@vinktarhq/cli 0.1.0

package/dist/bundler/rollup.js

@@ -0,0 +1,221 @@
+import { writeFile } from 'node:fs/promises';
+import { isAbsolute, join } from 'node:path';
+import { setDebugIdComment, shiftMappings } from '../debug-id.js';
+import { discover } from '../discover.js';
+import { disabled, session, stamp } from './core.js';
+/**
+ * Whether the snippet can go at the TOP of this chunk without corrupting its map.
+ *
+ * Under Rollup it can: nothing re-derives the map after `renderChunk`, so the inserted line is
+ * accounted for exactly, in `repairChunks`.
+ *
+ * Under Rolldown it cannot, and this is the difference between a working map and a meaningless
+ * one. Rolldown's Oxc minifier runs AFTER every `renderChunk` hook and rebuilds the chunk's map
+ * from the code we hand it, composed against a base that knows nothing about our extra line — so
+ * every mapping in the file lands inside the snippet. A build proved it: the first segment of a
+ * Vite 8 chunk pointed at generated column 1, which is the middle of the injected IIFE.
+ *
+ * There is no hook between those two steps, and expressing the insertion as a real transform map
+ * would mean emitting a segment per token for every chunk — which is what both incumbents do, and
+ * what their magic-string dependency is for. Appending moves nothing, so it needs no map at all;
+ * the cost is that a chunk which throws while initialising does not register its id there.
+ *
+ * `this.meta.rolldownVersion` is Rolldown's own marker, absent under Rollup.
+ */
+function prependable(context) {
+    return context?.meta?.rolldownVersion === undefined;
+}
+/**
+ * The name a chunk answers to in every hook.
+ *
+ * `fileName` still holds a hash PLACEHOLDER during `renderChunk` — the whole point of the hook is
+ * that the hash has not been computed yet — so keying on it there and looking it up by the final
+ * name later matched nothing at all. `preliminaryFileName` is the one that is stable across both.
+ */
+function keyOf(chunk) {
+    return chunk.preliminaryFileName ?? chunk.fileName ?? '';
+}
+/** Stamp one chunk and remember what its map will owe. Shared with the Vite plugin. */
+export function stampChunk(code, rawChunk, tracked, context) {
+    const chunk = (rawChunk ?? {});
+    const stamped = stamp(code, { prepend: prependable(context) });
+    tracked.set(keyOf(chunk), { debugId: stamped.debugId, line: stamped.line });
+    /**
+     * `map: null`, and it must be exactly that — not an omitted key.
+     *
+     * Rollup reads it as a strict null check: `null` keeps this transform OUT of the chunk's
+     * sourcemap chain and leaves the existing map alone, while `undefined` (an omitted key) enters
+     * the chain as a MISSING link, which makes Rollup log `SOURCEMAP_BROKEN` and collapse the whole
+     * chain to empty mappings. The line this inserted is accounted for in {@link repairChunks}
+     * instead, exactly, rather than through a generated transform map.
+     */
+    return stamped.changed ? { code: stamped.code, map: null } : null;
+}
+/**
+ * Square the chunk's map up with the snippet, and put back the comment that ran after us.
+ *
+ * Both halves belong in `generateBundle` with `order: 'pre'`, and both are load-bearing:
+ *
+ * - **The comment.** Vite 8 is Rolldown, and its Oxc minifier runs after `renderChunk`: it strips
+ *   the `//# debugId=` line and leaves the snippet, so the uploader read no id, derived a fresh
+ *   one from the minified bytes and filed the map under an id no stack frame reports. The
+ *   embedded marker survives minification and is what this package reads back, but the comment is
+ *   what every OTHER tool reads.
+ * - **The mappings.** Inserting a line above the code shifts every generated line below it by
+ *   one, and splicing one empty group into `mappings` is the exact repair. It has to happen HERE,
+ *   before any other plugin's `generateBundle`, because Vite's own
+ *   `vite:build-import-analysis` rewrites the entry chunk and then does
+ *   `combineSourcemaps(fileName, [itsMap, chunk.map])`. Its map is measured against the code
+ *   INCLUDING our line; combining it with a `chunk.map` that is one line short does not merely
+ *   lose precision, it collapses to empty mappings — the entry chunk of every Vite build with a
+ *   dynamic import, silently resolving nothing.
+ *
+ * `order: 'pre'` is therefore not politeness; it is the difference between a working map and an
+ * empty one.
+ */
+export function repairChunks(bundle, tracked) {
+    for (const asset of Object.values(bundle)) {
+        const chunk = asset;
+        if (chunk.type !== 'chunk' || typeof chunk.code !== 'string')
+            continue;
+        const found = tracked.get(keyOf(chunk));
+        if (found === undefined)
+            continue;
+        // Placed the way `inject` places it — before a trailing `sourceMappingURL`, never after.
+        // Devtools stop reading at the mapping comment, so a debugId line below it would make the map
+        // unreachable, which is a strange way to fix a source-map tool.
+        chunk.code = setDebugIdComment(chunk.code, found.debugId);
+        const map = chunk.map;
+        if (map === null || map === undefined || typeof map.mappings !== 'string')
+            continue;
+        if (found.line !== null) {
+            map.mappings = String(shiftMappings({ mappings: map.mappings }, found.line)['mappings']);
+        }
+        // Vite carries `debugId` across its own re-combination by name, and nothing else, so this is
+        // the one field worth setting here rather than only on disk.
+        map['debugId'] = found.debugId;
+    }
+}
+/**
+ * Write each chunk's map to disk, because Rollup will not write ours.
+ *
+ * Rollup emits a chunk's map from the reference it captured while rendering, so an edit made in
+ * `generateBundle` reaches the bundle object every other plugin sees and never reaches the file.
+ * It survived for chunks a later Vite plugin happened to rebuild and vanished for the rest, which
+ * is the worst shape a bug of this kind can take: half the maps in a build one line out, and no
+ * warning from anything.
+ *
+ * Writing the file afterwards is safe in a way that rewriting a chunk would not be. Nothing hashes
+ * a source map: its name comes from the chunk's, no integrity attribute covers it, and no importer
+ * reads its contents.
+ */
+export async function writeMaps(dir, bundle, tracked, done) {
+    const chunks = Object.values(bundle).filter((asset) => {
+        const chunk = asset;
+        return chunk.type === 'chunk' && tracked.has(keyOf(chunk));
+    });
+    if (process.env['VINKTAR_DEBUG_TRACK'])
+        console.log('WRITEMAPS', dir, chunks.length, [...tracked.keys()], Object.keys(bundle));
+    if (chunks.length === 0)
+        return;
+    // One walk of the output, reusing the chunk-to-map resolution the uploader uses — which asks
+    // the chunk what its map is called before assuming a `<file>.map` sibling, and so copes with
+    // `output.sourcemapFileNames`.
