@usethrottle/auth 0.1.0

package/CLAUDE.md

@@ -0,0 +1,52 @@
+# @usethrottle/auth
+
+Buyer authentication SDK: framework-free core (`src/client.ts`, `src/account.ts`,
+`src/session.ts`, `src/storage.ts`, `src/request.ts`), a React provider + hooks
+(`src/react/`), and five prebuilt forms (`src/react/forms/`). Three entry
+points: `.` (core), `./react`, `./forms` — see `exports` in `package.json`.
+
+## Invariants an agent must not break
+
+- **The access token never goes to storage.** It lives only in `SessionState`
+  (`src/session.ts`), in memory. Only the refresh token is persisted, via the
+  `AuthStorage` adapter. Do not add a code path that writes `accessToken`
+  anywhere durable.
+- **Refresh is single-flight and cross-tab.** `client.ts`'s `refresh()` shares
+  one in-flight promise per client instance so N concurrent 401s produce one
+  `/auth/refresh` call, and `withLock()` additionally serialises refreshes
+  across browser tabs via the Web Locks API (falls back to no-op where
+  unsupported). The refresh token **rotates on every use**, and the server
+  revokes the whole session family on replay of a spent one — changing this
+  logic without preserving single-flight risks logging every buyer out the
+  next time two requests race.
+- **`useSavedCards` is named that way on purpose**, not `usePaymentMethods`.
+  `@usethrottle/payment-methods` exports a hook with that name, and merchants
+  commonly import both packages in one file. `src/exports.test.ts` asserts
+  `usePaymentMethods` is absent from this package's `./react` entry — do not
+  add it back, and do not rename `useSavedCards` without checking that test.
+- **The server API lives in `packages/platform-storefront`.** This package is
+  a client for `/v1/storefront/*` and must never outrun it — do not add a
+  method here for a route that package doesn't implement yet, and do not
+  change a request/response shape here without confirming the server already
+  matches it. Docs for the wire contract:
+  `apps/web/src/pages/docs/developers/storefront-auth/index.astro`.
+- **The claim cutoff is a server behavior, not a client one.** This package
+  does not filter anything client-side for it — an unverified buyer simply
+  gets empty lists and 403s back from the server. Do not "fix" apparently
+  empty `useOrders`/`useAddresses` results by adding client-side workarounds;
+  see the README's "Email verification and the claim cutoff" section.
+
+## Conventions
+
+- Every exported function's public surface is asserted in `src/exports.test.ts`
+  — a passing build with a broken barrel is the failure mode that test exists
+  to catch. Update it when you intentionally add/remove/rename a public export.
+- React stays a peer dependency (`peerDependenciesMeta.react.optional: true`).
+  Do not add a runtime `import` of `react` to any file reachable from the `.`
+  (core) entry point.
+- Test with `pnpm --filter @usethrottle/auth test`, not `pnpm vitest run
+  packages/auth-sdk/...` from the repo root — the latter resolves the root
+  vitest config, which lacks the jsdom environment this package's React tests
+  need. Tests are colocated (`src/*.test.ts(x)`); `vitest.config.ts`'s
+  `include` is scoped to `src/**` on purpose — a new test file outside `src/`
+  will not run.

package/README.md

@@ -0,0 +1,230 @@
+# @usethrottle/auth
+
+Buyer authentication for Throttle storefronts — a framework-free core, React
+hooks, and five drop-in forms. Wraps the `/v1/storefront/*` buyer-auth API
+(silent refresh, single-flight and cross-tab safe, retry-once-on-401) so a
+storefront never hand-rolls that logic.
+
+This is a different plane from your merchant `sk_*`/`pk_*` API key. See the
+[Storefront Customer Auth docs](https://usethrottle.dev/docs/developers/storefront-auth)
+for the full HTTP contract this package wraps.
+
+## Install
+
+```bash
+npm install @usethrottle/auth
+```
+
+React is a **peer dependency** and optional: the core client
+(`createThrottleAuth`, `createAccount`) works with no React installed at all.
+Only importing from `@usethrottle/auth/react` or `@usethrottle/auth/forms`
+requires `react` + `react-dom` (`>=18`) to be present.
