@synap-core/sdk 1.2.0 → 1.4.0

package/README.md

@@ -119,6 +119,160 @@ SDK refuses out-of-bounds `offset`/`limit`/`sort` locally, without a request),
 pass `ifNoneMatch` from a browser: the doors allow no cross-origin request header
 but `Content-Type`, so the preflight fails (browsers revalidate on their own).
 
+## Pod-app sign-in (server-only): `@synap-core/sdk/connect` (1.3.0, 1.4.0)
+
+An app that reads and writes a person's OWN pod connects as an OAuth 2.1 public
+client of that pod: its `client_id` is the https URL of its client metadata
+document (CIMD), PKCE S256, every answer checked for the pod's `iss`. The pod
+token stays on the app's server, sealed (AES-GCM) in an HttpOnly cookie; the
+browser never sees it. Framework-free and Web-standard (`Request` → `Response`,
+WebCrypto): Next route handlers and `proxy.ts`, Hono, Remix, edge runtimes.
+**Server-only**: it throws when loaded in a browser, and a browser bundle
+resolves it to a stub that throws.
+
+```typescript
+// lib/synap/pod-app/auth.ts (server-only)
+import { createPodAppAuth } from "@synap-core/sdk/connect";
+
+export const synap = createPodAppAuth({
+  appUrl: process.env.SITE_URL!, // https://studio.example.com
+  clientName: "Studio",
+  requests: [
+    { permission: "entity.post.read", reason: "Show your posts" },
+    { permission: "entity.post.create", reason: "Save drafts to your pod" },
+  ],
+  secret: process.env.SYNAP_APP_SESSION_SECRET!, // ≥ 32 chars, never NEXT_PUBLIC_
+  cloudUrl: process.env.SYNAP_CLOUD_URL, // optional (1.4): https://api.synap.live offers "Continue with Synap Cloud"
+});
+
+// app/.well-known/synap-client.json/route.ts  export const GET = synap.handlers.clientMetadata;
+// app/api/synap/connect/route.ts               export const POST = synap.handlers.connect;    // form { pod, next?, space?, prompt? }
+// app/api/synap/callback/route.ts              export const GET = synap.handlers.callback;
+// app/api/synap/disconnect/route.ts            export const POST = synap.handlers.disconnect; // form { next? }
+// app/api/synap/cloud/route.ts (1.4)           export const POST = synap.handlers.cloudConnect; // form { next?, space?, prompt? }
+//                                              export const GET = synap.handlers.cloudReturn;
+```
+
+```typescript
+// proxy.ts: refresh before render (server components cannot set cookies)
+const out = await synap.refreshIfNeeded(request);
+// out.status: none | skipped | fresh | refreshed | kept | expired | revoked | unavailable
+// out.lapsed (with none, 1.4): { podUrl } when this browser WAS connected and the connection lapsed
+// send out.setCookies on the response; forward out.cookieHeader (when set) as the request's Cookie
+
+// Next 16 strips its router headers before proxy code runs, so skip prefetches in the MATCHER
+// (it still sees them; matcher values must be literals):
+export const config = {
+  matcher: [{
+    source: "/((?!_next/static|_next/image|api/synap/|\\.well-known/|.*\\.\\w+$).*)",
+    missing: [{ type: "header", key: "next-router-prefetch" }, { type: "header", key: "purpose", value: "prefetch" }],
+  }],
+};
+
+// a server component / action (no Request there: pass the Cookie header)
+const connection = await synap.readConnection((await headers()).get("cookie"));
+const pod = synap.client(connection!);
+const res = await pod.post("/entities", { profileSlug: "post", title: "Hello" });
+if (res.ok && res.status === "proposed") showPending(res.reviewUrl); // success: queued for review, never retry
+if (!res.ok) res.error.code; // expired | unauthorized | forbidden | door_unsupported | rate_limited (retryAfterSec) | pod_unreachable | …
+```
+
+- **Discovery**: `discoverPod("pod.example.com")` fetches the pod's RFC 8414
+  metadata and requires `issuer` equal to the address, CIMD, `iss` on answers and
+  S256 (`not_a_pod`, `pod_unsupported`, `pod_unreachable`). A browser launch
+  (`?iss=…&target_link_uri=…`) is read with `acceptLaunch` and only pre-fills the
+  connect page.
+- **Failures** redirect with `?error=<ConnectErrorCode>`: `denied`,
+  `expired_transaction`, `mismatch`, `misconfigured`, `rate_limited`,
+  `pod_unreachable`, … (`parseConnectErrorCode` reads it back). `connect` and
+  `disconnect` are POST and same-origin only.
+- **Refresh** (rotating, single-use, 30 days from issue) is feature-detected: a
+  pod that issues no `refresh_token` gives a connection that ends with its
+  1-hour access token. `refreshIfNeeded` rotates only inside the last 5
+  minutes, is single-flight per connection in the process, and persists the
+  rotated connection BEFORE returning it. The pod revokes the whole connection
+  when a spent refresh token is presented again, so for 2 minutes a request
+  still carrying the spent token (a parallel request, a second tab) gets the
+  rotation's result instead of reaching the pod. Across server instances only
+  a shared server-side `ConnectionStore` rules that replay out. A concurrent
+  loser (refused softly by the pod) keeps the still-valid access token.
+  The pod's reuse grace (PB3b) answers a spent token presented again within
