@vericto/sdk 0.0.0-stage → 0.2.0

package/dist/chunk-HFL7W4WC.cjs

@@ -0,0 +1,600 @@
+'use strict';
+
+// src/dialects.ts
+var KNOWN_DIALECTS = ["postgres", "mysql", "oracle", "mssql", "snowflake", "sqlite"];
+var ALIASES = {
+  postgres: "postgres",
+  postgresql: "postgres",
+  pg: "postgres",
+  mysql: "mysql",
+  mysql2: "mysql",
+  mariadb: "mysql",
+  oracle: "oracle",
+  oracledb: "oracle",
+  mssql: "mssql",
+  sqlserver: "mssql",
+  tedious: "mssql",
+  snowflake: "snowflake",
+  sqlite: "sqlite",
+  sqlite3: "sqlite",
+  "better-sqlite3": "sqlite"
+};
+function normalizeDialect(name) {
+  const key = name.trim().toLowerCase();
+  return ALIASES[key] ?? key;
+}
+
+// src/errors.ts
+var VerictoError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var VerictoConfigError = class extends VerictoError {
+  status;
+  code;
+  constructor(message, options = {}) {
+    super(message);
+    this.status = options.status;
+    this.code = options.code;
+  }
+};
+var VerictoUnsupportedDialectError = class extends VerictoConfigError {
+  dialect;
+  supported;
+  constructor(dialect, supported, apiUrl) {
+    const listed = supported.length ? supported.join(", ") : "none reported";
+    super(
+      `The Vericto API at ${apiUrl} does not support the '${dialect}' dialect (supported: ${listed}). No SQL was executed. Upgrade the server, or use a supported dialect.`,
+      { code: "UNSUPPORTED_DIALECT" }
+    );
+    this.dialect = dialect;
+    this.supported = supported;
+  }
+};
+var VerictoUnavailableError = class extends VerictoError {
+  status;
+  code;
+  constructor(message, options = {}) {
+    super(message);
+    this.status = options.status;
+    this.code = options.code;
+  }
+};
+var VerictoQuotaExceededError = class extends VerictoUnavailableError {
+  resetsAt;
+  upgradeUrl;
+  constructor(message, options = {}) {
+    super(message, { status: 429, code: "QUOTA_EXCEEDED" });
+    this.resetsAt = options.resetsAt;
+    this.upgradeUrl = options.upgradeUrl;
+  }
+};
+var VerictoBlockedError = class extends VerictoError {
+  verdict;
+  sql;
+  constructor(verdict, sql) {
+    let message = `Query blocked by ${verdict.ruleCode ?? "a Vericto rule"}`;
+    if (verdict.severity) message += ` (severity ${verdict.severity})`;
+    if (verdict.message) message += `: ${verdict.message}`;
+    if (verdict.suggestedFix) message += `. Suggested fix: ${verdict.suggestedFix}`;
+    super(message);
+    this.verdict = verdict;
+    this.sql = sql;
+  }
+  get findings() {
+    return this.verdict.findings;
+  }
+  get suggestedFix() {
+    return this.verdict.suggestedFix;
+  }
+};
+
+// src/verdict.ts
+var SERVER_DECISIONS = /* @__PURE__ */ new Set(["ALLOWED", "FLAGGED", "MONITORED", "PARSE_ERROR", "BLOCKED"]);
+function sqlToExecute(verdict) {
+  return verdict.rewrittenQuery ?? verdict.sql;
+}
+function isMasked(verdict) {
+  return Boolean(verdict.rewrittenQuery);
+}
+function verdictFromResponse(body, sql, dialect) {
+  const raw = (typeof body.decision === "string" ? body.decision : "").toUpperCase();
+  const decision = SERVER_DECISIONS.has(raw) ? raw : "BLOCKED";
+  const ruleCode = optStr(body.rule_code);
+  const severity = optStr(body.severity);
+  const suggestedFix = optStr(body.suggested_safe_query);
+  let message = optStr(body.error);
+  if (message && ruleCode && message === `Query blocked by rule ${ruleCode}`) message = void 0;
+  return {
+    decision,
+    sql,
+    dialect,
+    ruleCode,
+    severity,
+    message,
+    suggestedFix,
+    // A blocked statement never runs, so it has nothing to rewrite.
