Fix package source map boundary

Author: rockyshi1993

.github/workflows/ci.yml

@@ -54,5 +54,5 @@ jobs:
       - name: Security audit
         run: npm audit --omit=dev
 
-      - name: Package dry run
-        run: npm pack --dry-run
+      - name: Package boundary check
+        run: npm run pack:check

.github/workflows/publish.yml

@@ -48,8 +48,8 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Preview package contents
-        run: npm pack --dry-run
+      - name: Package boundary check
+        run: npm run pack:check
 
       - name: Publish to npm
         run: npm publish --provenance --access public

CHANGELOG.md

@@ -2,8 +2,15 @@
 
 ## 目录导航
 
+- [1.0.1 - 2026-06-03](#101---2026-06-03)
 - [1.0.0 - 2026-06-02](#100---2026-06-02)
 
+## 1.0.1 - 2026-06-03
+
+- Remove source map files from npm package output.
+- Add a package boundary check that fails when `npm pack` includes `.map` files.
+- Run the package boundary check in CI, publish workflow, and `prepublishOnly`.
+
 ## 1.0.0 - 2026-06-02
 
 - Initialize `response-cache-kit` as a framework-agnostic response caching toolkit.

README.md

@@ -513,6 +513,7 @@ npm run build
 npm run benchmark
 npm run benchmark:http
 npm run benchmark:compare
+npm run pack:check
 npm audit
 npm pack --dry-run
 ```

docs/README.zh-CN.md

@@ -457,6 +457,7 @@ npm run build
 npm run benchmark
 npm run benchmark:http
 npm run benchmark:compare
+npm run pack:check
 npm audit
 npm pack --dry-run
 ```

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "response-cache-kit",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Framework-agnostic response caching toolkit for Node.js services.",
   "type": "module",
   "main": "./dist/cjs/index.cjs",
@@ -29,7 +29,8 @@
     "benchmark": "npm run build && node scripts/benchmark.mjs",
     "benchmark:http": "npm run build && node benchmarks/http.mjs",
     "benchmark:compare": "npm run build && node benchmarks/compare.mjs",
-    "prepublishOnly": "npm run typecheck && npm run test:coverage && npm run build && npm audit --omit=dev && npm pack --dry-run"
+    "pack:check": "node scripts/check-pack-contents.mjs",
+    "prepublishOnly": "npm run typecheck && npm run test:coverage && npm run build && npm audit --omit=dev && npm run pack:check"
   },
   "keywords": [
     "response-cache",

package.json

@@ -9,7 +9,7 @@ const shared = {
   platform: "node",
   target: "node18",
   packages: "external",
-  sourcemap: true,
+  sourcemap: false,
   minify: false,
   logLevel: "info",
 };

scripts/build.mjs

@@ -0,0 +1,36 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+const command =
+  process.platform === "win32"
+    ? ["cmd.exe", ["/d", "/s", "/c", "npm pack --dry-run --json"]]
+    : ["npm", ["pack", "--dry-run", "--json"]];
+
+const { stdout } = await execFileAsync(command[0], command[1]);
+
+const packs = JSON.parse(stdout);
+const files = packs.flatMap((pack) => pack.files ?? []);
+const paths = files.map((file) => file.path);
+const mapFiles = paths.filter((path) => path.endsWith(".map"));
+
+if (mapFiles.length > 0) {
+  console.error("Package contains source map files:");
+  for (const path of mapFiles) {
+    console.error(`- ${path}`);
+  }
+  process.exit(1);
+}
+
+console.log(
+  JSON.stringify(
+    {
+      package: packs[0]?.id,
+      files: paths.length,
+      sourceMaps: 0,
+    },
+    null,
+    2,
+  ),
+);

scripts/check-pack-contents.mjs

@@ -3,7 +3,7 @@
   "compilerOptions": {
     "noEmit": false,
     "declaration": true,
-    "declarationMap": true,
+    "declarationMap": false,
     "emitDeclarationOnly": true,
     "declarationDir": "dist/types",
     "rootDir": "src",