build: stop embedding source text in published source maps

.changeset/sourcemap-drop-sources-content.md

@@ -0,0 +1,30 @@
+---
+"@objectstack/spec": patch
+"@objectstack/cli": patch
+"@objectstack/core": patch
+"@objectstack/types": patch
+"@objectstack/metadata": patch
+"@objectstack/metadata-core": patch
+"@objectstack/metadata-fs": patch
+"@objectstack/metadata-protocol": patch
+"@objectstack/objectql": patch
+"@objectstack/runtime": patch
+"@objectstack/lint": patch
+"@objectstack/platform-objects": patch
+"@objectstack/plugin-auth": patch
+"@objectstack/plugin-webhooks": patch
+"@objectstack/service-cluster": patch
+"@objectstack/service-cluster-redis": patch
+"@objectstack/service-datasource": patch
+"@objectstack/account": patch
+"@objectstack/setup": patch
+"@objectstack/studio": patch
+---
+
+Published `.js.map` files no longer embed the complete original source text (`sourcesContent`) — comments included. `sourcemap: true` was esbuild shorthand, and esbuild's own default for `sourcesContent` is `true`; nobody had decided to publish every package's full source (including `@internal`/test-only comments) to npm inside its source maps, it fell out of a default nobody had looked at. Measured before this change: 55 of 57 publishable packages shipped embedded source text, and maps were roughly half of `@objectstack/spec`'s published bytes.
+
+`sourcesContent: false` is now set at one shared place (`scripts/tsup-drop-sources-content.mjs`, wired into every `tsup.config.ts` via tsup's `esbuildOptions` hook — most packages build through the repo-root config directly and pick this up with no config change of their own). `mappings` are untouched, so stack-trace positions still resolve correctly to the original file/line/column; only the embedded source text is gone.
+
+`@objectstack/cli` (built with `tsc`, not `tsup`) never embedded source text to begin with — its maps' `sources` entries point at `src/**` paths that are not part of the published tarball either way. That is not a defect unique to `cli`: every `tsup`-built package's `sources` entries are `../src/**`-relative paths that are equally outside `files: ["dist", …]`, and were merely masked by the embedded content that just stopped shipping. Shipping `src/**` in `files[]` to make `sources` resolve was rejected — it would put most of the removed bytes straight back. So `cli`'s maps are left exactly as `tsc` emits them: this is now the fleet-consistent shape (accurate `mappings`, non-resolving-but-honest `sources` labels, no embedded text), not an outlier.
+
+A new gate, `pnpm check:sourcemap-no-sources-content`, sweeps every built, non-private package's `dist/**/*.map` and fails if any of them carries a non-empty `sourcesContent` array — so a future `tsup.config.ts` that skips the shared hook, or a toolchain upgrade that changes esbuild's default back, is caught rather than silently re-publishing source text.

.github/workflows/ci.yml

@@ -1596,6 +1596,15 @@ jobs:
       - name: Every published require entry point actually loads
         run: pnpm check:dual-build-cjs-loads
 
+      # #16469 (build half of #15905's E3 question 1): `sourcesContent` is off
+      # by construction at the shared tsup/esbuild layer, so a `.map` file that
+      # carries it means a config skipped the shared hook, or a toolchain
+      # upgrade changed esbuild's default back to embedding. Lives here for the
+      # same reason the step above does: it reads a real `dist/`, and refuses
+      # (exit 3) rather than passing silently when there is none.
+      - name: No published source map embeds source text
+        run: pnpm check:sourcemap-no-sources-content
+
       - name: Analyze bundle size
         run: pnpm --filter @objectstack/spec analyze
 

