@crossauth/backend 0.0.15 → 0.0.17

package/dist/index.js

@@ -1,6 +1,6 @@
 var Ae = Object.defineProperty;
-var Ie = (C, a, e) => a in C ? Ae(C, a, { enumerable: !0, configurable: !0, writable: !0, value: e }) : C[a] = e;
-var h = (C, a, e) => Ie(C, typeof a != "symbol" ? a + "" : a, e);
+var Ie = (S, s, e) => s in S ? Ae(S, s, { enumerable: !0, configurable: !0, writable: !0, value: e }) : S[s] = e;
+var h = (S, s, e) => Ie(S, typeof s != "symbol" ? s + "" : s, e);
 import { CrossauthError as o, ErrorCode as l, UserState as E, CrossauthLogger as u, j as f, OAuthFlows as b, KeyPrefix as U, OAuthTokenConsumerBase as Pe, OAuthClientBase as Ke } from "@crossauth/common";
 import { PrismaClient as ce, Prisma as X } from "@prisma/client";
 import ye from "ldapjs";
@@ -9,15 +9,15 @@ import { promisify as De } from "node:util";
 import W from "nunjucks";
 import Ee from "nodemailer";
 import Be from "twilio";
-import ze from "qrcode";
+import Le from "qrcode";
 import { authenticator as fe } from "otplib";
-import ae from "jsonwebtoken";
-import { createPublicKey as Le } from "crypto";
+import se from "jsonwebtoken";
+import { createPublicKey as ze } from "crypto";
 import te from "node:fs";
 import * as He from "jose";
-var m = /* @__PURE__ */ ((C) => (C[C.String = 0] = "String", C[C.Number = 1] = "Number", C[C.Boolean = 2] = "Boolean", C[C.Json = 3] = "Json", C[C.JsonArray = 4] = "JsonArray", C))(m || {});
-function Me(C, a) {
-  let e = C.split("."), t = a;
+var m = /* @__PURE__ */ ((S) => (S[S.String = 0] = "String", S[S.Number = 1] = "Number", S[S.Boolean = 2] = "Boolean", S[S.Json = 3] = "Json", S[S.JsonArray = 4] = "JsonArray", S))(m || {});
+function Me(S, s) {
+  let e = S.split("."), t = s;
   for (let r in e) {
     const i = e[r];
     if (!(i in t) || t[i] == null) return;
@@ -25,8 +25,8 @@ function Me(C, a) {
   }
   return t;
 }
-function pe(C, a) {
-  let e = C.split("."), t = a;
+function pe(S, s) {
+  let e = S.split("."), t = s;
   for (let r in e) {
     const i = e[r];
     if (!(i in t) || t[i] == null) return !1;
@@ -34,48 +34,48 @@ function pe(C, a) {
   }
   return !0;
 }
-function je(C, a, e) {
-  const t = Me(a, e);
-  C[a.replace(".", "_")] = t;
+function je(S, s, e) {
+  const t = Me(s, e);
+  S[s.replace(".", "_")] = t;
 }
-function Ve(C, a, e, t) {
+function Ve(S, s, e, t) {
   var i;
-  const r = a.replace(".", "_");
+  const r = s.replace(".", "_");
   switch (e) {
     case 0:
-      C[r] = process.env[t] == "null" ? null : process.env[t];
+      S[r] = process.env[t] == "null" ? null : process.env[t];
       break;
     case 1:
-      C[r] = process.env[t] == "null" ? null : Number(process.env[t]);
+      S[r] = process.env[t] == "null" ? null : Number(process.env[t]);
       break;
     case 2:
-      C[r] = ["1", "true"].includes(((i = process.env[t]) == null ? void 0 : i.toLowerCase()) ?? "");
+      S[r] = ["1", "true"].includes(((i = process.env[t]) == null ? void 0 : i.toLowerCase()) ?? "");
       break;
     case 3:
-      C[r] = JSON.parse(process.env[t] ?? "{}");
+      S[r] = JSON.parse(process.env[t] ?? "{}");
       break;
     case 4:
-      C[r] = JSON.parse(process.env[t] ?? "[]");
+      S[r] = JSON.parse(process.env[t] ?? "[]");
       break;
   }
 }
-function w(C, a, e, t, r, i = !1) {
-  const s = "CROSSAUTH_" + r;
-  if (i && !pe(C, t) && !(s && s in process.env))
-    throw new o(l.Configuration, C + " is required");
-  pe(C, t) ? je(e, C, t) : r && s in process.env && process.env[s] != null && Ve(e, C, a, s);
+function w(S, s, e, t, r, i = !1) {
+  const a = "CROSSAUTH_" + r;
+  if (i && !pe(S, t) && !(a && a in process.env))
+    throw new o(l.Configuration, S + " is required");
+  pe(S, t) ? je(e, S, t) : r && a in process.env && process.env[a] != null && Ve(e, S, s, a);
 }
 class H {
   /**
    * Constructor
    * @param options See {@link UserStorageOptions}
    */
-  constructor(a = {}) {
+  constructor(s = {}) {
     h(this, "userEditableFields", []);
     h(this, "adminEditableFields", []);
     h(this, "normalizeUsername", !0);
     h(this, "normalizeEmail", !0);
-    w("userEditableFields", m.JsonArray, this, a, "USER_EDITABLE_FIELDS"), w("adminEditableFields", m.JsonArray, this, a, "ADMIN_EDITABLE_FIELDS"), w("normalizeUsername", m.JsonArray, this, a, "NORMALIZE_USERNAME"), w("normalizeEmail", m.JsonArray, this, a, "NORMALIZE_EMAIL");
+    w("userEditableFields", m.JsonArray, this, s, "USER_EDITABLE_FIELDS"), w("adminEditableFields", m.JsonArray, this, s, "ADMIN_EDITABLE_FIELDS"), w("normalizeUsername", m.JsonArray, this, s, "NORMALIZE_USERNAME"), w("normalizeEmail", m.JsonArray, this, s, "NORMALIZE_EMAIL");
   }
   /**
    * Creates a user with the given details and secrets.
@@ -84,7 +84,7 @@ class H {
    * @param _secrets will be put in the UserSecrets table
    * @returns the new user as a {@link @crossauth/common!User} object.
    */
-  createUser(a, e) {
+  createUser(s, e) {
     throw new o(l.Configuration);
   }
   /**
@@ -94,27 +94,27 @@ class H {
    * @param str the string to normalize
    * @returns the normalized string, in lowercase with diacritics removed
    */
-  static normalize(a) {
-    return a.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase();
+  static normalize(s) {
+    return s.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase();
   }
 }
-class z {
+class L {
   /**
    * Returns an object decoded from the data field as a JSON string
    * @param data the JSON string to decode
    * @returns the parse JSON object
    * @throws an exception is data is not a valid JSON string
    */
-  static decodeData(a) {
-    return a == null || a == "" ? {} : JSON.parse(a);
+  static decodeData(s) {
+    return s == null || s == "" ? {} : JSON.parse(s);
   }
   /**
    * Returns a JSON string encoded from the given object
    * @param data the object to encode
    * @returns a JSON string
    */
-  static encodeData(a) {
-    return a ? JSON.stringify(a) : "{}";
+  static encodeData(s) {
+    return s ? JSON.stringify(s) : "{}";
   }
   /**
    * Helper function for imnpklementing `updateData`
@@ -123,15 +123,15 @@ class z {
    * @param value the value to set it to
    * @returns new data object if changes were made, undefined otherwise
    */
-  updateDataInternal(a, e, t) {
+  updateDataInternal(s, e, t) {
     if (e.indexOf(".") > 0) {
-      let r = e.split("."), i = a;
-      for (let s = 0; s < r.length - 1 && a; s++)
-        i = i[r[s]];
+      let r = e.split("."), i = s;
+      for (let a = 0; a < r.length - 1 && s; a++)
+        i = i[r[a]];
       if (i)
-        return i[r[r.length - 1]] = t, a;
+        return i[r[r.length - 1]] = t, s;
     } else
-      return a[e] = t, a;
+      return s[e] = t, s;
   }
   /**
    * Helper function for imnpklementing `deleteData`
@@ -140,14 +140,14 @@ class z {
    * @param dataName name of field to delete (may contain dots)
    * @returns true if modifications were made, false otherwise
    */
-  deleteDataInternal(a, e) {
+  deleteDataInternal(s, e) {
     if (e.indexOf(".") > 0) {
-      let t = e.split("."), r = a;
-      for (let i = 0; i < t.length - 1 && a; i++)
+      let t = e.split("."), r = s;
+      for (let i = 0; i < t.length - 1 && s; i++)
         r = r[t[i]];
       return r && r[t[t.length - 1]] ? (delete r[t[t.length - 1]], !0) : !1;
     } else
-      return e in a ? (delete a[e], !0) : !1;
+      return e in s ? (delete s[e], !0) : !1;
   }
 }
 class me {
@@ -155,7 +155,7 @@ class me {
    * Constructor
    * @param _options see {@link OAuthClientStorageOptions}
    */
-  constructor(a = {}) {
+  constructor(s = {}) {
   }
 }
 class we {
@@ -163,7 +163,7 @@ class we {
    * Constructor
    * @param _options see {@link OAuthAuthorizationStorageOptions}
    */
-  constructor(a = {}) {
+  constructor(s = {}) {
   }
 }
 class G extends H {
@@ -186,9 +186,9 @@ class G extends H {
     }), e && e.prismaClient ? this.prismaClient = e.prismaClient : this.prismaClient = new ce();
   }
   async getUser(e, t, r) {
-    let i, s;
+    let i, a;
     try {
-      s = await this.prismaClient[this.userTable].findUniqueOrThrow({
+      a = await this.prismaClient[this.userTable].findUniqueOrThrow({
         where: {
           [e]: t
         },
@@ -198,20 +198,20 @@ class G extends H {
       i = new o(l.UserNotExist);
     }
     if (this.prismaClient || (i = new o(l.Connection)), i) throw i;
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.awaitingTwoFactorSetup)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.awaitingTwoFactorSetup)
       throw u.logger.debug(f({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.disabled)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.disabled)
       throw u.logger.debug(f({ msg: "User is deactivated" })), new o(l.UserNotActive);
-    if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && s.state == E.awaitingEmailVerification)
+    if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && a.state == E.awaitingEmailVerification)
       throw u.logger.debug(f({ msg: "User has not verified email" })), new o(l.EmailNotVerified);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.passwordChangeNeeded)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.passwordChangeNeeded)
       throw u.logger.debug(f({ msg: "User must change password" })), new o(l.PasswordChangeNeeded);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (s.state == E.passwordResetNeeded || s.state == E.passwordAndFactor2ResetNeeded))
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (a.state == E.passwordResetNeeded || a.state == E.passwordAndFactor2ResetNeeded))
       throw u.logger.debug(f({ msg: "User must reset password" })), new o(l.PasswordResetNeeded);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.factor2ResetNeeded)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.factor2ResetNeeded)
       throw u.logger.debug(f({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
-    const n = s.secrets || {};
-    return s.secrets && (delete n[this.useridForeignKeyColumn], delete s.secrets), { user: { ...s, id: s[this.idColumn] }, secrets: { userid: s[this.idColumn], ...n } };
+    const n = a.secrets || {};
+    return a.secrets && (delete n[this.useridForeignKeyColumn], delete a.secrets), { user: { ...a, id: a[this.idColumn] }, secrets: { userid: a[this.idColumn], ...n } };
   }
   /**
    * Returns a {@link @crossauth/common!User} and {@link @crossauth/common!UserSecrets} instance matching the given username, or throws an Exception.
