rea/docs/web-source-location.md

Captured website source locations

trace_web_source_location maps one selected position in a script retained by export_web_scripts through one explicitly paired local source map. The shared CLI/MCP workflow verifies actual manifest, script and map byte identities and returns the original position and embedded source inline. It acquires no browser, fetches no URL and executes no application code.

rea trace-web-source-location \
  /analysis/scripts/manifest.json 0 \
  /analysis/app.js.map 'https://example.test/maps/app.js.map?v=7#context' \
  1 25 --json

The six positional arguments select the manifest, zero-based script index, absolute map path, absolute map URL context, one-based generated line and zero-based UTF-16 column. The MCP arguments are:

{
  "manifest_path": "/analysis/scripts/manifest.json",
  "script_index": 0,
  "source_map": {
    "path": "/analysis/app.js.map",
    "url": "https://example.test/maps/app.js.map?v=7#context"
  },
  "generated_position": { "line": 1, "column": 25 }
}

The URL supplies the context for resolving sources and sourceRoot using the ECMA-426 URL parsing rule; it is not an instruction to fetch. Repeated path separators remain part of the resolved URL identity. A non-null sourceRoot prefixes each source, adding / only when the root does not already end with one. An empty root therefore prefixes /; a null or omitted root adds no prefix. Absolute virtual or file contexts can be selected as well. The map/script association is caller-selected: a declaration or local map does not prove deployment authenticity or execution. Use import tracing to inspect outgoing native module edges.

Meaning of the evidence

Lookup follows the greatest generated position less than or equal to the selected point, across lines, and returns every segment at that position. It includes generated-only mappings. This follows ECMA-426 GetOriginalPositions, with one-based lines in REA's public contract. A point result does not establish coverage of a source range, execution or UI causality.

Mapped entries preserve the raw source name/root, section path, section-local source index and flattened index. Duplicate URLs remain distinct, including entries with different embedded contents. Missing source names retain a null resolved URL. Original coordinates outside embedded text retain the reported coordinates and a null offset.

Embedded content hashes identify the UTF-8 encoding of the decoded sourcesContent string, including its line endings. They do not identify an independently captured original file. Raw map text is retained in Evidence's raw_result, including unknown extensions; these extensions are not interpreted. Capture context and source Evidence links accompany independently verified selected file identities.