TT-018: Published Vite plugin 1.0.0 ignores sourceMappingURL, so maps not named after their chunk upload with the wrong bundle_url

[unjica]

Severity: P2 · Area: Source maps · Found by: QA

Summary

The published @telemetry-tracker/vite-plugin@1.0.0 builds bundle_url by removing .map from the map's own path. It never reads the chunk's sourceMappingURL. When a map's filename or folder doesn't mirror its chunk, the plugin still reports success, but it uploads the map under a URL that no browser frame will ever have, so those errors don't symbolicate.

The repo source (develop/main) and docs/source-maps.md describe sourceMappingURL resolution. That code is unreleased under the same version number, 1.0.0.

Default Vite output ([name]-[hash].js + [name]-[hash].js.map, including build.sourcemap: 'hidden') works correctly.

Severity reason: P2. Source maps are a headline feature, and the failure is silent: the build log says "Uploaded 2 source maps", but symbolication fails for any non-default map naming or location. The default layout works.

Affected published versions

• @telemetry-tracker/vite-plugin@1.0.0 (only version, latest), published 2026-07-10 00:51 CEST. The npm metadata has no gitHead.

Environment and versions

2026-09-26 10:48 CEST. Vite 7.3.6, Node 20.19.2, Linux. Local mock upload server. No real upload.

Steps to reproduce

1. npm create vite@latest sm -- --template vanilla && cd sm && npm i -D @telemetry-tracker/vite-plugin@1.0.0, then add a dynamic import() so there are 2 chunks.
2. Mock upload server:

   // mock.mjs
   import http from "node:http";
   http.createServer((req, res) => { let b = ""; req.on("data", c => b += c); req.on("end", () => {
     const j = JSON.parse(b); console.log(req.method, req.url, j.bundle_url, "map.file=" + j.content.file);
     res.writeHead(201).end("{}"); }); }).listen(4318);

3. vite.config.js: the map hash is independent of the chunk hash (Turbopack-like layout):

   import { defineConfig } from "vite";
   import { telemetrySourceMaps } from "@telemetry-tracker/vite-plugin";
   export default defineConfig({
     build: { sourcemap: true, rollupOptions: { output: { sourcemapFileNames: "assets/[name]-[hash].js.map" } } },
     plugins: [telemetrySourceMaps({ apiKey: "k", projectId: "00000000-0000-4000-8000-000000000001", release: "r1",
       app: "web", baseUrl: "https://cdn.example.test", baseApiUrl: "http://127.0.0.1:4318" })],
   });

4. npx vite build, then compare each logged bundle_url with the chunk that references the map.

Expected

bundle_url is the URL of the chunk whose sourceMappingURL points at the map, e.g. https://cdn.example.test/assets/index-azjItrWU.js. That's what docs/source-maps.md line 149 promises ("The plugin and GitHub Action set bundle_url from the built file's sourceMappingURL comment…").

Actual

Same app, 5 layouts, published plugin vs. a build of the repo develop source (packages/telemetry-vite-plugin, 1.0.0 @ c652e61):

Layout	Maps	npm 1.0.0: uploaded / correct bundle_url	repo develop: uploaded / correct
default (sourcemap: true, hashed *.js.map beside chunk)	2	2 / 2	2 / 2
sourcemap: 'hidden' (no comment)	2	2 / 2	2 / 2
map hash ≠ chunk hash (assets/index-J4e2xGyD.js.map for assets/index-azjItrWU.js)	2	2 / 0: sent …/assets/index-J4e2xGyD.js	2 / 2
maps moved to maps/, comment ../maps/index-azjItrWU.js.map	2	2 / 0: sent …/maps/index-azjItrWU.js	2 / 2
sourcemapFileNames: "maps/[name]-[hash].map"	2	2 / 0: sent …/maps/index-J4e2xGyD	2 / 0 (Vite writes a comment that doesn't resolve to the map; not a plugin bug)
map named *.map.json	2	0 uploaded (only *.map is scanned)	0 uploaded

• Request shape (identical in both builds): POST <baseApiUrl>/api/project/source-maps, headers content-type, x-project-id, x-api-key, body {app, release, bundle_url, content}.
• In every case the build exits 0 and logs "Uploaded 2 source maps."

Root cause

• npm dist/upload.js:21-38 bundleUrlForMapFile() does relativePath.replace(/\.map$/, "") on the map path (line 27). dist/upload.js:66 passes the map path directly. There's no sourceMappingURL parsing anywhere in the dist. findMapFiles only matches *.map (line 46).
• The npm dist is byte-identical to tsc output of the repo at 74cb41d (2026-07-09 21:29 CEST, the last plugin commit before the publish).
• repo develop/main packages/telemetry-vite-plugin/src/upload.ts: parseSourceMappingURL (56), bundleFileForSourceMap (69), findBundleSources (110), and the call at 158-159. Added in 0e9158e (PR Scope source map uploads and flush fatal Node errors #672, 2026-09-25) without a version bump (package.json still 1.0.0). Built from develop, only upload.js differs from npm (54 changed lines). index.js is identical.

Release coordination

Single package, no dependency on core/node: publish @telemetry-tracker/vite-plugin@1.1.0 (new exported helpers parseSourceMappingURL, bundleFileForSourceMap, findBundleSources, so minor) from develop, with gitHead recorded. It's independent of the core/node release in #711. The GitHub Action already has the equivalent logic on main and tags ≥ v1.17.18.

Acceptance criteria

With the newly published @telemetry-tracker/vite-plugin@latest and the config above:

• every bundle_url equals the URL of the chunk whose sourceMappingURL resolves to the uploaded map (independent-hash and moved-maps layouts: 2/2 correct);
• default and hidden layouts are unchanged (2/2 correct);
• npm view @telemetry-tracker/vite-plugin@<new> gitHead matches the tagged commit;
• the npm tarball's dist/upload.js contains parseSourceMappingURL.

Fix references

• Unreleased repo fix: 0e9158e (PR Scope source map uploads and flush fatal Node errors #672). Needs an npm release.

History

• 2026-09-26 10:48 CEST: found and reproduced (6 layouts, npm vs. repo build).

---

Filed from the QA regression list on 2026-09-26. Source: QA report 2026-09-26-sdk-qa.md (#tt-018).

[unjica]

QA verification — PASS (closed)

When: 2026-10-02 ~08:58 CEST (weekday smoke)
Fix: PR #722 → published @telemetry-tracker/vite-plugin@1.1.0
Method: Fresh registry install; exercised parseSourceMappingURL / bundleFileForSourceMap from the published dist/upload.js twice.

• Independent map hash / moved maps dir (sourceMappingURL=../maps/index-BBB.js.map) resolves to the real chunk index-AAA.js
• Default mirrored names still resolve correctly

Both layouts 2/2. Closing as verified-fixed on vite-plugin 1.1.0.