@@ -223,6 +223,17 @@ class G extends H {
     const r = G.normalize(e);
     return this.getUser("username_normalized", r, t);
   }
+  /**
+   * Returns user matching the given field, or throws an exception.  
+   * 
+   * @param field the field to match
+   * @param value the value to match (case sensitive)
+   * @param options optionally turn off checks.  Used internally
+   * @throws CrossauthException with ErrorCode either `UserNotExist` or whatever pg throws
+   */
+  async getUserBy(e, t, r) {
+    return this.getUser(e, t, r);
+  }
   /**
    * Returns a {@link @crossauth/common!User} and {@link @crossauth/common!UserSecrets} instance matching the given email address, or throws an Exception.
    * 
@@ -266,7 +277,7 @@ class G extends H {
     if (!e.id) throw new o(l.InvalidKey);
     t && !t.userid && (t = { ...t, userid: e[this.idColumn] });
     try {
-      let { id: r, ...i } = e, { userid: s, ...n } = t ?? {};
+      let { id: r, ...i } = e, { userid: a, ...n } = t ?? {};
       "email" in i && i.email && (i = { email_normalized: G.normalize(i.email), ...i }), "username" in i && i.username && (i = { username_normalized: G.normalize(i.username), ...i }), t ? await this.prismaClient.$transaction(async (c) => {
         let d = {};
         try {
@@ -317,13 +328,13 @@ class G extends H {
   async createUser(e, t) {
     let r;
     if (t && !t.password) throw new o(l.PasswordFormat, "Password required when creating user");
-    let i, s = "", n = "";
+    let i, a = "", n = "";
     try {
-      "email" in e && e.email && (n = G.normalize(e.email)), "username" in e && e.username && (s = G.normalize(e.username)), t ? i = await this.prismaClient[this.userTable].create({
+      "email" in e && e.email && (n = G.normalize(e.email)), "username" in e && e.username && (a = G.normalize(e.username)), t ? i = await this.prismaClient[this.userTable].create({
         data: {
           ...e,
           email_normalized: n,
-          username_normalized: s,
+          username_normalized: a,
           secrets: {
             create: t
           }
@@ -333,7 +344,7 @@ class G extends H {
         data: {
           ...e,
           email_normalized: n,
-          username_normalized: s
+          username_normalized: a
         }
       });
     } catch (c) {
@@ -402,7 +413,7 @@ class G extends H {
     }
   }
 }
-class vt extends z {
+class kt extends L {
   /**
    * Constructor with user storage object to use plus optional parameters.
    * 
@@ -428,17 +439,17 @@ class vt extends z {
   async getKeyWithTransaction(e, t) {
     let r = { userid: 0, value: "", created: /* @__PURE__ */ new Date(), expires: void 0 }, i;
     try {
-      let s = await t[this.keyTable].findUniqueOrThrow({
+      let a = await t[this.keyTable].findUniqueOrThrow({
         where: {
           value: e
         }
       });
       r = {
-        ...s,
-        userid: s[this.useridForeignKeyColumn]
+        ...a,
+        userid: a[this.useridForeignKeyColumn]
       }, this.useridForeignKeyColumn != "userid" && delete r[this.useridForeignKeyColumn];
-    } catch (s) {
-      u.logger.debug(f({ err: s })), i = new o(l.InvalidKey);
+    } catch (a) {
+      u.logger.debug(f({ err: a })), i = new o(l.InvalidKey);
     }
     if (i)
       throw i;
@@ -454,7 +465,7 @@ class vt extends z {
    * @param extraFields these will be stored in the key table row
    * @throws {@link @crossauth/common!CrossauthError } if the key could not be stored.
    */
-  async saveKey(e, t, r, i, s, n = {}) {
+  async saveKey(e, t, r, i, a, n = {}) {
     let c;
     try {
       let d = {
@@ -462,7 +473,7 @@ class vt extends z {
         value: t,
         created: r,
         expires: i ?? null,
-        data: s,
+        data: a,
         ...n
       };
       await this.prismaClient[this.keyTable].create({
@@ -525,8 +536,8 @@ class vt extends z {
           }
         })
       );
-    } catch (s) {
-      u.logger.debug(f({ err: s })), i = new o(l.Connection, "Error deleting key");
+    } catch (a) {
+      u.logger.debug(f({ err: a })), i = new o(l.Connection, "Error deleting key");
     }
     if (i) throw i;
   }
@@ -578,8 +589,8 @@ class vt extends z {
         where: {
           [this.useridForeignKeyColumn]: e ?? null
         }
-      })).map((s) => {
-        let n = { ...s, userid: s[this.useridForeignKeyColumn] };
+      })).map((a) => {
+        let n = { ...a, userid: a[this.useridForeignKeyColumn] };
         return this.useridForeignKeyColumn != "userid" && delete n[this.useridForeignKeyColumn], n;
       });
     } catch {
@@ -628,21 +639,21 @@ class vt extends z {
     try {
       await this.prismaClient.$transaction(async (r) => {
         const i = await this.getKeyWithTransaction(e, r);
-        let s;
+        let a;
         if (!i.data || i.data == "")
-          s = {};
+          a = {};
         else
           try {
-            s = JSON.parse(i.data);
+            a = JSON.parse(i.data);
           } catch (n) {
             throw u.logger.debug(f({ err: n })), new o(l.DataFormat);
           }
         for (let n of t) {
-          let c = this.updateDataInternal(s, n.dataName, n.value);
+          let c = this.updateDataInternal(a, n.dataName, n.value);
           if (!c) throw new o(l.BadRequest, `Parents of ${n.dataName} not found in key data`);
-          s = c;
+          a = c;
         }
-        await this.updateKeyWithTransaction({ value: i.value, data: JSON.stringify(s) }, r);
+        await this.updateKeyWithTransaction({ value: i.value, data: JSON.stringify(a) }, r);
       }, { timeout: this.transactionTimeout });
     } catch (r) {
       throw r && typeof r == "object" && !("isCrossauthError" in r) ? (u.logger.debug(f({ err: r })), new o(l.Connection, "Failed updating session data")) : r;
@@ -655,24 +666,24 @@ class vt extends z {
     try {
       let r = !1;
       await this.prismaClient.$transaction(async (i) => {
-        let s = {};
+        let a = {};
         const n = await this.getKeyWithTransaction(e, i);
         if (n.data && n.data != "") {
           try {
-            s = JSON.parse(n.data);
+            a = JSON.parse(n.data);
           } catch (c) {
             throw u.logger.debug(f({ err: c })), new o(l.DataFormat);
           }
-          r = this.deleteDataInternal(s, t);
+          r = this.deleteDataInternal(a, t);
         }
-        r && await this.updateKeyWithTransaction({ value: n.value, data: JSON.stringify(s) }, i);
+        r && await this.updateKeyWithTransaction({ value: n.value, data: JSON.stringify(a) }, i);
       }, { timeout: this.transactionTimeout });
     } catch (r) {
       throw r && typeof r == "object" && !("isCrossauthError" in r) ? (u.logger.debug(f({ err: r })), new o(l.Connection, "Failed updating session data")) : r;
     }
   }
 }
-class Tt extends me {
+class Et extends me {
   /**
    * Constructor with user storage object to use plus optional parameters.
