developer/scrabble-game
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

build(ui): drop sourcemaps from prod bundle #153

Merged
developer merged 1 commits from feature/ui-drop-prod-sourcemaps into development 2026-07-01 15:00:44 +00:00
Conversation 1 Commits 1 Files Changed 2
+14 -1
developer commented 2026-07-01 14:57:21 +00:00
Owner
Copy Link
Copy Source

The production UI build shipped .map files carrying full sourcesContent, and the gateway/landing images serve dist/ verbatim — so anyone could fetch /app/assets/main-*.js.map (same assets under /vk/, /telegram/) and reconstruct the entire TypeScript/Svelte source at the edge.

Change: gate build.sourcemap off for mode === 'production' in vite.config.ts. Dev and the mock e2e build (vite build --mode mock) keep maps for debugging. Posture documented in ARCHITECTURE.md §12.

Verified locally: pnpm check clean; pnpm build (prod) emits no .map; vite build --mode mock still emits maps; pnpm test:unit 361/361.

Context: this is workstream A of the per-target-bundle investigation — the high-value anti-RE fix. The per-target split (B) was assessed and deferred (size win ~1-3 kB gz; vk-bridge already lazy-split, Telegram SDK external).

The production UI build shipped `.map` files carrying full `sourcesContent`, and the gateway/landing images serve `dist/` verbatim — so anyone could fetch `/app/assets/main-*.js.map` (same assets under `/vk/`, `/telegram/`) and reconstruct the entire TypeScript/Svelte source at the edge. **Change:** gate `build.sourcemap` off for `mode === 'production'` in `vite.config.ts`. Dev and the `mock` e2e build (`vite build --mode mock`) keep maps for debugging. Posture documented in ARCHITECTURE.md §12. **Verified locally:** `pnpm check` clean; `pnpm build` (prod) emits no `.map`; `vite build --mode mock` still emits maps; `pnpm test:unit` 361/361. Context: this is workstream A of the per-target-bundle investigation — the high-value anti-RE fix. The per-target split (B) was assessed and deferred (size win ~1-3 kB gz; vk-bridge already lazy-split, Telegram SDK external).
developer added 1 commit 2026-07-01 14:57:22 +00:00
build(ui): drop sourcemaps from prod bundle
CI / changes (pull_request) Successful in 2s
Details
CI / unit (pull_request) Has been skipped
Details
CI / integration (pull_request) Has been skipped
Details
CI / ui (pull_request) Successful in 57s
Details
CI / gate (pull_request) Successful in 0s
Details
CI / deploy (pull_request) Successful in 1m17s
Details
e6c5198caa 
The production UI build shipped `.map` files with full `sourcesContent`, and
the gateway/landing images serve `dist/` verbatim, so anyone could fetch
`/app/assets/main-*.js.map` (same assets under `/vk/`, `/telegram/`) and
reconstruct the entire TypeScript/Svelte source at the edge.

Gate `build.sourcemap` off for `mode === 'production'` (the Docker image build).
Dev and the `mock` e2e build (`vite build --mode mock`) keep maps for debugging.
Document the posture in ARCHITECTURE.md §12.
owner approved these changes 2026-07-01 14:59:38 +00:00
developer merged commit f0399e1bbc into development 2026-07-01 15:00:44 +00:00
developer deleted branch feature/ui-drop-prod-sourcemaps 2026-07-01 15:00:44 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
owner
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
owner (Ilia) developer
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: developer/scrabble-game#153
Delete Branch "feature/ui-drop-prod-sourcemaps"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?