@alxia/react-router 0.13.0 → 0.15.0

package/dist/session/index.js

@@ -0,0 +1,648 @@
+import {
+  isApiErrorLike2,
+  retryAfterOf,
+  attemptsLeftOf2,
+  routeError2,
+  nextOf2,
+  hasSiteCheck,
+  refuseCrossSite
+} from "../chunks/index-c3k47yw7.js";
+import {
+  HOME2,
+  safeNext2,
+  sitePath,
+  SIGN_IN_PATHS2,
+  signInPath2,
+  secondFactorPath2
+} from "../chunks/index-0tyw54ad.js";
+
+// src/session/codes.ts
+var INVALID_CODE = "CODE_INVALID";
+var CHALLENGE_OVER = [
+  "TOKEN_UNKNOWN",
+  "TOKEN_SPENT",
+  "TOKEN_EXPIRED"
+];
+var MAIL_THROTTLED = "MAIL_THROTTLED";
+// src/session/serialize.ts
+var TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var PATH = /^\/[^;\x00-\x1f\x7f]*$/;
+var isCookieName = (name) => TOKEN.test(name);
+var isCookiePath = (path) => PATH.test(path);
+function serializeCookie(name, value, { maxAge, path = "/", secure }) {
+  if (!isCookieName(name)) {
+    throw new TypeError(`serializeCookie(): the name ${JSON.stringify(name)} is not a cookie name (an RFC 6265 token).`);
+  }
+  if (!isCookiePath(path)) {
+    throw new TypeError(`serializeCookie(): the path ${JSON.stringify(path)} is not a cookie path: it must start with "/" and hold no ";" or control character.`);
+  }
+  return [
+    `${name}=${encodeURIComponent(value)}`,
+    `Max-Age=${Number.isFinite(maxAge) ? Math.max(0, Math.floor(maxAge)) : 0}`,
+    `Path=${path}`,
+    "HttpOnly",
+    ...secure ? ["Secure"] : [],
+    "SameSite=Lax"
+  ].join("; ");
+}
+function readCookie(request, name) {
+  for (const pair of request.headers.get("cookie")?.split(";") ?? []) {
+    const index = pair.indexOf("=");
+    if (index < 0 || pair.slice(0, index).trim() !== name)
+      continue;
+    const raw = pair.slice(index + 1).trim();
+    if (!raw)
+      continue;
+    try {
+      return decodeURIComponent(raw);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function millisOf(at) {
+  const time = typeof at === "string" ? Date.parse(at) : at.getTime();
+  return Number.isNaN(time) ? 0 : time;
+}
+function secondsUntil(expiresAt, now = Date.now()) {
+  const end = millisOf(expiresAt);
+  return end === 0 ? 0 : Math.max(0, (end - now) / 1000);
+}
+
+// src/session/cookies.ts
+var PREFIX = /^__(?:Host|Secure)-/;
+function checkName(label, name) {
+  if (!isCookieName(name)) {
+    throw new TypeError(`sessionCookies(): the ${label} name ${JSON.stringify(name)} is not a cookie name (an RFC 6265 token: letters, digits and ! # $ % & ' * + - . ^ _ \` | ~). Pass a name such as "my-app_${label}".`);
+  }
+  if (PREFIX.test(name)) {
+    throw new TypeError(`sessionCookies(): the ${label} name ${JSON.stringify(name)} already carries a prefix. Pass the base name: the package adds __Host- (session) or __Secure- (challenge) when secure is true.`);
+  }
+}
+function sessionCookies(options) {
+  const {
+    secure,
+    challengePath = "/sign-in",
+    challengeSeconds = 5 * 60
+  } = options;
+  checkName("session", options.session);
+  checkName("challenge", options.challenge);
+  if (!Number.isInteger(challengeSeconds) || challengeSeconds <= 0) {
+    throw new TypeError(`sessionCookies(): challengeSeconds must be a positive integer; got ${String(challengeSeconds)}.`);
+  }
+  if (!isCookiePath(challengePath)) {
+    throw new TypeError(`sessionCookies(): challengePath must start with "/" and hold no ";" or control character; got ${JSON.stringify(challengePath)}.`);
+  }
+  const session = secure ? `__Host-${options.session}` : options.session;
+  const challenge = secure ? `__Secure-${options.challenge}` : options.challenge;
+  const clear = (name, path) => serializeCookie(name, "", { maxAge: 0, secure, ...path && { path } });
+  const read = (request) => {
+    const value = readCookie(request, session);
+    const dot = value?.indexOf(".") ?? -1;
+    if (!value || dot < 1)
+      return null;
+    const digits = value.slice(0, dot);
+    const expiresAt = Number(digits);
+    const token = value.slice(dot + 1);