+    rewrittenQuery: decision === "BLOCKED" ? void 0 : optStr(body.rewritten_query),
+    parseError: optStr(body.parse_error),
+    findings: findingsOf(body, ruleCode, severity, suggestedFix),
+    sensitiveColumns: Array.isArray(body.sensitive_columns) ? body.sensitive_columns : [],
+    accessDenied: Array.isArray(body.access_denied) ? body.access_denied : [],
+    eventId: optStr(body.event_id),
+    rulesetVersion: optStr(body.ruleset_version),
+    cached: false,
+    raw: body
+  };
+}
+function unevaluatedVerdict(sql, dialect, reason) {
+  return {
+    decision: "UNEVALUATED",
+    sql,
+    dialect,
+    message: reason,
+    findings: [],
+    sensitiveColumns: [],
+    accessDenied: [],
+    cached: false,
+    raw: {}
+  };
+}
+function optStr(value) {
+  if (value === null || value === void 0 || value === "") return void 0;
+  return typeof value === "string" ? value : JSON.stringify(value);
+}
+function findingsOf(body, ruleCode, severity, suggestedFix) {
+  const listed = body.findings ?? body.violations;
+  if (Array.isArray(listed)) {
+    const out = [];
+    for (const item of listed) {
+      if (!item || typeof item !== "object") continue;
+      const f = item;
+      const code = optStr(f.rule_code ?? f.code);
+      if (!code) continue;
+      out.push({
+        ruleCode: code,
+        severity: optStr(f.severity),
+        ruleId: optStr(f.rule_id),
+        astNodePath: optStr(f.ast_node_path),
+        suggestedFix: optStr(f.suggested_safe_query ?? f.suggested_fix)
+      });
+    }
+    if (out.length) return out;
+  }
+  if (!ruleCode) return [];
+  return [
+    {
+      ruleCode,
+      severity,
+      ruleId: optStr(body.rule_id),
+      astNodePath: optStr(body.ast_node_path),
+      suggestedFix
+    }
+  ];
+}
+
+// src/version.ts
+var VERSION = "0.2.0";
+
+// src/runtime-api.ts
+var DEFAULT_API_URL = "https://api.vericto.com";
+var EVALUATE_PATH = "/api/v1/proxy/query";
+var CONFIG_PATH = "/api/v1/meta/config";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var RETRYABLE = /* @__PURE__ */ new Set([500, 502, 503, 504]);
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var MAX_BACKOFF_MS = 2e3;
+var RuntimeApiEvaluator = class {
+  apiUrl;
+  databaseId;
+  timeoutMs;
+  maxRetries;
+  #apiKey;
+  #backoffMs;
+  #dialectsTtlMs;
+  #fetch;
+  #dialects;
+  #dialectsAt = 0;
+  #dialectsPending;
+  constructor(options = {}) {
+    const env = options.env ?? (typeof process !== "undefined" ? process.env : {});
+    const key = (options.apiKey ?? env.VERICTO_API_KEY ?? "").trim();
+    if (!key) {
+      throw new VerictoConfigError(
+        "No Vericto API key: pass apiKey or set VERICTO_API_KEY (a vtro_... key with the proxy:evaluate scope)."
+      );
+    }
+    if (!key.startsWith("vtro_")) {
+      throw new VerictoConfigError("The Vericto API key must start with 'vtro_' (the value itself is not shown).");
+    }
+    this.#apiKey = key;
+    const db = (options.databaseId ?? env.VERICTO_DATABASE_ID ?? "").trim();
+    if (!db) {
+      throw new VerictoConfigError(
+        "No Vericto database id: pass databaseId or set VERICTO_DATABASE_ID (the id of the database registered in your Vericto workspace)."