package.json

@@ -151,6 +151,7 @@
     "check:published-readme-links": "node scripts/check-published-readme-links.mjs --self-test && node scripts/check-published-readme-links.mjs",
     "check:dual-build-cjs-loads": "node scripts/check-dual-build-cjs-loads.mjs --self-test && node scripts/check-dual-build-cjs-loads.mjs",
     "check:dts-closure": "node scripts/check-dts-closure.mjs --self-test && node scripts/check-dts-closure.mjs",
+    "check:sourcemap-no-sources-content": "node scripts/check-sourcemap-no-sources-content.mjs --self-test && node scripts/check-sourcemap-no-sources-content.mjs",
     "check:type-check-coverage": "node scripts/check-type-check-coverage.mjs --self-test && node scripts/check-type-check-coverage.mjs",
     "check:type-check-debt": "node scripts/check-type-check-coverage.mjs --self-test && node scripts/check-type-check-coverage.mjs --re-measure",
     "check:driver-conformance": "node scripts/check-driver-conformance.mjs --self-test && node scripts/check-driver-conformance.mjs",

packages/apps/account/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: {
     index: 'src/index.ts',
@@ -12,4 +14,5 @@ export default defineConfig({
   sourcemap: true,
   splitting: false,
   treeshake: true,
+  esbuildOptions: dropSourcesContent,
 });

packages/apps/setup/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: {
     index: 'src/index.ts',
@@ -12,4 +14,5 @@ export default defineConfig({
   sourcemap: true,
   splitting: false,
   treeshake: true,
+  esbuildOptions: dropSourcesContent,
 });

packages/apps/studio/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: {
     index: 'src/index.ts',
@@ -12,4 +14,5 @@ export default defineConfig({
   sourcemap: true,
   splitting: false,
   treeshake: true,
+  esbuildOptions: dropSourcesContent,
 });

packages/core/tsup.config.ts

@@ -1,5 +1,7 @@
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 /**
  * `@objectstack/core` ships two entry points:
  * - `index.ts` — full microkernel (Node-only; pulls in plugin sandbox,
@@ -16,4 +18,5 @@ export default defineConfig({
   dts: !process.env.OS_SKIP_DTS,
   format: ['esm', 'cjs'],
   target: 'es2020',
+  esbuildOptions: dropSourcesContent,
 });

packages/lint/tsup.config.ts

@@ -1,5 +1,7 @@
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 /**
  * Package-local config (#4463): `@objectstack/lint` ships TWO entries, so it
  * cannot use the repo-root `tsup.config.ts` (single `src/index.ts`).
@@ -20,4 +22,5 @@ export default defineConfig({
   dts: !process.env.OS_SKIP_DTS,
   format: ['esm', 'cjs'],
   target: 'es2020',
+  esbuildOptions: dropSourcesContent,
 });

packages/metadata-core/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig, type Options } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 // Everything both halves below share. Spelled once so the two cannot drift in
 // anything except the two properties they exist to differ in: `entry`/`format`.
 //
@@ -49,6 +51,7 @@ const shared: Options = {
   // emitted before the split.
   shims: true,
   external: ['vitest'],
+  esbuildOptions: dropSourcesContent,
 };
 
 // [#13013] The split is by FORMAT, never by ENTRY — that distinction is the

packages/metadata-fs/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: ['src/index.ts'],
   splitting: false,
@@ -11,4 +13,5 @@ export default defineConfig({
   format: ['esm', 'cjs'],
   target: 'es2020',
   external: ['chokidar', '@objectstack/metadata-core'],
+  esbuildOptions: dropSourcesContent,
 });

packages/metadata-protocol/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: ['src/index.ts'],
   splitting: true,
@@ -31,4 +33,5 @@ export default defineConfig({
   // `__dirname`/`__filename`, so the ESM build's shim path is a no-op.
   shims: true,
   external: ['vitest'],
+  esbuildOptions: dropSourcesContent,
 });

packages/metadata/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: [
     'src/index.ts',
@@ -23,4 +25,5 @@ export default defineConfig({
   dts: !process.env.OS_SKIP_DTS,
   format: ['esm', 'cjs'],
   target: 'es2020',
+  esbuildOptions: dropSourcesContent,
 });

packages/objectql/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   // `core` is the lean engine entry (ADR-0076) — engine/registry/hooks/validation
   // only, no kernel plugin or @objectstack/metadata-protocol. `index` is the
@@ -13,4 +15,5 @@ export default defineConfig({
   dts: !process.env.OS_SKIP_DTS,
   format: ['esm', 'cjs'],
   target: 'es2020',
+  esbuildOptions: dropSourcesContent,
 });