    * 
@@ -696,8 +707,8 @@ class Tt extends me {
   async getClientByName(e, t) {
     return await this.getClientWithTransaction("client_name", e, this.prismaClient, !1, t);
   }
-  async getClientWithTransaction(e, t, r, i, s) {
-    const n = s == null && s !== null ? {} : { [this.useridForeignKeyColumn]: s };
+  async getClientWithTransaction(e, t, r, i, a) {
+    const n = a == null && a !== null ? {} : { [this.useridForeignKeyColumn]: a };
     try {
       if (i) {
         const c = await r[this.clientTable].findUniqueOrThrow({
@@ -726,7 +737,7 @@ class Tt extends me {
         for (let d of c) {
           const g = d.redirect_uri, y = d.valid_flow;
           let p = d[this.useridForeignKeyColumn];
-          p == null && (p = void 0), d.userid = p, this.useridForeignKeyColumn != "userid" && delete d[this.useridForeignKeyColumn], d.client_secret = d.client_secret ?? void 0, d.redirect_uri = g.map((k) => k.uri), d.valid_flow = y.map((k) => k.flow);
+          p == null && (p = void 0), d.userid = p, this.useridForeignKeyColumn != "userid" && delete d[this.useridForeignKeyColumn], d.client_secret = d.client_secret ?? void 0, d.redirect_uri = g.map((_) => _.uri), d.valid_flow = y.map((_) => _.flow);
         }
         return c;
       }
@@ -754,9 +765,9 @@ class Tt extends me {
     }
   }
   async createClientWithTransaction(e, t) {
-    const { redirect_uri: r, valid_flow: i, userid: s, ...n } = e;
+    const { redirect_uri: r, valid_flow: i, userid: a, ...n } = e;
     let c;
-    if (s && (n[this.useridForeignKeyColumn] = s), this.useridForeignKeyColumn != "userid" && delete e[this.useridForeignKeyColumn], r)
+    if (a && (n[this.useridForeignKeyColumn] = a), this.useridForeignKeyColumn != "userid" && delete e[this.useridForeignKeyColumn], r)
       for (let d = 0; d < r.length; ++d) {
         if (r[d].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
         try {
@@ -844,28 +855,28 @@ class Tt extends me {
     if (!e.client_id) throw new o(l.InvalidClientId);
     const r = e.redirect_uri, i = e.valid_flow;
     if (r)
-      for (let s = 0; s < r.length; ++s) {
-        if (r[s].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
+      for (let a = 0; a < r.length; ++a) {
+        if (r[a].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
         try {
-          new URL(r[s]);
+          new URL(r[a]);
         } catch {
-          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[s]} is not valid`);
+          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[a]} is not valid`);
         }
       }
     if (i) {
-      for (let s = 0; s < i.length; ++s)
-        if (!b.isValidFlow(i[s])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
+      for (let a = 0; a < i.length; ++a)
+        if (!b.isValidFlow(i[a])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
     }
     try {
-      let s = { ...e };
-      delete s.client_id, delete s.redirect_uri, delete s.valid_flow, "userid" in s && this.useridForeignKeyColumn != "userid" && (s[this.useridForeignKeyColumn] = s.userid, delete s.userid), Object.keys(s).length > 0 && await t[this.clientTable].update({
+      let a = { ...e };
+      delete a.client_id, delete a.redirect_uri, delete a.valid_flow, "userid" in a && this.useridForeignKeyColumn != "userid" && (a[this.useridForeignKeyColumn] = a.userid, delete a.userid), Object.keys(a).length > 0 && await t[this.clientTable].update({
         where: {
           client_id: e.client_id
         },
-        data: s
+        data: a
       });
-    } catch (s) {
-      throw u.logger.debug(f({ err: s })), new o(l.Connection, "Error updating client");
+    } catch (a) {
+      throw u.logger.debug(f({ err: a })), new o(l.Connection, "Error updating client");
     }
     if (r != null)
       try {
@@ -874,15 +885,15 @@ class Tt extends me {
             client_id: e.client_id
           }
         });
-        for (let s = 0; s < r.length; ++s)
+        for (let a = 0; a < r.length; ++a)
           await t[this.redirectUriTable].create({
             data: {
               client_id: e.client_id,
-              uri: r[s]
+              uri: r[a]
             }
           });
-      } catch (s) {
-        throw s instanceof X.PrismaClientKnownRequestError || s instanceof Object && "code" in s ? s.code == "P2002" ? (u.logger.debug(f({ err: s })), new o(l.KeyExists, "Attempt to update an OAuth client with a redirect Uri that already belongs to another client")) : (u.logger.debug(f({ err: s })), new o(l.Connection, "Error updating client")) : (u.logger.debug(f({ err: s })), new o(l.Connection, "Error updating client"));
+      } catch (a) {
+        throw a instanceof X.PrismaClientKnownRequestError || a instanceof Object && "code" in a ? a.code == "P2002" ? (u.logger.debug(f({ err: a })), new o(l.KeyExists, "Attempt to update an OAuth client with a redirect Uri that already belongs to another client")) : (u.logger.debug(f({ err: a })), new o(l.Connection, "Error updating client")) : (u.logger.debug(f({ err: a })), new o(l.Connection, "Error updating client"));
       }
     if (i != null)
       try {
@@ -891,15 +902,15 @@ class Tt extends me {
             client_id: e.client_id
           }
         });
-        for (let s = 0; s < i.length; ++s)
+        for (let a = 0; a < i.length; ++a)
           await t[this.validFlowTable].create({
             data: {
               client_id: e.client_id,
-              flow: i[s]
+              flow: i[a]
             }
           });
-      } catch (s) {
-        throw s instanceof X.PrismaClientKnownRequestError || s instanceof Object && "code" in s ? (u.logger.debug(f({ err: s })), new o(l.Connection, "Error updating client")) : (u.logger.debug(f({ err: s })), new o(l.Connection, "Error updating client"));
+      } catch (a) {
+        throw a instanceof X.PrismaClientKnownRequestError || a instanceof Object && "code" in a ? (u.logger.debug(f({ err: a })), new o(l.Connection, "Error updating client")) : (u.logger.debug(f({ err: a })), new o(l.Connection, "Error updating client"));
       }
   }
   async updateClientWithTransaction_deleteAndInsert(e, t) {
@@ -911,8 +922,8 @@ class Tt extends me {
     let i = {};
     e && (i.skip = e), t && (i.take = t);
     try {
-      let s = [];
-      return r || r === null ? s = await this.prismaClient[this.clientTable].findMany({
+      let a = [];
+      return r || r === null ? a = await this.prismaClient[this.clientTable].findMany({
         ...i,
         where: {
           [this.useridForeignKeyColumn]: r
@@ -922,20 +933,20 @@ class Tt extends me {
             client_name: "asc"
           }
         ]
-      }) : s = await this.prismaClient[this.clientTable].findMany({
+      }) : a = await this.prismaClient[this.clientTable].findMany({
         ...i,
         orderBy: [
           {
             client_name: "asc"
           }
         ]
-      }), s.forEach((n) => (this.useridForeignKeyColumn != "userid" && (n.userid = n[this.useridForeignKeyColumn], delete n[this.useridForeignKeyColumn]), n.userid = n.userid === null ? void 0 : n.userid, n)), s;
-    } catch (s) {
-      throw u.logger.error(f({ err: s })), new o(l.Connection, "Couldn't select from client table");
+      }), a.forEach((n) => (this.useridForeignKeyColumn != "userid" && (n.userid = n[this.useridForeignKeyColumn], delete n[this.useridForeignKeyColumn]), n.userid = n.userid === null ? void 0 : n.userid, n)), a;
+    } catch (a) {
+      throw u.logger.error(f({ err: a })), new o(l.Connection, "Couldn't select from client table");
     }
   }
 }
-class kt extends we {
+class bt extends we {
   /**
    * Constructor with user storage object to use plus optional parameters.
    * 
@@ -985,22 +996,22 @@ class kt extends we {
           [this.useridForeignKeyColumn]: t ?? null
         }
       });
-      const s = [];
+      const a = [];
       r.forEach((n) => {
-        s.push(i[this.authorizationTable].create({
+        a.push(i[this.authorizationTable].create({
           data: {
             client_id: e,
             [this.useridForeignKeyColumn]: t ?? null,
             scope: n
           }
         }));
-      }), await Promise.all(s);
-    } catch (s) {
-      throw u.logger.debug(f({ err: s })), new o(l.Connection, "Error updating OAuth authorizations");
+      }), await Promise.all(a);
+    } catch (a) {
+      throw u.logger.debug(f({ err: a })), new o(l.Connection, "Error updating OAuth authorizations");
     }
   }
 }
-class _t extends H {
+class Ut extends H {
   /**
    * Creates a InMemoryUserStorage object, optionally overriding defaults.
