@vinktarhq/cli 0.1.0

package/dist/bundler/core.js

@@ -0,0 +1,320 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { readFile, unlink, writeFile } from 'node:fs/promises';
+import { sep } from 'node:path';
+import { upload } from '../commands/upload.js';
+import { deriveDebugId, existingDebugId, inject } from '../debug-id.js';
+import { allFiles, discover } from '../discover.js';
+import { DEFAULT_HOST } from '../limits.js';
+/**
+ * Stamp one chunk, and say what its map now needs.
+ *
+ * Must run AFTER minification and BEFORE the bundler hashes the output. Minifiers strip comments,
+ * so an id injected earlier loses its `//# debugId=` line; the embedded marker survives that, but
+ * the hash has to cover the snippet or the filename describes bytes that are not on disk.
+ *
+ * An id the chunk already carries is kept rather than replaced — Rollup's `output.sourcemapDebugIds`
+ * and webpack's `debugIds` stamp one themselves, and minting a competing id here would file the map
+ * under something no stack frame reports.
+ */
+export function stamp(code, options = {}) {
+    const debugId = existingDebugId(code) ?? deriveDebugId(code);
+    const injection = inject(code, debugId, options);
+    return {
+        code: injection.code,
+        debugId,
+        line: injection.line,
+        changed: injection.code !== code,
+    };
+}
+/**
+ * Whether the plugin should do nothing at all.
+ *
+ * Checked before the release is detected, because detecting it shells out to git — and a config
+ * shared with vitest would then run `git rev-parse` on every test file.
+ */
+export function disabled(options, env = process.env) {
+    if (options.disable === true)
+        return true;
+    const value = (env['VINKTAR_DISABLE'] ?? '').trim().toLowerCase();
+    return ['1', 'true', 'yes', 'on'].includes(value);
+}
+/**
+ * Things about the environment that will make this not work, said once.
+ *
+ * Both of these produce the same symptom — the upload silently does nothing — and both are
+ * invisible from inside the build. Turborepo in particular filters the environment down to what a
+ * task declares, so `VINKTAR_CLI_KEY` is simply absent and the plugin reports a missing key that
+ * the user can see perfectly well in their own shell.
+ */
+export function environmentWarnings(outDir, env = process.env) {
+    const warnings = [];
+    if (env['TURBO_HASH'] !== undefined && (env['VINKTAR_CLI_KEY'] ?? '') === '') {
+        warnings.push('Running under Turborepo, which passes only the environment a task declares. Add VINKTAR_* to that task\'s passThroughEnv, or the key will never reach this build.');
+    }
+    if (outDir.split(sep).includes('node_modules')) {
+        warnings.push(`The build output is inside node_modules (${outDir}). Those files are not served, so uploading their maps files them under URLs no frame will ever report.`);
+    }
+    return warnings;
+}
+/** True when this file is one we stamp: JavaScript, not a map, not CSS. */
+export function isScript(name) {
+    return /\.[cm]?js$/.test(name.split('?')[0] ?? name);
+}
+export function session(options, env = process.env) {
+    const log = (line) => {
+        if (options.silent !== true)
+            console.log(`[vinktar] ${line}`);
+    };
+    // Warnings are never silenced. `silent` means "do not narrate a successful build"; every line
+    // that reaches here says symbolication is about to be worse than the user thinks it is.
+    const warn = (line) => {
+        console.warn(`[vinktar] ${line}`);
+    };
+    const key = options.key ?? env['VINKTAR_CLI_KEY'] ?? '';
+    // Default TRUE, not "only when a key is set". A build with no key is the case worth talking
+    // about — a CI job whose secret was never wired up looks exactly like a working one — so it
+    // takes this path and warns, instead of quietly deciding the user meant to skip it.
+    const wantsUpload = options.uploadSourcemaps !== false;
+    // Deletion is the second half of uploading, so switching the upload off switches it off too.
+    // Everything else — no key, a failed request — still deletes: the maps are the application's
+    // source sitting in a directory that is about to be served, and that is true either way.
+    const wantsDelete = options.deleteSourcemapsAfterUpload ?? wantsUpload;
+    /** Per directory: the maps confirmed on the server, or `null` when nothing was uploaded. */
+    const seen = new Map();
+    let announced = false;
+    return {
+        async upload(outDir) {
+            if (outDir === '' || (!wantsUpload && !wantsDelete))
+                return;
+            if (!announced) {
+                announced = true;
+                for (const line of environmentWarnings(outDir, env))
+                    warn(line);
+            }
+            if (!wantsUpload) {
+                seen.set(outDir, null);
+                return;
+            }
+            if (key === '') {
+                // Never fatal: a contributor running `pnpm build` on a laptop has no key and does not
+                // need one. Loud anyway, and specific about what it costs, because the failure mode is
+                // silent minified stack traces weeks later.
+                warn(wantsDelete
+                    ? 'VINKTAR_CLI_KEY is not set: the source maps will be deleted from the build output and NOT uploaded, so this release cannot be symbolicated.'
+                    : 'VINKTAR_CLI_KEY is not set: source maps were not uploaded, so this release cannot be symbolicated.');
+                seen.set(outDir, null);
+                return;
+            }
+            try {
+                const summary = await upload(outDir, {
+                    host: (options.host ?? env['VINKTAR_HOST'] ?? DEFAULT_HOST).replace(/\/+$/, ''),
+                    key,
+                    release: options.release ?? detectRelease(env),
+                    ...(options.dist === undefined || options.dist === '' ? {} : { dist: options.dist }),
+                    urlPrefix: options.urlPrefix ?? '~/',
+                    dryRun: false,
+                    // The chunks were stamped as they were rendered; a second pass would re-read every
+                    // file in the build and change nothing.
+                    inject: false,
+                }, log, warn);
+                seen.set(outDir, summary.storedMaps.slice());
+            }
+            catch (error) {
+                const failure = error instanceof Error ? error : new Error(String(error));
+                seen.set(outDir, null);
+                if (options.errorHandler !== undefined) {
+                    options.errorHandler(failure);
+                    return;
+                }
+                // Fatal only when the maps are about to be deleted. Otherwise a later upload of the same
+                // artifacts still resolves these frames — debug ids do not expire — and failing a deploy
+                // over a brief network problem is the worse trade. With deletion on that reasoning dies
+                // with the maps: there is no second chance, so the build stops here.