+
+## Prerequisites
+
+Before any of this works, in the Throttle dashboard:
+
+1. Turn on customer accounts for the application (`auth.enabled: true`), per
+   environment.
+2. Add the storefront's origin to the application's allowed-origins list (the
+   same list `PUT /api/v1/embed-config` manages).
+3. Use a **publishable** (`pk_`) key — this package only ever talks to the
+   buyer plane, never the merchant one.
+
+The two failures merchants hit first:
+
+| Error | Cause |
+| ----- | ----- |
+| `404 auth_not_enabled` | Customer accounts are off for this application/environment. |
+| `403 origin_not_allowed` | The storefront's `Origin` is not on the allow-list (a production environment with an empty list denies everything; sandbox allows everything). |
+
+## React quick start
+
+```tsx
+import { ThrottleAuthProvider, useAuth } from '@usethrottle/auth/react';
+import { SignInForm } from '@usethrottle/auth/forms';
+
+function App() {
+  return (
+    <ThrottleAuthProvider publishableKey="pk_...">
+      <Account />
+    </ThrottleAuthProvider>
+  );
+}
+
+function Account() {
+  const { isAuthenticated, isLoading, customer } = useAuth();
+  if (isLoading) return null;
+  if (!isAuthenticated) return <SignInForm />;
+  return <p>Signed in as {customer!.email}</p>;
+}
+```
+
+`<ThrottleAuthProvider>` goes once, near the root — it owns the auth client
+and calls `restore()` on mount to pick up an existing session from storage.
+
+## Headless quick start
+
+No React required:
+
+```ts
+import { createThrottleAuth, createAccount } from '@usethrottle/auth';
+
+const auth = createThrottleAuth({ publishableKey: 'pk_...' });
+const account = createAccount(auth);
+
+await auth.signIn('buyer@example.com', 'hunter2000');
+const profile = await account.getProfile();
+```
+
+`auth.subscribe(fn)` + `auth.getSnapshot()` give you the same state a
+framework adapter would use to re-render.
+
+## Account pages
+
+Six hooks, each a `{ data, isLoading, error, refetch }` resource plus the
+mutations that resource supports:
+
+```tsx
+import { useCustomer, useAddresses, useSavedCards, useOrders, useInvoices, useSubscriptions } from '@usethrottle/auth/react';
+
+function Orders() {
+  const { data: orders, isLoading, error } = useOrders();
+  if (isLoading) return <p>Loading…</p>;
+  if (error) return <p>{error.message}</p>;
+  return <ul>{orders.map((o) => <li key={o.id}>{o.orderNumber}</li>)}</ul>;
+}
+```
+
+- `useCustomer()` — `update(patch)` calls `PATCH /me`.
+- `useAddresses()` — `create`, `update`, `remove`.
+- `useSavedCards()` — `setDefault`, `remove`. **Not** `usePaymentMethods`:
+  that name belongs to `@usethrottle/payment-methods`, which merchants often
+  import alongside this package in the same file.
+- `useOrders(page?)`, `useInvoices(page?)` — read-only, cursor-paginated
+  (`{ cursor, limit }`).
+- `useSubscriptions(page?)` — `cancel(id, { atPeriodEnd })`, `pause(id)`,
+  `resume(id)`.
+
+## Email verification and the claim cutoff
+
+**This is the single most surprising thing about this API — read it before
+you file a bug.**
+
+Registration issues a session immediately; a buyer never waits on an email
+round trip to browse or check out. But until they click the verification
+link, `emailVerified` is `false` on the session, and that has real
+consequences:
+
+- `PATCH /me` (`account.updateProfile` / `useCustomer().update`) returns
+  `403 verification_required`.
+- Saved payment methods are refused outright (`useSavedCards`), not just
+  filtered.
+- If the buyer's email already had **guest** orders, addresses, or a
+  subscription on this application, that pre-existing history stays hidden —
+  `useOrders`, `useInvoices`, `useSubscriptions`, and `useAddresses` all
+  return **empty** for anything created before registration — until
+  verification clears the cutoff.
