fix(db): keep bounded response captures attributable (#17522)

Keep more caller groups in one bounded database response capture and verify public caller paths in the production bundle. All local checks and CI passed; Greptile scored the exact head 5/5 with no unresolved comments.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/scripts/bundle-runtime.test.mjs

@@ -2,7 +2,7 @@ import { execFile } from "node:child_process";
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
@@ -85,6 +85,33 @@ describe("bundleRuntime", () => {
     expect(output.entryDir).toBe(path.join(root, "server", "dist"));
   });
 
+  it("keeps database caller locations public in a source-mapped runtime bundle", async () => {
+    const captureModule = fileURLToPath(new URL("../../packages/db/src/response-capture.ts", import.meta.url));
+    write(path.join(root, "server", "dist", "services", "response-caller.js"), [
+      `import { publicDatabaseCallers } from ${JSON.stringify(captureModule)};`,
+      'export function callers() { return publicDatabaseCallers(new Error("private-capture-message").stack); }',
+    ].join("\n"));
+    write(path.join(root, "server", "dist", "index.js"), [
+      'import { callers } from "./services/response-caller.js";',
+      'console.log(JSON.stringify({ callers: callers() }));',
+    ].join("\n"));
+    const summary = await bundleRuntime({ entry: path.join(root, "server", "dist", "index.js"), outdir: path.join(root, "server", "dist-runtime") });
+    const env = { ...process.env };
+    delete env.NODE_OPTIONS;
+    delete env.PAPERCLIP_DB_RESPONSE_CAPTURE_WINDOW;
+    const options = { cwd: path.join(root, "server"), env, timeout: 30_000 };
+    const plain = JSON.parse((await execFileAsync(process.execPath, [summary.outfile], options)).stdout);
+    const mapped = JSON.parse((await execFileAsync(process.execPath, ["--enable-source-maps", summary.outfile], options)).stdout);
+    expect(plain.callers).toEqual([]);
+    expect(mapped.callers).toEqual([expect.stringMatching(/^services\/response-caller\.js:\d+:\d+$/)]);
+    for (const result of [plain, mapped]) {
+      const output = JSON.stringify(result);
+      expect(output).not.toContain(root);
+      expect(output).not.toContain(captureModule);
+      expect(output).not.toContain("private-capture-message");
+    }
+  });
+
   it("emits a server module that loads without starting the server", async () => {
     const outdir = path.join(root, "server", "dist-runtime");
     const summary = await bundleRuntime({ entry: path.join(root, "server", "dist", "index.js"), outdir });