+                if (wantsDelete) {
+                    throw new Error(`source-map upload failed, and deleteSourcemapsAfterUpload is on, so this release could never be symbolicated: ${failure.message}`, { cause: failure });
+                }
+                warn(`source-map upload failed: ${failure.message}`);
+            }
+        },
+        async cleanup() {
+            if (!wantsDelete)
+                return;
+            let removed = 0;
+            for (const [dir, stored] of seen)
+                removed += await remove(dir, stored, warn);
+            if (removed > 0)
+                log(`removed ${removed} source map(s) from the build output`);
+            seen.clear();
+        },
+    };
+}
+/**
+ * Upload and clean up in one call, for the bundlers with a single end-of-build hook.
+ */
+export async function finish(outDir, options, env = process.env) {
+    const run = session(options, env);
+    await run.upload(outDir);
+    await run.cleanup();
+}
+/**
+ * Delete the maps under one directory, and unpoint the chunks that referenced them.
+ *
+ * `stored` names the maps the server confirmed; `null` means nothing was uploaded (no key, or a
+ * failure the caller chose to survive) and every map goes, because the reason for deleting them —
+ * they are the application's source, sitting in a public directory — has nothing to do with
+ * whether an upload happened.
+ *
+ * A map whose bytes changed since it was indexed is left alone. Turbopack rewrites files while
+ * later stages are still running, and deleting one there removes a map the server never got.
+ */
+async function remove(dir, stored, warn) {
+    const { artifacts } = await discover(dir).catch(() => ({ artifacts: [] }));
+    const hashes = new Map();
+    for (const entry of stored ?? [])
+        hashes.set(entry.map, entry.sha256);
+    let removed = 0;
+    for (const artifact of artifacts) {
+        if (artifact.map === null)
+            continue;
+        if (stored !== null && !hashes.has(artifact.map))
+            continue;
+        const expected = hashes.get(artifact.map);
+        if (expected !== undefined) {
+            const actual = await readFile(artifact.map).then((raw) => sha256(raw)).catch(() => null);
+            if (actual === null)
+                continue;
+            if (actual !== expected) {
+                warn(`${artifact.map} changed after it was uploaded; leaving it in place.`);
+                continue;
+            }
+        }
+        try {
+            await unlink(artifact.map);
+            removed += 1;
+        }
+        catch {
+            continue;
+        }
+        await unpoint(artifact.file, warn);
+    }
+    // CSS maps are never uploaded — the server symbolicates JavaScript — but a build that emitted
+    // them publishes the stylesheets' sources just as plainly, and `sourcemap: true` emits both.
+    // They are not artifacts, so they need their own sweep rather than a filter over the ones above.
+    for (const file of await allFiles(dir).catch(() => [])) {
+        if (!file.endsWith('.css.map'))
+            continue;
+        try {
+            await unlink(file);
+            removed += 1;
+        }
+        catch {
+            continue;
+        }
+        await unpoint(file.slice(0, -'.map'.length), warn);
+    }
+    return removed;
+}
+/**
+ * Drop a trailing `//# sourceMappingURL=` from a chunk whose map has just been deleted.
+ *
+ * Only the trailing one, and only when nothing but a `//# debugId=` line follows it: a comment in
+ * the middle of a chunk belongs to something concatenated into it, and removing a line from there
+ * would shift every mapping below. Left in place, the comment makes every devtools session fetch
+ * a 404 and report a broken build.
+ */
+async function unpoint(file, warn) {
+    let code;
+    try {
+        code = await readFile(file, 'utf8');
+    }
+    catch {
+        return;
+    }
+    // Both spellings: `//#` for JavaScript and `/*# … */` for CSS, which is the same comment in the
+    // only syntax a stylesheet has.
+    const stripped = code.replace(/\n?(?:\/\/[#@] sourceMappingURL=[^\n]*|\/\*[#@] sourceMappingURL=[^\n]*?\*\/)(?=(?:\s*\n\/\/# debugId=[^\n]*)?\s*$)/, '');
+    if (stripped === code)
+        return;
+    try {
+        await writeFile(file, stripped, 'utf8');
+    }
+    catch (error) {
+        warn(`could not remove the sourceMappingURL comment from ${file}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+/** Re-export so plugins can write an id and a line shift into a map without a second import. */
+export { injectIntoMap, mapDebugId } from '../debug-id.js';
+/**
+ * The release: the commit being built.
+ *
+ * CI first. A shallow checkout — which is what every default CI clone is — often has no usable git
+ * metadata, and falling straight to git produced an EMPTY release: every frame then lost its
+ * release+url match, leaving the debug id as the only thing holding symbolication together.
+ *
+ * The FULL sha, never a short one. A short sha is a prefix whose length varies by tool (7 from
+ * `git rev-parse --short`, 8 from GitLab, 12 from some deploy scripts), and the SDK reporting one
+ * length while the CLI uploaded another is a release mismatch that looks exactly like no release
+ * at all. Both sides read the same variables, so both get the same 40 characters.
+ */
+export function detectRelease(env = process.env) {
+    const explicit = env['VINKTAR_RELEASE'];
+    if (explicit !== undefined && explicit.trim() !== '')
+        return explicit.trim();
+    const pull = pullRequestHead(env);
+    if (pull !== null)
+        return pull;
+    for (const name of [
+        'GITHUB_SHA',
+        'VERCEL_GIT_COMMIT_SHA',
+        'CF_PAGES_COMMIT_SHA',
+        'CI_COMMIT_SHA',
+        'BITBUCKET_COMMIT',
+        'BUILD_SOURCEVERSION',
+        'COMMIT_REF',
+    ]) {
+        const value = env[name];
+        if (value !== undefined && value.trim() !== '')
+            return value.trim();
+    }
+    try {
+        return execFileSync('git', ['rev-parse', 'HEAD'], {
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        })
+            .toString()
+            .trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * The commit a GitHub pull-request build is actually building.
+ *
+ * On `pull_request`, `GITHUB_SHA` is a synthetic merge commit that exists only inside the runner:
+ * it is in nobody's history, so a release named after it matches nothing the deployed application
+ * will ever report. The head sha is in the event payload.
+ */
+function pullRequestHead(env) {
+    if (env['GITHUB_EVENT_NAME'] !== 'pull_request' && env['GITHUB_EVENT_NAME'] !== 'pull_request_target') {
+        return null;
+    }
+    const path = env['GITHUB_EVENT_PATH'];
+    if (path === undefined || path === '')
+        return null;
+    try {
+        // Read synchronously on purpose: this runs inside a bundler's config hook, which cannot await.
