@dudko.dev/agent-web 0.0.7 → 0.0.9

package/dist/mcp.cjs

@@ -20,17 +20,386 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/mcp/index.ts
 var mcp_exports = {};
 __export(mcp_exports, {
+  BrowserOAuthProvider: () => BrowserOAuthProvider,
+  MemoryOAuthStorage: () => MemoryOAuthStorage,
+  VaultOAuthStorage: () => VaultOAuthStorage,
+  beginMcpOAuth: () => beginMcpOAuth,
   connectMcpHttp: () => connectMcpHttp,
-  flattenContent: () => flattenContent
+  finishMcpOAuth: () => finishMcpOAuth,
+  flattenContent: () => flattenContent,
+  readOAuthCallback: () => readOAuthCallback
 });
 module.exports = __toCommonJS(mcp_exports);
 
 // src/mcp/http.ts
+var import_auth2 = require("@modelcontextprotocol/sdk/client/auth.js");
 var import_client = require("@modelcontextprotocol/sdk/client/index.js");
 var import_streamableHttp = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+var import_types = require("@modelcontextprotocol/sdk/types.js");
 var import_ai = require("ai");
+
+// src/mcp/oauth.ts
+var import_auth = require("@modelcontextprotocol/sdk/client/auth.js");
+
+// src/storage/db.ts
+var import_idb = require("idb");
+var KEYS_STORE = "keys";
+var SECRETS_STORE = "secrets";
+var SESSIONS_STORE = "sessions";
+var cache = /* @__PURE__ */ new Map();
+var openAgentWebDB = (opts = {}) => {
+  const name = opts.dbName ?? "agent-web";
+  let p = cache.get(name);
+  if (!p) {
+    p = (0, import_idb.openDB)(name, 1, {
+      upgrade(db) {
+        if (!db.objectStoreNames.contains(KEYS_STORE)) db.createObjectStore(KEYS_STORE);
+        if (!db.objectStoreNames.contains(SECRETS_STORE)) db.createObjectStore(SECRETS_STORE);
+        if (!db.objectStoreNames.contains(SESSIONS_STORE)) db.createObjectStore(SESSIONS_STORE);
+      }
+    });
+    cache.set(name, p);
+    p.catch(() => {
+      if (cache.get(name) === p) cache.delete(name);
+    });
+  }
+  return p;
+};
+
+// src/secrets/crypto.ts
+var KEY_ID = "vault-key-v1";
+var webcrypto = () => {
+  const c = globalThis.crypto;
+  if (!c?.subtle || !c.getRandomValues) {
+    throw new Error("WebCrypto (crypto.subtle) is unavailable in this environment");
+  }
+  return c;
+};
+var loadOrCreateKey = async (dbName) => {
+  const db = await openAgentWebDB({ dbName });
+  const existing = await db.get(KEYS_STORE, KEY_ID);
+  if (existing) return existing;
+  const key = await webcrypto().subtle.generateKey(
+    { name: "AES-GCM", length: 256 },
+    /* extractable */
+    false,
+    ["encrypt", "decrypt"]
+  );
+  const tx = db.transaction(KEYS_STORE, "readwrite");
+  const winner = await tx.store.get(KEY_ID);
+  if (winner) {
+    await tx.done;
+    return winner;
+  }
+  await tx.store.put(key, KEY_ID);
+  await tx.done;
+  return key;
+};
+var keyCache = /* @__PURE__ */ new Map();
+var getOrCreateVaultKey = (dbName) => {
+  const cacheKey = dbName ?? "agent-web";
+  let p = keyCache.get(cacheKey);
+  if (!p) {
+    p = loadOrCreateKey(dbName);
+    keyCache.set(cacheKey, p);
+    p.catch(() => {
+      if (keyCache.get(cacheKey) === p) keyCache.delete(cacheKey);
+    });
+  }
+  return p;
+};
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder();
+var encryptJSON = async (key, value) => {
+  const c = webcrypto();
+  const iv = c.getRandomValues(new Uint8Array(12));
+  const data = textEncoder.encode(JSON.stringify(value));
+  const ciphertext = await c.subtle.encrypt({ name: "AES-GCM", iv }, key, data);
+  return { iv, ciphertext };