+  30 s with the same pair the first use got; its `expires_in` may be under an
+  hour, and the SDK reads it as sent.
+- **Your own store**: implement `ConnectionStore` (`read`, `write`, `clear`,
+  returning Set-Cookie values) and pass it as `store`.
+- Lower level: `startConnect`, `handleCallback`, `refreshConnection`,
+  `revokeConnection`, `buildClientMetadata`, `seal`/`unseal`,
+  `startCloudConnect`, `acceptCloudReturn`.
+
+### 1.4.0 (additive)
+
+- **Re-consent**: the connect form's `prompt=consent` (or `startConnect({ prompt: "consent" })`)
+  goes to the pod's consent screen even when this browser is already connected to
+  that pod (to widen or narrow access). It is a normal sign-in: fresh PKCE verifier
+  and state, `iss` checked; a denied or forged answer leaves the live connection as it is.
+- **Synap Cloud** (wave C1): with `cloudUrl` set, `synap.cloudConnectAvailable` is
+  true and `cloudConnectAvailable({ cloudUrl })` too. POST `handlers.cloudConnect`
+  sends the browser to `<cp>/connect/pod?client_id=<client id>&state=<nonce>`, the
+  state sealed in an HttpOnly cookie of that browser (10 minutes). The CP returns to
+  the CIMD `initiate_login_uri?iss=<pod>&state=<nonce>` (your connect page):
+  `acceptLaunch(url).cloudState` is set, so forward the request's query to GET
+  `handlers.cloudReturn`, which checks the state against the cookie (constant time,
+  single use) BEFORE the pod is used, then runs the same sign-in as a typed address.
+  `acceptLaunch` itself never verifies anything; a return without a matching state
+  starts no sign-in (`mismatch`, `expired_transaction`). A cancel on the chooser
+  (`?state=…&error=access_denied`, no `iss`) also carries `cloudState`: forwarded the
+  same way, it lands on the connect page with `?error=denied` once the state matched.
+  Security notes: after the state matches, the named pod goes through the same
+  discovery as a typed address (metadata, `issuer` equality, CIMD, `iss`, S256)
+  before the browser is sent anywhere. The cloud cookie is single-use and cleared on
+  every outcome (success, cancel, mismatch). Accepted trade-off: a third-party page
+  that sends a visitor's browser to a forged return can cancel that visitor's Cloud
+  sign-in in progress (they click again); nothing leaks and nothing is bound, the
+  same nuisance any OAuth `state` check allows.
+
+  ```typescript
+  // app/connect/page.tsx (server component)
+  const launch = acceptLaunch(url, origin);
+  if (launch.cloudState) redirect(`${synap.paths.cloud}${new URL(url).search}`);
+  ```
+- **`connection.manageUrl` / `connection.appId`**: the pod's page for this app
+  connection (pod-admin `/apps/<appId>`), read from the token response's
+  `synap_app: { id, manageUrl }` (https only). Absent when the pod does not send it:
+  hide the link, never build one.
+- **`client.listPendingProposals({ workspaceId?, limit?, offset? })`**: "Waiting for
+  review: N" (`data.total`, plus summary rows with `reviewUrl`) from the pod's seamed
+  `GET /proposals` door. Ask for `proposal.read` in `requests`: without it the answer
+  is `forbidden` and nothing is sent (the pod would answer an empty list). It counts
+  the person's pending proposals in those spaces, from any agent.
+- **`spaces(connection)` / `client.spaces()`**: the grant by space
+  (`{ workspaceId, workspaceName, permissions }`), each permission once.
+- **Expired vs never connected**: each sign-in and refresh also sets a marker cookie
+  (`__Host-synap_seen`, 400 days) holding the pod's URL and nothing else.
+  `synap.readLapsed(cookieHeader)` and `RefreshOutcome.lapsed` say "this browser was
+  connected to <pod>" once the sealed session is gone; a disconnect clears it.
+- **`isPrefetchOrAsset(request)`** is exported, and its limit documented: inside
+  Next 16's proxy a router prefetch is invisible (see the matcher above).
+- Not added: `ensureTemplate` on the pod-app client. A pod-app key's grant is pinned
+  to the approved spaces, so creating a space is refused by the pod's grant check
+  every time; ask for templates with `templates` (CIMD `synap_templates`) instead:
+  the pod's consent offers to create the space.
+
+Test without a pod: `createMockAuthServer()` from `@synap-core/sdk/testing`
+(metadata, `authorize()` as the consent screen, `/token` with PKCE, rotating
+refresh with the 30 s reuse grace, `/revoke`, Hub REST doors: `GET /entities`
+answers an array as the pod does, `GET /proposals` lists what proposed writes
+filed; `synap_app` is `MOCK_APP` unless `app: null`; `writeMode`, `failures`, `refresh: false`, `entities`,
+`refreshGraceSec`), and `createMockCloud()` for the Synap Cloud pod chooser:
+
+```typescript
+const pod = createMockAuthServer();
+const cloud = createMockCloud();
+const synap = createPodAppAuth({ ...config, fetch: pod.fetch, cloudUrl: cloud.url });
+// POST connect → Location → pod.authorize(location) → GET callback with that URL
+// POST cloud → Location → cloud.choose(location, { pod: pod.issuer, metadata: synap.metadata }) → forward to GET cloud
+```
+
 ## Mock pod: `@synap-core/sdk/testing`
 