+        const payload = JSON.parse(readFileSync(path, 'utf8'));
+        const sha = payload?.pull_request?.head?.sha;
+        return typeof sha === 'string' && sha !== '' ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=core.js.map

package/dist/bundler/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/bundler/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAkB,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA+E5C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,UAAiC,EAAE;IACrE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEjD,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,OAAO;QACP,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,OAAO,EAAE,SAAS,CAAC,IAAI,KAAK,IAAI;KACjC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAuB,EAAE,MAA0C,OAAO,CAAC,GAAG;IACrG,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAElE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7E,QAAQ,CAAC,IAAI,CACX,mKAAmK,CACpK,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CACX,4CAA4C,MAAM,yGAAyG,CAC5J,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACvD,CAAC;AAiBD,MAAM,UAAU,OAAO,CAAC,OAAuB,EAAE,MAA0C,OAAO,CAAC,GAAG;IACpG,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACxD,4FAA4F;IAC5F,4FAA4F;IAC5F,oFAAoF;IACpF,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC;IACvD,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,IAAI,WAAW,CAAC;IAEvE,4FAA4F;IAC5F,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEnD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC;gBAAE,OAAO;YAE5D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS,GAAG,IAAI,CAAC;gBACjB,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAEvB,OAAO;YACT,CAAC;YAED,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBACf,sFAAsF;gBACtF,uFAAuF;gBACvF,4CAA4C;gBAC5C,IAAI,CACF,WAAW;oBACT,CAAC,CAAC,6IAA6I;oBAC/I,CAAC,CAAC,oGAAoG,CACzG,CAAC;gBACF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAEvB,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAC1B,MAAM,EACN;oBACE,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC/E,GAAG;oBACH,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC;oBAC9C,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;oBACpF,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,MAAM,EAAE,KAAK;oBACb,mFAAmF;oBACnF,wCAAwC;oBACxC,MAAM,EAAE,KAAK;iBACd,EACD,GAAG,EACH,IAAI,CACL,CAAC;gBAEF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1E,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAEvB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;oBAE9B,OAAO;gBACT,CAAC;gBAED,yFAAyF;gBACzF,yFAAyF;gBACzF,wFAAwF;gBACxF,qEAAqE;gBACrE,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,iHAAiH,OAAO,CAAC,OAAO,EAAE,EAClI,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,6BAA6B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,IAAI,CAAC,WAAW;gBAAE,OAAO;YAEzB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI;gBAAE,OAAO,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE7E,IAAI,OAAO,GAAG,CAAC;gBAAE,GAAG,CAAC,WAAW,OAAO,sCAAsC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAc,EACd,OAAuB,EACvB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,MAAM,CACnB,GAAW,EACX,MAAmC,EACnC,IAA4B;IAE5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtE,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAE3D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACzF,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAS;YAC9B,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,sDAAsD,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,KAAK,MAAM,IAAI,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,IAA4B;IAC/D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,qHAAqH,EACrH,EAAE,CACH,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAE9B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,sDAAsD,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,gGAAgG;AAChG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,MAA0C,OAAO,CAAC,GAAG;IACjF,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE7E,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI;QACjB,YAAY;QACZ,uBAAuB;QACvB,qBAAqB;QACrB,eAAe;QACf,kBAAkB;QAClB,qBAAqB;QACrB,YAAY;KACb,EAAE,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;YAChD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC;aACC,QAAQ,EAAE;aACV,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAuC;IAC9D,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,cAAc,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACtG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,CAAC;QACH,+FAA+F;QAC/F,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,GAAG,GAAI,OAA2D,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC;QAElG,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { execFileSync } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport { readFileSync } from 'node:fs';\nimport { readFile, unlink, writeFile } from 'node:fs/promises';\nimport { sep } from 'node:path';\n\nimport { upload, type StoredMap } from '../commands/upload.js';\nimport { deriveDebugId, existingDebugId, inject } from '../debug-id.js';\nimport { allFiles, discover } from '../discover.js';\nimport { DEFAULT_HOST } from '../limits.js';\n\n/**\n * Everything the bundler plugins share, with no bundler in it.\n *\n * There are two operations and five bundlers. The operations are the part worth getting right —\n * where the debug id comes from, when it is safe to inject, what the upload skips — and having\n * them once means a fix lands in all five rather than in whichever one someone remembered.\n *\n * Written by hand rather than on `unplugin`, which is the obvious tool for this: this package\n * ships zero runtime dependencies, and the per-bundler surface here is one hook each.\n */\n\nexport interface BundlerOptions {\n  /**\n   * Turn the whole plugin into a no-op, before any environment, git or network work happens.\n   *\n   * For a config that is reused by something other than a build — vitest, Storybook, a preview\n   * server — where stamping chunks and shelling out to git is pure cost. Also settable with\n   * `VINKTAR_DISABLE=1`, which is what a CI matrix can use without editing the config.\n   */\n  disable?: boolean;\n  /**\n   * Stamp debug ids into the chunks. Default true.\n   *\n   * Turn it off for a build under a strict CSP or with subresource integrity computed elsewhere,\n   * where nothing may modify a chunk after it is hashed by another tool. The maps are still\n   * uploaded; frames then match by release + url alone, which is weaker but not nothing.\n   */\n  injectDebugIds?: boolean;\n  /** What the built files are served under, for release+url matching. */\n  urlPrefix?: string;\n  /**\n   * Upload after the build. Default **true**, with a warning when no key is available.\n   *\n   * Not \"true when a key is set\": that made a CI job with an unwired secret indistinguishable\n   * from one that was never meant to upload, and both said nothing. Setting this to `false` turns\n   * the whole feature off, deletion included.\n   */\n  uploadSourcemaps?: boolean;\n  /**\n   * Remove the maps from the build output afterwards. Default **true**.