+
+None of this is a bug. It looks exactly like one (an account with real order
+history rendering as empty), so show a persistent banner rather than treating
+it as broken:
+
+```tsx
+import { useAuth } from '@usethrottle/auth/react';
+import { VerifyEmailPanel } from '@usethrottle/auth/forms';
+
+function AccountShell({ children }: { children: React.ReactNode }) {
+  const { isAuthenticated, emailVerified } = useAuth();
+  return (
+    <>
+      {isAuthenticated && !emailVerified && <VerifyEmailPanel />}
+      {children}
+    </>
+  );
+}
+```
+
+`<VerifyEmailPanel token={token} />` (token from the emailed link's query
+string) verifies on mount; call it with no `token` prop to render a
+"resend verification email" prompt instead.
+
+## Step-up
+
+A handful of destructive actions require the buyer to re-prove their current
+password: changing the password itself, removing a saved card, and
+cancelling/pausing/resuming a subscription. `ThrottleAuth` handles this for
+you — on a `403 step_up_required`, it calls `onStepUpRequired()`, expects the
+buyer's password back (or `null` to cancel), and retries the call once:
+
+```tsx
+<ThrottleAuthProvider
+  publishableKey={pk}
+  onStepUpRequired={async () => window.prompt('Confirm your password to continue')}
+>
+```
+
+Prefer a real password dialog over `window.prompt` in production — this is
+the minimum that satisfies the contract.
+
+## Errors
+
+Every rejected call throws a `ThrottleAuthError`:
+
+```ts
+class ThrottleAuthError extends Error {
+  code: string;
+  statusCode: number;
+  retryAfter?: number;
+  details?: unknown;
+}
+```
+
+`messageForError(err)` (from `@usethrottle/auth/forms`) maps every code to
+buyer-safe copy — use it instead of showing `err.message` directly, since two
+codes (`invalid_credentials`, and anything unrecognized) are deliberately
+vague by design.
+
+| Code | Meaning |
+| ---- | ------- |
+| `auth_not_enabled` | Customer accounts are off for this application/environment. |
+| `origin_not_allowed` | Storefront origin isn't on the allow-list. |
+| `invalid_api_key` | The publishable key is invalid, revoked, or expired. |
+| `invalid_credentials` | Sign-in or step-up failed — any cause, deliberately vague. |
+| `weak_password` | Fails the password policy; `message` carries the specific reason. |
+| `too_many_attempts` | Rate limited; `retryAfter` (seconds) is set when the server sent one. |
+| `verification_required` | The route needs a verified session (see claim cutoff above). |
+| `step_up_required` | The route needs a fresh step-up proof. |
+| `session_revoked` | The session was revoked, or its epoch is stale. |
+| `token_expired` / `token_invalid` / `token_already_used` | An email-verification or reset link is dead. |
+| `environment_mismatch` | Session and API key belong to different environments (sandbox vs. production). |
+| `auth_unavailable` | Credential routes (login/register/etc.) fail closed when the rate limiter is unreachable. |
+| `cart_already_claimed` | `claimCart` targeted a cart already bound to a different customer. |
+| `not_found` | The address/card/session/order/invoice/subscription id doesn't belong to this buyer. |
+
+## Security notes
+
+- The **access token lives in memory only** — this package never writes it to
+  storage, and there is no way to configure it to.
+- The **refresh token** is the only thing persisted, through the storage
+  adapter you provide (`localStorageAdapter()` by default).
+- Pass `storage: memoryStorage()` to `createThrottleAuth` /
+  `<ThrottleAuthProvider>` to opt out of persistence entirely — the buyer is
+  signed out on every page reload, useful for kiosk/shared-device contexts.
+- Refresh is single-flight (concurrent 401s share one refresh call) and
+  cross-tab safe via the Web Locks API where available. Do not build your own
+  refresh loop around the same publishable key; use `auth.call()` /
+  `account.*` / the hooks, all of which already go through it.
+
+## What this package does NOT do
+
+- **It does not add a saved card.** There is no buyer-plane "add payment
+  method" route — cards are added through
+  [`@usethrottle/payment-methods`](https://usethrottle.dev/docs/developers/payment-methods),
+  which needs a merchant-minted client token. `useSavedCards()` here only
+  lists, sets a default, and removes an already-saved card.