+};
+var decryptJSON = async (key, blob) => {
+  const iv = new Uint8Array(blob.iv);
+  const plain = await webcrypto().subtle.decrypt({ name: "AES-GCM", iv }, key, blob.ciphertext);
+  return JSON.parse(textDecoder.decode(plain));
+};
+
+// src/secrets/vault.ts
+var IndexedDBVault = class {
+  dbName;
+  constructor(opts = {}) {
+    this.dbName = opts.dbName;
+  }
+  key() {
+    return getOrCreateVaultKey(this.dbName);
+  }
+  /** Encrypt and store a secret string under `id`. */
+  async setSecret(id, value) {
+    const blob = await encryptJSON(await this.key(), value);
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    await db.put(SECRETS_STORE, blob, id);
+  }
+  /** Fetch and decrypt a secret, or undefined if absent. */
+  async getSecret(id) {
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    const blob = await db.get(SECRETS_STORE, id);
+    if (!blob) return void 0;
+    return decryptJSON(await this.key(), blob);
+  }
+  async deleteSecret(id) {
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    await db.delete(SECRETS_STORE, id);
+  }
+  async listSecretIds() {
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    return (await db.getAllKeys(SECRETS_STORE)).map(String);
+  }
+};
+
+// src/mcp/oauth.ts
+var VaultOAuthStorage = class {
+  vault;
+  constructor(opts = {}) {
+    this.vault = new IndexedDBVault(opts);
+  }
+  get(key) {
+    return this.vault.getSecret(key);
+  }
+  set(key, value) {
+    return this.vault.setSecret(key, value);
+  }
+  delete(key) {
+    return this.vault.deleteSecret(key);
+  }
+};
+var MemoryOAuthStorage = class {
+  map = /* @__PURE__ */ new Map();
+  async get(key) {
+    return this.map.get(key);
+  }
+  async set(key, value) {
+    this.map.set(key, value);
+  }
+  async delete(key) {
+    this.map.delete(key);
+  }
+};
+var DEFAULT_SKEW_SECONDS = 30;
+var namespaceFor = (serverUrl) => {
+  const u = new URL(serverUrl);
+  return `mcp-oauth:${u.origin}${u.pathname.replace(/\/+$/, "")}${u.search}`;
+};
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var assertSecureOAuthUrl = (url, label = "MCP server") => {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`${label}: "${url}" is not a valid URL`);
+  }
+  if (parsed.protocol === "https:" || LOOPBACK_HOSTS.has(parsed.hostname)) return;
+  throw new Error(
+    `${label}: MCP OAuth requires https (or a loopback host) - refusing to send tokens to "${url}"`
+  );
+};
+var randomToken = () => {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+};
+var BrowserOAuthProvider = class {
+  /** Set when the SDK asks for an authorization redirect; read it in your UI. */
+  authorizationUrl;
+  serverUrl;
+  storage;
+  ns;
+  _redirectUrl;
+  _clientMetadata;
+  skewMs;
+  onRedirect;
+  constructor(opts) {
+    assertSecureOAuthUrl(opts.serverUrl);
+    this.serverUrl = opts.serverUrl;
+    this.storage = opts.storage ?? new VaultOAuthStorage();
+    this.ns = namespaceFor(opts.serverUrl);
+    this._redirectUrl = String(opts.redirectUrl);
+    this.skewMs = (opts.expirySkewSeconds ?? DEFAULT_SKEW_SECONDS) * 1e3;
+    this.onRedirect = opts.onRedirect;
+    this._clientMetadata = {
+      client_name: opts.clientName ?? "agent-web",
+      redirect_uris: [this._redirectUrl],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      // Public client: a browser cannot hold a client_secret. PKCE is what
+      // actually protects the code exchange.
