_or_debug_id':\n      return new UploadError(\n        'A file had neither a URL nor a debug id, so the whole upload was rejected.',\n        status,\n        code,\n        'This is a bug in the CLI — please report it with the command you ran.',\n      );\n\n    case 'quota_exceeded': {\n      const quota = Number(payload['quota_bytes'] ?? 0);\n      const used = Number(payload['used_bytes'] ?? 0);\n\n      return new UploadError(\n        `Source-map storage is full: ${mb(used)} of ${mb(quota)} used.`,\n        status,\n        code,\n        'Delete old releases from project settings, or upgrade the plan for more storage.',\n      );\n    }\n\n    case 'file_too_large':\n      return new UploadError(\n        `A map is over the ${mb(Number(payload['max_bytes'] ?? MAX_FILE_BYTES))} per-file limit.`,\n        status,\n        code,\n        'Split the bundle, or exclude that chunk with --ignore.',\n      );\n\n    case 'payload_too_large':\n      return new UploadError(\n        `The request was too large${payload['max_bytes'] === undefined ? '' : ` (the server accepts ${mb(Number(payload['max_bytes']))})`}.`,\n        status,\n        code,\n        'Lower --concurrency, or raise the server\\'s post_max_size.',\n      );\n\n    default:\n      return new UploadError(\n        `Ingest rejected the upload (HTTP ${status}).`,\n        status,\n        code,\n        raw.slice(0, 200) || undefined,\n      );\n  }\n}\n\n/**\n * Group indexed maps into requests that fit.\n *\n * The budget is approached with headroom, because multipart framing and the field names add bytes\n * the file sizes do not account for, and an oversized request costs the whole batch. Sized on the\n * UNCOMPRESSED bodies even when the parts will be gzipped: compression only ever makes the request\n * smaller, so the bound stays true and one batch's worth of maps is still what sits in memory.\n *\n * Generic over whatever the caller is carrying alongside the entry, so a batch can hold the\n * artifact each map came from and the body can be read back from disk as its batch is sent —\n * nothing here pins the build in memory.\n */\nexport function batch<T extends { readonly entry: UploadEntry }>(\n  items: readonly T[],\n  limits: Limits | null = null,\n): T[][] {\n  // Without a word from the server this stays deliberately small — see CONSERVATIVE_BATCH_BYTES.\n  const budget =\n    limits === null\n      ? CONSERVATIVE_BATCH_BYTES\n      : Math.max(1, Math.min(limits.recommendedBatchBytes, Math.floor(limits.maxRequestBytes * 0.9)));\n  const framing = overheadFor({ name: 'files[]', value: '', filename: 'x'.repeat(64), contentType: 'application/json' });\n\n  const batches: T[][] = [];\n  let current: T[] = [];\n  let size = 0;\n\n  for (const item of items) {\n    const cost = item.entry.bytes + framing;\n    if (current.length > 0 && size + cost > budget) {\n      batches.push(current);\n      current = [];\n      size = 0;\n    }\n\n    current.push(item);\n    size += cost;\n  }\n\n  if (current.length > 0) batches.push(current);\n\n  return batches;\n}\n\n/**\n * Run `work` over `items` with a bounded number in flight.\n *\n * Source maps are large and the server is usually far away, so a build of two hundred chunks spent\n * most of its upload waiting on a socket. Bounded rather than unbounded: an unbounded fan-out of\n * 6 MB requests is how a deploy step gets itself rate-limited.\n */\nexport async function pooled<T, R>(\n  items: readonly T[],\n  limit: number,\n  work: (item: T, index: number) => Promise<R>,\n): Promise<R[]> {\n  const results: R[] = new Array<R>(items.length);\n  let next = 0;\n\n  const runner = async (): Promise<void> => {\n    for (;;) {\n      const i = next;\n      next += 1;\n      if (i >= items.length) return;\n      results[i] = await work(items[i]!, i);\n    }\n  };\n\n  await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, runner));\n\n  return results;\n}\n\nexport function mb(bytes: number): string {\n  return `${(bytes / 1_048_576).toFixed(1)} MB`;\n}\n"]}

package/dist/url.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Derives the `urls[]` value the server matches a frame against.
+ *
+ * `urls[]` is not optional in practice, and this is the one part of the contract most likely to be
+ * got wrong: `docs/API.md` omits the field entirely, but if a file's resolved debug id is empty
+ * AND its normalised url is empty, the server answers 400 and rolls back the WHOLE upload — not
+ * just that file.
+ *
+ * The server normalises what it stores by stripping the query, the fragment, and then the scheme
+ * and host, leaving a path. It applies the identical normalisation to the `file` on a runtime
+ * frame before comparing. So `https://cdn.example.com/assets/app.js?v=2` and `/assets/app.js`
+ * match, and a prefix that is a full origin is just as correct as one that is a bare path.
+ */
+/**
+ * @param prefix   what the file is served under: `/assets/`, `https://cdn.example.com/`, or `~/`
+ * @param relative the file's path relative to the upload root
+ */
+export declare function toUrl(prefix: string, relative: string): string;
+/**
+ * The server's own normalisation, reproduced so `--dry-run` can show what will actually be stored.
+ *
+ * Printing this is the difference between "the upload succeeded but nothing symbolicates" and a
+ * mismatch someone can see before spending a minute uploading.
+ */
+export declare function normalise(url: string): string;

