🔧 Inline sources and drop declaration maps

The JS source maps now embed their sources (inlineSources), so a debugger
resolves into src/ even though the package ships only dist/. declarationMap
is dropped: a .d.ts.map cannot embed source and would dangle against the
unshipped src/.

Also removes a duplicate backlog entry for the same task and closes the
sourcemap item.

README.md

@@ -38,7 +38,7 @@ Each tool's configuration trade-off is recorded in [Tooling decisions](#tooling-
 
 The choice and configuration of each tool above is the result of deliberate trade-offs, not defaults. The non-obvious ones:
 
-- **`tsconfig.json` extends `@tsconfig/strictest` + `@tsconfig/node26`**; `tsconfig.build.json` extends it to add the emit-only options (`declaration`, `sourceMap`, `outDir`, `target: es2024`, `rewriteRelativeImportExtensions: true`) and to exclude test files. This separation lets the editor and CI type-check from one config while the build emits from the other.
+- **`tsconfig.json` extends `@tsconfig/strictest` + `@tsconfig/node26`**; `tsconfig.build.json` extends it to add the emit-only options (`declaration`, `sourceMap`, `inlineSources`, `outDir`, `target: es2024`, `rewriteRelativeImportExtensions: true`) and to exclude test files. `inlineSources` embeds the original TypeScript in `dist/*.js.map`, so debuggers can map into `src/` without it being shipped; `declarationMap` is intentionally off because a `.d.ts.map` cannot embed source and would dangle. This separation lets the editor and CI type-check from one config while the build emits from the other.
 - **Source imports use `.ts` extensions** so `node --strip-types` resolves them at test time. `rewriteRelativeImportExtensions: true` in `tsconfig.build.json` rewrites them to `.js` in the emitted `dist/*` output, so consumers see conventional ESM imports.
 - **Type-aware oxlint is enabled declaratively** via `options.typeAware: true` in `.oxlintrc.json` (powered by `oxlint-tsgolint`). The script commands stay clean — no CLI flag — and type-aware mode is a property of the config, not the invocation.
 - **Source-level `oxlint-disable` directives** are used for known type-aware false positives (see `src/pattern.ts`, `src/match.ts`, `src/index.test.ts`). The disable lives next to the code it silences, not in `.oxlintrc.json`, so the trade-off is visible to anyone reading the source.

backlog.tasks

@@ -27,13 +27,14 @@ Setup:
     ☐ Fix the declaration emit (`.d.ts` post-step) or stop using relative `.ts` in the declaration surface
     ☐ Reconcile the README/CONTRIBUTING claim that `rewriteRelativeImportExtensions` yields "conventional ESM imports"
     ☐ Add a consumer-resolution test to the suite (durable guard; `attw` currently misses it)
-☐ Resolve sourcemap sources for consumers
+✔ Resolve sourcemap sources for consumers @done
     - `dist/*.map` `sources` are `../src/*.ts`, but `src` is not in `files`, so debuggers get missing sources
     - HANDOVER (setup-phase review, unfixed — emit work deferred out of that session):
         - verified: every `dist/*.map` (js and d.ts) has `sources: ["../src/<file>.ts"]`, and `package.json#files` ships only `dist`, `CHANGELOG.md`, `README.md`, `LICENSE` — so those paths point at files the consumer never receives
         - decide between shipping `src` in `files` (keeps go-to-definition working, slightly larger tarball) or dropping `sourceMap`/`declarationMap` from `tsconfig.build.json` (smaller, no broken references). Shipping `src` is usually the better library DX
         - overlaps the `.d.ts` item above: both are emit-surface changes, so doing them in one branch/commit avoids rebuilding that config twice
-    ☐ Ship `src`, or disable `sourceMap`/`declarationMap` for the published artifact
+    - resolution: `inlineSources: true` embeds `sourcesContent` in `dist/*.js.map`, so debuggers resolve the original TS even though `files` ships only `dist`; `declarationMap` is dropped because a `.d.ts.map` cannot embed source and would dangle against unshipped `src`
+    ✔ Resolved by `inlineSources` + dropping `declarationMap` (not by shipping `src`, nor by disabling both maps) @done
 ✔ Document pi-lsp false-positive diagnostics @done
     - `lsp_diagnostics` reported TS1295/TS1287 "CommonJS file under `verbatimModuleSyntax`" errors that `check:tsc` never produced
     - root cause: an earlier local test emptied package.json; the still-running TS7 server (5 min idle timeout) kept the corrupted project state alive and reported it against the real files
@@ -56,9 +57,6 @@ Setup:
 ✔ Silence the knip `@runwisp/pubv` false positive @done
     - `pubv` is a CLI invoked by `release.sh`, not imported, so knip flags it as an unused devDependency and advisory output stays permanently red
     ✔ Add a knip `ignoreDependencies` entry @done
-☐ Resolve sourcemap sources for consumers
-    - `dist/*.map` `sources` are `../src/*.ts`, but `src` is not in `files`, so debuggers get missing sources
-    ☐ Ship `src`, or disable `sourceMap`/`declarationMap` for the published artifact
 
 ✔ Sweep doc/formatter drift before v1.0 @done
     ✔ README says `--experimental-strip-types`; scripts use `--strip-types` @done

tsconfig.build.json

@@ -4,8 +4,8 @@
         "noEmit": false,
         "target": "es2024",
         "declaration": true,
-        "declarationMap": true,
         "sourceMap": true,
+        "inlineSources": true,
         "outDir": "dist",
         "rewriteRelativeImportExtensions": true,
         "rootDir": "src"