+      token_endpoint_auth_method: "none",
+      ...opts.scope ? { scope: opts.scope } : {},
+      ...opts.clientMetadata
+    };
+  }
+  get redirectUrl() {
+    return this._redirectUrl;
+  }
+  get clientMetadata() {
+    return this._clientMetadata;
+  }
+  key(suffix) {
+    return `${this.ns}:${suffix}`;
+  }
+  async readJSON(suffix) {
+    try {
+      const raw = await this.storage.get(this.key(suffix));
+      if (raw === void 0) return void 0;
+      return JSON.parse(raw);
+    } catch {
+      await this.storage.delete(this.key(suffix)).catch(() => {
+      });
+      return void 0;
+    }
+  }
+  async state() {
+    const value = randomToken();
+    await this.storage.set(this.key("state"), value);
+    return value;
+  }
+  /**
+   * CSRF check for the redirect back. Single-use: the stored value is dropped
+   * whether or not it matched, so a replayed callback can't pass twice.
+   */
+  async verifyState(returned) {
+    const expected = await this.storage.get(this.key("state"));
+    await this.storage.delete(this.key("state"));
+    return expected !== void 0 && returned !== void 0 && expected === returned;
+  }
+  async clientInformation() {
+    return this.readJSON("client");
+  }
+  async saveClientInformation(info) {
+    await this.storage.set(this.key("client"), JSON.stringify(info));
+  }
+  async tokens() {
+    return (await this.readJSON("tokens"))?.tokens;
+  }
+  async saveTokens(tokens) {
+    const stored = {
+      tokens,
+      expiresAt: typeof tokens.expires_in === "number" ? Date.now() + tokens.expires_in * 1e3 : void 0
+    };
+    await this.storage.set(this.key("tokens"), JSON.stringify(stored));
+  }
+  async saveCodeVerifier(verifier) {
+    await this.storage.set(this.key("verifier"), verifier);
+  }
+  async codeVerifier() {
+    const v = await this.storage.get(this.key("verifier"));
+    if (!v) {
+      throw new Error(
+        "No PKCE code verifier stored: the authorization was started in a different browser profile, or storage was cleared mid-flow"
+      );
+    }
+    return v;
+  }
+  async redirectToAuthorization(url) {
+    this.authorizationUrl = url;
+    await this.onRedirect?.(url);
+  }
+  /**
+   * Called by the SDK when the server rejects what we hold: `'tokens'` after an
+   * `invalid_grant` (dead refresh token), `'client'` / `'all'` after an
+   * `invalid_client` (the AS forgot our dynamic registration). Clearing lets
+   * the SDK re-register and re-authorize without the user clearing site data.
+   */
+  async invalidateCredentials(scope) {
+    const targets = scope === "all" ? ["tokens", "client", "verifier", "state"] : [scope];
+    await Promise.all(targets.map((t) => this.storage.delete(this.key(t))));
+  }
+  /** True when there is no access token, or it expires within the skew window. */
+  async isAccessTokenExpired() {
+    const stored = await this.readJSON("tokens");
+    if (!stored?.tokens?.access_token) return true;
+    if (stored.expiresAt === void 0) return false;
+    return Date.now() + this.skewMs >= stored.expiresAt;
+  }
+  /** True once an authorization has completed for this server. */
+  async isAuthorized() {
+    return await this.tokens() !== void 0;
+  }
+  /** Forget tokens, registration, verifier and state for this server. */
+  async reset() {
+    this.authorizationUrl = void 0;
+    await this.invalidateCredentials("all");
+  }
+};
+var readOAuthCallback = (input) => {
+  const href = input ? String(input) : typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0;
+  if (!href) return void 0;
+  let url;
+  try {
+    url = new URL(href);
+  } catch {
+    return void 0;
+  }
+  const params = new URLSearchParams(url.search);
+  const hash = url.hash.startsWith("#") ? url.hash.slice(1) : url.hash;
+  const q = hash.indexOf("?");
+  if (q >= 0) {
+    for (const [k, v] of new URLSearchParams(hash.slice(q + 1))) {