\n   *\n   * A source map is the application's original source. The bundler only emitted one because this\n   * plugin asked it to, so leaving it in the output directory publishes the whole codebase to\n   * anyone who guesses `app.js.map` — which is how it shipped before, and what `sourcemap:\n   * 'hidden'` exists to prevent. Set `false` when the maps are meant to be served.\n   */\n  deleteSourcemapsAfterUpload?: boolean;\n  /** Build discriminator, when several builds share one release. */\n  dist?: string;\n  /** The release these maps belong to. Defaults to the CI commit, then the git SHA. */\n  release?: string;\n  /** Ingest host. Defaults to `$VINKTAR_HOST`, then the public one. */\n  host?: string;\n  /** The `cli`-scoped key. Defaults to `$VINKTAR_CLI_KEY`. */\n  key?: string;\n  /**\n   * What to do when the upload fails. Providing one makes every failure non-fatal: it is called,\n   * and the build carries on. Without one, a failed upload fails the build only when the maps are\n   * being deleted — see {@link Session.upload}.\n   */\n  errorHandler?: (error: Error) => void;\n  /** Suppress the plugin's own output. Warnings about lost symbolication are still printed. */\n  silent?: boolean;\n}\n\nexport interface Stamped {\n  readonly code: string;\n  readonly debugId: string;\n  /**\n   * The generated line the snippet was inserted at, or `null` when it was appended. The chunk's\n   * map must gain one empty group at this index; every plugin does that for its own map.\n   */\n  readonly line: number | null;\n  /** False when the chunk already carried everything, so the caller can skip writing it back. */\n  readonly changed: boolean;\n}\n\n/**\n * Stamp one chunk, and say what its map now needs.\n *\n * Must run AFTER minification and BEFORE the bundler hashes the output. Minifiers strip comments,\n * so an id injected earlier loses its `//# debugId=` line; the embedded marker survives that, but\n * the hash has to cover the snippet or the filename describes bytes that are not on disk.\n *\n * An id the chunk already carries is kept rather than replaced — Rollup's `output.sourcemapDebugIds`\n * and webpack's `debugIds` stamp one themselves, and minting a competing id here would file the map\n * under something no stack frame reports.\n */\nexport function stamp(code: string, options: { prepend?: boolean } = {}): Stamped {\n  const debugId = existingDebugId(code) ?? deriveDebugId(code);\n  const injection = inject(code, debugId, options);\n\n  return {\n    code: injection.code,\n    debugId,\n    line: injection.line,\n    changed: injection.code !== code,\n  };\n}\n\n/**\n * Whether the plugin should do nothing at all.\n *\n * Checked before the release is detected, because detecting it shells out to git — and a config\n * shared with vitest would then run `git rev-parse` on every test file.\n */\nexport function disabled(options: BundlerOptions, env: Record<string, string | undefined> = process.env): boolean {\n  if (options.disable === true) return true;\n\n  const value = (env['VINKTAR_DISABLE'] ?? '').trim().toLowerCase();\n\n  return ['1', 'true', 'yes', 'on'].includes(value);\n}\n\n/**\n * Things about the environment that will make this not work, said once.\n *\n * Both of these produce the same symptom — the upload silently does nothing — and both are\n * invisible from inside the build. Turborepo in particular filters the environment down to what a\n * task declares, so `VINKTAR_CLI_KEY` is simply absent and the plugin reports a missing key that\n * the user can see perfectly well in their own shell.\n */\nexport function environmentWarnings(\n  outDir: string,\n  env: Record<string, string | undefined> = process.env,\n): string[] {\n  const warnings: string[] = [];\n\n  if (env['TURBO_HASH'] !== undefined && (env['VINKTAR_CLI_KEY'] ?? '') === '') {\n    warnings.push(\n      'Running under Turborepo, which passes only the environment a task declares. Add VINKTAR_* to that task\\'s passThroughEnv, or the key will never reach this build.',\n    );\n  }\n\n  if (outDir.split(sep).includes('node_modules')) {\n    warnings.push(\n      `The build output is inside node_modules (${outDir}). Those files are not served, so uploading their maps files them under URLs no frame will ever report.`,\n    );\n  }\n\n  return warnings;\n}\n\n/** True when this file is one we stamp: JavaScript, not a map, not CSS. */\nexport function isScript(name: string): boolean {\n  return /\\.[cm]?js$/.test(name.split('?')[0] ?? name);\n}\n\n/**\n * The upload-then-delete half of a build, as one object per plugin instance.\n *\n * Split in two because Rollup and Vite are: `writeBundle` fires once per output and is the only\n * hook that knows where the files went, while deletion has to wait until every output is on the\n * server. A build with a client bundle and an SSR bundle would otherwise delete the first one's\n * maps while the second was still being written.\n */\nexport interface Session {\n  /** Upload everything under `outDir`. Safe to call repeatedly; the server dedupes by content. */\n  upload(outDir: string): Promise<void>;\n  /** Remove the maps from every directory uploaded so far, if that is configured. */\n  cleanup(): Promise<void>;\n}\n\nexport function session(options: BundlerOptions, env: Record<string, string | undefined> = process.env): Session {\n  const log = (line: string): void => {\n    if (options.silent !== true) console.log(`[vinktar] ${line}`);\n  };\n  // Warnings are never silenced. `silent` means \"do not narrate a successful build\"; every line\n  // that reaches here says symbolication is about to be worse than the user thinks it is.\n  const warn = (line: string): void => {\n    console.warn(`[vinktar] ${line}`);\n  };\n\n  const key = options.key ?? env['VINKTAR_CLI_KEY'] ?? '';\n  // Default TRUE, not \"only when a key is set\". A build with no key is the case worth talking\n  // about — a CI job whose secret was never wired up looks exactly like a working one — so it\n  // takes this path and warns, instead of quietly deciding the user meant to skip it.\n  const wantsUpload = options.uploadSourcemaps !== false;\n  // Deletion is the second half of uploading, so switching the upload off switches it off too.\n  // Everything else — no key, a failed request — still deletes: the maps are the application's\n  // source sitting in a directory that is about to be served, and that is true either way.\n  const wantsDelete = options.deleteSourcemapsAfterUpload ?? wantsUpload;\n\n  /** Per directory: the maps confirmed on the server, or `null` when nothing was uploaded. */\n  const seen = new Map<string, StoredMap[] | null>();\n\n  let announced = false;\n\n  return {\n    async upload(outDir: string): Promise<void> {\n      if (outDir === '' || (!wantsUpload && !wantsDelete)) return;\n\n      if (!announced) {\n        announced = true;\n        for (const line of environmentWarnings(outDir, env)) warn(line);\n      }\n\n      if (!wantsUpload) {\n        seen.set(outDir, null);\n\n        return;\n      }\n\n      if (key === '') {\n        // Never fatal: a contributor running `pnpm build` on a laptop has no key and does not\n        // need one. Loud anyway, and specific about what it costs, because the failure mode is\n        // silent minified stack traces weeks later.