+    const { artifacts } = await discover(dir).catch(() => ({ artifacts: [] }));
+    const maps = new Map(artifacts.map((artifact) => [artifact.file, artifact.map]));
+    for (const chunk of chunks) {
+        const found = tracked.get(keyOf(chunk));
+        const map = chunk.map;
+        if (map === null || map === undefined || typeof map.mappings !== 'string')
+            continue;
+        const path = maps.get(join(dir, chunk.fileName ?? ''));
+        if (process.env['VINKTAR_DEBUG_TRACK'])
+            console.log('WM', chunk.fileName, path, found.line, typeof map.mappings);
+        // Idempotent per file per build: `writeBundle` fires once per output, and two outputs writing
+        // into one directory must not each rewrite the other's maps.
+        if (path === undefined || path === null || done.has(path))
+            continue;
+        done.add(path);
+        try {
+            await writeFile(path, JSON.stringify({ ...map, debugId: found.debugId, debug_id: found.debugId }), 'utf8');
+        }
+        catch {
+            // A read-only volume, or a map the bundler did not actually write. The chunk still carries
+            // its id, and the uploader will stamp whatever map it does find.
+        }
+    }
+}
+export function vinktarRollup(options = {}) {
+    if (disabled(options))
+        return inert();
+    const tracked = new Map();
+    const repaired = new Set();
+    const stamping = options.injectDebugIds !== false;
+    const run = session(options);
+    return {
+        name: 'vinktar',
+        buildStart() {
+            // A watch rebuild rewrites every file, so last build's bookkeeping would suppress this
+            // build's repairs.
+            tracked.clear();
+            repaired.clear();
+        },
+        renderChunk: {
+            order: 'post',
+            handler(code, chunk) {
+                return stamping ? stampChunk(code, chunk, tracked, this) : null;
+            },
+        },
+        generateBundle: {
+            order: 'pre',
+            handler(_options, bundle) {
+                repairChunks(bundle, tracked);
+            },
+        },
+        /**
+         * Every output, not the first one.
+         *
+         * The previous version latched on the output directory and returned early for the rest, so a
+         * build with a client output and an SSR output — SvelteKit, Nuxt, Remix, or plain
+         * `output: [a, b]` — uploaded the first and silently dropped the second. Re-uploading costs
+         * nothing: the content hashes are checked against the server before any bytes are sent.
+         */
+        async writeBundle(output, bundle) {
+            const dir = outputDir(output);
+            if (dir === '')
+                return;
+            await writeMaps(dir, bundle, tracked, repaired);
+            await run.upload(dir);
+            // Deleting here rather than only in `closeBundle`, because `closeBundle` fires only when the
+            // caller closes the bundle — Vite and the Rollup CLI do, `rollup.rollup().write()` does not.
+            // Leaving the maps in a public directory on that path is the exact leak this deletes.
+            await run.cleanup();
+        },
+        async closeBundle() {
+            await run.cleanup();
+        },
+    };
+}
+/**
+ * The plugin that does nothing, for `disable: true`.
+ *
+ * A whole plugin rather than a flag threaded through every hook, so that a config reused by
+ * vitest or Storybook costs a function call and not a directory walk.
+ */
+function inert() {
+    return {
+        name: 'vinktar',
+        buildStart() { },
+        renderChunk: { order: 'post', handler: () => null },
+        generateBundle: { order: 'pre', handler: () => { } },
+        writeBundle: async () => { },
+        closeBundle: async () => { },
+    };
+}
+function outputDir(output) {
+    const dir = output.dir ?? (output.file === undefined ? '' : join(output.file, '..'));
+    if (dir === '')
+        return '';
+    return isAbsolute(dir) ? dir : join(process.cwd(), dir);
+}
+//# sourceMappingURL=rollup.js.map

package/dist/bundler/rollup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollup.js","sourceRoot":"","sources":["../../src/bundler/rollup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAuB,MAAM,WAAW,CAAC;AA+C1E;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,WAAW,CAAC,OAAgB;IACnC,OAAQ,OAAgE,EAAE,IAAI,EAAE,eAAe,KAAK,SAAS,CAAC;AAChH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,QAAiB,EACjB,OAAgC,EAChC,OAAiB;IAEjB,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAe,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAE/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5E;;;;;;;;OAQG;IACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,YAAY,CAAC,MAA+B,EAAE,OAAgC;IAC5F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAmB,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QAEvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAElC,yFAAyF;QACzF,8FAA8F;QAC9F,gEAAgE;QAChE,KAAK,CAAC,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,SAAS;QAEpF,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,6FAA6F;QAC7F,6DAA6D;QAC5D,GAA+B,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,MAA+B,EAC/B,OAAgC,EAChC,IAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACzE,MAAM,KAAK,GAAG,KAAmB,CAAC;QAElC,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/H,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhC,6FAA6F;IAC7F,6FAA6F;IAC7F,+BAA+B;IAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEjF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAE,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,SAAS;QAEpF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjH,8FAA8F;QAC9F,6DAA6D;QAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,SAAS,CACb,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,EAAE,GAAI,GAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EACvF,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2FAA2F;YAC3F,iEAAiE;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAA0B,EAAE;IACxD,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,EAAE,CAAC;IAEtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO;QACL,IAAI,EAAE,SAAS;QAEf,UAAU;YACR,uFAAuF;YACvF,mBAAmB;YACnB,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAED,WAAW,EAAE;YACX,KAAK,EAAE,MAAM;YACb,OAAO,CAAgB,IAAY,EAAE,KAAc;gBACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,CAAC;SACF;QAED,cAAc,EAAE;YACd,KAAK,EAAE,KAAK;YACZ,OAAO,CAAC,QAAiB,EAAE,MAA+B;gBACxD,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC;SACF;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,WAAW,CAAC,MAAuC,EAAE,MAA+B;YACxF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,EAAE;gBAAE,OAAO;YAEvB,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChD,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,6FAA6F;YAC7F,6FAA6F;YAC7F,sFAAsF;YACtF,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,WAAW;YACf,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,KAAK;IACZ,OAAO;QACL,IAAI,EAAE,SAAS;QACf,UAAU,KAAI,CAAC;QACf,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;QACnD,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;QACnD,WAAW,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QAC3B,WAAW,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAuC;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrF,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAE1B,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["import { writeFile } from 'node:fs/promises';\nimport { isAbsolute, join } from 'node:path';\n\nimport { setDebugIdComment, shiftMappings } from '../debug-id.js';\nimport { discover } from '../discover.js';\nimport { disabled, session, stamp, type BundlerOptions } from './core.js';\n\nexport type { BundlerOptions } from './core.js';\n\n/**\n * The Rollup plugin, which is also the shape Vite takes.