Compose server source maps and debug IDs across multi-pass builds #25679

Several frameworks run a second bundling or merging step over the output of the step where Sentry injects debug IDs and generates source maps:

• Nitro bundles the Vite SSR output again.
• wrangler and OpenNext bundle the worker.
• SvelteKit adapters merge files.
• TanStack Start and Bun builds have similar steps.

When the source-map chain is not composed through that later step, or several injected debug IDs end up in one output file, server stack traces resolve to intermediate build files or not at all. Issues: #21012, #20084, #20051, #19213, #19396, #25618.

There are framework-specific fixes: SvelteKit flattens with sorcery (packages/sveltekit/src/vite/sourceMaps.ts), #25333 handles Nuxt 5, and #25670 handles Bun. Each framework solves the same problem separately, and the bundler-plugins core has nothing for it.

There are also two failure modes on the runtime side:

• When several _sentryDebugIds snippets end up in one file, they all map to the same filename and the last one wins.
• Native _debugIds override Sentry's for the same file (packages/core/src/utils/debug-ids.ts).

Both fail silently.

Proposal

1. A shared, opt-in "finalize output" step in @sentry/bundler-plugins, exposed as a plugin hook and as a CLI command that can run on a final output directory. For each final .js file it should:

   • follow the sourceMappingURL chain through the intermediate maps and compose it back to the original sources;
   • reduce the file to one debug ID (remove duplicate snippets and stamp a single ID);
   • then upload.

   Framework SDKs (SvelteKit, Nuxt/Nitro, TanStack Start, Cloudflare/wrangler, Bun) would enable it inside their existing plugins and replace their own workarounds. This would build on the zero-config source-map work in Bundler plugins should handle source maps without any user configuration #25609.

2. Runtime detection. Log a debug warning in getFilenameToDebugIdMap when more than one debug ID resolves to the same filename, so collisions can be diagnosed.

Not fixable on our side, and worth stating in docs: build steps that emit no source map at all (for example OpenNext, opennextjs-cloudflare#1352), and Turbopack maps that leave mangled names out of names (#18248, vercel/next.js#87896).