+      if (!params.has(k)) params.set(k, v);
+    }
+  }
+  const code = params.get("code") ?? void 0;
+  const error = params.get("error") ?? void 0;
+  if (!code && !error) return void 0;
+  return {
+    code,
+    state: params.get("state") ?? void 0,
+    error,
+    errorDescription: params.get("error_description") ?? void 0
+  };
+};
+var finishMcpOAuth = async (provider, callback, opts = {}) => {
+  if (callback.error) {
+    throw new Error(
+      `Authorization denied by the server: ${callback.error}${callback.errorDescription ? ` - ${callback.errorDescription}` : ""}`
+    );
+  }
+  if (!callback.code) {
+    throw new Error("Authorization callback carried no code");
+  }
+  if (!await provider.verifyState(callback.state)) {
+    throw new Error("Authorization state mismatch; refusing to exchange the code (possible CSRF)");
+  }
+  const result = await (0, import_auth.auth)(provider, {
+    serverUrl: provider.serverUrl,
+    authorizationCode: callback.code,
+    fetchFn: opts.fetch
+  });
+  if (result !== "AUTHORIZED") {
+    throw new Error(`Token exchange did not complete (SDK returned "${result}")`);
+  }
+};
+var beginMcpOAuth = async (provider, opts = {}) => {
+  provider.authorizationUrl = void 0;
+  return (0, import_auth.auth)(provider, { serverUrl: provider.serverUrl, fetchFn: opts.fetch });
+};
+
+// src/mcp/http.ts
 var MAX_TOOL_NAME_LEN = 64;
+var DEFAULT_RECONNECTION = {
+  maxReconnectionDelay: 3e4,
+  initialReconnectionDelay: 1e3,
+  reconnectionDelayGrowFactor: 1.5,
+  maxRetries: 5
+};
 var sanitizeName = (s) => s.replace(/[^a-zA-Z0-9_-]/g, "_");
+var uniqueKey = (base, taken) => {
+  if (!Object.hasOwn(taken, base)) return base;
+  for (let n = 2; n < 100; n++) {
+    const suffix = `_${n}`;
+    const candidate = base.slice(0, MAX_TOOL_NAME_LEN - suffix.length) + suffix;
+    if (!Object.hasOwn(taken, candidate)) return candidate;
+  }
+  return "";
+};
 var flattenContent = (content) => {
   if (!Array.isArray(content)) return content;
   const parts = content;
@@ -38,58 +407,96 @@ var flattenContent = (content) => {
   if (allText) return parts.map((p) => p.text).join("\n");
   return parts.map((p) => p?.type === "text" && typeof p.text === "string" ? p.text : p);
 };
-var connectOne = async (name, cfg, opts, log) => {
+var RefreshOnlyAbort = class extends Error {
+};
+var refreshOnly = (p) => ({
+  // Must stay truthy: `auth()` reads a missing redirectUrl as "non-interactive
+  // grant" and would try to fetch a token without one.
+  get redirectUrl() {
+    return p.redirectUrl;
+  },
+  get clientMetadata() {
+    return p.clientMetadata;
+  },
+  clientInformation: () => p.clientInformation(),
+  saveClientInformation: p.saveClientInformation?.bind(p),
+  tokens: () => p.tokens(),
+  saveTokens: (t) => p.saveTokens(t),
+  invalidateCredentials: p.invalidateCredentials?.bind(p),
+  addClientAuthentication: p.addClientAuthentication?.bind(p),
+  validateResourceURL: p.validateResourceURL?.bind(p),
+  codeVerifier: () => p.codeVerifier(),
+  state: () => {
+    throw new RefreshOnlyAbort();
+  },
+  saveCodeVerifier: () => {
+    throw new RefreshOnlyAbort();
+  },
+  redirectToAuthorization: () => {
+    throw new RefreshOnlyAbort();
+  }
+});
+var refreshIfExpired = async (provider, serverUrl, fetchFn, log, name) => {
+  const check = provider.isAccessTokenExpired;
+  if (typeof check !== "function") return;
+  if (!await check.call(provider)) return;
+  const tokens = await provider.tokens();
+  if (!tokens?.refresh_token) return;
+  try {
+    await (0, import_auth2.auth)(refreshOnly(provider), { serverUrl, fetchFn });
+  } catch (err) {
+    log(
+      "info",
+      err instanceof RefreshOnlyAbort ? `[mcp] ${name}: the stored token could not be refreshed; a new authorization is needed` : `[mcp] ${name}: proactive token refresh failed (${err instanceof Error ? err.message : String(err)}); continuing`