+      );
+    }
+    if (!UUID_RE.test(db)) {
+      throw new VerictoConfigError(`The Vericto database id must be a UUID, got ${JSON.stringify(db.slice(0, 64))}.`);
+    }
+    this.databaseId = db.toLowerCase();
+    const url = ((options.apiUrl ?? env.VERICTO_API_URL ?? "").trim() || DEFAULT_API_URL).replace(/\/+$/, "");
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new VerictoConfigError(`Invalid Vericto API URL ${JSON.stringify(url)}: expected https://host.`);
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      throw new VerictoConfigError(`Invalid Vericto API URL ${JSON.stringify(url)}: expected https://host.`);
+    }
+    if (parsed.protocol === "http:" && !LOCAL_HOSTS.has(parsed.hostname)) {
+      throw new VerictoConfigError(`Refusing to send the API key over plain HTTP to ${parsed.hostname}: use https://.`);
+    }
+    this.apiUrl = url;
+    let timeoutMs = options.timeoutMs;
+    if (timeoutMs === void 0) {
+      const fromEnv = (env.VERICTO_TIMEOUT ?? "").trim();
+      timeoutMs = fromEnv ? Number(fromEnv) * 1e3 : 5e3;
+      if (!Number.isFinite(timeoutMs)) {
+        throw new VerictoConfigError(`VERICTO_TIMEOUT must be a number of seconds, got ${JSON.stringify(fromEnv)}.`);
+      }
+    }
+    if (!(timeoutMs > 0)) throw new VerictoConfigError("timeoutMs must be greater than 0.");
+    const maxRetries = options.maxRetries ?? 2;
+    if (!(maxRetries >= 0)) throw new VerictoConfigError("maxRetries cannot be negative.");
+    this.timeoutMs = timeoutMs;
+    this.maxRetries = Math.floor(maxRetries);
+    this.#backoffMs = Math.max(0, options.backoffMs ?? 200);
+    this.#dialectsTtlMs = options.dialectsTtlMs ?? 6e5;
+    const f = options.fetch ?? globalThis.fetch;
+    if (!f) throw new VerictoConfigError("No fetch implementation: Node 18+ is required, or pass options.fetch.");
+    this.#fetch = f;
+  }
+  toString() {
+    return `RuntimeApiEvaluator(apiUrl=${this.apiUrl}, databaseId=${this.databaseId})`;
+  }
+  toJSON() {
+    return { apiUrl: this.apiUrl, databaseId: this.databaseId };
+  }
+  async evaluate(sql, dialect) {
+    const payload = JSON.stringify({ query: sql, database_id: this.databaseId, dialect });
+    let lastError = "no attempt made";
+    let retryAfterMs;
+    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+      if (attempt > 0) await sleep(this.#delay(attempt, retryAfterMs));
+      retryAfterMs = void 0;
+      let response;
+      try {
+        response = await this.#request(EVALUATE_PATH, {
+          method: "POST",
+          headers: { ...this.#headers(), "Content-Type": "application/json", "X-API-Key": this.#apiKey },
+          body: payload
+        });
+      } catch (err) {
+        lastError = `${errorName(err)} while calling ${this.apiUrl}`;
+        continue;
+      }
+      const status = response.status;
+      const body = await jsonBody(response);
+      if (status === 200 || status === 403 && (typeof body.decision === "string" ? body.decision : "").toUpperCase() === "BLOCKED") {
+        if (!("decision" in body)) {
+          lastError = `HTTP ${status} without a decision from ${this.apiUrl}`;
+          continue;
+        }
+        return verdictFromResponse(body, sql, dialect);
+      }
+      const error = body.error && typeof body.error === "object" ? body.error : {};
+      const code = typeof error.code === "string" && error.code ? error.code : void 0;
+      const message = typeof error.message === "string" && error.message ? error.message : void 0;
+      if (status === 429 && code === "QUOTA_EXCEEDED") {
+        const resetsAt = typeof error.resets_at === "string" ? error.resets_at : void 0;
+        throw new VerictoQuotaExceededError(
+          `The Vericto workspace has used its monthly query quota${resetsAt ? `; it resets at ${resetsAt}` : ""}.`,
+          { resetsAt, upgradeUrl: typeof error.upgrade_url === "string" ? error.upgrade_url : void 0 }
+        );
+      }
+      if (status === 429 || RETRYABLE.has(status)) {
+        lastError = `HTTP ${status}${code ? ` ${code}` : ""} from ${this.apiUrl}`;
+        retryAfterMs = retryAfter(response.headers.get("retry-after"), error.retry_after_seconds);
+        continue;
+      }
+      throw await this.#configError(status, code, message, dialect);
+    }
+    throw new VerictoUnavailableError(
+      `Vericto did not return a verdict after ${this.maxRetries + 1} attempt(s): ${lastError}.`
+    );
+  }
+  /**
+   * The dialects the server evaluates (`GET /api/v1/meta/config`), cached. `undefined`
+   * when the server cannot be asked; the evaluation request then decides.