+    return token && /^\d+$/.test(digits) && Number.isSafeInteger(expiresAt) ? { token, expiresAt } : null;
+  };
+  const commit = (token, expiresAt, now) => serializeCookie(session, `${millisOf(expiresAt)}.${token}`, {
+    maxAge: secondsUntil(expiresAt, now),
+    secure
+  });
+  return {
+    names: { session, challenge },
+    read,
+    token: (request) => read(request)?.token ?? null,
+    commit,
+    destroy: () => clear(session),
+    refreshed(current, expiresAt) {
+      const end = expiresAt ? millisOf(expiresAt) : 0;
+      if (!expiresAt || end === 0 || end === current.expiresAt)
+        return {};
+      return { "Set-Cookie": commit(current.token, expiresAt) };
+    },
+    challengeOf: (request) => readCookie(request, challenge),
+    commitChallenge: (value, expiresAt, now) => serializeCookie(challenge, value, {
+      maxAge: Math.min(challengeSeconds, expiresAt ? secondsUntil(expiresAt, now) : challengeSeconds),
+      path: challengePath,
+      secure
+    }),
+    destroyChallenge: () => clear(challenge, challengePath),
+    signInPageHeaders(deadSession) {
+      const headers = new Headers;
+      headers.append("Set-Cookie", clear(challenge, challengePath));
+      if (deadSession)
+        headers.append("Set-Cookie", clear(session));
+      return headers;
+    }
+  };
+}
+// src/session/link-token.ts
+import { data, replace } from "react-router";
+
+// src/session/guard.ts
+function samesitePost(json, request) {
+  json.requireJsonPost(request);
+  refuseCrossSite(json, request);
+}
+
+// src/session/link-token.ts
+var TOKEN_PAGE_HEADERS = {
+  "Referrer-Policy": "no-referrer",
+  "X-Robots-Tag": "noindex, nofollow"
+};
+var pathOf = (path, call) => sitePath(path, { label: `${call}: a token page's path` });
+var statePath = (path, state) => `${pathOf(path, "statePath()")}?${new URLSearchParams({ state })}`;
+function withTokenHeaders(headers) {
+  const merged = new Headers(headers);
+  for (const [name, value] of Object.entries(TOKEN_PAGE_HEADERS)) {
+    merged.set(name, value);
+  }
+  return merged;
+}
+var stateRedirect = (path, state, headers) => replace(statePath(path, state), { headers: withTokenHeaders(headers) });
+var isTokenIssue = (issue) => {
+  const first = issue.path?.[0];
+  return (typeof first === "object" ? first.key : first) === "token";
+};
+async function linkArgs({ json }, invalidState, schema, request, path) {
+  samesitePost(json, request);
+  pathOf(path, "linkArgs()");
+  const body = await json.readJson(request);
+  const result = await schema["~standard"].validate(body);
+  if (!result.issues)
+    return result.value;
+  if (result.issues.some(isTokenIssue)) {
+    throw stateRedirect(path, invalidState);
+  }
+  throw data("Bad link request", { status: 400 });
+}
+async function spendToken(options, run, { request, language, path, states, fields: shown = [] }) {
+  const { errors } = options;
+  samesitePost(options.json, request);
+  pathOf(path, "spendToken()");
+  try {
+    return { ok: true, value: await run() };
+  } catch (error) {
+    const refusal = errors.apiRefusal(error, language);
+    if (!refusal)
+      throw error;
+    const { message, status } = refusal;
+    if (isApiErrorLike2(error)) {
+      const state = error.code ? states[error.code] : undefined;
+      if (state)
+        return { ok: false, response: stateRedirect(path, state) };
+      const fields = errors.fieldErrors(error, language);
+      const named = Object.keys(fields);
+      if (named.length && named.every((field) => shown.includes(field))) {
+        return { ok: false, refusal: { fieldErrors: fields }, status };
+      }
+    }
+    return { ok: false, refusal: { formError: message }, status };
+  }
+}
+var answerOf = (spent) => ("response" in spent) ? spent.response : data(spent.refusal, { status: spent.status });
+// src/session/links.ts
+import { data as data3 } from "react-router";
+
+// src/session/link-land.ts
+import { data as data2, replace as replace2 } from "react-router";