\n        warn(\n          wantsDelete\n            ? 'VINKTAR_CLI_KEY is not set: the source maps will be deleted from the build output and NOT uploaded, so this release cannot be symbolicated.'\n            : 'VINKTAR_CLI_KEY is not set: source maps were not uploaded, so this release cannot be symbolicated.',\n        );\n        seen.set(outDir, null);\n\n        return;\n      }\n\n      try {\n        const summary = await upload(\n          outDir,\n          {\n            host: (options.host ?? env['VINKTAR_HOST'] ?? DEFAULT_HOST).replace(/\\/+$/, ''),\n            key,\n            release: options.release ?? detectRelease(env),\n            ...(options.dist === undefined || options.dist === '' ? {} : { dist: options.dist }),\n            urlPrefix: options.urlPrefix ?? '~/',\n            dryRun: false,\n            // The chunks were stamped as they were rendered; a second pass would re-read every\n            // file in the build and change nothing.\n            inject: false,\n          },\n          log,\n          warn,\n        );\n\n        seen.set(outDir, summary.storedMaps.slice());\n      } catch (error) {\n        const failure = error instanceof Error ? error : new Error(String(error));\n        seen.set(outDir, null);\n\n        if (options.errorHandler !== undefined) {\n          options.errorHandler(failure);\n\n          return;\n        }\n\n        // Fatal only when the maps are about to be deleted. Otherwise a later upload of the same\n        // artifacts still resolves these frames — debug ids do not expire — and failing a deploy\n        // over a brief network problem is the worse trade. With deletion on that reasoning dies\n        // with the maps: there is no second chance, so the build stops here.\n        if (wantsDelete) {\n          throw new Error(\n            `source-map upload failed, and deleteSourcemapsAfterUpload is on, so this release could never be symbolicated: ${failure.message}`,\n            { cause: failure },\n          );\n        }\n\n        warn(`source-map upload failed: ${failure.message}`);\n      }\n    },\n\n    async cleanup(): Promise<void> {\n      if (!wantsDelete) return;\n\n      let removed = 0;\n      for (const [dir, stored] of seen) removed += await remove(dir, stored, warn);\n\n      if (removed > 0) log(`removed ${removed} source map(s) from the build output`);\n      seen.clear();\n    },\n  };\n}\n\n/**\n * Upload and clean up in one call, for the bundlers with a single end-of-build hook.\n */\nexport async function finish(\n  outDir: string,\n  options: BundlerOptions,\n  env: Record<string, string | undefined> = process.env,\n): Promise<void> {\n  const run = session(options, env);\n  await run.upload(outDir);\n  await run.cleanup();\n}\n\n/**\n * Delete the maps under one directory, and unpoint the chunks that referenced them.\n *\n * `stored` names the maps the server confirmed; `null` means nothing was uploaded (no key, or a\n * failure the caller chose to survive) and every map goes, because the reason for deleting them —\n * they are the application's source, sitting in a public directory — has nothing to do with\n * whether an upload happened.\n *\n * A map whose bytes changed since it was indexed is left alone. Turbopack rewrites files while\n * later stages are still running, and deleting one there removes a map the server never got.\n */\nasync function remove(\n  dir: string,\n  stored: readonly StoredMap[] | null,\n  warn: (line: string) => void,\n): Promise<number> {\n  const { artifacts } = await discover(dir).catch(() => ({ artifacts: [] }));\n  const hashes = new Map<string, string>();\n  for (const entry of stored ?? []) hashes.set(entry.map, entry.sha256);\n\n  let removed = 0;\n\n  for (const artifact of artifacts) {\n    if (artifact.map === null) continue;\n    if (stored !== null && !hashes.has(artifact.map)) continue;\n\n    const expected = hashes.get(artifact.map);\n    if (expected !== undefined) {\n      const actual = await readFile(artifact.map).then((raw) => sha256(raw)).catch(() => null);\n      if (actual === null) continue;\n      if (actual !== expected) {\n        warn(`${artifact.map} changed after it was uploaded; leaving it in place.`);\n        continue;\n      }\n    }\n\n    try {\n      await unlink(artifact.map);\n      removed += 1;\n    } catch {\n      continue;\n    }\n\n    await unpoint(artifact.file, warn);\n  }\n\n  // CSS maps are never uploaded — the server symbolicates JavaScript — but a build that emitted\n  // them publishes the stylesheets' sources just as plainly, and `sourcemap: true` emits both.\n  // They are not artifacts, so they need their own sweep rather than a filter over the ones above.\n  for (const file of await allFiles(dir).catch(() => [])) {\n    if (!file.endsWith('.css.map')) continue;\n    try {\n      await unlink(file);\n      removed += 1;\n    } catch {\n      continue;\n    }\n\n    await unpoint(file.slice(0, -'.map'.length), warn);\n  }\n\n  return removed;\n}\n\n/**\n * Drop a trailing `//# sourceMappingURL=` from a chunk whose map has just been deleted.\n *\n * Only the trailing one, and only when nothing but a `//# debugId=` line follows it: a comment in\n * the middle of a chunk belongs to something concatenated into it, and removing a line from there\n * would shift every mapping below. Left in place, the comment makes every devtools session fetch\n * a 404 and report a broken build.\n */\nasync function unpoint(file: string, warn: (line: string) => void): Promise<void> {\n  let code: string;\n  try {\n    code = await readFile(file, 'utf8');\n  } catch {\n    return;\n  }\n\n  // Both spellings: `//#` for JavaScript and `/*# … */` for CSS, which is the same comment in the\n  // only syntax a stylesheet has.\n  const stripped = code.replace(\n    /\\n?(?:\\/\\/[#@] sourceMappingURL=[^\\n]*|\\/\\*[#@] sourceMappingURL=[^\\n]*?\\*\\/)(?=(?:\\s*\\n\\/\\/# debugId=[^\\n]*)?\\s*$)/,\n    '',\n  );\n  if (stripped === code) return;\n\n  try {\n    await writeFile(file, stripped, 'utf8');\n  } catch (error) {\n    warn(`could not remove the sourceMappingURL comment from ${file}: ${error instanceof Error ? error.message : String(error)}`);\n  }\n}\n\nfunction sha256(value: Buffer | string): string {\n  return createHash('sha256').update(value).digest('hex');\n}\n\n/** Re-export so plugins can write an id and a line shift into a map without a second import. */\nexport { injectIntoMap, mapDebugId } from '../debug-id.js';\n\n/**\n * The release: the commit being built.\n *\n * CI first. A shallow checkout — which is what every default CI clone is — often has no usable git\n * metadata, and falling straight to git produced an EMPTY release: every frame then lost its\n * release+url match, leaving the debug id as the only thing holding symbolication together.