+    );
+  }
+};
+var openConnection = async (name, cfg, opts, log) => {
+  let client;
   try {
     if (cfg.headers && cfg.getHeaders) {
       throw new Error(`MCP server "${name}": specify either headers or getHeaders, not both`);
     }
     const headers = cfg.getHeaders ? await cfg.getHeaders() : cfg.headers;
+    if (cfg.authProvider) {
+      if (headers && "Authorization" in headers) {
+        log(
+          "warn",
+          `[mcp] ${name}: an explicit Authorization header shadows the OAuth token from authProvider`
+        );
+      }
+      assertSecureOAuthUrl(cfg.url, name);
+      await refreshIfExpired(cfg.authProvider, cfg.url, cfg.fetch, log, name);
+    }
     const transport = new import_streamableHttp.StreamableHTTPClientTransport(new URL(cfg.url), {
-      requestInit: headers ? { headers } : void 0
+      requestInit: headers ? { headers } : void 0,
+      authProvider: cfg.authProvider,
+      fetch: cfg.fetch,
+      reconnectionOptions: { ...DEFAULT_RECONNECTION, ...cfg.reconnection }
     });
-    const client = new import_client.Client({
+    transport.onerror = (err) => log("warn", `[mcp] ${name}: transport error - ${err.message}`);
+    transport.onclose = () => log("info", `[mcp] ${name}: transport closed`);
+    client = new import_client.Client({
       name: opts.clientName ?? "agent-web",
       version: opts.clientVersion ?? "0.0.0"
     });
     await client.connect(transport);
-    const listed = await client.listTools();
-    const mounts = [];
-    for (const t of listed.tools) {
-      const prefixed = `${sanitizeName(name)}__${sanitizeName(t.name)}`;
-      if (prefixed.length > MAX_TOOL_NAME_LEN) {
-        log(
-          "warn",
-          `[mcp] ${name}: tool "${t.name}" exceeds the ${MAX_TOOL_NAME_LEN}-char name limit; skipping`
-        );
-        continue;
-      }
-      const description = t.description ?? "";
-      mounts.push({
-        key: prefixed,
-        description,
-        tool: (0, import_ai.dynamicTool)({
-          description,
-          inputSchema: (0, import_ai.jsonSchema)(t.inputSchema),
-          execute: async (args, options) => {
-            const res = await client.callTool(
-              { name: t.name, arguments: args ?? {} },
-              void 0,
-              options?.abortSignal ? { signal: options.abortSignal } : void 0
-            );
-            const flat = flattenContent(res.content);
-            if (res.isError) {
-              throw new Error(typeof flat === "string" ? flat : JSON.stringify(flat));
-            }
-            return flat;
-          }
-        })
-      });
+    if (opts.onToolsChanged) {
+      const notify = opts.onToolsChanged;
+      client.setNotificationHandler(import_types.ToolListChangedNotificationSchema, () => notify(name));
     }
-    return { name, client, mounts };
+    const listed = (await client.listTools()).tools;
+    return { name, client, listed };
   } catch (err) {
+    if (client) await client.close().catch(() => {
+    });
+    const needsAuthorization = err instanceof import_auth2.UnauthorizedError;
     const message = err instanceof Error ? err.message : String(err);
-    log("error", `[mcp] ${name}: failed to connect - ${message}`);
-    return { name, mounts: [], error: message };
+    log(
+      "error",
+      needsAuthorization ? `[mcp] ${name}: authorization required - send the user to the provider's authorizationUrl` : `[mcp] ${name}: failed to connect - ${message}`
+    );
+    return { name, error: message, needsAuthorization };
   }
 };
 var connectMcpHttp = async (servers, opts = {}) => {
@@ -99,32 +506,85 @@ var connectMcpHttp = async (servers, opts = {}) => {
   const tools = {};
   const catalog = [];
   const results = [];
-  const settled = await Promise.all(
-    Object.entries(servers).map(([name, cfg]) => connectOne(name, cfg, opts, log))