+
+// src/session/land.ts
+import { redirect } from "react-router";
+async function revokeSession({ options }, request, { context } = {}) {
+  samesitePost(options.json, request);
+  const token = options.cookies.token(request);
+  if (!token)
+    return false;
+  try {
+    await options.revoke(token, request, context);
+  } catch {}
+  return true;
+}
+var isLive = (answer) => answer.status === "signedIn" && Boolean(answer.token) && Boolean(answer.expiresAt) && millisOf(answer.expiresAt) > Date.now();
+function landing({ options, paths }, answer, next) {
+  const { cookies } = options;
+  if (isLive(answer)) {
+    const headers = new Headers;
+    headers.append("Set-Cookie", cookies.commit(answer.token, answer.expiresAt));
+    headers.append("Set-Cookie", cookies.destroyChallenge());
+    for (const cookie of options.clear?.() ?? []) {
+      headers.append("Set-Cookie", cookie);
+    }
+    return redirect(safeNext2(next), { headers });
+  }
+  if (answer.status === "secondFactor" && answer.challenge) {
+    return redirect(secondFactorPath2(next, paths.secondFactor), {
+      headers: {
+        "Set-Cookie": cookies.commitChallenge(answer.challenge, answer.expiresAt)
+      }
+    });
+  }
+  return null;
+}
+async function landReplacing(flow, answer, next, {
+  request,
+  revokeOn = ["signedIn"],
+  context
+}) {
+  samesitePost(flow.options.json, request);
+  const landed = landing(flow, answer, next);
+  if (!landed || answer.status === "other")
+    return landed;
+  if (!revokeOn.includes(answer.status))
+    return landed;
+  const hadSession = await revokeSession(flow, request, { context });
+  if (hadSession && answer.status !== "signedIn") {
+    landed.headers.append("Set-Cookie", flow.options.cookies.destroy());
+  }
+  return landed;
+}
+
+// src/session/link-land.ts
+async function startOf({ start }, request, token) {
+  if (!start)
+    return HOME2;
+  try {
+    return safeNext2(await start(token, request));
+  } catch {
+    return HOME2;
+  }
+}
+async function landByLink(options, answer, {
+  request,
+  language,
+  other,
+  context
+}) {
+  samesitePost(options.json, request);
+  if (answer.status === "other" && other) {
+    return stateRedirect(other.path, other.state);
+  }
+  const next = isLive(answer) ? await startOf(options, request, answer.token) : HOME2;
+  const landed = await options.signIn.landReplacing(answer, next, {
+    request,
+    revokeOn: ["signedIn", "secondFactor"],
+    context
+  });
+  if (!landed) {
+    return data2({ formError: options.signIn.unavailable(language) }, { status: 503 });
+  }
+  const location = landed.headers.get("Location") ?? HOME2;
+  return replace2(location, { headers: withTokenHeaders(landed.headers) });
+}
+async function afterReset(options, resetDone, request, { context } = {}) {
+  samesitePost(options.json, request);
+  await options.signIn.revokeSession(request, { context });
+  const headers = withTokenHeaders();
+  headers.append("Set-Cookie", options.cookies.destroy());
+  headers.append("Set-Cookie", options.cookies.destroyChallenge());
+  for (const cookie of options.signIn.clear()) {
+    headers.append("Set-Cookie", cookie);
+  }
+  return replace2(resetDone, { headers });
+}
+
+// src/session/links.ts
+var RESET_DONE = "/sign-in?password-reset=1";
+var worded = ({ wording, errors }, error, language) => wording?.(error, language) ?? errors.apiErrorMessage(error, language);
+async function requestLink(options, run, { request, language }) {
+  const { errors } = options;
+  samesitePost(options.json, request);
+  try {
+    await run();
+    return data3({ sent: true });
+  } catch (error) {
+    const api = isApiErrorLike2(error);
+    if (api && error.code === (options.codes?.mailThrottled ?? MAIL_THROTTLED)) {
+      const retryAfter = retryAfterOf(error);
+      return data3({
+        formError: worded(options, error, language),
+        throttled: true,
+        ...retryAfter === undefined ? {} : { retryAfter }