+- It does not let a buyer change which card a subscription renews on directly
+  — that's done by setting a different card as the account default
+  (`useSavedCards().setDefault(id)`).
+- It does not change a buyer's email address (`PATCH /me` covers name, phone,
+  company, marketing consent — not email).

package/dist/chunk-NQU7HM23.js

@@ -0,0 +1,378 @@
+// src/errors.ts
+var ThrottleAuthError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  constructor(args) {
+    super(args.message);
+    this.name = "ThrottleAuthError";
+    this.code = args.code;
+    this.statusCode = args.statusCode;
+    this.retryAfter = args.retryAfter;
+    this.details = args.details;
+  }
+};
+
+// src/storage.ts
+function memoryStorage() {
+  const map = /* @__PURE__ */ new Map();
+  return {
+    get: (k) => map.get(k) ?? null,
+    set: (k, v) => void map.set(k, v),
+    remove: (k) => void map.delete(k)
+  };
+}
+function localStorageAdapter() {
+  const fallback = memoryStorage();
+  const ls = () => {
+    try {
+      return typeof localStorage !== "undefined" ? localStorage : null;
+    } catch {
+      return null;
+    }
+  };
+  return {
+    get(k) {
+      try {
+        const v = ls()?.getItem(k);
+        if (v != null) return v;
+      } catch {
+      }
+      return fallback.get(k);
+    },
+    set(k, v) {
+      fallback.set(k, v);
+      try {
+        ls()?.setItem(k, v);
+      } catch {
+      }
+    },
+    remove(k) {
+      fallback.remove(k);
+      try {
+        ls()?.removeItem(k);
+      } catch {
+      }
+    }
+  };
+}
+
+// src/request.ts
+async function request(input) {
+  const headers = { "X-API-Key": input.publishableKey };
+  if (input.body !== void 0) headers["Content-Type"] = "application/json";
+  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;
+  if (input.stepUpToken) headers["X-Step-Up"] = input.stepUpToken;
+  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {
+    method: input.method,
+    headers,
+    ...input.body !== void 0 ? { body: JSON.stringify(input.body) } : {}
+  });
+  const text = await res.text();
+  let parsed = {};
+  try {
+    parsed = text ? JSON.parse(text) : {};
+  } catch {
+  }
+  if (!res.ok) {
+    const e = parsed?.error ?? {};
+    const ra = Number(res.headers.get("retry-after"));
+    throw new ThrottleAuthError({
+      code: e.code ?? "request_failed",
+      message: e.message ?? `Request failed with ${res.status}`,
+      statusCode: res.status,
+      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : void 0,
+      details: e.details
+    });
+  }
+  return parsed && typeof parsed === "object" && "data" in parsed ? parsed.data : parsed ?? {};
+}
+
+// src/session.ts
+var SessionState = class {
+  #snapshot = { status: "loading", customer: null, emailVerified: false };
+  #accessToken = null;
+  #expiresAt = null;
+  #listeners = /* @__PURE__ */ new Set();
+  get() {
+    return this.#snapshot;
+  }
+  accessToken() {
+    return this.#accessToken;
+  }
+  expiresAt() {
+    return this.#expiresAt;
+  }
+  setSession(session) {
+    this.#accessToken = session.accessToken;
+    this.#expiresAt = Date.parse(session.expiresAt);
+    this.#publish({
+      status: "authenticated",
+      customer: session.customer,
+      emailVerified: Boolean(session.customer?.emailVerified)
+    });
+  }
+  setStatus(status) {
+    this.#publish({ ...this.#snapshot, status });
+  }
+  clear() {
+    this.#accessToken = null;
+    this.#expiresAt = null;
+    this.#publish({ status: "unauthenticated", customer: null, emailVerified: false });
+  }
+  subscribe(fn) {
+    this.#listeners.add(fn);
+    return () => {
+      this.#listeners.delete(fn);
+    };
+  }
+  #publish(next) {
+    const same = next.status === this.#snapshot.status && next.emailVerified === this.#snapshot.emailVerified && customerEquals(next.customer, this.#snapshot.customer);
+    if (same) return;
+    this.#snapshot = next;
+    for (const fn of [...this.#listeners]) {
+      try {
+        fn(next);
+      } catch {
+      }
+    }
+  }
+};
+function customerEquals(a, b) {