-  );
-  for (const server of settled) {
-    if (server.error !== void 0) {
-      results.push({ name: server.name, connected: false, error: server.error });
-      continue;
+  const mountedKeys = /* @__PURE__ */ new Map();
+  const mountTools = (name, client, listed) => {
+    const prefix = `${sanitizeName(name)}__`;
+    for (const k of mountedKeys.get(name) ?? []) {
+      delete tools[k];
+    }
+    for (let i = catalog.length - 1; i >= 0; i--) {
+      if (catalog[i].server === name) catalog.splice(i, 1);
     }
-    if (server.client) clients.set(server.name, server.client);
+    const keys = [];
     let mounted = 0;
-    for (const m of server.mounts) {
-      if (tools[m.key]) {
-        log("warn", `[mcp] ${server.name}: duplicate tool name "${m.key}"; keeping the first`);
+    for (const t of listed) {
+      const prefixed = prefix + sanitizeName(t.name);
+      if (prefixed.length > MAX_TOOL_NAME_LEN) {
+        log(
+          "warn",
+          `[mcp] ${name}: tool "${t.name}" exceeds the ${MAX_TOOL_NAME_LEN}-char name limit; skipping`
+        );
+        continue;
+      }
+      const key = uniqueKey(prefixed, tools);
+      if (!key) {
+        log("warn", `[mcp] ${name}: cannot find a free name for tool "${t.name}"; skipping`);
         continue;
       }
-      tools[m.key] = m.tool;
-      catalog.push({ name: m.key, description: m.description, server: server.name });
+      if (key !== prefixed) {
+        log("warn", `[mcp] ${name}: tool name "${prefixed}" already taken; mounted as "${key}"`);
+      }
+      const description = t.description ?? "";
+      tools[key] = (0, import_ai.dynamicTool)({
+        description,
+        inputSchema: (0, import_ai.jsonSchema)(t.inputSchema),
+        execute: async (args, options) => {
+          const res = await client.callTool(
+            { name: t.name, arguments: args ?? {} },
+            void 0,
+            options?.abortSignal ? { signal: options.abortSignal } : void 0
+          );
+          const flat = flattenContent(res.content);
+          if (res.isError) {
+            throw new Error(typeof flat === "string" ? flat : JSON.stringify(flat));
+          }
+          return flat;
+        }
+      });
+      catalog.push({ name: key, description, server: name });
+      keys.push(key);
       mounted += 1;
     }
-    log("info", `[mcp] ${server.name}: ${mounted} tools mounted`);
+    mountedKeys.set(name, keys);
+    log("info", `[mcp] ${name}: ${mounted} tools mounted`);
+  };
+  const connects = await Promise.all(
+    Object.entries(servers).map(([name, cfg]) => openConnection(name, cfg, opts, log))
+  );
+  for (const server of connects) {
+    if (!server.client || !server.listed) {
+      results.push({
+        name: server.name,
+        connected: false,
+        error: server.error,
+        ...server.needsAuthorization ? { needsAuthorization: true } : {}
+      });
+      continue;
+    }
+    clients.set(server.name, server.client);
+    mountTools(server.name, server.client, server.listed);
     results.push({ name: server.name, connected: true });
   }
   return {
     tools,
     catalog,
     results,
+    refreshServer: async (name) => {
+      const client = clients.get(name);
+      if (!client) throw new Error(`MCP server "${name}" is not connected`);
+      const listed = (await client.listTools()).tools;
+      mountTools(name, client, listed);
+    },
     close: async () => {
       await Promise.allSettled([...clients.values()].map((c) => c.close()));
     }
@@ -132,7 +592,13 @@ var connectMcpHttp = async (servers, opts = {}) => {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BrowserOAuthProvider,
+  MemoryOAuthStorage,
+  VaultOAuthStorage,
+  beginMcpOAuth,
   connectMcpHttp,
-  flattenContent
+  finishMcpOAuth,
+  flattenContent,
+  readOAuthCallback
 });
 //# sourceMappingURL=mcp.cjs.map