+      }, { status: 429 });
+    }
+    if (api) {
+      const email = errors.fieldErrors(error, language)["email"];
+      if (email) {
+        return data3({ fieldErrors: { email } }, { status: error.status });
+      }
+    }
+    const refusal = errors.apiRefusal(error, language);
+    if (!refusal)
+      throw error;
+    return data3({ formError: api ? worded(options, error, language) : refusal.message }, { status: refusal.status });
+  }
+}
+function authLinks(links) {
+  const { signIn } = links;
+  const options = {
+    ...links,
+    cookies: signIn.cookies,
+    errors: signIn.errors,
+    json: signIn.json
+  };
+  const resetDone = options.resetDone ?? RESET_DONE;
+  sitePath(resetDone, { label: "authLinks(): resetDone", query: true });
+  const invalid = options.invalidState ?? "invalid";
+  return {
+    statePath,
+    ended: stateRedirect,
+    linkArgs: (schema, request, path) => linkArgs(options, invalid, schema, request, path),
+    spendToken: (run, o) => spendToken(options, run, o),
+    answerOf,
+    landByLink: (answer, o) => landByLink(options, answer, o),
+    afterReset: (request, o) => afterReset(options, resetDone, request, o),
+    requestLink: (run, o) => requestLink(options, run, o)
+  };
+}
+// src/session/second-factor.ts
+import { data as data4 } from "react-router";
+var MAX_CODE = 40;
+function isMethod(value) {
+  return value === "code" || value === "recovery";
+}
+async function readCodeInput({ options }, request) {
+  samesitePost(options.json, request);
+  const body = await options.json.readJson(request);
+  const { kind, code } = body ?? {};
+  if (!isMethod(kind) || typeof code !== "string" || code.length > MAX_CODE) {
+    throw data4("Bad code request", { status: 400 });
+  }
+  return { kind, code };
+}
+function codeStep(input, challenge, steps) {
+  return input.kind === "code" ? steps.confirm(challenge, input.code) : steps.recover(challenge, input.code);
+}
+
+// src/session/step.ts
+import { data as data5 } from "react-router";
+function codeRefusal({ options, invalidCode, challengeOver }, error, language, whenNone) {
+  if (error.code !== invalidCode) {
+    return error.code && challengeOver.includes(error.code) ? undefined : options.errors.apiErrorMessage(error, language);
+  }
+  const message = options.errors.apiErrorMessage(error, language);
+  const count = attemptsLeftOf2(error);
+  if (count === undefined)
+    return message;
+  if (count === 0) {
+    return whenNone === undefined ? undefined : `${message} ${whenNone}`;
+  }
+  return `${message} ${options.attemptsLeft(count, language)}`;
+}
+var unavailableMessage = ({ unavailable, errors }, language) => unavailable?.(language) ?? errors.unavailableMessage(language);
+async function signInStep(flow, run, {
+  request,
+  language,
+  next,
+  extra,
+  refused,
+  context
+}) {
+  const { errors, json } = flow.options;
+  samesitePost(json, request);
+  const stay = (formError, status) => data5({ ...extra, formError }, { status });
+  const unreachable = () => stay(unavailableMessage(flow.options, language), 503);
+  let answer;
+  try {
+    answer = await run();
+  } catch (error) {
+    const refusal = errors.apiRefusal(error, language);
+    if (!refusal)
+      throw error;
+    if (!isApiErrorLike2(error))
+      return unreachable();
+    const own = refused?.(error);
+    if (own instanceof Response)
+      return own;
+    return stay(own ?? refusal.message, refusal.status);
+  }
+  return await landReplacing(flow, answer, next, { request, context }) ?? unreachable();
+}
+
+// src/session/viewer.ts
+import { redirect as redirect2 } from "react-router";
+var nextParam = (request) => safeNext2(new URL(request.url).searchParams.get("next"));
+function signInRedirect({ options, paths }, request) {
+  const { endedParam, cookies } = options;
+  const query = endedParam && cookies.read(request) ? { [endedParam]: "1" } : undefined;
+  return redirect2(signInPath2(nextOf2(request.url), {