\n *\n * The FULL sha, never a short one. A short sha is a prefix whose length varies by tool (7 from\n * `git rev-parse --short`, 8 from GitLab, 12 from some deploy scripts), and the SDK reporting one\n * length while the CLI uploaded another is a release mismatch that looks exactly like no release\n * at all. Both sides read the same variables, so both get the same 40 characters.\n */\nexport function detectRelease(env: Record<string, string | undefined> = process.env): string {\n  const explicit = env['VINKTAR_RELEASE'];\n  if (explicit !== undefined && explicit.trim() !== '') return explicit.trim();\n\n  const pull = pullRequestHead(env);\n  if (pull !== null) return pull;\n\n  for (const name of [\n    'GITHUB_SHA',\n    'VERCEL_GIT_COMMIT_SHA',\n    'CF_PAGES_COMMIT_SHA',\n    'CI_COMMIT_SHA',\n    'BITBUCKET_COMMIT',\n    'BUILD_SOURCEVERSION',\n    'COMMIT_REF',\n  ]) {\n    const value = env[name];\n    if (value !== undefined && value.trim() !== '') return value.trim();\n  }\n\n  try {\n    return execFileSync('git', ['rev-parse', 'HEAD'], {\n      stdio: ['ignore', 'pipe', 'ignore'],\n      windowsHide: true,\n    })\n      .toString()\n      .trim();\n  } catch {\n    return '';\n  }\n}\n\n/**\n * The commit a GitHub pull-request build is actually building.\n *\n * On `pull_request`, `GITHUB_SHA` is a synthetic merge commit that exists only inside the runner:\n * it is in nobody's history, so a release named after it matches nothing the deployed application\n * will ever report. The head sha is in the event payload.\n */\nfunction pullRequestHead(env: Record<string, string | undefined>): string | null {\n  if (env['GITHUB_EVENT_NAME'] !== 'pull_request' && env['GITHUB_EVENT_NAME'] !== 'pull_request_target') {\n    return null;\n  }\n\n  const path = env['GITHUB_EVENT_PATH'];\n  if (path === undefined || path === '') return null;\n\n  try {\n    // Read synchronously on purpose: this runs inside a bundler's config hook, which cannot await.\n    const payload: unknown = JSON.parse(readFileSync(path, 'utf8'));\n    const sha = (payload as { pull_request?: { head?: { sha?: unknown } } })?.pull_request?.head?.sha;\n\n    return typeof sha === 'string' && sha !== '' ? sha : null;\n  } catch {\n    return null;\n  }\n}\n"]}

package/dist/bundler/esbuild.d.ts

@@ -0,0 +1,44 @@
+import { type BundlerOptions } from './core.js';
+export type { BundlerOptions } from './core.js';
+/**
+ * The esbuild plugin.
+ *
+ * ```js
+ * import { vinktarEsbuild } from '@vinktarhq/cli/esbuild';
+ * await esbuild.build({ plugins: [vinktarEsbuild()], metafile: true, sourcemap: true });
+ * ```
+ *
+ * ## One honest caveat
+ *
+ * esbuild has no hook between generating a chunk and writing it, so unlike the Rollup and webpack
+ * plugins this one edits the files afterwards. If the build uses `[hash]` in `entryNames` or
+ * `chunkNames`, that hash is computed over the pre-injection bytes and will not match the file on
+ * disk — the plugin says so once, rather than leaving it to be discovered by a service worker
+ * serving a permanently stale chunk. Nothing in esbuild's API avoids it today; every source-map
+ * tool for esbuild has the same limitation. Either leave the hash out, or use the Rollup/Vite
+ * plugin where the hook exists.
+ *
+ * `metafile: true` is required — it is how the plugin learns which files were written.
+ */
+interface BuildResult {
+    metafile?: {
+        outputs: Record<string, unknown>;
+    };
+    errors?: unknown[];
+}
+interface Build {
+    initialOptions: {
+        metafile?: boolean;
+        outdir?: string;
+        outfile?: string;
+        entryNames?: string;
+        chunkNames?: string;
+        write?: boolean;
+    };
+    onEnd(callback: (result: BuildResult) => Promise<void> | void): void;
+}
+export interface EsbuildPlugin {
+    name: string;
+    setup(build: Build): void;
+}
+export declare function vinktarEsbuild(options?: BundlerOptions): EsbuildPlugin;

package/dist/bundler/esbuild.js

@@ -0,0 +1,85 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { disabled, injectIntoMap, isScript, session, stamp } from './core.js';
+export function vinktarEsbuild(options = {}) {
+    if (disabled(options))
+        return { name: 'vinktar', setup: () => { } };
+    const stamping = options.injectDebugIds !== false;
+    return {
+        name: 'vinktar',
+        setup(build) {
+            const run = session(options);
+            let warnedAboutHash = false;
+            build.onEnd(async (result) => {
+                // A failed build has nothing worth stamping, and stamping a partial output is worse than
+                // leaving it alone.
+                if ((result.errors ?? []).length > 0)
+                    return;
+                if (build.initialOptions.write === false) {
+                    console.warn('[vinktar] esbuild is configured with `write: false`, so there are no files to stamp; skipping');
+                    return;
+                }
+                if (result.metafile === undefined) {
+                    console.warn('[vinktar] esbuild needs `metafile: true` to find its output; skipping');
+                    return;
+                }
+                if (!warnedAboutHash && hashed(build.initialOptions)) {
+                    warnedAboutHash = true;
+                    console.warn('[vinktar] esbuild computes [hash] before a plugin can touch the output, so the debug id is not in the hash. ' +
+                        'The filenames are still stable and the upload is correct; anything that re-hashes the file (SRI, a service-worker precache manifest) will disagree with the name.');
+                }
+                for (const file of stamping ? Object.keys(result.metafile.outputs) : []) {
+                    if (!isScript(file))
+                        continue;
+                    try {
+                        const code = await readFile(file, 'utf8');
+                        const stamped = stamp(code);
+                        if (!stamped.changed)
+                            continue;
+                        await writeFile(file, stamped.code, 'utf8');
+                        const map = mapOf(file, code);
+                        if (map === null)
+                            continue;
+                        const raw = await readFile(map, 'utf8').catch(() => null);
+                        if (raw === null)
+                            continue;
+                        // Same pass, same bytes: the inserted line shifts every mapping below it, and a map
+                        // left unshifted resolves every frame to the line above the one that threw.
+                        await writeFile(map, injectIntoMap(raw, stamped.debugId, stamped.line), 'utf8');
+                    }
+                    catch {
+                        // A file esbuild reported but did not write, or one on a read-only volume. One
+                        // unstamped chunk matches by release + url; a failed build helps nobody.