+   */
+  async supportedDialects() {
+    if (this.#dialects && Date.now() - this.#dialectsAt < this.#dialectsTtlMs) return this.#dialects;
+    this.#dialectsPending ??= this.#fetchDialects().finally(() => {
+      this.#dialectsPending = void 0;
+    });
+    return this.#dialectsPending;
+  }
+  async #fetchDialects() {
+    try {
+      const response = await this.#request(CONFIG_PATH, { method: "GET", headers: this.#headers() });
+      if (response.status !== 200) return this.#dialects;
+      const listed = (await jsonBody(response)).dialects;
+      if (!Array.isArray(listed)) return this.#dialects;
+      const ids = listed.map((d) => d && typeof d === "object" ? d.id : void 0).filter((id) => typeof id === "string" && id.length > 0);
+      this.#dialects = ids;
+      this.#dialectsAt = Date.now();
+      return ids;
+    } catch {
+      return this.#dialects;
+    }
+  }
+  #headers() {
+    return { Accept: "application/json", "User-Agent": `vericto-node/${VERSION}` };
+  }
+  async #request(path, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+      controller.abort();
+    }, this.timeoutMs);
+    try {
+      return await this.#fetch(this.apiUrl + path, { ...init, redirect: "manual", signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  #delay(attempt, retryAfterMs) {
+    if (retryAfterMs !== void 0) return Math.min(retryAfterMs, MAX_BACKOFF_MS);
+    const base = this.#backoffMs * 2 ** (attempt - 1);
+    return Math.min(MAX_BACKOFF_MS, base * (0.5 + Math.random() / 2));
+  }
+  async #configError(status, code, message, dialect) {
+    if (status === 401) {
+      return new VerictoConfigError("Vericto rejected the API key (HTTP 401). Check VERICTO_API_KEY.", {
+        status,
+        code
+      });
+    }
+    if (status === 403) {
+      return new VerictoConfigError(
+        `Vericto refused the request (HTTP 403${code ? `, ${code}` : ""}): ${message ?? "the key lacks the proxy:evaluate scope or this database"}.`,
+        { status, code }
+      );
+    }
+    if (status === 400) {
+      const supported = await this.supportedDialects();
+      if (supported && !supported.includes(dialect)) {
+        return new VerictoUnsupportedDialectError(dialect, supported, this.apiUrl);
+      }
+    }
+    return new VerictoConfigError(
+      `Vericto rejected the request (HTTP ${status}${code ? `, ${code}` : ""})${message ? `: ${message}` : "."}`,
+      { status, code }
+    );
+  }
+};
+async function jsonBody(response) {
+  try {
+    const text = await response.text();
+    const parsed = text ? JSON.parse(text) : {};
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function retryAfter(header, bodyValue) {
+  for (const value of [header, bodyValue]) {
+    if (value === null || value === void 0 || value === "") continue;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  }
+  return void 0;
+}
+function errorName(err) {
+  if (err instanceof Error) return err.name === "AbortError" ? "Timeout" : err.name;
+  return "Error";
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/guard.ts
+var DEFAULT_LOGGER = {
+  info: () => {
+  },
+  warn: (m) => {
+    console.warn(m);
+  },
+  error: (m) => {
+    console.error(m);
+  }
+};
+var SILENT = { info: () => {
+}, warn: () => {
+}, error: () => {
+} };
+var Vericto = class {
+  evaluator;
+  failMode;
+  onVerdict;
+  #logger;
+  #cache;
+  constructor(options = {}) {
