@cboxdk/id-js 0.1.0

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Cbox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,143 @@
+# @cboxdk/id-js
+
+Turnkey [Cbox ID](https://github.com/cboxdk/laravel-id) client for JavaScript /
+TypeScript. It speaks standard OpenID Connect against a Cbox ID instance — so
+integrating is a redirect and a callback, not a rewrite — and adds the conveniences a
+hosted-identity product needs:
+
+- **Login** — one redirect, one callback. PKCE (S256), a CSRF `state`, a nonce, and
+  full `id_token` verification (signature against the instance's JWKS via
+  [`jose`](https://github.com/panva/jose), plus issuer, audience and nonce) are
+  handled for you.
+- **Hosted profile management** — send a signed-in user to the instance's own account
+  page (password, MFA, passkeys, sessions) and back to your app.
+- **Back-channel calls** — machine (client-credentials) tokens, UserInfo, RFC 7662
+  introspection.
+- **Webhook / action verification** — confirm an inbound `X-Cbox-Signature`.
+
+Runs on Node, edge runtimes and the browser (built on Web Crypto and `fetch`), with a
+first-class **Next.js** adapter.
+
+## Install
+
+```bash
+npm install @cboxdk/id-js
+```
+
+## Next.js (App Router)
+
+```ts
+// lib/cbox.ts
+import { createCboxId } from '@cboxdk/id-js/nextjs';
+
+// Reads CBOX_ID_ISSUER / CBOX_ID_CLIENT_ID / CBOX_ID_CLIENT_SECRET / CBOX_ID_REDIRECT_URI
+export const cboxId = createCboxId();
+```
+
+```ts
+// app/auth/sign-in/route.ts
+import { cboxId } from '@/lib/cbox';
+export const GET = () => cboxId.signIn();
+```
+
+```ts
+// app/auth/callback/route.ts
+import { NextResponse, type NextRequest } from 'next/server';
+import { cboxId } from '@/lib/cbox';
+
+export async function GET(request: NextRequest) {
+  const user = await cboxId.callback(request); // verifies state, PKCE and the id_token
+  // create your own session for `user.id` (the stable subject), then:
+  return NextResponse.redirect(new URL('/dashboard', request.url));
+}
+```
+
+Send users to hosted profile management:
+
+```ts
+// app/account/route.ts
+import { cboxId } from '@/lib/cbox';
+export const GET = () => cboxId.profileRedirect('/dashboard');
+```
+
+## Any framework (the core)
+
+`CboxIdClient` is framework-agnostic — it hands you the values to persist and takes
+them back:
+
+```ts
+import { CboxIdClient } from '@cboxdk/id-js';
+
+const client = new CboxIdClient({
+  issuer: 'https://id.acme.com',
+  clientId: process.env.CBOX_ID_CLIENT_ID!,
+  clientSecret: process.env.CBOX_ID_CLIENT_SECRET,
+  redirectUri: 'https://app.acme.com/auth/callback',
+});
+
+// Start login — persist state/codeVerifier/nonce (e.g. signed httpOnly cookies).
+const { url, state, codeVerifier, nonce } = await client.createAuthorizationRequest();
+// redirect the user to `url` ...
+
+// On the callback:
+const user = await client.authenticate({
+  params: { code, state: callbackState },
+  stored: { state, codeVerifier, nonce },
+});
+```
+
+## Back-channel calls
+
+```ts
+const token = await client.machineToken({ scopes: ['reports.read'] });   // as your app
+const claims = await client.userinfo(user.accessToken);                  // as a user
+const introspection = await client.introspect(someToken);                // RFC 7662
+```
+
+## Verify webhooks
+
+```ts
+import { verifyWebhook } from '@cboxdk/id-js';
+
+const ok = await verifyWebhook({
+  payload: rawBody,                       // the exact bytes received
+  signatureHeader: req.headers['x-cbox-signature'],
+  secret: process.env.CBOX_ID_WEBHOOK_SECRET!,
+});
+```
+
+## Token Vault
+
+Broker downstream credentials (API keys for OpenAI, GitHub, …) through the instance's
+Token Vault: provision + grant with a `vault.manage` token, and let an authorized
+agent client redeem the plaintext with a `vault.lease` token.
+
+```ts
+// Provisioning backend (vault.manage)
+const admin = client.vault(await client.machineToken({ scopes: ['vault.manage'] }));
+const secret = await admin.store({ name: 'openai', provider: 'openai', secret: 'sk-live-…' });
+await admin.grant(secret.id, 'agent-1');
+
+// Agent worker (vault.lease) — keyed on its own client
+const agent = client.vault(await client.machineToken({ scopes: ['vault.lease'] }));
+const lease = await agent.lease(secret.id, 'call openai');
+// use lease.secret immediately; it is never persisted
+```
+
+A lease with no live grant is refused — the vault is deny-by-default.