+                    }
+                }
+                const dir = build.initialOptions.outdir ?? dirOf(build.initialOptions.outfile);
+                if (dir === '')
+                    return;
+                await run.upload(dir);
+                await run.cleanup();
+            });
+        },
+    };
+}
+const SOURCE_MAPPING_COMMENT = /^\/\/[#@] sourceMappingURL=(.*)$/gm;
+/** The map beside a chunk: what the chunk says first, then the sibling esbuild writes by default. */
+function mapOf(file, code) {
+    let last = null;
+    for (const match of code.matchAll(SOURCE_MAPPING_COMMENT))
+        last = match;
+    const referenced = last?.[1]?.trim();
+    if (referenced !== undefined && referenced !== '' && !referenced.startsWith('data:') && !/^[a-z]+:\/\//i.test(referenced)) {
+        return resolve(dirname(file), (referenced.split('?')[0] ?? '').split('#')[0] ?? '');
+    }
+    return `${file}.map`;
+}
+function hashed(options) {
+    return (options.entryNames ?? '').includes('[hash]') || (options.chunkNames ?? '').includes('[hash]');
+}
+function dirOf(outfile) {
+    if (outfile === undefined || outfile === '')
+        return '';
+    const slash = outfile.lastIndexOf('/');
+    return slash === -1 ? '.' : outfile.slice(0, slash);
+}
+//# sourceMappingURL=esbuild.js.map

package/dist/bundler/esbuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"esbuild.js","sourceRoot":"","sources":["../../src/bundler/esbuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAuB,MAAM,WAAW,CAAC;AA+CnG,MAAM,UAAU,cAAc,CAAC,UAA0B,EAAE;IACzD,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAEnE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,SAAS;QAEf,KAAK,CAAC,KAAY;YAChB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,eAAe,GAAG,KAAK,CAAC;YAE5B,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC3B,yFAAyF;gBACzF,oBAAoB;gBACpB,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBAE7C,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;oBAE9G,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;oBAEtF,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;oBACrD,eAAe,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,IAAI,CACV,8GAA8G;wBAC5G,mKAAmK,CACtK,CAAC;gBACJ,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAE9B,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;wBAC5B,IAAI,CAAC,OAAO,CAAC,OAAO;4BAAE,SAAS;wBAE/B,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAE5C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;wBAC9B,IAAI,GAAG,KAAK,IAAI;4BAAE,SAAS;wBAE3B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC1D,IAAI,GAAG,KAAK,IAAI;4BAAE,SAAS;wBAE3B,oFAAoF;wBACpF,4EAA4E;wBAC5E,MAAM,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;oBAClF,CAAC;oBAAC,MAAM,CAAC;wBACP,+EAA+E;wBAC/E,yEAAyE;oBAC3E,CAAC;gBACH,CAAC;gBAED,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;gBAC/E,IAAI,GAAG,KAAK,EAAE;oBAAE,OAAO;gBAEvB,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAEpE,qGAAqG;AACrG,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,IAAI,IAAI,GAA2B,IAAI,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,IAAI,GAAG,KAAK,CAAC;IAExE,MAAM,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1H,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,MAAM,CAAC,OAAqD;IACnE,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,KAAK,CAAC,OAA2B;IACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import { readFile, writeFile } from 'node:fs/promises';\nimport { dirname, resolve } from 'node:path';\n\nimport { disabled, injectIntoMap, isScript, session, stamp, type BundlerOptions } from './core.js';\n\nexport type { BundlerOptions } from './core.js';\n\n/**\n * The esbuild plugin.\n *\n * ```js\n * import { vinktarEsbuild } from '@vinktarhq/cli/esbuild';\n * await esbuild.build({ plugins: [vinktarEsbuild()], metafile: true, sourcemap: true });\n * ```\n *\n * ## One honest caveat\n *\n * esbuild has no hook between generating a chunk and writing it, so unlike the Rollup and webpack\n * plugins this one edits the files afterwards. If the build uses `[hash]` in `entryNames` or\n * `chunkNames`, that hash is computed over the pre-injection bytes and will not match the file on\n * disk — the plugin says so once, rather than leaving it to be discovered by a service worker\n * serving a permanently stale chunk. Nothing in esbuild's API avoids it today; every source-map\n * tool for esbuild has the same limitation. Either leave the hash out, or use the Rollup/Vite\n * plugin where the hook exists.\n *\n * `metafile: true` is required — it is how the plugin learns which files were written.\n */\n\ninterface BuildResult {\n  metafile?: { outputs: Record<string, unknown> };\n  errors?: unknown[];\n}\n\ninterface Build {\n  initialOptions: {\n    metafile?: boolean;\n    outdir?: string;\n    outfile?: string;\n    entryNames?: string;\n    chunkNames?: string;\n    write?: boolean;\n  };\n  onEnd(callback: (result: BuildResult) => Promise<void> | void): void;\n}\n\nexport interface EsbuildPlugin {\n  name: string;\n  setup(build: Build): void;\n}\n\nexport function vinktarEsbuild(options: BundlerOptions = {}): EsbuildPlugin {\n  if (disabled(options)) return { name: 'vinktar', setup: () => {} };\n\n  const stamping = options.injectDebugIds !== false;\n\n  return {\n    name: 'vinktar',\n\n    setup(build: Build): void {\n      const run = session(options);\n      let warnedAboutHash = false;\n\n      build.onEnd(async (result) => {\n        // A failed build has nothing worth stamping, and stamping a partial output is worse than\n        // leaving it alone.\n        if ((result.errors ?? []).length > 0) return;\n\n        if (build.initialOptions.write === false) {\n          console.warn('[vinktar] esbuild is configured with `write: false`, so there are no files to stamp; skipping');\n\n          return;\n        }\n\n        if (result.metafile === undefined) {\n          console.warn('[vinktar] esbuild needs `metafile: true` to find its output; skipping');\n\n          return;\n        }\n\n        if (!warnedAboutHash && hashed(build.initialOptions)) {\n          warnedAboutHash = true;\n          console.warn(\n            '[vinktar] esbuild computes [hash] before a plugin can touch the output, so the debug id is not in the hash. ' +\n              'The filenames are still stable and the upload is correct; anything that re-hashes the file (SRI, a service-worker precache manifest) will disagree with the name.',\n          );\n        }\n\n        for (const file of stamping ? Object.keys(result.metafile.outputs) : []) {\n          if (!isScript(file)) continue;\n\n          try {\n            const code = await readFile(file, 'utf8');\n            const stamped = stamp(code);\n            if (!stamped.changed) continue;\n\n            await writeFile(file, stamped.code, 'utf8');\n\n            const map = mapOf(file, code);\n            if (map === null) continue;\n\n            const raw = await readFile(map, 'utf8').catch(() => null);\n            if (raw === null) continue;\n\n            // Same pass, same bytes: the inserted line shifts every mapping below it, and a map\n            // left unshifted resolves every frame to the line above the one that threw.