    * @param options see {@link InMemoryUserStorageOptions}
@@ -1049,8 +1060,8 @@ class _t extends H {
         throw u.logger.debug(f({ msg: "User email not verified" })), new o(l.EmailNotVerified);
       if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.disabled)
         throw u.logger.debug(f({ msg: "User is deactivated" })), new o(l.UserNotActive);
-      const s = this.secretsByUsername[r];
-      return { user: { ...i }, secrets: { userid: i.id, ...s } };
+      const a = this.secretsByUsername[r];
+      return { user: { ...i }, secrets: { userid: i.id, ...a } };
     }
     throw u.logger.debug(f({ msg: "User does not exist" })), new o(l.UserNotExist);
   }
@@ -1070,8 +1081,8 @@ class _t extends H {
         throw u.logger.debug(f({ msg: "User email not verified" })), new o(l.EmailNotVerified);
       if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state != "active")
         throw u.logger.debug(f({ msg: "User is deactivated" })), new o(l.UserNotActive);
-      const s = this.secretsByEmail[r];
-      return { user: { ...i }, secrets: { userid: i.id, ...s } };
+      const a = this.secretsByEmail[r];
+      return { user: { ...i }, secrets: { userid: i.id, ...a } };
     }
     throw u.logger.debug(f({ msg: "User does not exist" })), new o(l.UserNotExist);
   }
@@ -1089,6 +1100,16 @@ class _t extends H {
       this.getUserByUsername(e, t)
     );
   }
+  /**
+   * Returns a {@link User } and {@link UserSecrets } instance matching the given email address, or throws an Exception.
+   * 
+   * @param email the emaila ddress to look up
+   * @returns a {@link User } and {@link UserSecrets } instance, ie including the password hash.
+   * @throws {@link @crossauth/common!CrossauthError } with {@link @crossauth/common!ErrorCode } set to either `UserNotExist`.
+   */
+  async getUserBy(e, t, r) {
+    throw new o(l.NotImplemented);
+  }
   /**
    * If the given session key exist in the database, update it with the passed values.  If it doesn't
    * exist, throw a CreossauthError with InvalidKey.
@@ -1129,14 +1150,14 @@ class _t extends H {
     const r = Object.keys(this.usersByUsername).sort();
     let i = [];
     e || (e = 0);
-    let s = t || r.length;
-    s >= r.length - e && (s = r.length - e);
-    for (let n = e; n < s; ++n)
+    let a = t || r.length;
+    a >= r.length - e && (a = r.length - e);
+    for (let n = e; n < a; ++n)
       i.push(this.usersByUsername[r[n]]);
     return i;
   }
 }
-class Et extends z {
+class At extends L {
   /**
    * Constructor
    */
@@ -1168,13 +1189,13 @@ class Et extends z {
    * @param expires the date/time the key expires.
    * @param extraFields these will also be stored in the key table row
    */
-  async saveKey(e, t, r, i, s, n) {
+  async saveKey(e, t, r, i, a, n) {
     const c = {
       value: t,
       userid: e,
       created: r,
       expires: i,
-      data: s,
+      data: a,
       ...n
     };
     this.keys[t] = c, e ? e in this.keysByUserId ? this.keysByUserId[e].push(c) : this.keysByUserId[e] = [c] : this.nonUserKeys.push(c);
@@ -1206,8 +1227,8 @@ class Et extends z {
     for (let t in this.keys) {
       let r = !0;
       const i = this.keys[t];
-      for (let s in e)
-        if (s in i && i[s] != e[s]) {
+      for (let a in e)
+        if (a in i && i[a] != e[a]) {
           r = !1;
           break;
         }
@@ -1216,21 +1237,21 @@ class Et extends z {
     for (let t in this.keysByUserId) {
       const r = this.keysByUserId[t];
       for (let i = 0; i < r.length; ++i) {
-        let s = !0, n = 0;
+        let a = !0, n = 0;
         const c = r[i];
         for (let d in e)
           if (d in c && c[d] != e[d]) {
-            s = !1, n = i;
+            a = !1, n = i;
             break;
           }
-        s && (this.keysByUserId[t] = this.keysByUserId[t].splice(n, 1));
+        a && (this.keysByUserId[t] = this.keysByUserId[t].splice(n, 1));
       }
     }
     for (let t = 0; t < this.nonUserKeys.length; ++t) {
       let r = !0, i = 0;
-      const s = this.nonUserKeys[t];
+      const a = this.nonUserKeys[t];
       for (let n in e)
-        if (n in s && s[n] != e[n]) {
+        if (n in a && a[n] != e[n]) {
           r = !1, i = t;
           break;
         }
@@ -1266,12 +1287,12 @@ class Et extends z {
     else
       try {
         i = JSON.parse(r.data);
-      } catch (s) {
-        throw u.logger.debug(f({ err: s })), new o(l.DataFormat);
+      } catch (a) {
+        throw u.logger.debug(f({ err: a })), new o(l.DataFormat);
       }
-    for (let s of t)
-      if (this.updateDataInternal(i, s.dataName, s.value)) r.data = JSON.stringify(i);
-      else throw new o(l.BadRequest, `parents of ${s.dataName} not found in key data`);
+    for (let a of t)
+      if (this.updateDataInternal(i, a.dataName, a.value)) r.data = JSON.stringify(i);
+      else throw new o(l.BadRequest, `parents of ${a.dataName} not found in key data`);
   }
   /**
    * See {@link KeyStorage}.
@@ -1289,7 +1310,7 @@ class Et extends z {
     this.deleteDataInternal(i, t) && (r.data = JSON.stringify(i));
   }
 }
-class bt extends me {
+class It extends me {
   /**
    * Constructor
    */
@@ -1322,8 +1343,8 @@ class bt extends me {
       const r = this.clientsByName[e];
       if (t == null && t !== null) return r;
       const i = [];
-      for (let s of r)
-        s.userid === t && i.push(s);
+      for (let a of r)
+        a.userid === t && i.push(a);
       return i;
     }
     return [];
@@ -1371,16 +1392,16 @@ class bt extends me {
   }
   async getClients(e, t, r) {
     const i = Object.keys(this.clients).sort();
-    let s = [];
+    let a = [];
     e || (e = 0);
     let n = t || i.length;
     n >= i.length - e && (n = i.length - e);
     for (let c = e; c < n; ++c)
-      r === null ? this.clients[i[c]].userid == null && s.push(this.clients[i[c]]) : r != null && r !== null ? this.clients[i[c]].userid == r && s.push(this.clients[i[c]]) : s.push(this.clients[i[c]]);
-    return s;
+      r === null ? this.clients[i[c]].userid == null && a.push(this.clients[i[c]]) : r != null && r !== null ? this.clients[i[c]].userid == r && a.push(this.clients[i[c]]) : a.push(this.clients[i[c]]);
+    return a;
   }
 }
-class Ut extends we {
+class Pt extends we {
   /**
    * Constructor
    */
@@ -1415,8 +1436,8 @@ class Ut extends we {
       this.byClient[e] = [...r];
   }
 }
-function $e(C, a) {
-  return { username: Array.isArray(a.uid) ? a.uid[0] : a.uid, state: "active", ...C };
+function $e(S, s) {
+  return { username: Array.isArray(s.uid) ? s.uid[0] : s.uid, state: "active", ...S };
 }
 class oe extends H {
   /**
@@ -1474,7 +1495,18 @@ class oe extends H {
    * @throws {@link @crossauth/common!CrossauthError} with {@link @crossauth/common!ErrorCode} `UsernameOrPasswordInvalid` or `Connection`
    */
   async getUserByEmail(e, t) {
-    return await this.getUserByEmail(e, t);
+    return await this.localStorage.getUserByEmail(e, t);
+  }
+  /**
+   * Returns user matching the given field, or throws an exception.  
