fix(cli): support pre-hash esbuild sourcemap IDs

[posthog]

Problem

posthog-cli sourcemap inject rewrites JavaScript after Angular has generated ngsw.json and after bundlers or CDNs have chosen content-hashed filenames. This invalidates service-worker versions, SRI values, and immutable cache keys.

Editing Angular's generated manifest in the CLI would couple a generic source-map tool to a framework-private format. A source-map-only ID is also insufficient unless the deployed JavaScript registers the same ID at runtime.

Fixes #86046 together with PostHog/posthog-js#4644.

Changes

• Keep the existing warnings whenever CLI injection or --delete-after rewrites built JavaScript.
• Add a narrow upload contract for first-party build plugins:
  • the deployed JavaScript must contain PostHog's output-filename runtime-registration marker;
  • the source-map chunk_id must exactly match the JavaScript filename;
  • normal source-injected chunk IDs remain authoritative.
• Reject mismatched filename/map IDs.
• Reject output-filename IDs in event release mode, which requires a resolved release ID inside JavaScript.
• Document the @posthog/esbuild-plugin + non-mutating sourcemap upload Angular flow.
• Keep official ngsw-config regeneration as the fallback for projects that cannot customize their builder.

Companion plugin

PostHog/posthog-js#4644 adds @posthog/esbuild-plugin. It inserts a deterministic import.meta.url runtime banner before esbuild computes output hashes, then stamps the final content-hashed filename into source-map metadata without rewriting JavaScript. Angular can safely generate ngsw.json afterward.

Verification

• cargo test --lib (148 passed)
• cargo test --test sourcemap (28 passed)
• cargo clippy --lib --tests -- -D warnings
• cargo fmt -- --check
• Added coverage for accepted filename IDs, metadata mismatches, and unsupported event release mode.
• Companion plugin was tested end-to-end against Angular 22 PWA output: every ngsw.json JavaScript SHA-1 matched, map IDs matched content-hashed filenames, and repeat builds were byte-identical.

Automatic notifications

• Publish to changelog?

Docs update

CLI README updated. Public Angular source-map docs should move to the esbuild plugin workflow after both packages are released.

[trunk-io]

Merging to master in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[posthog]

🦔 ReviewHog reviewed this pull request

Nothing worth raising this time, so here's a calming picture instead:

[github-actions]

🤖 CI report

✅ Trunk lane — non-backend lane

This PR is assigned to the non-backend lane. It does not run backend Python tests and may merge in parallel with PRs in other lanes.

[stamphog]

Additive, contained change to the sourcemap CLI: it only adds warning logs and a README caveat when injection/cleanup rewrites built files, without altering the actual injection behavior; includes a targeted regression test. No risky territory (no data model, API, billing, auth, dependency, or CI/deploy config changes) and no unresolved review concerns.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	122L, 2F substantive, 148L/3F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1c-medium (148L, 3F, single-area, fix)
stamphog 2.0.0b4		.stamphog/policy.yml @ fcfd143 · reviewed head fcfd143

New commits were pushed — dismissing the stamphog approval from an earlier head. This PR no longer qualifies for automatic review.

[marandaneto]

cc @PostHog/team-error-tracking