\n *\n * ```js\n * import { vinktarRollup } from '@vinktarhq/cli/rollup';\n * export default { plugins: [vinktarRollup({ urlPrefix: '/assets/' })] };\n * ```\n *\n * `renderChunk` with `order: 'post'` is the whole trick: it is the last hook that can change a\n * chunk's bytes, and it runs before Rollup computes the content hash that goes in the filename.\n * Anything later — including writing the files and editing them afterwards, which is what this\n * plugin used to do — leaves every hash in the build describing content that no longer exists.\n */\nexport interface RollupPlugin {\n  name: string;\n  buildStart(): void;\n  renderChunk: {\n    order: 'post';\n    handler(this: unknown, code: string, chunk: unknown): { code: string; map: null } | null;\n  };\n  generateBundle: {\n    order: 'pre';\n    handler(options: unknown, bundle: Record<string, unknown>): void;\n  };\n  writeBundle(options: { dir?: string; file?: string }, bundle: Record<string, unknown>): Promise<void>;\n  closeBundle(): Promise<void>;\n}\n\n/** What a chunk got in `renderChunk`, so the map can be squared up afterwards. */\nexport interface ChunkStamp {\n  readonly debugId: string;\n  /** Generated line the snippet occupies, or null when it was appended and nothing moved. */\n  readonly line: number | null;\n}\n\ninterface ChunkShape {\n  type?: string;\n  fileName?: string;\n  preliminaryFileName?: string;\n  code?: string;\n  map?: { mappings?: unknown } | null;\n}\n\n/**\n * Whether the snippet can go at the TOP of this chunk without corrupting its map.\n *\n * Under Rollup it can: nothing re-derives the map after `renderChunk`, so the inserted line is\n * accounted for exactly, in `repairChunks`.\n *\n * Under Rolldown it cannot, and this is the difference between a working map and a meaningless\n * one. Rolldown's Oxc minifier runs AFTER every `renderChunk` hook and rebuilds the chunk's map\n * from the code we hand it, composed against a base that knows nothing about our extra line — so\n * every mapping in the file lands inside the snippet. A build proved it: the first segment of a\n * Vite 8 chunk pointed at generated column 1, which is the middle of the injected IIFE.\n *\n * There is no hook between those two steps, and expressing the insertion as a real transform map\n * would mean emitting a segment per token for every chunk — which is what both incumbents do, and\n * what their magic-string dependency is for. Appending moves nothing, so it needs no map at all;\n * the cost is that a chunk which throws while initialising does not register its id there.\n *\n * `this.meta.rolldownVersion` is Rolldown's own marker, absent under Rollup.\n */\nfunction prependable(context: unknown): boolean {\n  return (context as { meta?: { rolldownVersion?: unknown } } | undefined)?.meta?.rolldownVersion === undefined;\n}\n\n/**\n * The name a chunk answers to in every hook.\n *\n * `fileName` still holds a hash PLACEHOLDER during `renderChunk` — the whole point of the hook is\n * that the hash has not been computed yet — so keying on it there and looking it up by the final\n * name later matched nothing at all. `preliminaryFileName` is the one that is stable across both.\n */\nfunction keyOf(chunk: ChunkShape): string {\n  return chunk.preliminaryFileName ?? chunk.fileName ?? '';\n}\n\n/** Stamp one chunk and remember what its map will owe. Shared with the Vite plugin. */\nexport function stampChunk(\n  code: string,\n  rawChunk: unknown,\n  tracked: Map<string, ChunkStamp>,\n  context?: unknown,\n): { code: string; map: null } | null {\n  const chunk = (rawChunk ?? {}) as ChunkShape;\n  const stamped = stamp(code, { prepend: prependable(context) });\n\n  tracked.set(keyOf(chunk), { debugId: stamped.debugId, line: stamped.line });\n\n  /**\n   * `map: null`, and it must be exactly that — not an omitted key.\n   *\n   * Rollup reads it as a strict null check: `null` keeps this transform OUT of the chunk's\n   * sourcemap chain and leaves the existing map alone, while `undefined` (an omitted key) enters\n   * the chain as a MISSING link, which makes Rollup log `SOURCEMAP_BROKEN` and collapse the whole\n   * chain to empty mappings. The line this inserted is accounted for in {@link repairChunks}\n   * instead, exactly, rather than through a generated transform map.\n   */\n  return stamped.changed ? { code: stamped.code, map: null } : null;\n}\n\n/**\n * Square the chunk's map up with the snippet, and put back the comment that ran after us.\n *\n * Both halves belong in `generateBundle` with `order: 'pre'`, and both are load-bearing:\n *\n * - **The comment.** Vite 8 is Rolldown, and its Oxc minifier runs after `renderChunk`: it strips\n *   the `//# debugId=` line and leaves the snippet, so the uploader read no id, derived a fresh\n *   one from the minified bytes and filed the map under an id no stack frame reports. The\n *   embedded marker survives minification and is what this package reads back, but the comment is\n *   what every OTHER tool reads.\n * - **The mappings.** Inserting a line above the code shifts every generated line below it by\n *   one, and splicing one empty group into `mappings` is the exact repair. It has to happen HERE,\n *   before any other plugin's `generateBundle`, because Vite's own\n *   `vite:build-import-analysis` rewrites the entry chunk and then does\n *   `combineSourcemaps(fileName, [itsMap, chunk.map])`. Its map is measured against the code\n *   INCLUDING our line; combining it with a `chunk.map` that is one line short does not merely\n *   lose precision, it collapses to empty mappings — the entry chunk of every Vite build with a\n *   dynamic import, silently resolving nothing.\n *\n * `order: 'pre'` is therefore not politeness; it is the difference between a working map and an\n * empty one.\n */\nexport function repairChunks(bundle: Record<string, unknown>, tracked: Map<string, ChunkStamp>): void {\n  for (const asset of Object.values(bundle)) {\n    const chunk = asset as ChunkShape;\n    if (chunk.type !