\n            await writeFile(map, injectIntoMap(raw, stamped.debugId, stamped.line), 'utf8');\n          } catch {\n            // A file esbuild reported but did not write, or one on a read-only volume. One\n            // unstamped chunk matches by release + url; a failed build helps nobody.\n          }\n        }\n\n        const dir = build.initialOptions.outdir ?? dirOf(build.initialOptions.outfile);\n        if (dir === '') return;\n\n        await run.upload(dir);\n        await run.cleanup();\n      });\n    },\n  };\n}\n\nconst SOURCE_MAPPING_COMMENT = /^\\/\\/[#@] sourceMappingURL=(.*)$/gm;\n\n/** The map beside a chunk: what the chunk says first, then the sibling esbuild writes by default. */\nfunction mapOf(file: string, code: string): string | null {\n  let last: RegExpExecArray | null = null;\n  for (const match of code.matchAll(SOURCE_MAPPING_COMMENT)) last = match;\n\n  const referenced = last?.[1]?.trim();\n  if (referenced !== undefined && referenced !== '' && !referenced.startsWith('data:') && !/^[a-z]+:\\/\\//i.test(referenced)) {\n    return resolve(dirname(file), (referenced.split('?')[0] ?? '').split('#')[0] ?? '');\n  }\n\n  return `${file}.map`;\n}\n\nfunction hashed(options: { entryNames?: string; chunkNames?: string }): boolean {\n  return (options.entryNames ?? '').includes('[hash]') || (options.chunkNames ?? '').includes('[hash]');\n}\n\nfunction dirOf(outfile: string | undefined): string {\n  if (outfile === undefined || outfile === '') return '';\n  const slash = outfile.lastIndexOf('/');\n\n  return slash === -1 ? '.' : outfile.slice(0, slash);\n}\n"]}

package/dist/bundler/rollup.d.ts

@@ -0,0 +1,84 @@
+import { type BundlerOptions } from './core.js';
+export type { BundlerOptions } from './core.js';
+/**
+ * The Rollup plugin, which is also the shape Vite takes.
+ *
+ * ```js
+ * import { vinktarRollup } from '@vinktarhq/cli/rollup';
+ * export default { plugins: [vinktarRollup({ urlPrefix: '/assets/' })] };
+ * ```
+ *
+ * `renderChunk` with `order: 'post'` is the whole trick: it is the last hook that can change a
+ * chunk's bytes, and it runs before Rollup computes the content hash that goes in the filename.
+ * Anything later — including writing the files and editing them afterwards, which is what this
+ * plugin used to do — leaves every hash in the build describing content that no longer exists.
+ */
+export interface RollupPlugin {
+    name: string;
+    buildStart(): void;
+    renderChunk: {
+        order: 'post';
+        handler(this: unknown, code: string, chunk: unknown): {
+            code: string;
+            map: null;
+        } | null;
+    };
+    generateBundle: {
+        order: 'pre';
+        handler(options: unknown, bundle: Record<string, unknown>): void;
+    };
+    writeBundle(options: {
+        dir?: string;
+        file?: string;
+    }, bundle: Record<string, unknown>): Promise<void>;
+    closeBundle(): Promise<void>;
+}
+/** What a chunk got in `renderChunk`, so the map can be squared up afterwards. */
+export interface ChunkStamp {
+    readonly debugId: string;
+    /** Generated line the snippet occupies, or null when it was appended and nothing moved. */
+    readonly line: number | null;
+}
+/** Stamp one chunk and remember what its map will owe. Shared with the Vite plugin. */
+export declare function stampChunk(code: string, rawChunk: unknown, tracked: Map<string, ChunkStamp>, context?: unknown): {
+    code: string;
+    map: null;
+} | null;
+/**
+ * Square the chunk's map up with the snippet, and put back the comment that ran after us.
+ *
+ * Both halves belong in `generateBundle` with `order: 'pre'`, and both are load-bearing:
+ *
+ * - **The comment.** Vite 8 is Rolldown, and its Oxc minifier runs after `renderChunk`: it strips
+ *   the `//# debugId=` line and leaves the snippet, so the uploader read no id, derived a fresh
+ *   one from the minified bytes and filed the map under an id no stack frame reports. The
+ *   embedded marker survives minification and is what this package reads back, but the comment is
+ *   what every OTHER tool reads.
+ * - **The mappings.** Inserting a line above the code shifts every generated line below it by
+ *   one, and splicing one empty group into `mappings` is the exact repair. It has to happen HERE,
+ *   before any other plugin's `generateBundle`, because Vite's own
+ *   `vite:build-import-analysis` rewrites the entry chunk and then does
+ *   `combineSourcemaps(fileName, [itsMap, chunk.map])`. Its map is measured against the code
+ *   INCLUDING our line; combining it with a `chunk.map` that is one line short does not merely
+ *   lose precision, it collapses to empty mappings — the entry chunk of every Vite build with a
+ *   dynamic import, silently resolving nothing.
+ *
+ * `order: 'pre'` is therefore not politeness; it is the difference between a working map and an
+ * empty one.
+ */
+export declare function repairChunks(bundle: Record<string, unknown>, tracked: Map<string, ChunkStamp>): void;
+/**
+ * Write each chunk's map to disk, because Rollup will not write ours.
+ *
+ * Rollup emits a chunk's map from the reference it captured while rendering, so an edit made in
+ * `generateBundle` reaches the bundle object every other plugin sees and never reaches the file.
+ * It survived for chunks a later Vite plugin happened to rebuild and vanished for the rest, which
+ * is the worst shape a bug of this kind can take: half the maps in a build one line out, and no
+ * warning from anything.
+ *
+ * Writing the file afterwards is safe in a way that rewriting a chunk would not be. Nothing hashes
+ * a source map: its name comes from the chunk's, no integrity attribute covers it, and no importer
+ * reads its contents.
+ */
+export declare function writeMaps(dir: string, bundle: Record<string, unknown>, tracked: Map<string, ChunkStamp>, done: Set<string>): Promise<void>;
+export declare function vinktarRollup(options?: BundlerOptions): RollupPlugin;