+    this.evaluator = options.evaluator ?? new RuntimeApiEvaluator(options);
+    const env = options.env ?? (typeof process !== "undefined" ? process.env : {});
+    const mode = (options.failMode ?? env.VERICTO_FAIL_MODE ?? "closed").trim().toLowerCase();
+    if (mode !== "closed" && mode !== "open") {
+      throw new VerictoConfigError(`failMode must be 'closed' or 'open', got ${JSON.stringify(mode)}.`);
+    }
+    this.failMode = mode;
+    const ttl = options.cacheTtlMs ?? 0;
+    const size = options.cacheSize ?? 1024;
+    if (ttl < 0 || size < 1) throw new VerictoConfigError("cacheTtlMs must be >= 0 and cacheSize >= 1.");
+    this.#cache = ttl > 0 ? new VerdictCache(ttl, size) : void 0;
+    this.onVerdict = options.onVerdict;
+    this.#logger = options.logger === false ? SILENT : options.logger ?? DEFAULT_LOGGER;
+  }
+  /**
+   * Fail fast if the server reports that it does not evaluate `dialect`. Resolves the
+   * normalized dialect id. When the server cannot be asked, nothing is thrown here.
+   */
+  async requireDialect(dialect) {
+    const name = normalizeDialect(dialect);
+    const supported = await this.evaluator.supportedDialects();
+    if (supported && !supported.includes(name)) {
+      throw new VerictoUnsupportedDialectError(name, supported, this.evaluator.apiUrl ?? "the configured evaluator");
+    }
+    return name;
+  }
+  /**
+   * Evaluate `sql` and resolve the verdict, whatever it is. Does not apply the fail
+   * mode and does not reject on `BLOCKED`: use it to ask, and `enforce` to guard.
+   */
+  async check(sql, dialect) {
+    if (typeof sql !== "string") {
+      throw new TypeError(`vericto: expected the SQL text as a string, got ${typeof sql}.`);
+    }
+    const name = await this.requireDialect(dialect);
+    const hit = this.#cache?.get(sql, name);
+    if (hit) return hit;
+    const verdict = await this.evaluator.evaluate(sql, name);
+    this.#cache?.put(verdict);
+    return verdict;
+  }
+  /**
+   * Evaluate `sql` and apply the decision: reject with `VerictoBlockedError` on
+   * `BLOCKED`; log `FLAGGED`/`MONITORED`/allowed `PARSE_ERROR`; apply the fail mode
+   * when Vericto cannot answer. Run `sqlToExecute(verdict)` (the masked rewrite, if any).
+   */
+  async enforce(sql, dialect) {
+    let verdict;
+    try {
+      verdict = await this.check(sql, dialect);
+    } catch (err) {
+      if (!(err instanceof VerictoUnavailableError)) throw err;
+      if (this.failMode === "closed") {
+        this.#logger.error(`vericto: no verdict, statement not executed (failMode=closed): ${err.message}`);
+        throw err;
+      }
+      verdict = unevaluatedVerdict(sql, normalizeDialect(dialect), err.message);
+      this.#logger.warn(`vericto: no verdict, statement executed unevaluated (failMode=open): ${err.message}`);
+      emitFailOpenWarning(err.message);
+      this.#notify(verdict);
+      return verdict;
+    }
+    this.#notify(verdict);
+    this.#log(verdict);
+    if (verdict.decision === "BLOCKED") throw new VerictoBlockedError(verdict, sql);
+    return verdict;
+  }
+  /** `enforce`, resolving the SQL text to execute. */
+  async prepare(sql, dialect) {
+    return sqlToExecute(await this.enforce(sql, dialect));
+  }
+  /** Enforce a batch in order; a block anywhere rejects before the caller runs any of it. */
+  async enforceAll(statements, dialect) {
+    const out = [];
+    for (const statement of statements) out.push(await this.enforce(statement, dialect));