+    path: paths.signIn,
+    ...query && { query }
+  }), { headers: { "Set-Cookie": cookies.destroy() } });
+}
+async function viewer({ options }, request, read, token = options.cookies.token(request)) {
+  if (!token)
+    return;
+  try {
+    return await read(token);
+  } catch (error) {
+    return isApiErrorLike2(error) && error.status === 401 ? null : undefined;
+  }
+}
+async function requireViewer(context, request, read, expiresAt) {
+  const session = context.options.cookies.read(request);
+  if (!session)
+    throw signInRedirect(context, request);
+  let found;
+  try {
+    found = await read(session.token);
+  } catch (error) {
+    if (isApiErrorLike2(error) && error.status === 401) {
+      throw signInRedirect(context, request);
+    }
+    throw routeError2(error);
+  }
+  if (!found)
+    throw signInRedirect(context, request);
+  return {
+    viewer: found,
+    headers: context.options.cookies.refreshed(session, expiresAt(found))
+  };
+}
+async function signOut(flow, request, {
+  to,
+  context
+} = {}) {
+  const { options, paths } = flow;
+  await options.json.readJson(request);
+  await revokeSession(flow, request, { context });
+  const headers = new Headers;
+  headers.append("Set-Cookie", options.cookies.destroy());
+  headers.append("Set-Cookie", options.cookies.destroyChallenge());
+  for (const cookie of options.clear?.() ?? []) {
+    headers.append("Set-Cookie", cookie);
+  }
+  return redirect2(to === undefined ? `${paths.signIn}?signed-out=1` : safeNext2(to), { headers });
+}
+
+// src/session/sign-in.ts
+function resolve(options) {
+  const paths = { ...SIGN_IN_PATHS2, ...options.paths };
+  for (const key of ["signIn", "secondFactor"]) {
+    sitePath(paths[key], { label: `signInFlow(): paths.${key}` });
+  }
+  if (!hasSiteCheck(options.json)) {
+    throw new TypeError("signInFlow(): json must come from jsonActions(), which carries the site check every step runs; this object has none (a hand-made double?). Pass the app's jsonActions({ origin }) instance, or a spread copy of it.");
+  }
+  const invalidCode = options.codes?.invalidCode ?? INVALID_CODE;
+  const challengeOver = options.codes?.challengeOver ?? CHALLENGE_OVER;
+  if (challengeOver.includes(invalidCode)) {
+    throw new TypeError(`signInFlow(): the code ${JSON.stringify(invalidCode)} is both the wrong-code code (codes.invalidCode) and in codes.challengeOver. A wrong code that leaves tries cannot end the challenge.`);
+  }
+  return { options, paths, invalidCode, challengeOver };
+}
+function signInFlow(options) {
+  const context = resolve(options);
+  const { options: o } = context;
+  return {
+    cookies: o.cookies,
+    errors: o.errors,
+    json: o.json,
+    unavailable: (language) => unavailableMessage(o, language),
+    clear: () => o.clear?.() ?? [],
+    attemptsLeft: o.attemptsLeft,
+    guard: (request) => samesitePost(o.json, request),
+    nextParam,
+    signInRedirect: (request) => signInRedirect(context, request),
+    landing: (answer, next) => landing(context, answer, next),
+    landReplacing: (answer, next, o) => landReplacing(context, answer, next, o),
+    signInStep: (run, o) => signInStep(context, run, o),
+    codeRefusal: (error, language, whenNone) => codeRefusal(context, error, language, whenNone),
+    readCodeInput: (request) => readCodeInput(context, request),
+    codeStep,
+    revokeSession: (request, o) => revokeSession(context, request, o),
+    signOut: (request, o) => signOut(context, request, o),
+    viewer: (request, read, token) => viewer(context, request, read, token),
+    requireViewer: (request, read, expiresAt) => requireViewer(context, request, read, expiresAt)
+  };
+}
+// src/session/step-up.ts
+import { data as data6 } from "react-router";
+
+// src/session/step-up-codes.ts
+var STEP_UP_REQUIRED = "STEP_UP_REQUIRED";
+var STEP_UP_OVER = [
+  ...CHALLENGE_OVER,
+  "TOKEN_STALE",
+  "SECOND_FACTOR_ACTIVE",
+  "SECOND_FACTOR_NOT_ENROLLED"
+];
+
+// src/session/step-up.ts