+
+## Security & scope
+
+Login is hardened by default — PKCE, `state`, nonce, and full `id_token` verification
+(signature/issuer/audience) via `jose`; webhook checks are constant-time within a
+freshness window. Keep `clientSecret` and webhook secrets server-side.
+
+This is a **client**. It authenticates users and calls a Cbox ID instance's standard
+endpoints; it does not configure SSO, run SCIM, or manage organizations — those are
+platform capabilities of [`cboxdk/laravel-id`](https://github.com/cboxdk/laravel-id).
+
+Report vulnerabilities via this repo's GitHub **Private Vulnerability Reporting**.
+
+## License
+
+MIT © Cbox.

package/dist/chunk-D4OUHK6N.js

@@ -0,0 +1,490 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+
+// src/errors.ts
+var CboxIdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var ConfigurationError = class extends CboxIdError {
+};
+var InvalidStateError = class extends CboxIdError {
+};
+var AuthenticationError = class extends CboxIdError {
+};
+
+// src/pkce.ts
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(bytes = 32) {
+  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function createVerifier() {
+  return randomToken(32);
+}
+async function challenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url(new Uint8Array(digest));
+}
+
+// src/vault.ts
+var VaultClient = class {
+  constructor(issuer, token, timeoutMs = 1e4) {
+    this.token = token;
+    this.timeoutMs = timeoutMs;
+    this.base = `${issuer.replace(/\/$/, "")}/api/v1/vault`;
+  }
+  token;
+  timeoutMs;
+  base;
+  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */
+  store(input) {
+    return this.json("POST", "/secrets", {
+      name: input.name,
+      provider: input.provider,
+      secret: input.secret,
+      owner_type: input.ownerType,
+      owner_id: input.ownerId,
+      expires_at: input.expiresAt
+    });
+  }
+  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */
+  rotate(secretId, secret) {
+    return this.json("POST", `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });
+  }
+  /** Revoke a secret permanently (scope `vault.manage`). */
+  async revoke(secretId) {
+    await this.request("DELETE", `/secrets/${encodeURIComponent(secretId)}`);
+  }
+  /** Authorize an agent client to lease a secret (scope `vault.manage`). */
+  grant(secretId, clientId, maxTtlSeconds) {
+    return this.json("POST", `/secrets/${encodeURIComponent(secretId)}/grants`, {
+      client_id: clientId,
+      max_ttl_seconds: maxTtlSeconds
+    }).then((raw) => {
+      const r = raw;
+      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };
+    });
+  }
+  /** Revoke an agent's authorization (scope `vault.manage`). */
+  async revokeGrant(secretId, clientId) {
+    await this.request(
+      "DELETE",
+      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`
+    );
+  }
+  /**
+   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller
+   * is identified by the token's client; a lease with no live grant is refused.
+   */
+  lease(secretId, purpose) {
+    return this.json("POST", `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {
+      const r = raw;
+      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };
+    });
+  }
+  async json(method, path, body) {
+    const response = await this.request(method, path, body);
+    return await response.json();
+  }
+  async request(method, path, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const init = {
+        method,
+        headers: {
+          authorization: `Bearer ${this.token}`,
+          ...body ? { "content-type": "application/json" } : {}
+        },
+        signal: controller.signal
+      };
+      if (body) {
+        init.body = JSON.stringify(body);
+      }
+      const response = await fetch(`${this.base}${path}`, init);
+      if (!response.ok) {
+        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);
+      }
+      return response;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/webhook.ts
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function toHex(bytes) {
+  return Array.from(new Uint8Array(bytes)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyWebhook(options) {
+  const { payload, signatureHeader, secret } = options;
+  const toleranceSeconds = options.toleranceSeconds ?? 300;
+  const now = options.now ?? Math.floor(Date.now() / 1e3);
+  if (!signatureHeader) {
+    return false;
+  }
+  const parts = {};
+  for (const segment of signatureHeader.split(",")) {
+    const [key2, value] = segment.trim().split("=", 2);
+    if (key2) {
+      parts[key2] = value ?? "";
+    }
+  }
+  const timestamp = parts["t"] ?? "";
+  const signature = parts["v1"] ?? "";
+  if (timestamp === "" || signature === "" || !/^\d+$/.test(timestamp)) {
+    return false;
+  }
+  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {
+    return false;
+  }
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const expected = toHex(
+    await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${timestamp}.${payload}`))
+  );
+  return timingSafeEqual(expected, signature);
+}
+
+// src/discovery.ts
+var Discovery = class {
+  constructor(issuer, timeoutMs, cacheTtlMs, now = Date.now) {
+    this.issuer = issuer;