== 'chunk' || typeof chunk.code !== 'string') continue;\n\n    const found = tracked.get(keyOf(chunk));\n    if (found === undefined) continue;\n\n    // Placed the way `inject` places it — before a trailing `sourceMappingURL`, never after.\n    // Devtools stop reading at the mapping comment, so a debugId line below it would make the map\n    // unreachable, which is a strange way to fix a source-map tool.\n    chunk.code = setDebugIdComment(chunk.code, found.debugId);\n\n    const map = chunk.map;\n    if (map === null || map === undefined || typeof map.mappings !== 'string') continue;\n\n    if (found.line !== null) {\n      map.mappings = String(shiftMappings({ mappings: map.mappings }, found.line)['mappings']);\n    }\n    // Vite carries `debugId` across its own re-combination by name, and nothing else, so this is\n    // the one field worth setting here rather than only on disk.\n    (map as Record<string, unknown>)['debugId'] = found.debugId;\n  }\n}\n\n/**\n * Write each chunk's map to disk, because Rollup will not write ours.\n *\n * Rollup emits a chunk's map from the reference it captured while rendering, so an edit made in\n * `generateBundle` reaches the bundle object every other plugin sees and never reaches the file.\n * It survived for chunks a later Vite plugin happened to rebuild and vanished for the rest, which\n * is the worst shape a bug of this kind can take: half the maps in a build one line out, and no\n * warning from anything.\n *\n * Writing the file afterwards is safe in a way that rewriting a chunk would not be. Nothing hashes\n * a source map: its name comes from the chunk's, no integrity attribute covers it, and no importer\n * reads its contents.\n */\nexport async function writeMaps(\n  dir: string,\n  bundle: Record<string, unknown>,\n  tracked: Map<string, ChunkStamp>,\n  done: Set<string>,\n): Promise<void> {\n  const chunks = Object.values(bundle).filter((asset): asset is ChunkShape => {\n    const chunk = asset as ChunkShape;\n\n    return chunk.type === 'chunk' && tracked.has(keyOf(chunk));\n  });\n\n  if (process.env['VINKTAR_DEBUG_TRACK']) console.log('WRITEMAPS', dir, chunks.length, [...tracked.keys()], Object.keys(bundle));\n  if (chunks.length === 0) return;\n\n  // One walk of the output, reusing the chunk-to-map resolution the uploader uses — which asks\n  // the chunk what its map is called before assuming a `<file>.map` sibling, and so copes with\n  // `output.sourcemapFileNames`.\n  const { artifacts } = await discover(dir).catch(() => ({ artifacts: [] }));\n  const maps = new Map(artifacts.map((artifact) => [artifact.file, artifact.map]));\n\n  for (const chunk of chunks) {\n    const found = tracked.get(keyOf(chunk))!;\n    const map = chunk.map;\n    if (map === null || map === undefined || typeof map.mappings !== 'string') continue;\n\n    const path = maps.get(join(dir, chunk.fileName ?? ''));\n    if (process.env['VINKTAR_DEBUG_TRACK']) console.log('WM', chunk.fileName, path, found.line, typeof map.mappings);\n    // Idempotent per file per build: `writeBundle` fires once per output, and two outputs writing\n    // into one directory must not each rewrite the other's maps.\n    if (path === undefined || path === null || done.has(path)) continue;\n    done.add(path);\n\n    try {\n      await writeFile(\n        path,\n        JSON.stringify({ ...(map as object), debugId: found.debugId, debug_id: found.debugId }),\n        'utf8',\n      );\n    } catch {\n      // A read-only volume, or a map the bundler did not actually write. The chunk still carries\n      // its id, and the uploader will stamp whatever map it does find.\n    }\n  }\n}\n\nexport function vinktarRollup(options: BundlerOptions = {}): RollupPlugin {\n  if (disabled(options)) return inert();\n\n  const tracked = new Map<string, ChunkStamp>();\n  const repaired = new Set<string>();\n  const stamping = options.injectDebugIds !== false;\n  const run = session(options);\n\n  return {\n    name: 'vinktar',\n\n    buildStart() {\n      // A watch rebuild rewrites every file, so last build's bookkeeping would suppress this\n      // build's repairs.\n      tracked.clear();\n      repaired.clear();\n    },\n\n    renderChunk: {\n      order: 'post',\n      handler(this: unknown, code: string, chunk: unknown) {\n        return stamping ? stampChunk(code, chunk, tracked, this) : null;\n      },\n    },\n\n    generateBundle: {\n      order: 'pre',\n      handler(_options: unknown, bundle: Record<string, unknown>) {\n        repairChunks(bundle, tracked);\n      },\n    },\n\n    /**\n     * Every output, not the first one.\n     *\n     * The previous version latched on the output directory and returned early for the rest, so a\n     * build with a client output and an SSR output — SvelteKit, Nuxt, Remix, or plain\n     * `output: [a, b]` — uploaded the first and silently dropped the second. Re-uploading costs\n     * nothing: the content hashes are checked against the server before any bytes are sent.\n     */\n    async writeBundle(output: { dir?: string; file?: string }, bundle: Record<string, unknown>): Promise<void> {\n      const dir = outputDir(output);\n      if (dir === '') return;\n\n      await writeMaps(dir, bundle, tracked, repaired);\n      await run.upload(dir);\n      // Deleting here rather than only in `closeBundle`, because `closeBundle` fires only when the\n      // caller closes the bundle — Vite and the Rollup CLI do, `rollup.rollup().write()` does not.\n      // Leaving the maps in a public directory on that path is the exact leak this deletes.\n      await run.cleanup();\n    },\n\n    async closeBundle(): Promise<void> {\n      await run.cleanup();\n    },\n  };\n}\n\n/**\n * The plugin that does nothing, for `disable: true`.\n *\n * A whole plugin rather than a flag threaded through every hook, so that a config reused by\n * vitest or Storybook costs a function call and not a directory walk.\n */\nfunction inert(): RollupPlugin {\n  return {\n    name: 'vinktar',\n    buildStart() {},\n    renderChunk: { order: 'post', handler: () => null },\n    generateBundle: { order: 'pre', handler: () => {} },\n    writeBundle: async () => {},\n    closeBundle: async () => {},\n  };\n}\n\nfunction outputDir(output: { dir?: string; file?: string }): string {\n  const dir = output.dir ?? (output.file === undefined ? '' : join(output.file, '..'));\n  if (dir === '') return '';\n\n  return isAbsolute(dir) ? dir : join(process.cwd(), dir);\n}\n"]}

package/dist/bundler/rspack.d.ts

@@ -0,0 +1,8 @@
+/**
+ * rspack reimplements webpack's plugin API — `thisCompilation`, `processAssets`, the stage
+ * constants and `compilation.updateAsset` all behave the same way — so the plugin is the same
+ * plugin. This module exists so an rspack config can say `vinktarRspack` and read correctly,
+ * rather than importing something called "webpack" into a build that is not one.