package/dist/url.js

@@ -0,0 +1,40 @@
+/**
+ * Derives the `urls[]` value the server matches a frame against.
+ *
+ * `urls[]` is not optional in practice, and this is the one part of the contract most likely to be
+ * got wrong: `docs/API.md` omits the field entirely, but if a file's resolved debug id is empty
+ * AND its normalised url is empty, the server answers 400 and rolls back the WHOLE upload — not
+ * just that file.
+ *
+ * The server normalises what it stores by stripping the query, the fragment, and then the scheme
+ * and host, leaving a path. It applies the identical normalisation to the `file` on a runtime
+ * frame before comparing. So `https://cdn.example.com/assets/app.js?v=2` and `/assets/app.js`
+ * match, and a prefix that is a full origin is just as correct as one that is a bare path.
+ */
+/**
+ * @param prefix   what the file is served under: `/assets/`, `https://cdn.example.com/`, or `~/`
+ * @param relative the file's path relative to the upload root
+ */
+export function toUrl(prefix, relative) {
+    const left = prefix.endsWith('/') ? prefix : `${prefix}/`;
+    const right = relative.startsWith('/') ? relative.slice(1) : relative;
+    return `${left}${right}`;
+}
+/**
+ * The server's own normalisation, reproduced so `--dry-run` can show what will actually be stored.
+ *
+ * Printing this is the difference between "the upload succeeded but nothing symbolicates" and a
+ * mismatch someone can see before spending a minute uploading.
+ */
+export function normalise(url) {
+    let value = url.split('#')[0] ?? '';
+    value = value.split('?')[0] ?? '';
+    const scheme = value.match(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i);
+    if (scheme)
+        value = value.slice(scheme[0].length);
+    // `~/` is the conventional "wherever this is served from" prefix; it is not part of the path.
+    if (value.startsWith('~'))
+        value = value.slice(1);
+    return value.startsWith('/') ? value : `/${value}`;
+}
+//# sourceMappingURL=url.js.map

package/dist/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,QAAgB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEtE,OAAO,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAElD,8FAA8F;IAC9F,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElD,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;AACrD,CAAC","sourcesContent":["/**\n * Derives the `urls[]` value the server matches a frame against.\n *\n * `urls[]` is not optional in practice, and this is the one part of the contract most likely to be\n * got wrong: `docs/API.md` omits the field entirely, but if a file's resolved debug id is empty\n * AND its normalised url is empty, the server answers 400 and rolls back the WHOLE upload — not\n * just that file.\n *\n * The server normalises what it stores by stripping the query, the fragment, and then the scheme\n * and host, leaving a path. It applies the identical normalisation to the `file` on a runtime\n * frame before comparing. So `https://cdn.example.com/assets/app.js?v=2` and `/assets/app.js`\n * match, and a prefix that is a full origin is just as correct as one that is a bare path.\n */\n\n/**\n * @param prefix   what the file is served under: `/assets/`, `https://cdn.example.com/`, or `~/`\n * @param relative the file's path relative to the upload root\n */\nexport function toUrl(prefix: string, relative: string): string {\n  const left = prefix.endsWith('/') ? prefix : `${prefix}/`;\n  const right = relative.startsWith('/') ? relative.slice(1) : relative;\n\n  return `${left}${right}`;\n}\n\n/**\n * The server's own normalisation, reproduced so `--dry-run` can show what will actually be stored.\n *\n * Printing this is the difference between \"the upload succeeded but nothing symbolicates\" and a\n * mismatch someone can see before spending a minute uploading.\n */\nexport function normalise(url: string): string {\n  let value = url.split('#')[0] ?? '';\n  value = value.split('?')[0] ?? '';\n\n  const scheme = value.match(/^[a-z][a-z0-9+.-]*:\\/\\/[^/]*/i);\n  if (scheme) value = value.slice(scheme[0].length);\n\n  // `~/` is the conventional \"wherever this is served from\" prefix; it is not part of the path.\n  if (value.startsWith('~')) value = value.slice(1);\n\n  return value.startsWith('/') ? value : `/${value}`;\n}\n"]}