packages/platform-objects/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: {
     index: 'src/index.ts',
@@ -22,4 +24,5 @@ export default defineConfig({
   sourcemap: true,
   splitting: false,
   treeshake: true,
+  esbuildOptions: dropSourcesContent,
 });

packages/plugins/plugin-auth/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 /**
  * Two entries, deliberately (#6040).
  *
@@ -42,4 +44,5 @@ export default defineConfig({
   dts: !process.env.OS_SKIP_DTS,
   format: ['esm', 'cjs'],
   target: 'es2020',
+  esbuildOptions: dropSourcesContent,
 });

packages/plugins/plugin-webhooks/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
     entry: ['src/index.ts', 'src/schema.ts'],
     splitting: true,
@@ -11,4 +13,5 @@ export default defineConfig({
     format: ['esm', 'cjs'],
     target: 'es2020',
     external: ['vitest'],
+    esbuildOptions: dropSourcesContent,
 });

packages/runtime/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
   entry: ['src/index.ts'],
   splitting: false,
@@ -34,4 +36,5 @@ export default defineConfig({
     '@objectstack/metadata',
     '@objectstack/objectql',
   ],
+  esbuildOptions: dropSourcesContent,
 });

packages/services/service-cluster-redis/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
     entry: ['src/index.ts'],
     splitting: true,
@@ -11,4 +13,5 @@ export default defineConfig({
     format: ['esm', 'cjs'],
     target: 'es2020',
     external: ['vitest', 'ioredis'],
+    esbuildOptions: dropSourcesContent,
 });

packages/services/service-cluster/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig, type Options } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 // Everything both halves below share. Spelled once so the two cannot drift in
 // anything except the two properties they exist to differ in: `entry`/`format`.
 //
@@ -22,6 +24,7 @@ const shared: Options = {
   dts: !process.env.OS_SKIP_DTS,
   target: 'es2020',
   external: ['vitest'],
+  esbuildOptions: dropSourcesContent,
 };
 
 // [#13013] The split is by FORMAT, never by ENTRY.

packages/services/service-datasource/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../../scripts/tsup-drop-sources-content.mjs';
+
 export default defineConfig({
     entry: ['src/index.ts', 'src/contracts/index.ts'],
     splitting: true,
@@ -16,4 +18,5 @@ export default defineConfig({
     // never tries to bundle/resolve those optional natives. (They are devDeps for
     // tests; previously they were optional peerDeps, which tsup auto-externalized.)
     external: ['vitest', /^@objectstack\/driver-/],
+    esbuildOptions: dropSourcesContent,
 });

packages/spec/tsup.config.ts

@@ -5,6 +5,8 @@ import { dirname, join } from 'node:path';
 import { defineConfig, type Options } from 'tsup';
 import type { Plugin } from 'esbuild';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 /**
  * [#10031] Annotate deferred schema construction as pure IN THE EMITTED
  * BUNDLES, so a CONSUMER's bundler may drop the schema consts its entry never
@@ -192,6 +194,7 @@ const mainConfig: Options = {
   target: 'es2020',
   treeshake: true,
   esbuildPlugins: [pureSchemaConstruction],
+  esbuildOptions: dropSourcesContent,
 };
 
 /**
@@ -213,6 +216,7 @@ const browserConfig: Options = {
   target: 'es2020',
   treeshake: true,
   esbuildPlugins: [pureSchemaConstruction, swapServerOnlyGrammarArm],
+  esbuildOptions: dropSourcesContent,
 };
 
 // The DTS pass re-runs only the main config (declarations once, per entry);

packages/types/tsup.config.ts

@@ -2,6 +2,8 @@
 
 import { defineConfig } from 'tsup';
 
+import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
+
 /**
  * Two entries, deliberately. `src/index.ts` is the edge/browser-safe root that
  * `@objectstack/hono` (Cloudflare Workers, Deno, Bun) and the Worker-bootable
@@ -25,4 +27,5 @@ export default defineConfig({
   dts: !process.env.OS_SKIP_DTS,
   format: ['esm', 'cjs'],
   target: 'es2020',
+  esbuildOptions: dropSourcesContent,
 });