feat(crashlytics): add support for hidden source maps

[tonybaroneee]

Description

Add support for hidden sourcemaps (e.g., generated by Vite, Angular, Webpack, Rollup) has been added to the Crashlytics source map upload workflow, while preserving support for traditional sourcemaps and unlinked fallback mappings.

1. Hidden Sourcemap Helpers:

   • extractSourceMapFileField: Efficiently reads the header of a .js.map file to extract the optional "file" field without loading massive mapping tables into memory.
   • findHiddenSourceMapTarget: Resolves the corresponding target JS file for a hidden source map via:
     • Standard naming conventions (stripping .map suffix, e.g., bundle.js.map $\rightarrow$ bundle.js).
     • The sourcemap JSON "file" property (both relative path resolution and basename matching in the same directory).

2. Two-Pass Mapping Strategy in findSourceMapMappings:

   • Pass 1 (Traditional): Scans JavaScript files for trailing //# sourceMappingURL= comments using getLinkedSourceMapPath.
   • Pass 2 (Hidden): For all remaining unlinked map files, discovers their target JS files among the unlinked JS assets using findHiddenSourceMapTarget.
   • Pass 3 (Fallback): Any standalone map files without matching JS assets fallback to mapping to themselves.

3. Comprehensive Testing:

   • Added unit tests in src/crashlytics/sourcemap.spec.ts covering extractSourceMapFileField, findHiddenSourceMapTarget, Vite-style hashed bundles, Angular-style browser bundles, custom-named sourcemaps, and mixed directories.
   • Added integration tests in src/commands/crashlytics-sourcemap-upload.spec.ts verifying GCS archive naming and API registration payloads for hidden sourcemaps and mixed directories.

Scenarios Tested

The test above in src/crashlytics/sourcemap.spec.ts verifies that mixed directories correctly handle all three sourcemap scenarios concurrently:

1. Traditional Sourcemap (tradJs + tradMap): traditional.js has a //# sourceMappingURL=traditional-hash.js.map comment linking it to traditional-hash.js.map $\rightarrow$ resolves to obfuscatedFilePath: "traditional.js".
2. Hidden Sourcemap (hiddenJs + hiddenMap): hidden.js has no source mapping comment, but hidden.js.map exists $\rightarrow$ discovers and links to obfuscatedFilePath: "hidden.js".
3. Unlinked Fallback (unlinkedMap): standalone.js.map has no matching .js file on disk $\rightarrow$ safely falls back to obfuscatedFilePath: "standalone.js.map".

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	9  5
Software Management Findings	-
Total	9  5

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

[gemini-code-assist]

Code Review

This pull request adds support for hidden sourcemaps (generated without sourceMappingURL comments) in the Crashlytics sourcemap upload command. It updates the mapping discovery process to resolve matching JS files using filename conventions and the source map's 'file' property, with comprehensive unit tests added to cover these scenarios. Feedback suggests refining the fallback logic in findHiddenSourceMapTarget to ensure consistent filesystem checks when jsFilesSet is omitted, which also reduces code nesting.