feat(sourcemaps): Inject debugId into sourcemaps, not debug_id (#3005)

Align debug ID injection [with the relevant TC39 proposal](https://github.com/tc39/ecma426/blob/main/proposals/debug-id.md#debug-ids-in-source-maps) by upgrading the `sourcemap` crate to [9.3.0](https://github.com/getsentry/rust-sourcemap/releases/tag/9.3.0), which serializes the Debug ID on a sourcemap [under the `"debugId"` key, instead of the `"debug_id"` key](getsentry/rust-sourcemap#134). The crate still supports reading the `"debug_id"` key, but the `"debugId"` key takes precedence if both keys are present.

These changes primarily affect the `sourcemaps inject` command, which will now place the debug ID in the `"debugId"` field rather than the `"debug_id"` field. The `sourcemaps upload` command is also affected, as sourcemaps will be rewritten with `"debugId"` rather than `"debug_id"`. Previously, rewriting preserved the key being used; if a sourcemap contained both keys, both would have been preserved after rewriting, but after these changes, we emit only `"debugId"`. For example, if a sourcemap contains only the `"debug_id"` key, the rewritten sourcemap will have that key in `"debugId"` instead; however, if a sourcemap contains both the `"debugId"` and the `"debug_id"` keys, the `"debug_id"` is completely stripped, and its value ignored.

Closes #2221
Closes [CLI-44](https://linear.app/getsentry/issue/CLI-44/time-capsule-dont-open-before-nov-6-2025-emit-debugid-instead-of-debug)

Author: szokeasaurusrex

CHANGELOG.md

@@ -37,6 +37,7 @@ The following changes only apply when using `sentry-cli` via the npm package [`@
 ### Improvements
 
 - The `sentry-cli upload-proguard` command now uses chunked uploading by default ([#2918](https://github.com/getsentry/sentry-cli/pull/2918)). Users who previously set the `SENTRY_EXPERIMENTAL_PROGUARD_CHUNK_UPLOAD` environment variable to opt into this behavior no longer need to set the variable.
+- We now place source map debug IDs under the source map's `debugId` field, per the [TC39 Debug ID proposal](https://github.com/tc39/ecma426/blob/main/proposals/debug-id.md#debug-ids-in-source-maps) ([#3005](https://github.com/getsentry/sentry-cli/pull/3005)). This change affects the `sentry-cli sourcemaps inject` command and, unless `--no-rewrite` is passed, the `sentry-cli sourcemaps upload` command. Sentry CLI can still read the `debug_id` field, but whenever the CLI writes or rewrites a source map, we always use `debugId`.
 
 ### Fixes
 

Cargo.lock

@@ -62,7 +62,7 @@ sentry = { version = "0.46.0", default-features = false, features = [
 serde = { version = "1.0.152", features = ["derive"] }
 serde_json = "1.0.93"
 sha1_smol = { version = "1.0.0", features = ["serde", "std"] }
-sourcemap = { version = "9.2.0", features = ["ram_bundle"] }
+sourcemap = { version = "9.3.0", features = ["ram_bundle"] }
 symbolic = { version = "12.13.3", features = ["debuginfo-serde", "il2cpp"] }
 thiserror = "1.0.38"
 url = "2.3.1"

Cargo.toml

@@ -9,7 +9,7 @@ $ sentry-cli sourcemaps upload --bundle tests/integration/_fixtures/file-hermes-
 > Adding source map references
 > Bundling completed in [..]
 > Bundled 2 files for upload
-> Bundle ID: 0b10dfbf-7d11-52a5-9107-d16f625896ad
+> Bundle ID: b87a18c0-0d49-5771-bb15-cb1654bc9129
 > Optimizing completed in [..]
 > Uploading completed in [..]
 > Uploaded files to Sentry