+ */
+export { VinktarWebpackPlugin as VinktarRspackPlugin, vinktarWebpack as vinktarRspack } from './webpack.js';
+export type { BundlerOptions } from './core.js';

package/dist/bundler/rspack.js

@@ -0,0 +1,8 @@
+/**
+ * rspack reimplements webpack's plugin API — `thisCompilation`, `processAssets`, the stage
+ * constants and `compilation.updateAsset` all behave the same way — so the plugin is the same
+ * plugin. This module exists so an rspack config can say `vinktarRspack` and read correctly,
+ * rather than importing something called "webpack" into a build that is not one.
+ */
+export { VinktarWebpackPlugin as VinktarRspackPlugin, vinktarWebpack as vinktarRspack } from './webpack.js';
+//# sourceMappingURL=rspack.js.map

package/dist/bundler/rspack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rspack.js","sourceRoot":"","sources":["../../src/bundler/rspack.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,IAAI,mBAAmB,EAAE,cAAc,IAAI,aAAa,EAAE,MAAM,cAAc,CAAC","sourcesContent":["/**\n * rspack reimplements webpack's plugin API — `thisCompilation`, `processAssets`, the stage\n * constants and `compilation.updateAsset` all behave the same way — so the plugin is the same\n * plugin. This module exists so an rspack config can say `vinktarRspack` and read correctly,\n * rather than importing something called \"webpack\" into a build that is not one.\n */\nexport { VinktarWebpackPlugin as VinktarRspackPlugin, vinktarWebpack as vinktarRspack } from './webpack.js';\nexport type { BundlerOptions } from './core.js';\n"]}

package/dist/bundler/webpack.d.ts

@@ -0,0 +1,83 @@
+import { type BundlerOptions } from './core.js';
+/**
+ * The webpack plugin, which is also the rspack plugin.
+ *
+ * ```js
+ * const { vinktarWebpack } = require('@vinktarhq/cli/webpack');
+ * module.exports = { plugins: [new vinktarWebpack({ urlPrefix: '/static/' })] };
+ * ```
+ *
+ * rspack reimplements webpack's plugin API, including `processAssets` and its stage constants, so
+ * one class serves both. `@vinktarhq/cli/rspack` re-exports this under its own name because that is
+ * what a reader of an rspack config expects to see.
+ *
+ * ## The stage matters
+ *
+ * `PROCESS_ASSETS_STAGE_OPTIMIZE_HASH` is the documented point for "changing the asset in a way
+ * that affects its hash", and it is where the real content hashes are computed. Doing this any
+ * later — in `afterEmit`, say — means the file on disk no longer matches the hash in its own name,
+ * and everything downstream that recorded that hash (a PWA precache manifest, an integrity
+ * attribute, a precompressed copy) is pointing at bytes that are gone.
+ *
+ * One BEFORE it, though, not at it. Taps sharing a stage run in registration order, and rspack's
+ * real-content-hash pass is native and registered before any user plugin — so at the stage itself
+ * the hash was computed from the pre-injection bytes and the filename described a file that never
+ * existed. A build proved it: with the plugin and without it, rspack emitted the same
+ * `main.<hash>.js` for different content. webpack is unaffected either way, so both take the
+ * earlier slot.
+ *
+ * It is also after `PROCESS_ASSETS_STAGE_DEV_TOOLING`, which is where `SourceMapDevToolPlugin`
+ * emits the `.map` assets and appends the `sourceMappingURL` comment. That ordering is what lets
+ * the map be corrected in the same pass as the chunk: the injected line shifts every mapping
+ * below it, and a map fixed in a later hook would already have been hashed and written.
+ */
+/** Just enough of webpack's shape to compile without depending on it. */
+interface Compiler {
+    hooks: {
+        thisCompilation: {
+            tap(name: string, fn: (compilation: Compilation) => void): void;
+        };
+        afterEmit: {
+            tapPromise(name: string, fn: (compilation: Compilation) => Promise<void>): void;
+        };
+    };
+    options: {
+        output?: {
+            path?: string;
+        };
+    };
+    webpack?: {
+        Compilation?: {
+            PROCESS_ASSETS_STAGE_OPTIMIZE_HASH?: number;
+        };
+        sources?: SourceLibrary;
+    };
+}
+interface SourceLibrary {
+    RawSource: new (value: string) => unknown;
+}
+interface Compilation {
+    hooks: {
+        processAssets: {
+            tap(options: {
+                name: string;
+                stage: number;
+            }, fn: (assets: Record<string, Asset>) => void): void;
+        };
+    };
+    updateAsset(name: string, source: unknown): void;
+    getAsset(name: string): {
+        source: Asset;
+    } | undefined;
+}
+interface Asset {
+    source(): string | Buffer;
+}
+export declare class VinktarWebpackPlugin {
+    private readonly options;
+    constructor(options?: BundlerOptions);
+    apply(compiler: Compiler): void;
+}
+/** Named for how a config reads: `new vinktarWebpack({ … })`. */
+export declare const vinktarWebpack: typeof VinktarWebpackPlugin;
+export type { BundlerOptions } from './core.js';

package/dist/bundler/webpack.js

@@ -0,0 +1,104 @@
+import { disabled, injectIntoMap, isScript, session, stamp } from './core.js';
+const NAME = 'vinktar';
+/** webpack's own value for this stage, when the compiler does not expose the constant. */
+const STAGE_OPTIMIZE_HASH = 2500;
+export class VinktarWebpackPlugin {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    apply(compiler) {
+        if (disabled(this.options))
+            return;
+        const stamping = this.options.injectDebugIds !== false;
+        const RawSource = compiler.webpack?.sources?.RawSource;
+        const stage = (compiler.webpack?.Compilation?.PROCESS_ASSETS_STAGE_OPTIMIZE_HASH ?? STAGE_OPTIMIZE_HASH) - 1;
+        const run = session(this.options);
+        compiler.hooks.thisCompilation.tap(NAME, (compilation) => {
+            compilation.hooks.processAssets.tap({ name: NAME, stage }, (assets) => {
+                if (!stamping)
+                    return;
+                const write = (name, value) => {
+                    // `RawSource` is reached through the compiler rather than imported, so this file has no
+                    // build-time dependency on webpack at all — and so rspack's own sources are used under
+                    // rspack rather than webpack's.