+  if (a === b) return true;
+  if (!a || !b) return false;
+  const keys = /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)]);
+  for (const k of keys) if (a[k] !== b[k]) return false;
+  return true;
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.usethrottle.dev";
+var REFRESH_SKEW_MS = 3e4;
+function createThrottleAuth(config) {
+  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+  const storage = config.storage ?? localStorageAdapter();
+  const storageKey = `throttle_auth_rt:${config.publishableKey}`;
+  const lockName = `throttle_auth_refresh:${config.publishableKey}`;
+  const state = new SessionState();
+  let refreshInFlight = null;
+  let stepUpToken = null;
+  let stepUpExpiresAt = 0;
+  const base = { baseUrl, publishableKey: config.publishableKey };
+  async function persist(session) {
+    state.setSession(session);
+    await storage.set(storageKey, session.refreshToken);
+  }
+  async function forget() {
+    stepUpToken = null;
+    state.clear();
+    await storage.remove(storageKey);
+  }
+  function withLock(fn) {
+    const locks = globalThis.navigator?.locks;
+    return locks?.request ? locks.request(lockName, fn) : fn();
+  }
+  async function doRefresh() {
+    await withLock(async () => {
+      const refreshToken = await storage.get(storageKey);
+      if (!refreshToken) {
+        await forget();
+        throw new ThrottleAuthError({ code: "session_revoked", message: "No session", statusCode: 401 });
+      }
+      try {
+        const data = await request({ ...base, method: "POST", path: "/auth/refresh", body: { refreshToken } });
+        await persist(data);
+      } catch (err) {
+        await forget();
+        throw err;
+      }
+    });
+  }
+  function refresh() {
+    if (!refreshInFlight) {
+      refreshInFlight = doRefresh().finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return refreshInFlight;
+  }
+  async function accessToken() {
+    const expires = state.expiresAt();
+    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {
+      return state.accessToken();
+    }
+    if (await storage.get(storageKey)) {
+      await refresh();
+      return state.accessToken();
+    }
+    return state.accessToken();
+  }
+  async function ensureStepUp() {
+    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;
+    if (!config.onStepUpRequired) return false;
+    const password = await config.onStepUpRequired();
+    if (!password) return false;
+    await stepUp(password);
+    return true;
+  }
+  async function stepUp(password) {
+    const data = await request({
+      ...base,
+      method: "POST",
+      path: "/auth/step-up",
+      accessToken: await accessToken() ?? void 0,
+      body: { password }
+    });
+    stepUpToken = data.stepUpToken;
+    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1e3 - 5e3;
+  }
+  async function call(method, path, body) {
+    let retriedAuth = false;
+    let retriedStepUp = false;
+    for (; ; ) {
+      const token = await accessToken();
+      try {
+        return await request({
+          ...base,
+          method,
+          path,
+          body,
+          accessToken: token ?? void 0,
+          stepUpToken: stepUpToken ?? void 0
+        });
+      } catch (err) {
+        const e = err;
+        const expired = e.statusCode === 401 && (e.code === "unauthorized" || e.code === "token_expired" || e.code === "session_revoked");
+        if (expired && !retriedAuth) {
+          retriedAuth = true;
+          await refresh();
+          continue;
+        }
+        if (e.code === "step_up_required" && !retriedStepUp) {
+          retriedStepUp = true;
+          stepUpToken = null;
+          if (await ensureStepUp()) continue;
+        }
+        throw err;
+      }
+    }
+  }
+  return {
+    async register(email, password) {
+      const data = await request({ ...base, method: "POST", path: "/auth/register", body: { email, password } });
+      if (data?.status === "pending") return { status: "pending" };
+      await persist(data);
+      return { status: "active" };
+    },
