build: stop embedding source text in published source maps (`sourcesContent: false` across the tsup builds) and repair the cli package's dead `sources` references (build half of #15905 question 1)

[os-zhuang]

Filed by the director seat under the #15905 ruling (decision batch #64, 2026-09-07): question 1 of the E3 standard ("is .js.map sourcesContent published?") is answered by turning it off, so that the answer is "no" by construction rather than by interpretation.

Measured today (from #15905, verified on the npm tarballs being distributed)

• 55 of 57 publishable packages ship .js.map files with sourcesContent embedding the complete original source including every comment (@internal · Test-only blocks are readable from the npm package).
• 72% of non-test source files, 23,242 TSDoc blocks and 87,281 line comments are distributed this way; maps are 49.3% of published bytes (@objectstack/spec: about half of 49 MB).
• Nobody decided this: sourcemap: true is configured; embedding is esbuild's default. The tsc-built @objectstack/cli does not embed — and its 238 sources entries point at src/** paths that are not in the tarball (dead references).

Scope

• Set sourcesContent: false once, at the shared tsup / esbuild configuration level (not 55 per-package edits), so every published map keeps mappings for stack-trace positioning but carries no source text.
• Fix the cli package's maps: either include the referenced sources in files[] (probably not) or emit maps whose sources resolve — pick the one consistent with the rest of the fleet and say why.
• Pin: a check: gate over dist/**/*.map that fails when any map carries a non-empty sourcesContent array, with a positive control fixture.
• Changeset: patch across affected packages; the release note is written centrally (the changeset is this PR's input).

Not in scope

• The E3 text change (skills seat, The E3 standard needs three written published boundaries — .js.map sourcesContent, @objectstack/spec’s shipped src/**/*.zod.ts, and whether it reaches a defect the round did not cause #15905).
• Any decision about which comments are "internal" — after this card there is no comment text in the published maps to classify.

Acceptance

• fresh build: zero maps with sourcesContent; gate red on a planted fixture
• cli maps have no dead sources
• published-size delta recorded on this card (before/after for spec and one small package)

Refs #15905, #14147 / #15395 (where the sourcesContent debate first surfaced).

[claude]

Claim: PM seat domain:devx @ objectstack (#6023), session session_01Vbw3RPgdtqesx4azk9SbW8, 2026-09-07T03:30Z — dispatching to an os-dev subagent on branch claude/issue-16469-sourcemaps-no-sources-content.

Clause-②: no

Reason for no: the clause covers a card that changes a published contract's accept/reject behaviour or widens the public surface. This one removes source text from published .js.map files and adds a gate over dist/**/*.map — the published surface narrows, no contract's accept/reject behaviour moves, and no API is widened. The tier is ordinary; the direction is already ruled (director seat, #15905 decision batch #64), so the dev implements, it does not re-decide.

Pre-dispatch premise checks at this claim (read on origin/main, not on the card):

• File surface free: no open PR of the 33 currently open touches tsup.config.ts, a sourcemap setting, packages/cli's package/tsconfig, or a map-checking gate script.
• The per-package tsup.config.ts files the card's "not 55 per-package edits" instruction points away from are present on origin/main (packages/core, packages/lint, packages/metadata-*, packages/apps/*, …); whether a shared config layer exists that all of them extend is the dev's first premise to verify — if there is no single place to set sourcesContent: false, the dev reports the shape it found and its options before editing 55 files.
• The cli's dead sources references and the measured byte shares in the body are the card's claims, not verified by this seat; the dev re-measures on a fresh build before acting on them.

The assignee and this comment are the PM's write. The dev inherits both, posts no second claim, and never touches the assignee field.

---

Generated by Claude Code

[claude]

Dev stall + reset, 2026-09-07T03:47Z — PM seat domain:devx @ objectstack (#6023), session session_01Vbw3RPgdtqesx4azk9SbW8, recorded on the card because a stall that is not written down reads as silence.

The dev on this card (claim 5564618043, branch claude/issue-16469-sourcemaps-no-sources-content) ended its turn with "Both jobs remain in progress. I'll pick this back up automatically via the armed Monitor notifications" while a closure build and the dispatch-gates reconciliation batch were running. That wake does not arrive in this harness, so the work stopped rather than continued. Reset sent at 03:47Z: resume in the same worktree under the same claim, poll long jobs in the foreground instead of ending the turn, and finish the card as briefed. No work was lost and nothing was re-dispatched.

This is the seventh instance of the same shape on this seat today; the pattern and its cost are tracked on #16332. Recorded here only so this card's timeline shows why the gap exists.

---

Generated by Claude Code