.gitignore

@@ -64,3 +64,8 @@ docs/.vitepress/cache
 # GlitchTip
 docker/glitchtip/.env
 backups/
+
+# WS-7 RFC §3.5: Vite sourcemaps are uploaded to GlitchTip and stripped
+# from dist/ before deploy. Defensive exclusion in case dist/ is ever
+# committed by mistake (it's already covered by `dist/` above).
+apps/app/dist/**/*.map

deploy.sh

@@ -94,6 +94,9 @@ else
 fi
 
 echo "→ Building frontend assets (apps/app)..."
+# WS-7 RFC §3.4 — release identifier is injected at build-time so Vite
+# inlines it into import.meta.env.VITE_SENTRY_RELEASE for the bundle.
+export VITE_SENTRY_RELEASE="crewli-app@$(git rev-parse --short HEAD)"
 npm run build -w apps/app
 
 if [ ! -f "apps/app/dist/index.html" ]; then
@@ -101,6 +104,28 @@ if [ ! -f "apps/app/dist/index.html" ]; then
     exit 1
 fi
 
+# ──────────────────────────────────────────
+# 4a. Sourcemap upload to GlitchTip + scrub from dist/
+# ──────────────────────────────────────────
+# WS-7 RFC §3.5: maps generated by Vite, uploaded to GlitchTip so stack
+# traces are readable in the UI, then DELETED from dist/ before nginx
+# serves them. No public-mapped sources on production.
+if [ -n "${SENTRY_AUTH_TOKEN:-}" ] && [ -n "${VITE_SENTRY_DSN_FRONTEND:-}" ]; then
+    SENTRY_ORG_VAL="${SENTRY_ORG:-crewli}"
+    echo "→ Uploading sourcemaps for release ${VITE_SENTRY_RELEASE} to project crewli-app..."
+    npx --yes @sentry/cli@latest sourcemaps upload \
+        --org "$SENTRY_ORG_VAL" \
+        --project crewli-app \
+        --release "$VITE_SENTRY_RELEASE" \
+        --url-prefix "~/assets/" \
+        apps/app/dist/assets || echo "⚠️  Sourcemap upload failed; continuing deploy."
+else
+    echo "→ SENTRY_AUTH_TOKEN or VITE_SENTRY_DSN_FRONTEND unset — skipping sourcemap upload."
+fi
+
+echo "→ Stripping *.map files from dist/ (RFC §3.5: no public-mapped sources)..."
+find apps/app/dist -name '*.map' -type f -delete
+
 # ──────────────────────────────────────────
 # 5. Run migrations
 # ──────────────────────────────────────────