recover the source from the published sourcemaps — 8 of 8 versions rebuild byte-identically

Merged
YA
2mo ago
+6617-0

This repo advertises itself as the source of @wave-av/cli and contains none of it. Eight versions were published between 2026-04-03 and 2026-08-04 from a working copy that was never committed — so a stranger who runs npm install @wave-av/cli and follows the repository link the package itself carries arrives at a README and a LICENSE, while the code executing on their machine exists in no public repository.

The source was never lost — it ships in every tarball

Every published version carries dist/index.js.map, and that sourcemap carries sourcesContent: not the names of the original files but their complete contents, pre-compilation. All 70 TypeScript files in this PR were extracted from it verbatim. Nothing was inferred from the compiled bundle, hand-written to match, or reasoned backwards from the type declarations.

The receipt — every version, not a sample

versionrebuilt dist/index.js vs published
1.0.0 · 1.0.2 · 1.0.3 · 1.0.4byte-identical
1.0.5 · 1.0.6 · 1.0.7 · 1.0.8byte-identical

cmp exits 0 silently on all eight. RECOVERY.md carries the three commands to re-derive any row from scratch.

This is a reproducible-build proof, which is a stronger claim than the recovery bar asked for — that bar was a matching file list; this is the matching bundle, byte for byte.

What was AUTHORED, and is therefore not recovered

Two files, called out here rather than left looking like they came out of the artifact, because a sourcemap contains source and not build configuration:

  • tsconfig.json — conventional strict ES2022/ESNext
  • tsup.config.ts — entry src/index.ts, ESM, node18, sourcemap, shebang banner

They are not loose guesses: they are the settings under which output matches the published bytes exactly, eight times over. A different plausible configuration would have produced a different bundle and every comparison above would have failed. But written is not recovered, and conflating those two is the exact class of error this exercise exists to correct.

package.json is the published manifest, which npm preserves in full including scripts and devDependencies.

Safety

gitleaks with this repo's own .gitleaks.toml: no leaks found, 251 KB scanned. Worth stating why that check came first — the sourcemap has been publicly downloadable since April, so a credential inside it would have been a live four-month exposure, a fact about the published package rather than a risk created by recovering it. It is clean.

What this unblocks, and what it deliberately does not

Unblocks #17. That publish workflow is correct and cannot run: its verify job dies at npm ci against a repo with no package.json. The workflow was never the blocker; the missing source was. Do not weaken #17 to make it green — merge this first.

Does not create the tags. Recovering source does not retroactively produce the tags these eight versions never had. Tagging each against its own cmp receipt is tracked separately, and tags on a public repo are a claim that this commit produced that artifact — checkable, permanent, and worse than no tag if wrong.

Says nothing about @wave-av/workflow-sdk. Its seven versions carry no sourcemap at all. That source is recoverable only as a reconstruction — a tree provably producing the published bytes, which is genuinely weaker than a tree that did produce them. Both end with a repo that builds and publishes identical output; only one is true, and they must not be recorded as the same thing.

Refs wave-av/claude-workstation#1624

[!NOTE]
Cursor Bugbot is generating a summary for commit 8ce183a2aeac624cb9bbb9122b90ddfbfcef458f. Configure here.

[!NOTE]

Add Wave CLI source recovered from published sourcemaps with full command set

  • Recovers the full TypeScript source of the Wave CLI from published npm sourcemaps, rebuilding byte-identically across all 8 versions, as documented in RECOVERY.md.
  • Establishes the CLI entrypoint, Commander program wiring, config schema, keychain-based credential storage, and device-flow OAuth login in src/.
  • Adds ~40 command namespaces covering streams, studio, auth, billing, logs, analytics, DRM, Zoom, signage, and more, each delegating to a typed @wave/sdk client.
  • Adds project scaffolding templates (blank, podcast, multi-camera, SRT, WebRTC, webhook handler, API integration, studio plugin) with package.json and .env.example files.
  • Adds shared output utilities (table, JSON, YAML, spinner, confirm prompts) and an SSE client for real-time log/event tailing.

Macroscope summarized 8ce183a.