package/dist/version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The published version, kept by hand.
+ *
+ * Its own module so the HTTP layer can put it in a `User-Agent` without importing the CLI's
+ * argument parser, which would make every plugin drag the command surface into a build.
+ *
+ * A test asserts it matches `package.json`, and `prepublishOnly` runs that test — reading the
+ * manifest at runtime instead would mean resolving a path that moves between `src` and `dist`.
+ */
+export declare const VERSION = "0.1.0";

package/dist/version.js

@@ -0,0 +1,11 @@
+/**
+ * The published version, kept by hand.
+ *
+ * Its own module so the HTTP layer can put it in a `User-Agent` without importing the CLI's
+ * argument parser, which would make every plugin drag the command surface into a build.
+ *
+ * A test asserts it matches `package.json`, and `prepublishOnly` runs that test — reading the
+ * manifest at runtime instead would mean resolving a path that moves between `src` and `dist`.
+ */
+export const VERSION = '0.1.0';
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC","sourcesContent":["/**\n * The published version, kept by hand.\n *\n * Its own module so the HTTP layer can put it in a `User-Agent` without importing the CLI's\n * argument parser, which would make every plugin drag the command surface into a build.\n *\n * A test asserts it matches `package.json`, and `prepublishOnly` runs that test — reading the\n * manifest at runtime instead would mean resolving a path that moves between `src` and `dist`.\n */\nexport const VERSION = '0.1.0';\n"]}

package/dist/vite.d.ts

@@ -0,0 +1,74 @@
+import { type BundlerOptions } from './bundler/core.js';
+/**
+ * The plugin's shape, declared here rather than imported as Vite's `Plugin`.
+ *
+ * Two copies of Vite's types at different patch versions — the consumer's and this package's —
+ * are structurally identical and nominally incompatible, so importing `Plugin` makes
+ * `plugins: [vinktar()]` fail to typecheck for anyone whose lockfile resolves a different patch
+ * than ours. Structural typing has no such problem, and it also means this package's public types
+ * do not depend on `vite` at all.
+ */
+export interface VitePlugin {
+    name: string;
+    /**
+     * `unknown` parameters, deliberately, and it is the direction that matters: a hook which accepts
+     * ANYTHING can stand in for one Vite will call with its own config types, whatever version those
+     * come from. A hook typed against a narrower shape cannot — which is the whole failure this
+     * exists to avoid, and `never` (the first thing that looks right) has exactly the wrong variance.
+     */
+    config(userConfig: unknown, env: unknown): Promise<{
+        define: Record<string, string>;
+        build?: {
+            sourcemap: 'hidden';
+        };
+    }>;
+    configResolved(resolved: unknown): void;
+    buildStart(): void;
+    renderChunk: {
+        order: 'post';
+        handler(this: unknown, code: string, chunk: unknown): {
+            code: string;
+            map: null;
+        } | null;
+    };
+    generateBundle: {
+        order: 'pre';
+        handler(options: unknown, bundle: Record<string, unknown>): void;
+    };
+    writeBundle(options: unknown, bundle: Record<string, unknown>): Promise<void>;
+    closeBundle(): Promise<void>;
+}
+/**
+ * The Vite side of Vinktar, as one plugin.
+ *
+ * ```ts
+ * // vite.config.ts
+ * import { vinktar } from '@vinktarhq/cli/vite';
+ *
+ * export default defineConfig({ plugins: [vinktar()] });
+ * ```
+ *
+ * What it does, all driven by the same VINKTAR_* variables every other Vinktar SDK reads
+ * (from the process env and Vite's .env files):
+ *
+ * - Exposes `import.meta.env.VINKTAR_KEY`, `VINKTAR_HOST`, `VINKTAR_ENVIRONMENT` and
+ *   `VINKTAR_RELEASE` to the bundle, so `init({ key: import.meta.env.VINKTAR_KEY, … })` is the
+ *   whole application-side setup. `VINKTAR_CLI_KEY` is NEVER exposed — a bundle is public.
+ * - `VINKTAR_RELEASE` falls back to the CI commit, then the git SHA, so errors correlate to a
+ *   deploy without anyone wiring a release string.
+ * - Turns on `build.sourcemap: 'hidden'`.
+ * - Stamps a debug id into each chunk **as it is rendered**, then after the build uploads the maps
+ *   under the same release the bundle reports, and removes them from the output directory.
+ *
+ * ## Why injection is a `renderChunk` hook
+ *
+ * The previous version rewrote the files in `closeBundle`, after Vite had already written them.
+ * That is after Rollup computed the content hash in each filename, after `vite-plugin-pwa` wrote
+ * its precache revisions, and after any integrity or precompression plugin had run — so every one
+ * of those recorded a hash of bytes that no longer existed on disk. A service worker built that
+ * way serves a permanently stale chunk. Injecting during `renderChunk` makes the snippet part of
+ * the artifact everything downstream measures.
+ */
+export interface VinktarPluginOptions extends BundlerOptions {
+}
+export declare function vinktar(options?: VinktarPluginOptions): VitePlugin;