+   * 
+   * @param field the field to match
+   * @param value the value to match (case sensitive)
+   * @param options optionally turn off checks.  Used internally
+   * @throws CrossauthException with ErrorCode either `UserNotExist` or whatever pg throws
+   */
+  async getUserBy(e, t, r) {
+    return await this.localStorage.getUserBy(e, t, r);
   }
   async getUsers(e, t) {
     return await this.localStorage.getUsers(e, t);
@@ -1514,35 +1546,35 @@ class oe extends H {
   async getLdapUser(e, t) {
     let r;
     try {
-      const i = oe.sanitizeLdapDnForSerach(e), s = [this.ldapUsernameAttribute + "=" + i, this.ldapUserSearchBase].join(",");
+      const i = oe.sanitizeLdapDnForSerach(e), a = [this.ldapUsernameAttribute + "=" + i, this.ldapUserSearchBase].join(",");
       if (!t) throw new o(l.PasswordInvalid);
-      return u.logger.debug(f({ msg: "LDAP search " + s })), r = await this.ldapBind(s, t), await this.searchUser(r, s);
+      return u.logger.debug(f({ msg: "LDAP search " + a })), r = await this.ldapBind(a, t), await this.searchUser(r, a);
     } catch (i) {
       u.logger.debug(f({ err: i }));
-      const s = o.asCrossauthError(i);
-      throw i instanceof ye.InvalidCredentialsError ? new o(l.UsernameOrPasswordInvalid) : s.code != l.UnknownError ? s : new o(l.Connection, "LDAP error getting user");
+      const a = o.asCrossauthError(i);
+      throw i instanceof ye.InvalidCredentialsError ? new o(l.UsernameOrPasswordInvalid) : a.code != l.UnknownError ? a : new o(l.Connection, "LDAP error getting user");
     }
   }
   // bind and return the ldap client
   // from https://github.com/shaozi/ldap-authentication/blob/master/index.js
   ldapBind(e, t) {
     return new Promise((r, i) => {
-      let s = ye.createClient({ url: this.ldapUrls });
-      s.on("connect", function() {
-        s.bind(e, t, function(n) {
+      let a = ye.createClient({ url: this.ldapUrls });
+      a.on("connect", function() {
+        a.bind(e, t, function(n) {
           if (n) {
-            i(n), s.unbind();
+            i(n), a.unbind();
             return;
           }
-          r(s);
+          r(a);
         });
-      }), s.on("timeout", (n) => {
+      }), a.on("timeout", (n) => {
         i(n);
-      }), s.on("connectTimeout", (n) => {
+      }), a.on("connectTimeout", (n) => {
         i(n);
-      }), s.on("error", (n) => {
+      }), a.on("error", (n) => {
         i(n);
-      }), s.on("connectError", function(n) {
+      }), a.on("connectError", function(n) {
         if (n) {
           i(n);
           return;
@@ -1551,7 +1583,7 @@ class oe extends H {
     });
   }
   async searchUser(e, t, r) {
-    return new Promise(function(i, s) {
+    return new Promise(function(i, a) {
       let n = {
         scope: "base"
       };
@@ -1561,15 +1593,15 @@ class oe extends H {
         function(c, d) {
           let g;
           if (c) {
-            s(c), e.unbind();
+            a(c), e.unbind();
             return;
           }
           d.on("searchEntry", function(y) {
             g = oe.searchResultToUser(y.pojo);
           }), d.on("error", function(y) {
-            s(y), e.unbind();
+            a(y), e.unbind();
           }), d.on("end", function(y) {
-            y.status != 0 ? s(new o(l.Connection, "LDAP  onnection failed")) : g ? i(g) : s(new o(l.UsernameOrPasswordInvalid)), e.unbind();
+            y.status != 0 ? a(new o(l.Connection, "LDAP  onnection failed")) : g ? i(g) : a(new o(l.UsernameOrPasswordInvalid)), e.unbind();
           });
         }
       );
@@ -1649,42 +1681,53 @@ class Y extends H {
     const r = this.normalizeEmail ? Y.normalize(e) : e;
     return this.getUser("email_normalized", r, t);
   }
+  /**
+   * Returns user matching the given field, or throws an exception.  
+   * 
+   * @param field the field to match
+   * @param value the value to match (case sensitive)
+   * @param options optionally turn off checks.  Used internally
+   * @throws CrossauthException with ErrorCode either `UserNotExist` or whatever pg throws
+   */
+  async getUserBy(e, t, r) {
+    return await this.getUser(e, t, r);
+  }
   async getUser(e, t, r) {
-    let i = await this.dbPool.connect(), s, n, c = this.dbPool.parameters();
+    let i = await this.dbPool.connect(), a, n, c = this.dbPool.parameters();
     try {
       await i.startTransaction();
       let d = `select * from ${this.userTable} where ${e} = ` + c.nextParameter(), g = await i.execute(d, [t]);
       if (g.length == 0)
         throw new o(l.UserNotExist);
-      let y, p, k;
+      let y, p, _;
       if (this.idColumn in g[0]) y = g[0][this.idColumn];
       else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
       if ("username" in g[0]) p = g[0].username;
       else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
-      if ("state" in g[0]) k = g[0].state;
+      if ("state" in g[0]) _ = g[0].state;
       else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
-      if (s = {
+      if (a = {
         ...g[0],
         id: y,
         username: p,
-        state: k
-      }, !s) throw new o(l.UserNotExist);
-      if (c = this.dbPool.parameters(), d = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = ` + c.nextParameter(), g = await i.execute(d, [s.id]), g.length == 0)
+        state: _
+      }, !a) throw new o(l.UserNotExist);
+      if (c = this.dbPool.parameters(), d = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = ` + c.nextParameter(), g = await i.execute(d, [a.id]), g.length == 0)
         throw new o(l.UserNotExist);
-      if (g.length > 0 ? n = { userid: s.id, ...g[0] } : n = { userid: s.id }, !n) throw new o(l.UserNotExist);
-      if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.awaitingTwoFactorSetup)
+      if (g.length > 0 ? n = { userid: a.id, ...g[0] } : n = { userid: a.id }, !n) throw new o(l.UserNotExist);
+      if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.awaitingTwoFactorSetup)
         throw u.logger.debug(f({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.disabled)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.disabled)
         throw u.logger.debug(f({ msg: "User is deactivated" })), new o(l.UserNotActive);
-      if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && s.state == E.awaitingEmailVerification)
+      if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && a.state == E.awaitingEmailVerification)
         throw u.logger.debug(f({ msg: "User has not verified email" })), new o(l.EmailNotVerified);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.passwordChangeNeeded)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.passwordChangeNeeded)
         throw u.logger.debug(f({ msg: "User must change password" })), new o(l.PasswordChangeNeeded);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (s.state == E.passwordResetNeeded || s.state == E.passwordAndFactor2ResetNeeded))
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (a.state == E.passwordResetNeeded || a.state == E.passwordAndFactor2ResetNeeded))
         throw u.logger.debug(f({ msg: "User must reset password" })), new o(l.PasswordResetNeeded);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.factor2ResetNeeded)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.factor2ResetNeeded)
         throw u.logger.debug(f({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
-      return { user: s, secrets: n };
+      return { user: a, secrets: n };
     } catch (d) {
       throw await i.rollback(), d;
     } finally {
@@ -1699,27 +1742,27 @@ class Y extends H {
    */
   async getUsers(e, t) {
     const r = await this.dbPool.connect();
-    let i = [], s = [], n = "", c = "", d = this.dbPool.parameters();
-    e && (c = "OFFSET " + d.nextParameter()), t && (s.push(t), n = "LIMIT " + d.nextParameter());
+    let i = [], a = [], n = "", c = "", d = this.dbPool.parameters();
+    e && (c = "OFFSET " + d.nextParameter()), t && (a.push(t), n = "LIMIT " + d.nextParameter());
     try {
-      let g = `select * from ${this.userTable} ${n} ${c} order by username_normalized asc`, y = await r.execute(g, s);
+      let g = `select * from ${this.userTable} ${n} ${c} order by username_normalized asc`, y = await r.execute(g, a);
       if (y.length == 0)
         throw new o(l.UserNotExist);
       for (let p of y) {
-        let k, S, v;
-        if (this.idColumn in p) k = p[this.idColumn];
+        let _, C, v;
+        if (this.idColumn in p) _ = p[this.idColumn];
         else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
-        if ("username" in p) S = p.username;
+        if ("username" in p) C = p.username;
         else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
         if ("state" in p) v = p.state;
         else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
-        let _ = {
+        let k = {
           ...p,
-          id: k,
-          username: S,
+          id: _,
+          username: C,
           state: v
         };
-        i.push(_);
+        i.push(k);
       }
       return i;
     } catch (g) {
@@ -1743,8 +1786,8 @@ class Y extends H {
     const r = await this.dbPool.connect();
     try {
       await r.startTransaction();
-      let i = this.dbPool.parameters(), s = `select * from ${this.userTable} where ${this.idColumn} = ` + i.nextParameter();