 A fake `fetch` that answers the public doors (forms, shares, sites) from fixtures,

package/dist/chunk-J7XHAAFJ.js

@@ -0,0 +1,79 @@
+// src/connect/encoding.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function utf8(text) {
+  return encoder.encode(text);
+}
+function fromUtf8(bytes) {
+  return decoder.decode(bytes);
+}
+function base64url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64url(text) {
+  if (!/^[A-Za-z0-9_-]*$/.test(text)) return null;
+  const padded = text.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((text.length + 3) % 4);
+  let binary;
+  try {
+    binary = atob(padded);
+  } catch {
+    return null;
+  }
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function randomBytes(length) {
+  const out = new Uint8Array(length);
+  crypto.getRandomValues(out);
+  return out;
+}
+function randomToken() {
+  return base64url(randomBytes(32));
+}
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", utf8(verifier));
+  return base64url(new Uint8Array(digest));
+}
+function constantTimeEqual(a, b) {
+  const x = utf8(a);
+  const y = utf8(b);
+  let diff = x.length ^ y.length;
+  for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);
+  return diff === 0;
+}
+function parseCookies(header) {
+  const out = /* @__PURE__ */ new Map();
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const name = part.slice(0, eq).trim();
+    if (!name || out.has(name)) continue;
+    let value = part.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1);
+    out.set(name, value);
+  }
+  return out;
+}
+function serializeCookie(name, value, attrs) {
+  const parts = [`${name}=${value}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${Math.max(0, Math.floor(attrs.maxAgeSec))}`];
+  if (attrs.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+
+export {
+  utf8,
+  fromUtf8,
+  base64url,
+  fromBase64url,
+  randomBytes,
+  randomToken,
+  pkceChallenge,
+  constantTimeEqual,
+  parseCookies,
+  serializeCookie
+};
+//# sourceMappingURL=chunk-J7XHAAFJ.js.map