+                    compilation.updateAsset(name, RawSource === undefined ? value : new RawSource(value));
+                };
+                for (const name of Object.keys(assets)) {
+                    if (!isScript(name))
+                        continue;
+                    const asset = compilation.getAsset(name);
+                    if (asset === undefined)
+                        continue;
+                    const code = String(asset.source.source());
+                    const stamped = stamp(code);
+                    if (!stamped.changed)
+                        continue;
+                    write(name, stamped.code);
+                    // The map is corrected in the same stage, from the same bytes. Skipping it leaves every
+                    // line one out of step, which is worse than no map: the frame resolves, to the wrong
+                    // line, and nobody doubts a source map that answered.
+                    const mapName = mapAssetOf(name, code, assets);
+                    if (mapName === null)
+                        continue;
+                    const map = compilation.getAsset(mapName);
+                    if (map === undefined)
+                        continue;
+                    try {
+                        write(mapName, injectIntoMap(String(map.source.source()), stamped.debugId, stamped.line));
+                    }
+                    catch {
+                        // A map asset that is not JSON is not ours to rewrite.
+                    }
+                }
+            });
+        });
+        compiler.hooks.afterEmit.tapPromise(NAME, async () => {
+            const dir = compiler.options.output?.path ?? '';
+            if (dir === '')
+                return;
+            await run.upload(dir);
+            await run.cleanup();
+        });
+    }
+}
+const SOURCE_MAPPING_COMMENT = /^\/\/[#@] sourceMappingURL=(.*)$/gm;
+/**
+ * The map asset belonging to a chunk asset.
+ *
+ * `output.sourceMapFilename` is configurable — `[file].map` is only the default, and a build that
+ * puts maps under `sourcemaps/[name].map` has no `<file>.map` asset at all. The chunk names its
+ * own map in the comment `SourceMapDevToolPlugin` just appended, so that is asked first and the
+ * sibling is the fallback.
+ */
+function mapAssetOf(name, code, assets) {
+    let last = null;
+    for (const match of code.matchAll(SOURCE_MAPPING_COMMENT))
+        last = match;
+    const referenced = last?.[1]?.trim();
+    if (referenced !== undefined && referenced !== '' && !referenced.startsWith('data:')) {
+        const slash = name.lastIndexOf('/');
+        const directory = slash === -1 ? '' : name.slice(0, slash + 1);
+        const target = normalise(`${directory}${(referenced.split('?')[0] ?? '').split('#')[0] ?? ''}`);
+        if (target in assets)
+            return target;
+    }
+    return `${name}.map` in assets ? `${name}.map` : null;
+}
+/** Collapse `a/../b` and `./b`, which a relative sourceMappingURL legitimately contains. */
+function normalise(path) {
+    const parts = [];
+    for (const segment of path.split('/')) {
+        if (segment === '.' || segment === '')
+            continue;
+        if (segment === '..') {
+            parts.pop();
+            continue;
+        }
+        parts.push(segment);
+    }
+    return parts.join('/');
+}
+/** Named for how a config reads: `new vinktarWebpack({ … })`. */
+export const vinktarWebpack = VinktarWebpackPlugin;
+//# sourceMappingURL=webpack.js.map

package/dist/bundler/webpack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webpack.js","sourceRoot":"","sources":["../../src/bundler/webpack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAuB,MAAM,WAAW,CAAC;AA+DnG,MAAM,IAAI,GAAG,SAAS,CAAC;AAEvB,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,UAA0B,EAAE;QAA5B,YAAO,GAAP,OAAO,CAAqB;IAAG,CAAC;IAE7D,KAAK,CAAC,QAAkB;QACtB,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC;QACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QACvD,MAAM,KAAK,GACT,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,kCAAkC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACjG,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YACvD,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;gBACpE,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBAEtB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;oBAClD,wFAAwF;oBACxF,uFAAuF;oBACvF,gCAAgC;oBAChC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxF,CAAC,CAAC;gBAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAE9B,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACzC,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAElC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC5B,IAAI,CAAC,OAAO,CAAC,OAAO;wBAAE,SAAS;oBAE/B,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;oBAE1B,wFAAwF;oBACxF,qFAAqF;oBACrF,sDAAsD;oBACtD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC/C,IAAI,OAAO,KAAK,IAAI;wBAAE,SAAS;oBAE/B,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,GAAG,KAAK,SAAS;wBAAE,SAAS;oBAEhC,IAAI,CAAC;wBACH,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC5F,CAAC;oBAAC,MAAM,CAAC;wBACP,uDAAuD;oBACzD,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,IAAI,GAAG,KAAK,EAAE;gBAAE,OAAO;YAEvB,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAEpE;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,MAA+B;IAC7E,IAAI,IAAI,GAA2B,IAAI,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,IAAI,GAAG,KAAK,CAAC;IAExE,MAAM,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEhG,IAAI,MAAM,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IACtC,CAAC;IAED,OAAO,GAAG,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAChD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC","sourcesContent":["import { disabled, injectIntoMap, isScript, session, stamp, type BundlerOptions } from './core.js';\n\n/**\n * The webpack plugin, which is also the rspack plugin.\n *\n * ```js\n * const { vinktarWebpack } = require('@vinktarhq/cli/webpack');\n * module.exports = { plugins: [new vinktarWebpack({ urlPrefix: '/static/' })] };\n * ```\n *\n * rspack reimplements webpack's plugin API, including `processAssets` and its stage constants, so\n * one class serves both. `@vinktarhq/cli/rspack` re-exports this under its own name because that is\n * what a reader of an rspack config expects to see.\n *\n * ## The stage matters\n *\n * `PROCESS_ASSETS_STAGE_OPTIMIZE_HASH` is the documented point for \"changing the asset in a way\n * that affects its hash\", and it is where the real content hashes are computed. Doing this any\n * later — in `afterEmit`, say — means the file on disk no longer matches the hash in its own name,\n * and everything downstream that recorded that hash (a PWA precache manifest, an integrity\n * attribute, a precompressed copy) is pointing at bytes that are gone.