-      if ((await r.execute(s, [e.id])).length == 0)
+      let i = this.dbPool.parameters(), a = `select * from ${this.userTable} where ${this.idColumn} = ` + i.nextParameter();
+      if ((await r.execute(a, [e.id])).length == 0)
         throw new o(l.UserNotExist);
       let c = { ...e }, d = t ? { ...t } : void 0;
       "email" in c && c.email && (c = { email_normalized: this.normalizeEmail ? Y.normalize(c.email) : c.email, ...c }), "username" in c && c.username && (c = { username_normalized: this.normalizeUsername ? Y.normalize(c.username) : c.username, ...c }), i = this.dbPool.parameters();
@@ -1754,8 +1797,8 @@ class Y extends H {
       if (g.length > 0) {
         let p = g.join(", ");
         y.push(e.id);
-        let k = `update ${this.userTable} set ${p} where ${this.idColumn} = ` + i.nextParameter();
-        await r.execute(k, y);
+        let _ = `update ${this.userTable} set ${p} where ${this.idColumn} = ` + i.nextParameter();
+        await r.execute(_, y);
       }
       if (t) {
         g = [], y = [], i = this.dbPool.parameters();
@@ -1764,8 +1807,8 @@ class Y extends H {
         if (g.length > 0) {
           let p = g.join(", ");
           y.push(e.id);
-          let k = `update ${this.userSecretsTable} set ${p} where userid = ` + i.nextParameter();
-          await r.execute(k, y);
+          let _ = `update ${this.userSecretsTable} set ${p} where userid = ` + i.nextParameter();
+          await r.execute(_, y);
         }
       }
       await r.commit();
@@ -1791,35 +1834,35 @@ class Y extends H {
     let i;
     try {
       await r.startTransaction();
-      let s = { ...e }, n = t ? { ...t } : void 0;
-      "email" in s && s.email && (s = { email_normalized: this.normalizeEmail ? Y.normalize(s.email) : s.email, ...s }), "username" in s && s.username && (s = { username_normalized: this.normalizeUsername ? Y.normalize(s.username) : s.username, ...s });
+      let a = { ...e }, n = t ? { ...t } : void 0;
+      "email" in a && a.email && (a = { email_normalized: this.normalizeEmail ? Y.normalize(a.email) : a.email, ...a }), "username" in a && a.username && (a = { username_normalized: this.normalizeUsername ? Y.normalize(a.username) : a.username, ...a });
       let c = [], d = [], g = [];
       const y = this.dbPool.parameters();
-      for (let k in s)
-        s[k] != null && k != "id" && (c.push(k), d.push(y.nextParameter()), g.push(s[k]));
+      for (let _ in a)
+        a[_] != null && _ != "id" && (c.push(_), d.push(y.nextParameter()), g.push(a[_]));
       if (c.length > 0) {
-        let k = c.join(", "), S = d.join(", ");
-        const v = `insert into ${this.userTable} (${k}) values (${S}) returning ${this.idColumn}`, _ = await r.execute(v, g);
-        if (_.length == 0 || !_[0][this.idColumn]) throw new o(l.Connection, "Couldn't create user");
-        i = _[0][this.idColumn];
+        let _ = c.join(", "), C = d.join(", ");
+        const v = `insert into ${this.userTable} (${_}) values (${C}) returning ${this.idColumn}`, k = await r.execute(v, g);
+        if (k.length == 0 || !k[0][this.idColumn]) throw new o(l.Connection, "Couldn't create user");
+        i = k[0][this.idColumn];
       }
       if (!i) throw new o(l.Connection, "Couldn't create user");
       if (t) {
         c = [], d = [], g = [];
-        const k = this.dbPool.parameters();
-        c.push("userid"), d.push(k.nextParameter()), g.push(i);
-        for (let S in n)
-          n[S] != null && S != "userid" && (c.push(S), d.push(k.nextParameter()), g.push(n[S]));
+        const _ = this.dbPool.parameters();
+        c.push("userid"), d.push(_.nextParameter()), g.push(i);
+        for (let C in n)
+          n[C] != null && C != "userid" && (c.push(C), d.push(_.nextParameter()), g.push(n[C]));
         if (c.length > 0) {
-          let S = c.join(", "), v = d.join(", ");
-          const _ = `insert into ${this.userSecretsTable} (${S}) values (${v})`;
-          u.logger.debug(f({ msg: "Executing query", query: _ })), await r.execute(_, g);
+          let C = c.join(", "), v = d.join(", ");
+          const k = `insert into ${this.userSecretsTable} (${C}) values (${v})`;
+          u.logger.debug(f({ msg: "Executing query", query: k })), await r.execute(k, g);
         }
       }
       return await r.commit(), (await this.getUserById(i)).user;
-    } catch (s) {
+    } catch (a) {
       await r.rollback();
-      const n = o.asCrossauthError(s);
+      const n = o.asCrossauthError(a);
       throw u.logger.debug(f({ err: n })), n.code == l.ConstraintViolation ? new o(l.UserExists, "User already exists") : n;
     } finally {
       r.release();
@@ -1830,10 +1873,10 @@ class Y extends H {
     let { user: r } = await this.getUserByUsername(e), i = r.id;
     try {
       await t.startTransaction();
-      let s = this.dbPool.parameters(), n = `delete from ${this.userSecretsTable} where ${this.useridForeignKeyColumn}=` + s.nextParameter();
-      await t.execute(n, [i]), s = this.dbPool.parameters(), n = `delete from ${this.userTable} where username=` + s.nextParameter(), await t.execute(n, [e]), await t.commit();
-    } catch (s) {
-      throw await t.rollback(), s;
+      let a = this.dbPool.parameters(), n = `delete from ${this.userSecretsTable} where ${this.useridForeignKeyColumn}=` + a.nextParameter();
+      await t.execute(n, [i]), a = this.dbPool.parameters(), n = `delete from ${this.userTable} where username=` + a.nextParameter(), await t.execute(n, [e]), await t.commit();
+    } catch (a) {
+      throw await t.rollback(), a;
     } finally {
       t.release();
     }
@@ -1860,7 +1903,7 @@ class Y extends H {
     }
   }
 }
-class qe extends z {
+class qe extends L {
   /**
    * Constructor with user storage object to use plus optional parameters.
    * 
@@ -1888,23 +1931,23 @@ class qe extends z {
   }
   async getKeyInTransaction(e, t) {
     const r = this.dbPool.parameters();
-    let i = `select * from ${this.keyTable} where value = ` + r.nextParameter(), s = await e.execute(i, [t]);
-    if (s.length == 0)
+    let i = `select * from ${this.keyTable} where value = ` + r.nextParameter(), a = await e.execute(i, [t]);
+    if (a.length == 0)
       throw new o(l.InvalidKey);
-    return this.makeKey(s[0]);
+    return this.makeKey(a[0]);
   }
   makeKey(e) {
     e = { ...e };
-    let t, r = null, i, s;
+    let t, r = null, i, a;
     if (this.useridForeignKeyColumn in e && (r = e[this.useridForeignKeyColumn], this.useridForeignKeyColumn != "userid" && delete e[this.useridForeignKeyColumn]), e.value) t = e.value;
     else throw new o(l.InvalidKey, "No value in key");
     if (e.created) i = e.created;
     else throw new o(l.InvalidKey, "No creation date in key");
-    return e.expires && (s = e.expires), e.userid || e.userid, {
+    return e.expires && (a = e.expires), e.userid || e.userid, {
       value: t,
       userid: r,
       created: i,
-      expires: s,
+      expires: a,
       ...e
     };
   }
@@ -1918,20 +1961,20 @@ class qe extends z {
    * @param extraFields these will be stored in the key table row
    * @throws {@link @crossauth/common!CrossauthError } if the key could not be stored.
    */
-  async saveKey(e, t, r, i, s, n = {}) {
+  async saveKey(e, t, r, i, a, n = {}) {
     let c, d = [this.useridForeignKeyColumn, "value", "created", "expires", "data"], g = this.dbPool.parameters(), y = [];
-    for (let _ = 0; _ < 5; ++_)
+    for (let k = 0; k < 5; ++k)
       y.push(g.nextParameter());
-    let p = [e ?? null, t, r, i ?? null, s ?? ""];
-    for (let _ in n)
-      d.push(_), y.push(g.nextParameter()), p.push(n[_]);
-    let k = d.join(", "), S = y.join(", ");
+    let p = [e ?? null, t, r, i ?? null, a ?? ""];
+    for (let k in n)
+      d.push(k), y.push(g.nextParameter()), p.push(n[k]);
+    let _ = d.join(", "), C = y.join(", ");
     const v = await this.dbPool.connect();
     try {
-      const _ = `insert into ${this.keyTable} (${k}) values (${S})`;
-      await v.execute(_, p);
-    } catch (_) {
-      o.asCrossauthError(_).code == l.ConstraintViolation ? (u.logger.warn(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), u.logger.debug(f({ err: _ })), c = new o(l.KeyExists)) : (u.logger.debug(f({ err: _ })), c = new o(l.Connection, "Error saving key"));
+      const k = `insert into ${this.keyTable} (${_}) values (${C})`;
+      await v.execute(k, p);
+    } catch (k) {
+      o.asCrossauthError(k).code == l.ConstraintViolation ? (u.logger.warn(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), u.logger.debug(f({ err: k })), c = new o(l.KeyExists)) : (u.logger.debug(f({ err: k })), c = new o(l.Connection, "Error saving key"));
     } finally {
       v.release();
     }
@@ -1950,17 +1993,17 @@ class qe extends z {
   async deleteAllForUser(e, t, r) {
     const i = await this.dbPool.connect();
     try {
-      let s, n = [], c = "", d = this.dbPool.parameters();
+      let a, n = [], c = "", d = this.dbPool.parameters();
       if (e) {
         const g = d.nextParameter(), y = d.nextParameter();
-        s = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${g} and value like ${y} `, n = [e];
+        a = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${g} and value like ${y} `, n = [e];