package/dist/chunk-J7XHAAFJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connect/encoding.ts"],"sourcesContent":["/**\n * Web-standard primitives (WebCrypto, TextEncoder, btoa/atob): the same code\n * runs on Node 18+, edge runtimes and workers. No Node import.\n */\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\n/** `Uint8Array<ArrayBuffer>`: what WebCrypto's `BufferSource` takes under TS 5.7+ lib types. */\nexport type Bytes = Uint8Array<ArrayBuffer>;\n\nexport function utf8(text: string): Bytes {\n  return encoder.encode(text);\n}\n\nexport function fromUtf8(bytes: Uint8Array): string {\n  return decoder.decode(bytes);\n}\n\nexport function base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/** Null when `text` is not base64url. */\nexport function fromBase64url(text: string): Bytes | null {\n  if (!/^[A-Za-z0-9_-]*$/.test(text)) return null;\n  const padded = text.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((text.length + 3) % 4);\n  let binary: string;\n  try {\n    binary = atob(padded);\n  } catch {\n    return null;\n  }\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n  return out;\n}\n\nexport function randomBytes(length: number): Bytes {\n  const out = new Uint8Array(length);\n  crypto.getRandomValues(out);\n  return out;\n}\n\n/** 32 random bytes, base64url (43 chars): a state value or a PKCE verifier. */\nexport function randomToken(): string {\n  return base64url(randomBytes(32));\n}\n\n/** RFC 7636 §4.2: `BASE64URL(SHA256(ASCII(code_verifier)))`. */\nexport async function pkceChallenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", utf8(verifier));\n  return base64url(new Uint8Array(digest));\n}\n\n/** Compare two strings without an early exit on the first differing byte. */\nexport function constantTimeEqual(a: string, b: string): boolean {\n  const x = utf8(a);\n  const y = utf8(b);\n  let diff = x.length ^ y.length;\n  for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);\n  return diff === 0;\n}\n\n/** The request's cookies by name (the first value wins, as browsers order the most specific first). */\nexport function parseCookies(header: string | null): Map<string, string> {\n  const out = new Map<string, string>();\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq < 0) continue;\n    const name = part.slice(0, eq).trim();\n    if (!name || out.has(name)) continue;\n    let value = part.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"')) value = value.slice(1, -1);\n    out.set(name, value);\n  }\n  return out;\n}\n\nexport interface CookieAttributes {\n  maxAgeSec: number;\n  secure: boolean;\n}\n\n/** `HttpOnly; SameSite=Lax; Path=/` always; `Secure` on https. Never a `Domain`. */\nexport function serializeCookie(name: string, value: string, attrs: CookieAttributes): string {\n  const parts = [`${name}=${value}`, \"Path=/\", \"HttpOnly\", \"SameSite=Lax\", `Max-Age=${Math.max(0, Math.floor(attrs.maxAgeSec))}`];\n  if (attrs.secure) parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n"],"mappings":";AAKA,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAKzB,SAAS,KAAK,MAAqB;AACxC,SAAO,QAAQ,OAAO,IAAI;AAC5B;AAEO,SAAS,SAAS,OAA2B;AAClD,SAAO,QAAQ,OAAO,KAAK;AAC7B;AAEO,SAAS,UAAU,OAA2B;AACnD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,WAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAC7E,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAGO,SAAS,cAAc,MAA4B;AACxD,MAAI,CAAC,mBAAmB,KAAK,IAAI,EAAG,QAAO;AAC3C,QAAM,SAAS,KAAK,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAC7F,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI,WAAW,OAAO,MAAM;AACxC,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,SAAO;AACT;AAEO,SAAS,YAAY,QAAuB;AACjD,QAAM,MAAM,IAAI,WAAW,MAAM;AACjC,SAAO,gBAAgB,GAAG;AAC1B,SAAO;AACT;AAGO,SAAS,cAAsB;AACpC,SAAO,UAAU,YAAY,EAAE,CAAC;AAClC;AAGA,eAAsB,cAAc,UAAmC;AACrE,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC;AACnE,SAAO,UAAU,IAAI,WAAW,MAAM,CAAC;AACzC;AAGO,SAAS,kBAAkB,GAAW,GAAoB;AAC/D,QAAM,IAAI,KAAK,CAAC;AAChB,QAAM,IAAI,KAAK,CAAC;AAChB,MAAI,OAAO,EAAE,SAAS,EAAE;AACxB,WAAS,IAAI,GAAG,IAAI,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAK,UAAS,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK;AACtF,SAAO,SAAS;AAClB;AAGO,SAAS,aAAa,QAA4C;AACvE,QAAM,MAAM,oBAAI,IAAoB;AACpC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,EAAG;AACZ,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,QAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAG;AAC5B,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,EAAG,SAAQ,MAAM,MAAM,GAAG,EAAE;AAC3E,QAAI,IAAI,MAAM,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AAQO,SAAS,gBAAgB,MAAc,OAAe,OAAiC;AAC5F,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,UAAU,YAAY,gBAAgB,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE;AAC9H,MAAI,MAAM,OAAQ,OAAM,KAAK,QAAQ;AACrC,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/connect.browser.cjs

