feat: add fetch, sources, and lookup --context commands

Add three new CLI capabilities for debugging production websites:

- `srcmap fetch <url>` — download a JS/CSS bundle and its source map
  from a URL, automatically resolving sourceMappingURL references
  (inline data URIs, external URLs, and conventional .map suffix fallback)

- `srcmap sources <file.map>` — list or extract embedded sourcesContent
  entries to disk with directory structure preservation. Handles webpack://,
  file://, and relative path sanitization.

- `srcmap lookup --context <n>` — show surrounding lines of original
  source code around a mapped position, with gutter display and
  highlighted target line.

These commands enable the full remote debugging workflow:
  srcmap fetch https://cdn.example.com/app.min.js -o ./debug
  srcmap sources ./debug/app.min.js.map --extract -o ./src
  srcmap lookup ./debug/app.min.js.map 0 84729 --context 5

Also adds ureq HTTP client dependency, 43 integration tests (up from 32),
webpack:// path fixture, and updated docs in both READMEs.

Author: BartWaardenburg

Cargo.lock

@@ -29,6 +29,7 @@ serde-wasm-bindgen = "0.6"
 js-sys = "0.3"
 clap = { version = "4", features = ["derive"] }
 rustc-hash = "2"
+ureq = "2"
 
 [profile.release]
 lto = true

Cargo.toml

@@ -249,7 +249,7 @@ cargo install srcmap-cli
 
 srcmap info bundle.js.map --json            # Inspect metadata and statistics
 srcmap validate bundle.js.map --json        # Validate a source map
-srcmap lookup bundle.js.map 42 10 --json    # Original position (0-based)
+srcmap lookup bundle.js.map 42 10 --context 5 --json  # Original position with source context
 srcmap resolve bundle.js.map --source src/app.ts 10 0 --json  # Reverse lookup
 srcmap mappings bundle.js.map --limit 100 --json              # List mappings
 srcmap decode "AAAA;AACA" --json            # Decode VLQ mappings string
@@ -258,6 +258,8 @@ srcmap concat a.js.map b.js.map -o bundle.js.map              # Concatenate
 srcmap remap minified.js.map --dir ./maps -o composed.js.map  # Compose
 srcmap symbolicate stack.txt --dir ./maps --json               # Symbolicate
 srcmap scopes bundle.js.map --json          # Inspect ECMA-426 scopes & bindings
+srcmap fetch https://cdn.example.com/app.min.js -o ./debug     # Fetch bundle + source map
+srcmap sources bundle.js.map --extract -o ./src                # Extract original sources
 srcmap schema                               # All commands as JSON (for agents)
 ```
 

README.md

@@ -21,6 +21,7 @@ srcmap-scopes = { workspace = true }
 srcmap-symbolicate = { workspace = true }
 clap = { workspace = true }
 serde_json = { workspace = true }
+ureq = { workspace = true }
 
 [dev-dependencies]
 serde_json = { workspace = true }

crates/cli/Cargo.toml

@@ -28,6 +28,8 @@ cargo install srcmap-cli
 | `remap` | Compose/remap source maps through a transform chain |
 | `symbolicate` | Symbolicate a stack trace using source maps |
 | `scopes` | Inspect ECMA-426 scopes and variable bindings |
+| `fetch` | Fetch a JS/CSS bundle and its source map from a URL |
+| `sources` | List or extract original sources from a source map |
 | `schema` | Describe all commands as JSON (for agent introspection) |
 
 ## Usage
@@ -42,6 +44,9 @@ srcmap validate bundle.js.map
 # Look up original position (0-based line:column)
 srcmap lookup bundle.js.map 42 12
 
+# Look up with surrounding source context
+srcmap lookup bundle.js.map 42 12 --context 5
+
 # Reverse lookup
 srcmap resolve bundle.js.map --source src/app.ts 10 0
 
@@ -63,6 +68,15 @@ srcmap symbolicate stacktrace.txt --dir ./sourcemaps
 # Inspect ECMA-426 scopes
 srcmap scopes bundle.js.map
 
+# Fetch a bundle and its source map from a URL
+srcmap fetch https://cdn.example.com/app.min.js -o ./debug
+
+# List embedded original sources
+srcmap sources bundle.js.map
+
+# Extract all original sources to disk
+srcmap sources bundle.js.map --extract -o ./src
+
 # All commands support --json for structured output
 srcmap info bundle.js.map --json
 
@@ -78,7 +92,10 @@ srcmap schema
 - **Dry run** — `--dry-run` on mutating commands (`concat`, `remap`) to validate without writing
 - **Input hardening** — rejects control characters, path traversals, and percent-encoding in source names
 - **Output sandboxing** — all file writes validated against the current working directory
-- **Structured errors** — error codes (`IO_ERROR`, `PARSE_ERROR`, `NOT_FOUND`, `VALIDATION_ERROR`, `PATH_TRAVERSAL`, `INVALID_INPUT`) in JSON mode
+- **Remote fetching** — `srcmap fetch` downloads bundles and source maps from URLs, resolving `sourceMappingURL` automatically
+- **Source extraction** — `srcmap sources --extract` writes embedded `sourcesContent` to disk with directory structure
+- **Context lines** — `srcmap lookup --context N` shows surrounding original source around a mapped position
+- **Structured errors** — error codes (`IO_ERROR`, `PARSE_ERROR`, `NOT_FOUND`, `VALIDATION_ERROR`, `PATH_TRAVERSAL`, `INVALID_INPUT`, `FETCH_ERROR`) in JSON mode
 
 ## Part of [srcmap](https://github.com/BartWaardenburg/srcmap)