\n *\n * One BEFORE it, though, not at it. Taps sharing a stage run in registration order, and rspack's\n * real-content-hash pass is native and registered before any user plugin — so at the stage itself\n * the hash was computed from the pre-injection bytes and the filename described a file that never\n * existed. A build proved it: with the plugin and without it, rspack emitted the same\n * `main.<hash>.js` for different content. webpack is unaffected either way, so both take the\n * earlier slot.\n *\n * It is also after `PROCESS_ASSETS_STAGE_DEV_TOOLING`, which is where `SourceMapDevToolPlugin`\n * emits the `.map` assets and appends the `sourceMappingURL` comment. That ordering is what lets\n * the map be corrected in the same pass as the chunk: the injected line shifts every mapping\n * below it, and a map fixed in a later hook would already have been hashed and written.\n */\n\n/** Just enough of webpack's shape to compile without depending on it. */\ninterface Compiler {\n  hooks: {\n    thisCompilation: { tap(name: string, fn: (compilation: Compilation) => void): void };\n    afterEmit: { tapPromise(name: string, fn: (compilation: Compilation) => Promise<void>): void };\n  };\n  options: { output?: { path?: string } };\n  webpack?: { Compilation?: { PROCESS_ASSETS_STAGE_OPTIMIZE_HASH?: number }; sources?: SourceLibrary };\n}\n\ninterface SourceLibrary {\n  RawSource: new (value: string) => unknown;\n}\n\ninterface Compilation {\n  hooks: {\n    processAssets: {\n      tap(options: { name: string; stage: number }, fn: (assets: Record<string, Asset>) => void): void;\n    };\n  };\n  updateAsset(name: string, source: unknown): void;\n  getAsset(name: string): { source: Asset } | undefined;\n}\n\ninterface Asset {\n  source(): string | Buffer;\n}\n\nconst NAME = 'vinktar';\n\n/** webpack's own value for this stage, when the compiler does not expose the constant. */\nconst STAGE_OPTIMIZE_HASH = 2500;\n\nexport class VinktarWebpackPlugin {\n  constructor(private readonly options: BundlerOptions = {}) {}\n\n  apply(compiler: Compiler): void {\n    if (disabled(this.options)) return;\n\n    const stamping = this.options.injectDebugIds !== false;\n    const RawSource = compiler.webpack?.sources?.RawSource;\n    const stage =\n      (compiler.webpack?.Compilation?.PROCESS_ASSETS_STAGE_OPTIMIZE_HASH ?? STAGE_OPTIMIZE_HASH) - 1;\n    const run = session(this.options);\n\n    compiler.hooks.thisCompilation.tap(NAME, (compilation) => {\n      compilation.hooks.processAssets.tap({ name: NAME, stage }, (assets) => {\n        if (!stamping) return;\n\n        const write = (name: string, value: string): void => {\n          // `RawSource` is reached through the compiler rather than imported, so this file has no\n          // build-time dependency on webpack at all — and so rspack's own sources are used under\n          // rspack rather than webpack's.\n          compilation.updateAsset(name, RawSource === undefined ? value : new RawSource(value));\n        };\n\n        for (const name of Object.keys(assets)) {\n          if (!isScript(name)) continue;\n\n          const asset = compilation.getAsset(name);\n          if (asset === undefined) continue;\n\n          const code = String(asset.source.source());\n          const stamped = stamp(code);\n          if (!stamped.changed) continue;\n\n          write(name, stamped.code);\n\n          // The map is corrected in the same stage, from the same bytes. Skipping it leaves every\n          // line one out of step, which is worse than no map: the frame resolves, to the wrong\n          // line, and nobody doubts a source map that answered.\n          const mapName = mapAssetOf(name, code, assets);\n          if (mapName === null) continue;\n\n          const map = compilation.getAsset(mapName);\n          if (map === undefined) continue;\n\n          try {\n            write(mapName, injectIntoMap(String(map.source.source()), stamped.debugId, stamped.line));\n          } catch {\n            // A map asset that is not JSON is not ours to rewrite.\n          }\n        }\n      });\n    });\n\n    compiler.hooks.afterEmit.tapPromise(NAME, async () => {\n      const dir = compiler.options.output?.path ?? '';\n      if (dir === '') return;\n\n      await run.upload(dir);\n      await run.cleanup();\n    });\n  }\n}\n\nconst SOURCE_MAPPING_COMMENT = /^\\/\\/[#@] sourceMappingURL=(.*)$/gm;\n\n/**\n * The map asset belonging to a chunk asset.\n *\n * `output.sourceMapFilename` is configurable — `[file].map` is only the default, and a build that\n * puts maps under `sourcemaps/[name].map` has no `<file>.map` asset at all. The chunk names its\n * own map in the comment `SourceMapDevToolPlugin` just appended, so that is asked first and the\n * sibling is the fallback.\n */\nfunction mapAssetOf(name: string, code: string, assets: Record<string, unknown>): string | null {\n  let last: RegExpExecArray | null = null;\n  for (const match of code.matchAll(SOURCE_MAPPING_COMMENT)) last = match;\n\n  const referenced = last?.[1]?.trim();\n  if (referenced !== undefined && referenced !== '' && !referenced.startsWith('data:')) {\n    const slash = name.lastIndexOf('/');\n    const directory = slash === -1 ? '' : name.slice(0, slash + 1);\n    const target = normalise(`${directory}${(referenced.split('?')[0] ?? '').split('#')[0] ?? ''}`);\n\n    if (target in assets) return target;\n  }\n\n  return `${name}.map` in assets ? `${name}.map` : null;\n}\n\n/** Collapse `a/../b` and `./b`, which a relative sourceMappingURL legitimately contains. */\nfunction normalise(path: string): string {\n  const parts: string[] = [];\n  for (const segment of path.split('/')) {\n    if (segment === '.' || segment === '') continue;\n    if (segment === '..') {\n      parts.pop();\n      continue;\n    }\n    parts.push(segment);\n  }\n\n  return parts.join('/');\n}\n\n/** Named for how a config reads: `new vinktarWebpack({ … })`. */\nexport const vinktarWebpack = VinktarWebpackPlugin;\n\n// Re-exported so a config can type its own options without reaching into the package root, which\n// is the ESM-only entry point — a CommonJS `webpack.config.js` cannot import from there at all.\nexport type { BundlerOptions } from './core.js';\n"]}

package/dist/cjs/bundler/core.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Everything the bundler plugins share, with no bundler in it.
+ *
+ * There are two operations and five bundlers. The operations are the part worth getting right —
+ * where the debug id comes from, when it is safe to inject, what the upload skips — and having
+ * them once means a fix lands in all five rather than in whichever one someone remembered.