+    this.timeoutMs = timeoutMs;
+    this.cacheTtlMs = cacheTtlMs;
+    this.now = now;
+  }
+  issuer;
+  timeoutMs;
+  cacheTtlMs;
+  now;
+  cached = null;
+  async document() {
+    if (this.cached && this.cached.expiresAt > this.now()) {
+      return this.cached.doc;
+    }
+    const url = `${this.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let doc;
+    try {
+      const response = await fetch(url, { signal: controller.signal });
+      if (!response.ok) {
+        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);
+      }
+      doc = await response.json();
+    } catch (error) {
+      if (error instanceof AuthenticationError) {
+        throw error;
+      }
+      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (typeof doc.issuer !== "string" || doc.issuer === "") {
+      throw new AuthenticationError("The discovery document was missing an issuer.");
+    }
+    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };
+    return doc;
+  }
+  /** A required endpoint from the discovery document. */
+  async endpoint(name) {
+    const value = (await this.document())[name];
+    if (typeof value !== "string" || value === "") {
+      throw new ConfigurationError(`The instance does not advertise a ${name}.`);
+    }
+    return value;
+  }
+  /** An optional endpoint, or null when the instance advertises none. */
+  async optionalEndpoint(name) {
+    const value = (await this.document())[name];
+    return typeof value === "string" && value !== "" ? value : null;
+  }
+};
+
+// src/client.ts
+var CboxIdClient = class {
+  constructor(config) {
+    this.config = config;
+    if (!config.issuer) {
+      throw new ConfigurationError("Cbox ID config `issuer` is required.");
+    }
+    if (!config.clientId) {
+      throw new ConfigurationError("Cbox ID config `clientId` is required.");
+    }
+    if (!config.redirectUri) {
+      throw new ConfigurationError("Cbox ID config `redirectUri` is required.");
+    }
+    this.discovery = new Discovery(
+      config.issuer,
+      config.timeoutMs ?? 1e4,
+      config.cacheTtlMs ?? 36e5
+    );
+  }
+  config;
+  discovery;
+  jwksByUri = /* @__PURE__ */ new Map();
+  /**
+   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and
+   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back
+   * to {@link authenticate} on the callback.
+   */
+  async createAuthorizationRequest(options = {}) {
+    const codeVerifier = createVerifier();
+    const state = options.state ?? randomToken(16);
+    const nonce = randomToken(16);
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: this.config.clientId,
+      redirect_uri: options.redirectUri ?? this.config.redirectUri,
+      scope: (options.scopes ?? this.scopes()).join(" "),
+      state,
+      nonce,
+      code_challenge: await challenge(codeVerifier),
+      code_challenge_method: "S256"
+    });
+    if (options.prompt) {
+      params.set("prompt", options.prompt);
+    }
+    if (options.loginHint) {
+      params.set("login_hint", options.loginHint);
+    }
+    const endpoint = await this.discovery.endpoint("authorization_endpoint");
+    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };
+  }
+  /**
+   * Complete login on your callback route: verify state, exchange the code with the
+   * PKCE verifier, verify the id_token, and return the authenticated user.
+   *
+   * @throws InvalidStateError when state does not match (forged/stale request)
+   * @throws AuthenticationError on any other failure
+   */
+  async authenticate(input) {
+    const { params, stored } = input;
+    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {
+      throw new InvalidStateError("The login state did not match \u2014 the request may be forged or stale.");
+    }
+    if (params.error) {
+      throw new AuthenticationError(
+        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ""}`
+      );
+    }
+    if (!params.code) {
+      throw new AuthenticationError("The callback was missing an authorization code.");
+    }
+    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);
+    if (!tokens.access_token) {
+      throw new AuthenticationError("No access token was returned.");
+    }
+    let claims = {};
+    if (tokens.id_token) {
+      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);
+    }
+    claims = { ...claims, ...await this.userinfo(tokens.access_token) };
+    const sub = claims["sub"];
+    if (typeof sub !== "string" || sub === "") {
+      throw new AuthenticationError("The verified token carried no subject.");
+    }
+    return {
+      id: sub,
+      email: typeof claims["email"] === "string" ? claims["email"] : null,
+      name: typeof claims["name"] === "string" ? claims["name"] : null,
+      organizationId: typeof claims["org"] === "string" ? claims["org"] : null,
+      claims,
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token ?? null,
+      idToken: tokens.id_token ?? null,
+      expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0
+    };
+  }
+  /**
+   * The URL of the instance's hosted account/profile page (self-service password,
+   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox
+   * ID session; `returnTo` is passed so the page can link back to your app.