+    return out;
+  }
+  clearCache() {
+    this.#cache?.clear();
+  }
+  #notify(verdict) {
+    if (!this.onVerdict) return;
+    try {
+      this.onVerdict(verdict);
+    } catch (err) {
+      this.#logger.error(`vericto: onVerdict callback threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  #log(verdict) {
+    const extra = `rule=${verdict.ruleCode ?? "-"} severity=${verdict.severity ?? "-"} event_id=${verdict.eventId ?? "-"}`;
+    switch (verdict.decision) {
+      case "BLOCKED":
+        this.#logger.warn(`vericto: statement BLOCKED ${extra}`);
+        break;
+      case "FLAGGED":
+        this.#logger.warn(`vericto: statement FLAGGED ${extra}`);
+        break;
+      case "PARSE_ERROR":
+        this.#logger.warn(`vericto: statement not parsed, allowed by workspace policy ${extra}`);
+        break;
+      case "MONITORED":
+        this.#logger.info(`vericto: statement MONITORED ${extra}`);
+        break;
+    }
+    if (isMasked(verdict)) this.#logger.info(`vericto: running the masked rewrite ${extra}`);
+  }
+};
+function emitFailOpenWarning(reason) {
+  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
+    process.emitWarning(`Vericto could not evaluate the statement and failMode is 'open', so it ran unchecked: ${reason}`, {
+      type: "VerictoFailOpenWarning",
+      code: "VERICTO_FAIL_OPEN"
+    });
+  }
+}
+var VerdictCache = class {
+  #ttl;
+  #size;
+  #items = /* @__PURE__ */ new Map();
+  #ruleset;
+  constructor(ttl, size) {
+    this.#ttl = ttl;
+    this.#size = size;
+  }
+  get(sql, dialect) {
+    const key = `${dialect}\0${sql}`;
+    const item = this.#items.get(key);
+    if (!item) return void 0;
+    if (Date.now() - item.at > this.#ttl) {
+      this.#items.delete(key);
+      return void 0;
+    }
+    this.#items.delete(key);
+    this.#items.set(key, item);
+    return { ...item.verdict, cached: true };
+  }
+  put(verdict) {
+    if (verdict.decision === "UNEVALUATED") return;
+    if (verdict.rulesetVersion && verdict.rulesetVersion !== this.#ruleset) {
+      if (this.#ruleset !== void 0) this.#items.clear();
+      this.#ruleset = verdict.rulesetVersion;
+    }
+    const key = `${verdict.dialect}\0${verdict.sql}`;
+    this.#items.delete(key);
+    this.#items.set(key, { at: Date.now(), verdict });
+    while (this.#items.size > this.#size) {
+      const oldest = this.#items.keys().next().value;
+      if (oldest === void 0) break;
+      this.#items.delete(oldest);
+    }
+  }
+  clear() {
+    this.#items.clear();
+  }
+};
+
+exports.CONFIG_PATH = CONFIG_PATH;
+exports.DEFAULT_API_URL = DEFAULT_API_URL;
+exports.EVALUATE_PATH = EVALUATE_PATH;
+exports.KNOWN_DIALECTS = KNOWN_DIALECTS;
+exports.RuntimeApiEvaluator = RuntimeApiEvaluator;
+exports.VERSION = VERSION;
+exports.Vericto = Vericto;
+exports.VerictoBlockedError = VerictoBlockedError;
+exports.VerictoConfigError = VerictoConfigError;
+exports.VerictoError = VerictoError;
+exports.VerictoQuotaExceededError = VerictoQuotaExceededError;
+exports.VerictoUnavailableError = VerictoUnavailableError;
+exports.VerictoUnsupportedDialectError = VerictoUnsupportedDialectError;
+exports.isMasked = isMasked;
+exports.normalizeDialect = normalizeDialect;
+exports.sqlToExecute = sqlToExecute;
+exports.verdictFromResponse = verdictFromResponse;
+//# sourceMappingURL=chunk-HFL7W4WC.cjs.map
+//# sourceMappingURL=chunk-HFL7W4WC.cjs.map