@@ -0,0 +1,22 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/connect/browser.ts
+var browser_exports = {};
+module.exports = __toCommonJS(browser_exports);
+throw new Error(
+  "@synap-core/sdk/connect is server-only: it holds the pod's tokens and the app secret. Import it from route handlers, proxy.ts or server code, never from a client component."
+);
+//# sourceMappingURL=connect.browser.cjs.map

package/dist/connect.browser.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connect/browser.ts"],"sourcesContent":["/**\n * What a BROWSER bundle gets for `@synap-core/sdk/connect` (the `browser`\n * export condition): no exports, and a throw on load. See ./guard.ts.\n */\nthrow new Error(\n  \"@synap-core/sdk/connect is server-only: it holds the pod's tokens and the app secret. \" +\n    \"Import it from route handlers, proxy.ts or server code, never from a client component.\",\n);\n\nexport {};\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;AAIA,MAAM,IAAI;AAAA,EACR;AAEF;","names":[]}

package/dist/connect.browser.d.cts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/connect.browser.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/connect.browser.js

@@ -0,0 +1,5 @@
+// src/connect/browser.ts
+throw new Error(
+  "@synap-core/sdk/connect is server-only: it holds the pod's tokens and the app secret. Import it from route handlers, proxy.ts or server code, never from a client component."
+);
+//# sourceMappingURL=connect.browser.js.map

package/dist/connect.browser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connect/browser.ts"],"sourcesContent":["/**\n * What a BROWSER bundle gets for `@synap-core/sdk/connect` (the `browser`\n * export condition): no exports, and a throw on load. See ./guard.ts.\n */\nthrow new Error(\n  \"@synap-core/sdk/connect is server-only: it holds the pod's tokens and the app secret. \" +\n    \"Import it from route handlers, proxy.ts or server code, never from a client component.\",\n);\n\nexport {};\n"],"mappings":";AAIA,MAAM,IAAI;AAAA,EACR;AAEF;","names":[]}