+   */
+  profileUrl(returnTo) {
+    const base = `${this.config.issuer.replace(/\/$/, "")}${this.accountPath()}`;
+    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;
+  }
+  /** The RP-initiated logout URL, or null when the instance advertises none. */
+  async logoutUrl(returnTo) {
+    const endpoint = await this.discovery.optionalEndpoint("end_session_endpoint");
+    if (!endpoint) {
+      return null;
+    }
+    return returnTo ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}` : endpoint;
+  }
+  /**
+   * A machine (client-credentials) access token for calling Cbox ID APIs as your
+   * app, not on a user's behalf. Requires a client secret.
+   */
+  async machineToken(options = {}) {
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: this.config.clientId,
+      client_secret: this.requireSecret()
+    });
+    if (options.scopes && options.scopes.length > 0) {
+      body.set("scope", options.scopes.join(" "));
+    }
+    if (options.resource) {
+      body.set("resource", options.resource);
+    }
+    const response = await this.post(await this.discovery.endpoint("token_endpoint"), body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);
+    }
+    const json = await response.json();
+    if (typeof json.access_token !== "string") {
+      throw new AuthenticationError("The token response had no access_token.");
+    }
+    return json.access_token;
+  }
+  /** The OIDC userinfo claims for an access token. */
+  async userinfo(accessToken) {
+    const endpoint = await this.discovery.optionalEndpoint("userinfo_endpoint");
+    if (!endpoint) {
+      return {};
+    }
+    const response = await this.fetchWithTimeout(endpoint, {
+      headers: { authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) {
+      throw new AuthenticationError("Userinfo request failed.");
+    }
+    return await response.json();
+  }
+  /**
+   * RFC 7662 token introspection (confidential-client auth). Returns the raw
+   * response; `active` tells you if the token is currently valid. Requires a secret.
+   */
+  async introspect(token) {
+    const endpoint = await this.discovery.endpoint("introspection_endpoint");
+    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);
+    const response = await this.post(
+      endpoint,
+      new URLSearchParams({ token }),
+      { authorization: `Basic ${basic}` }
+    );
+    if (!response.ok) {
+      throw new AuthenticationError("Introspection request failed.");
+    }
+    return await response.json();
+  }
+  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */
+  verifyWebhook(options) {
+    return verifyWebhook(options);
+  }
+  /**
+   * A Token Vault client bound to an access token. Obtain the token with
+   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to
+   * redeem), then call `store` / `grant` / `lease` etc.
+   */
+  vault(accessToken) {
+    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 1e4);
+  }
+  async exchange(code, verifier, redirectUri) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri ?? this.config.redirectUri,
+      client_id: this.config.clientId,
+      code_verifier: verifier
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const response = await this.post(await this.discovery.endpoint("token_endpoint"), body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);
+    }
+    return await response.json();
+  }
+  async verifyIdToken(idToken, nonce) {
+    const jwksUri = await this.discovery.endpoint("jwks_uri");
+    let resolver = this.jwksByUri.get(jwksUri);
+    if (!resolver) {
+      resolver = createRemoteJWKSet(new URL(jwksUri));
+      this.jwksByUri.set(jwksUri, resolver);
+    }
+    let payload;
+    try {
+      ({ payload } = await jwtVerify(idToken, resolver, {
+        issuer: this.config.issuer,
+        audience: this.config.clientId
+      }));
+    } catch (error) {
+      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);
+    }
+    if (nonce && payload["nonce"] !== nonce) {
+      throw new AuthenticationError("The id_token nonce did not match \u2014 possible replay.");
+    }
+    return payload;
+  }
+  scopes() {
+    const scopes = this.config.scopes;
+    return scopes && scopes.length > 0 ? scopes : ["openid", "profile", "email"];
+  }
+  accountPath() {
+    const path = this.config.accountPath;
+    return path && path !== "" ? `/${path.replace(/^\//, "")}` : "/settings";
+  }
+  requireSecret() {
+    if (!this.config.clientSecret) {
+      throw new ConfigurationError("This call requires a `clientSecret`, but none is configured.");
+    }
+    return this.config.clientSecret;
+  }
+  post(url, body, headers = {}) {
+    return this.fetchWithTimeout(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", ...headers },
+      body
+    });
+  }
+  async fetchWithTimeout(url, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 1e4);
+    try {
+      return await fetch(url, { ...init, signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+function timingSafeEqualString(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+
+export { AuthenticationError, CboxIdClient, CboxIdError, ConfigurationError, InvalidStateError, VaultClient, challenge, createVerifier, randomToken, verifyWebhook };
+//# sourceMappingURL=chunk-D4OUHK6N.js.map
+//# sourceMappingURL=chunk-D4OUHK6N.js.map