       } else {
         const g = d.nextParameter();
-        s = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} is null and value like ${g}`;
+        a = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} is null and value like ${g}`;
       }
-      n.push(t + "%"), r && (c = "and value != " + d.nextParameter(), n.push(r)), s += " " + c, u.logger.debug(f({ msg: "Executing query", query: s })), await i.execute(s, n);
-    } catch (s) {
-      throw s;
+      n.push(t + "%"), r && (c = "and value != " + d.nextParameter(), n.push(r)), a += " " + c, u.logger.debug(f({ msg: "Executing query", query: a })), await i.execute(a, n);
+    } catch (a) {
+      throw a;
     } finally {
       i.release();
     }
@@ -1969,10 +2012,10 @@ class qe extends z {
     const t = await this.dbPool.connect();
     try {
       let r = [], i = [];
-      const s = this.dbPool.parameters();
+      const a = this.dbPool.parameters();
       for (let d in e) {
         let g = d == "userid" ? this.useridForeignKeyColumn : d;
-        e[d] == null ? r.push(g + " is null") : (r.push(g + " = " + s.nextParameter()), i.push(e[d]));
+        e[d] == null ? r.push(g + " is null") : (r.push(g + " = " + a.nextParameter()), i.push(e[d]));
       }
       let n = r.join(" and "), c = `delete from ${this.keyTable} where ${n}`;
       await t.execute(c, i);
@@ -1985,16 +2028,16 @@ class qe extends z {
   async deleteWithPrefix(e, t) {
     const r = await this.dbPool.connect();
     try {
-      let i, s = [];
+      let i, a = [];
       const n = this.dbPool.parameters();
       if (e) {
         let c = n.nextParameter(), d = n.nextParameter();
-        i = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${c} and value like ${d}`, s.push(e);
+        i = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${c} and value like ${d}`, a.push(e);
       } else {
         let c = n.nextParameter();
         i = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} is null and value like ${c}`;
       }
-      s.push(t + "%"), await r.execute(i, s);
+      a.push(t + "%"), await r.execute(i, a);
     } catch (i) {
       throw i;
     } finally {
@@ -2004,10 +2047,10 @@ class qe extends z {
   async getAllForUser(e) {
     const t = await this.dbPool.connect();
     try {
-      let r = [], i, s = [];
+      let r = [], i, a = [];
       const n = this.dbPool.parameters();
-      e ? (i = `select * from ${this.keyTable} where ${this.useridForeignKeyColumn} = ` + n.nextParameter(), s = [e]) : i = `select * from ${this.keyTable} where ${this.useridForeignKeyColumn} is null`, u.logger.debug(f({ msg: "Executing query", query: i }));
-      let c = await t.execute(i, s);
+      e ? (i = `select * from ${this.keyTable} where ${this.useridForeignKeyColumn} = ` + n.nextParameter(), a = [e]) : i = `select * from ${this.keyTable} where ${this.useridForeignKeyColumn} is null`, u.logger.debug(f({ msg: "Executing query", query: i }));
+      let c = await t.execute(i, a);
       if (c.length == 0)
         return [];
       for (let d of c) {
@@ -2041,14 +2084,14 @@ class qe extends z {
     let r = { ...t };
     if (!t.value) throw new o(l.InvalidKey);
     delete r.value;
-    let i = [], s = [], n = this.dbPool.parameters();
+    let i = [], a = [], n = this.dbPool.parameters();
     for (let c in r) {
       let d = c;
-      r[c] != null && c == "userid" && this.useridForeignKeyColumn != "userid" && (d = this.useridForeignKeyColumn), i.push(c + "= " + n.nextParameter()), s.push(r[d]);
+      r[c] != null && c == "userid" && this.useridForeignKeyColumn != "userid" && (d = this.useridForeignKeyColumn), i.push(c + "= " + n.nextParameter()), a.push(r[d]);
     }
-    if (s.push(t.value), i.length > 0) {
+    if (a.push(t.value), i.length > 0) {
       let c = i.join(", "), d = `update ${this.keyTable} set ${c} where value = ` + n.nextParameter();
-      u.logger.debug(f({ msg: "Executing query", query: d })), await e.execute(d, s);
+      u.logger.debug(f({ msg: "Executing query", query: d })), await e.execute(d, a);
     }
   }
   /**
@@ -2065,21 +2108,21 @@ class qe extends z {
     try {
       await r.startTransaction();
       const i = await this.getKeyInTransaction(r, e);
-      let s;
+      let a;
       if (!i.data || i.data == "")
-        s = {};
+        a = {};
       else
         try {
-          s = JSON.parse(i.data);
+          a = JSON.parse(i.data);
         } catch (n) {
           throw u.logger.debug(f({ err: n })), new o(l.DataFormat);
         }
       for (let n of t) {
-        let c = this.updateDataInternal(s, n.dataName, n.value);
+        let c = this.updateDataInternal(a, n.dataName, n.value);
         if (!c) throw new o(l.BadRequest, `Parents of ${n.dataName} not found in key data`);
-        s = c;
+        a = c;
       }
-      await this.updateKeyInTransaction(r, { value: i.value, data: JSON.stringify(s) }), await r.commit();
+      await this.updateKeyInTransaction(r, { value: i.value, data: JSON.stringify(a) }), await r.commit();
     } catch (i) {
       throw await r.rollback(), i && typeof i == "object" && !("isCrossauthError" in i) ? (u.logger.debug(f({ err: i })), new o(l.Connection, "Failed updating session data")) : i;
     } finally {
@@ -2094,16 +2137,16 @@ class qe extends z {
     try {
       await r.startTransaction();
       const i = await this.getKeyInTransaction(r, e);
-      let s = {}, n = !1;
+      let a = {}, n = !1;
       if (i.data && i.data != "") {
         try {
-          s = JSON.parse(i.data);
+          a = JSON.parse(i.data);
         } catch (c) {
           throw u.logger.debug(f({ err: c })), new o(l.DataFormat);
         }
-        n = this.deleteDataInternal(s, t);
+        n = this.deleteDataInternal(a, t);
       }
-      n && await this.updateKeyInTransaction(r, { value: i.value, data: JSON.stringify(s) }), await r.commit();
+      n && await this.updateKeyInTransaction(r, { value: i.value, data: JSON.stringify(a) }), await r.commit();
     } catch (i) {
       throw await r.rollback(), i && typeof i == "object" && !("isCrossauthError" in i) ? (u.logger.debug(f({ err: i })), new o(l.Connection, "Failed updating session data")) : i;
     } finally {
@@ -2153,28 +2196,28 @@ class We extends me {
     }
   }
   makeClient(e) {
-    let t, r, i, s = !1, n = [], c = [];
+    let t, r, i, a = !1, n = [], c = [];
     if ("client_id" in e && (t = e.client_id), !t) throw new o(l.InvalidClientId);
     if ("client_name" in e && (r = e.client_name), !r) throw new o(l.InvalidClientId);
-    return "client_secret" in e && (i = e.client_secret), "confidential" in e && (s = e.confidential), "redirect_uri" in e && e.redirect_uri && (n = e.redirect_uri), "valid_flow" in e && e.valid_flow && (c = e.valid_flow), {
+    return "client_secret" in e && (i = e.client_secret), "confidential" in e && (a = e.confidential), "redirect_uri" in e && e.redirect_uri && (n = e.redirect_uri), "valid_flow" in e && e.valid_flow && (c = e.valid_flow), {
       client_id: t,
       client_name: r,
       client_secret: i,
-      confidential: s,
+      confidential: a,
       redirect_uri: n,
       valid_flow: c,
       ...e
     };
   }
-  async getClientWithTransaction(e, t, r, i, s, n) {
+  async getClientWithTransaction(e, t, r, i, a, n) {
     let c = [], d = this.dbPool.parameters(), g = [], y = `select c.*, r.uri as uri, null as flow from ${this.clientTable} as c left join ${this.redirectUriTable} r on c.client_id = r.client_id `, p = "";
     t && r && (p = `where c.${t} = ` + d.nextParameter(), g.push(r)), i !== null && i == null || (p == "" ? p = "where " : p += " and ", i == null ? p += "userid is null" : (p += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), g.push(i)));
-    let k = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, S = "";
-    t && r && (S = `where c.${t} = ` + d.nextParameter(), g.push(r)), i !== null && i == null || (S == "" ? S = "where " : S += " and ", i == null ? S += "userid is null" : (S += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), g.push(i))), n && (s || (s = 0), s = Number(s), n = Number(n), p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`, S == "" ? S = "where " : S += " and ", S += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`), y += p, k += S;
-    let v = y + " union " + k + " order by client_id";
-    const _ = await e.execute(v, g);
+    let _ = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, C = "";
+    t && r && (C = `where c.${t} = ` + d.nextParameter(), g.push(r)), i !== null && i == null || (C == "" ? C = "where " : C += " and ", i == null ? C += "userid is null" : (C += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), g.push(i))), n && (a || (a = 0), a = Number(a), n = Number(n), p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${a})`, C == "" ? C = "where " : C += " and ", C += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${a})`), y += p, _ += C;
+    let v = y + " union " + _ + " order by client_id";
+    const k = await e.execute(v, g);
     let A;
-    for (let M of _)
+    for (let M of k)
       (!A || M.client_id != A.client_id) && (A && c.push(A), A = this.makeClient(M), A.valid_flow = [], A.redirect_uri = []), M.uri && A.redirect_uri.push(M.uri), M.flow && A.valid_flow.push(M.flow);