+    async signIn(email, password) {
+      const data = await request({ ...base, method: "POST", path: "/auth/login", body: { email, password } });
+      await persist(data);
+    },
+    async signOut() {
+      try {
+        await call("POST", "/auth/logout");
+      } catch {
+      }
+      await forget();
+    },
+    async signOutEverywhere() {
+      try {
+        await call("POST", "/auth/logout-all");
+      } catch {
+      }
+      await forget();
+    },
+    async restore() {
+      if (!await storage.get(storageKey)) {
+        state.setStatus("unauthenticated");
+        return;
+      }
+      try {
+        await refresh();
+      } catch {
+      }
+    },
+    getSnapshot: () => state.get(),
+    subscribe: (fn) => state.subscribe(fn),
+    stepUp,
+    call,
+    async verifyEmail(token) {
+      await request({ ...base, method: "POST", path: "/auth/verify-email", body: { token } });
+      if (await storage.get(storageKey)) {
+        try {
+          await refresh();
+        } catch {
+        }
+      }
+    },
+    async resendVerification() {
+      await call("POST", "/auth/verify-email/resend");
+    },
+    async forgotPassword(email) {
+      await request({ ...base, method: "POST", path: "/auth/forgot-password", body: { email } });
+    },
+    async resetPassword(token, password) {
+      await request({ ...base, method: "POST", path: "/auth/reset-password", body: { token, password } });
+      await forget();
+    },
+    async changePassword(password) {
+      await call("POST", "/me/change-password", { password });
+      await refresh();
+    },
+    async listSessions() {
+      return call("GET", "/me/sessions");
+    },
+    async revokeSession(id) {
+      const mine = await call("GET", "/me/sessions");
+      const current = mine.find((s) => s.current);
+      await call("DELETE", `/me/sessions/${encodeURIComponent(id)}`);
+      if (current?.id === id) await forget();
+    }
+  };
+}
+
+// src/account.ts
+var seg = (v) => encodeURIComponent(v);
+function query(page) {
+  const params = new URLSearchParams();
+  if (page?.cursor) params.set("cursor", page.cursor);
+  if (page?.limit != null) params.set("limit", String(page.limit));
+  const s = params.toString();
+  return s ? `?${s}` : "";
+}
+function createAccount(auth) {
+  const { call } = auth;
+  return {
+    getProfile: () => call("GET", "/me"),
+    updateProfile: (patch) => call("PATCH", "/me", patch),
+    listAddresses: () => call("GET", "/me/addresses"),
+    createAddress: (input) => call("POST", "/me/addresses", input),
+    updateAddress: (id, patch) => call("PATCH", `/me/addresses/${seg(id)}`, patch),
+    deleteAddress: (id) => call("DELETE", `/me/addresses/${seg(id)}`),
+    listPaymentMethods: () => call("GET", "/me/payment-methods"),
+    // The platform has no "change this subscription's card" capability, so
+    // this is how a buyer changes what they are billed on: move the default.
+    setDefaultPaymentMethod: (id) => call("PATCH", `/me/payment-methods/${seg(id)}`, { isDefault: true }),
+    deletePaymentMethod: (id) => call("DELETE", `/me/payment-methods/${seg(id)}`),
+    listOrders: (page) => call("GET", `/me/orders${query(page)}`),
+    getOrder: (id) => call("GET", `/me/orders/${seg(id)}`),
+    listInvoices: (page) => call("GET", `/me/invoices${query(page)}`),
+    getInvoice: (id) => call("GET", `/me/invoices/${seg(id)}`),
+    listSubscriptions: (page) => call("GET", `/me/subscriptions${query(page)}`),
+    getSubscription: (id) => call("GET", `/me/subscriptions/${seg(id)}`),
+    cancelSubscription: (id, opts) => call("POST", `/me/subscriptions/${seg(id)}/cancel`, opts),
+    pauseSubscription: (id) => call("POST", `/me/subscriptions/${seg(id)}/pause`),
+    resumeSubscription: (id) => call("POST", `/me/subscriptions/${seg(id)}/resume`),
+    claimCart: (cartId) => call("POST", `/me/carts/${seg(cartId)}/claim`)
+  };
+}
+
+export {
+  ThrottleAuthError,
+  memoryStorage,
+  localStorageAdapter,
+  createThrottleAuth,
+  createAccount
+};
+//# sourceMappingURL=chunk-NQU7HM23.js.map