+ *
+ * Written by hand rather than on `unplugin`, which is the obvious tool for this: this package
+ * ships zero runtime dependencies, and the per-bundler surface here is one hook each.
+ */
+export interface BundlerOptions {
+    /**
+     * Turn the whole plugin into a no-op, before any environment, git or network work happens.
+     *
+     * For a config that is reused by something other than a build — vitest, Storybook, a preview
+     * server — where stamping chunks and shelling out to git is pure cost. Also settable with
+     * `VINKTAR_DISABLE=1`, which is what a CI matrix can use without editing the config.
+     */
+    disable?: boolean;
+    /**
+     * Stamp debug ids into the chunks. Default true.
+     *
+     * Turn it off for a build under a strict CSP or with subresource integrity computed elsewhere,
+     * where nothing may modify a chunk after it is hashed by another tool. The maps are still
+     * uploaded; frames then match by release + url alone, which is weaker but not nothing.
+     */
+    injectDebugIds?: boolean;
+    /** What the built files are served under, for release+url matching. */
+    urlPrefix?: string;
+    /**
+     * Upload after the build. Default **true**, with a warning when no key is available.
+     *
+     * Not "true when a key is set": that made a CI job with an unwired secret indistinguishable
+     * from one that was never meant to upload, and both said nothing. Setting this to `false` turns
+     * the whole feature off, deletion included.
+     */
+    uploadSourcemaps?: boolean;
+    /**
+     * Remove the maps from the build output afterwards. Default **true**.
+     *
+     * A source map is the application's original source. The bundler only emitted one because this
+     * plugin asked it to, so leaving it in the output directory publishes the whole codebase to
+     * anyone who guesses `app.js.map` — which is how it shipped before, and what `sourcemap:
+     * 'hidden'` exists to prevent. Set `false` when the maps are meant to be served.
+     */
+    deleteSourcemapsAfterUpload?: boolean;
+    /** Build discriminator, when several builds share one release. */
+    dist?: string;
+    /** The release these maps belong to. Defaults to the CI commit, then the git SHA. */
+    release?: string;
+    /** Ingest host. Defaults to `$VINKTAR_HOST`, then the public one. */
+    host?: string;
+    /** The `cli`-scoped key. Defaults to `$VINKTAR_CLI_KEY`. */
+    key?: string;
+    /**
+     * What to do when the upload fails. Providing one makes every failure non-fatal: it is called,
+     * and the build carries on. Without one, a failed upload fails the build only when the maps are
+     * being deleted — see {@link Session.upload}.
+     */
+    errorHandler?: (error: Error) => void;
+    /** Suppress the plugin's own output. Warnings about lost symbolication are still printed. */
+    silent?: boolean;
+}
+export interface Stamped {
+    readonly code: string;
+    readonly debugId: string;
+    /**
+     * The generated line the snippet was inserted at, or `null` when it was appended. The chunk's
+     * map must gain one empty group at this index; every plugin does that for its own map.
+     */
+    readonly line: number | null;
+    /** False when the chunk already carried everything, so the caller can skip writing it back. */
+    readonly changed: boolean;
+}
+/**
+ * Stamp one chunk, and say what its map now needs.
+ *
+ * Must run AFTER minification and BEFORE the bundler hashes the output. Minifiers strip comments,
+ * so an id injected earlier loses its `//# debugId=` line; the embedded marker survives that, but
+ * the hash has to cover the snippet or the filename describes bytes that are not on disk.
+ *
+ * An id the chunk already carries is kept rather than replaced — Rollup's `output.sourcemapDebugIds`
+ * and webpack's `debugIds` stamp one themselves, and minting a competing id here would file the map
+ * under something no stack frame reports.
+ */
+export declare function stamp(code: string, options?: {
+    prepend?: boolean;
+}): Stamped;
+/**
+ * Whether the plugin should do nothing at all.
+ *
+ * Checked before the release is detected, because detecting it shells out to git — and a config
+ * shared with vitest would then run `git rev-parse` on every test file.
+ */
+export declare function disabled(options: BundlerOptions, env?: Record<string, string | undefined>): boolean;
+/**
+ * Things about the environment that will make this not work, said once.
+ *
+ * Both of these produce the same symptom — the upload silently does nothing — and both are
+ * invisible from inside the build. Turborepo in particular filters the environment down to what a
+ * task declares, so `VINKTAR_CLI_KEY` is simply absent and the plugin reports a missing key that
+ * the user can see perfectly well in their own shell.
+ */
+export declare function environmentWarnings(outDir: string, env?: Record<string, string | undefined>): string[];
+/** True when this file is one we stamp: JavaScript, not a map, not CSS. */
+export declare function isScript(name: string): boolean;
+/**
+ * The upload-then-delete half of a build, as one object per plugin instance.
+ *
+ * Split in two because Rollup and Vite are: `writeBundle` fires once per output and is the only
+ * hook that knows where the files went, while deletion has to wait until every output is on the
+ * server. A build with a client bundle and an SSR bundle would otherwise delete the first one's
+ * maps while the second was still being written.
+ */
+export interface Session {
+    /** Upload everything under `outDir`. Safe to call repeatedly; the server dedupes by content. */
+    upload(outDir: string): Promise<void>;
+    /** Remove the maps from every directory uploaded so far, if that is configured. */
+    cleanup(): Promise<void>;
+}
+export declare function session(options: BundlerOptions, env?: Record<string, string | undefined>): Session;
+/**
+ * Upload and clean up in one call, for the bundlers with a single end-of-build hook.
+ */
+export declare function finish(outDir: string, options: BundlerOptions, env?: Record<string, string | undefined>): Promise<void>;
+/** Re-export so plugins can write an id and a line shift into a map without a second import. */
+export { injectIntoMap, mapDebugId } from '../debug-id.js';
+/**
+ * The release: the commit being built.
+ *
+ * CI first. A shallow checkout — which is what every default CI clone is — often has no usable git
+ * metadata, and falling straight to git produced an EMPTY release: every frame then lost its
+ * release+url match, leaving the debug id as the only thing holding symbolication together.
+ *
+ * The FULL sha, never a short one. A short sha is a prefix whose length varies by tool (7 from
+ * `git rev-parse --short`, 8 from GitLab, 12 from some deploy scripts), and the SDK reporting one
+ * length while the CLI uploaded another is a release mismatch that looks exactly like no release
+ * at all. Both sides read the same variables, so both get the same 40 characters.
+ */
+export declare function detectRelease(env?: Record<string, string | undefined>): string;