+function resolve2(steps) {
+  const invalidCode = steps.codes?.invalidCode ?? INVALID_CODE;
+  const challengeOver = steps.codes?.challengeOver ?? STEP_UP_OVER;
+  if (challengeOver.includes(invalidCode)) {
+    throw new TypeError(`stepUpSteps(): the code ${JSON.stringify(invalidCode)} is both the wrong-code code (codes.invalidCode) and in codes.challengeOver. A wrong code that leaves tries cannot end the challenge.`);
+  }
+  return {
+    options: steps.signIn,
+    steps,
+    invalidCode,
+    challengeOver,
+    stepUpRequired: steps.codes?.stepUpRequired ?? STEP_UP_REQUIRED,
+    mailThrottled: steps.codes?.mailThrottled ?? MAIL_THROTTLED
+  };
+}
+function worded2({ steps }, error, language) {
+  return steps.wording?.(error, language) ?? steps.signIn.errors.apiErrorMessage(error, language);
+}
+function refusedCode(context, error, via, language) {
+  const { steps } = context;
+  const attemptsLeft = attemptsLeftOf2(error);
+  if (attemptsLeft === 0 && via !== "secondFactor") {
+    return {
+      error: "expired",
+      attemptsLeft,
+      locked: false,
+      message: steps.spent(language)
+    };
+  }
+  const locked = attemptsLeft === 0;
+  const message = codeRefusal(context, error, language, locked ? steps.locked?.(language) : undefined) ?? steps.signIn.errors.apiErrorMessage(error, language);
+  return {
+    error: "invalid",
+    ...attemptsLeft === undefined ? {} : { attemptsLeft },
+    locked,
+    message
+  };
+}
+async function requestStep(context, run, { request, language }) {
+  samesitePost(context.steps.signIn.json, request);
+  const intent = "request-step-up";
+  try {
+    const { challenge, via } = await run();
+    return { ok: true, intent, challenge, via };
+  } catch (error) {
+    const refusal = context.steps.signIn.errors.apiRefusal(error, language);
+    if (!refusal)
+      throw error;
+    const api = isApiErrorLike2(error);
+    const message = api ? worded2(context, error, language) : refusal.message;
+    const throttled = api && error.code === context.mailThrottled;
+    const retryAfter = throttled ? retryAfterOf(error) : undefined;
+    return data6({
+      ok: false,
+      intent,
+      error: throttled ? "throttled" : "failed",
+      message,
+      ...retryAfter === undefined ? {} : { retryAfter }
+    }, { status: refusal.status });
+  }
+}
+async function confirmStep(context, run, { request, language, via }) {
+  samesitePost(context.steps.signIn.json, request);
+  const intent = "confirm-step-up";
+  try {
+    await run();
+    return { ok: true, intent };
+  } catch (error) {
+    const refusal = context.steps.signIn.errors.apiRefusal(error, language);
+    if (!refusal)
+      throw error;
+    const stay = (failure) => data6({ ok: false, intent, ...failure }, { status: refusal.status });
+    const failed = (message) => stay({ error: "failed", locked: false, message });
+    if (!isApiErrorLike2(error))
+      return failed(refusal.message);
+    if (error.code === context.invalidCode) {
+      return stay(refusedCode(context, error, via, language));
+    }
+    if (error.code && context.challengeOver.includes(error.code)) {
+      return stay({
+        error: "expired",
+        locked: false,
+        message: context.steps.spent(language)
+      });
+    }
+    return failed(worded2(context, error, language));
+  }
+}
+function stepUpSteps(options) {
+  const context = resolve2(options);
+  return {
+    request: (run, o) => requestStep(context, run, o),
+    confirm: (run, o) => confirmStep(context, run, o),
+    isStepUpRequired: (error) => isApiErrorLike2(error) && error.code === context.stepUpRequired
+  };
+}
+export {
+  CHALLENGE_OVER,
+  INVALID_CODE,
+  MAIL_THROTTLED,
+  STEP_UP_OVER,
+  STEP_UP_REQUIRED,
+  TOKEN_PAGE_HEADERS,
+  authLinks,
+  readCookie,
+  secondsUntil,
+  serializeCookie,
+  sessionCookies,
+  signInFlow,
+  stepUpSteps
+};
+
+//# debugId=A957A7CA74458AAE64756E2164756E21
+//# sourceMappingURL=index.js.map