     return A && c.push(A), c;
   }
@@ -2198,49 +2241,49 @@ class We extends me {
     }
   }
   async createClientWithTransaction(e, t) {
-    const { redirect_uri: r, valid_flow: i, userid: s, ...n } = t;
-    if (s && (n[this.useridForeignKeyColumn] = s), r)
-      for (let S = 0; S < r.length; ++S) {
-        if (r[S].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
+    const { redirect_uri: r, valid_flow: i, userid: a, ...n } = t;
+    if (a && (n[this.useridForeignKeyColumn] = a), r)
+      for (let C = 0; C < r.length; ++C) {
+        if (r[C].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
         try {
-          new URL(r[S]);
+          new URL(r[C]);
         } catch {
-          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[S]} is not valid`);
+          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[C]} is not valid`);
         }
       }
     if (i) {
-      for (let S = 0; S < i.length; ++S)
-        if (!b.isValidFlow(i[S])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[S]);
+      for (let C = 0; C < i.length; ++C)
+        if (!b.isValidFlow(i[C])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[C]);
     }
     let c = [], d = [], g = [], y = this.dbPool.parameters();
     try {
-      for (let S in n)
-        c.push(S), d.push(y.nextParameter()), g.push(n[S]);
+      for (let C in n)
+        c.push(C), d.push(y.nextParameter()), g.push(n[C]);
       if (c.length > 0) {
-        let S = c.join(", "), v = d.join(", ");
-        const _ = `insert into ${this.clientTable} (${S}) values (${v})`;
-        await e.execute(_, g);
+        let C = c.join(", "), v = d.join(", ");
+        const k = `insert into ${this.clientTable} (${C}) values (${v})`;
+        await e.execute(k, g);
       }
-    } catch (S) {
-      throw typeof S == "object" && S != null && "code" in S && typeof S.code == "string" && (S.code.startsWith("22") || S.code.startsWith("23")) ? (u.logger.debug(f({ err: S })), new o(l.InvalidClientId, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (u.logger.debug(f({ err: S })), new o(l.Connection, "Error saving OAuth client"));
+    } catch (C) {
+      throw typeof C == "object" && C != null && "code" in C && typeof C.code == "string" && (C.code.startsWith("22") || C.code.startsWith("23")) ? (u.logger.debug(f({ err: C })), new o(l.InvalidClientId, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (u.logger.debug(f({ err: C })), new o(l.Connection, "Error saving OAuth client"));
     }
     let p = await this.getClientWithTransaction(e, "client_id", t.client_id, t.userid);
     if (p.length == 0)
       throw u.logger.error(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), new o(l.KeyExists);
-    let k = p[0];
+    let _ = p[0];
     if (r)
-      for (let S = 0; S < r.length; ++S) {
+      for (let C = 0; C < r.length; ++C) {
         g = [], y = this.dbPool.parameters();
         let v = `insert into ${this.redirectUriTable} (client_id, uri) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        g.push(k.client_id), g.push(r[S]), await e.execute(v, g);
+        g.push(_.client_id), g.push(r[C]), await e.execute(v, g);
       }
     if (i)
-      for (let S = 0; S < i.length; ++S) {
+      for (let C = 0; C < i.length; ++C) {
         g = [], y = this.dbPool.parameters();
         let v = `insert into ${this.validFlowTable} (client_id, flow) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        g.push(k.client_id), g.push(i[S]), await e.execute(v, g);
+        g.push(_.client_id), g.push(i[C]), await e.execute(v, g);
       }
-    return { ...k, redirect_uri: r, valid_flow: i };
+    return { ..._, redirect_uri: r, valid_flow: i };
   }
   /**
    * 
@@ -2260,8 +2303,8 @@ class We extends me {
     }
   }
   async deleteClientWithTransaction(e, t) {
-    let r = [], s = this.dbPool.parameters().nextParameter(), n = `delete from ${this.redirectUriTable} where client_id = ${s}`;
-    r.push(t), await e.execute(n, r), n = `delete from ${this.validFlowTable} where client_id = ${s}`, await e.execute(n, r), n = `delete from ${this.clientTable} where client_id = ${s}`, await e.execute(n, r);
+    let r = [], a = this.dbPool.parameters().nextParameter(), n = `delete from ${this.redirectUriTable} where client_id = ${a}`;
+    r.push(t), await e.execute(n, r), n = `delete from ${this.validFlowTable} where client_id = ${a}`, await e.execute(n, r), n = `delete from ${this.clientTable} where client_id = ${a}`, await e.execute(n, r);
   }
   /**
    * If the given session key exist in the database, update it with the passed values.  If it doesn't
@@ -2298,39 +2341,39 @@ class We extends me {
         if (!b.isValidFlow(i[v])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
     }
     if (!t.client_id) throw new o(l.InvalidClientId, "No client ig given");
-    let { client_id: s, redirect_uri: n, valid_flow: c, ...d } = t;
+    let { client_id: a, redirect_uri: n, valid_flow: c, ...d } = t;
     n || (n = []), c || (c = []);
     let g = this.dbPool.parameters(), y = `delete from ${this.redirectUriTable} where client_id = ` + g.nextParameter();
     await e.execute(y, [t.client_id]), g = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + g.nextParameter(), await e.execute(y, [t.client_id]);
-    let p = [], k = [], S = [];
+    let p = [], _ = [], C = [];
     g = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + g.nextParameter();
     for (let v in d)
-      p.push(v), k.push(g.nextParameter()), S.push(d[v]);
+      p.push(v), _.push(g.nextParameter()), C.push(d[v]);
     if (p.length > 0) {
-      let v = p.join(", "), _ = k.join(", ");
-      y = `update ${this.clientTable} set (${v}) values (${_})`, await e.execute(y, S);
+      let v = p.join(", "), k = _.join(", ");
+      y = `update ${this.clientTable} set (${v}) values (${k})`, await e.execute(y, C);
     }
     if (n)
       for (let v = 0; v < n.length; ++v) {
-        S = [], g = this.dbPool.parameters();
-        let _ = `insert into ${this.redirectUriTable} (client_id, uri) values (` + g.nextParameter() + ", " + g.nextParameter() + ")";
-        S.push(t.client_id), S.push(n[v]), await e.execute(_, S);
+        C = [], g = this.dbPool.parameters();
+        let k = `insert into ${this.redirectUriTable} (client_id, uri) values (` + g.nextParameter() + ", " + g.nextParameter() + ")";
+        C.push(t.client_id), C.push(n[v]), await e.execute(k, C);
       }
     if (c)
       for (let v = 0; v < c.length; ++v) {
-        S = [], g = this.dbPool.parameters();
-        let _ = `insert into ${this.validFlowTable} (client_id, flow) values (` + g.nextParameter() + ", " + g.nextParameter() + ")";
-        S.push(t.client_id), S.push(c[v]), await e.execute(_, S);
+        C = [], g = this.dbPool.parameters();
+        let k = `insert into ${this.validFlowTable} (client_id, flow) values (` + g.nextParameter() + ", " + g.nextParameter() + ")";
+        C.push(t.client_id), C.push(c[v]), await e.execute(k, C);
       }
   }
   async getClients(e, t, r) {
     let i = await this.dbPool.connect();
     try {
       await i.startTransaction();
-      const s = this.getClientWithTransaction(i, void 0, void 0, r, e, t);
-      return await i.commit(), s;
-    } catch (s) {
-      throw await i.rollback(), s;
+      const a = this.getClientWithTransaction(i, void 0, void 0, r, e, t);
+      return await i.commit(), a;
+    } catch (a) {
+      throw await i.rollback(), a;
     } finally {
       i.release();
     }
@@ -2352,9 +2395,9 @@ class Je extends we {
   async getAuthorizations(e, t) {
     let r = await this.dbPool.connect();
     try {
-      const i = this.dbPool.parameters(), s = [];
+      const i = this.dbPool.parameters(), a = [];
       let n = `select scope from ${this.authorizationTable} where client_id = ` + i.nextParameter();
-      return s.push(e), t === null ? n += ` and ${this.useridForeignKeyColumn} is null` : t && (n += ` and ${this.useridForeignKeyColumn} = ` + i.nextParameter(), s.push(t)), (await r.execute(n, s)).map((g) => g.scope);
+      return a.push(e), t === null ? n += ` and ${this.useridForeignKeyColumn} is null` : t && (n += ` and ${this.useridForeignKeyColumn} = ` + i.nextParameter(), a.push(t)), (await r.execute(n, a)).map((g) => g.scope);
     } catch (i) {
       throw i;
     } finally {
@@ -2365,13 +2408,13 @@ class Je extends we {
     let i = await this.dbPool.connect();
     try {
       await i.startTransaction();
-      let s = this.dbPool.parameters(), n = [], c = `delete from ${this.authorizationTable} where client_id = ` + s.nextParameter();
-      n.push(e), t ? (c += ` and ${this.useridForeignKeyColumn} = ` + s.nextParameter(), n.push(t)) : c += ` and ${this.useridForeignKeyColumn} is null`, await i.execute(c, n);
+      let a = this.dbPool.parameters(), n = [], c = `delete from ${this.authorizationTable} where client_id = ` + a.nextParameter();
+      n.push(e), t ? (c += ` and ${this.useridForeignKeyColumn} = ` + a.nextParameter(), n.push(t)) : c += ` and ${this.useridForeignKeyColumn} is null`, await i.execute(c, n);
       for (let d of r)
-        s = this.dbPool.parameters(), n = [], c = `insert into ${this.authorizationTable} (client_id, userid, scope) values (` + s.nextParameter() + ", " + s.nextParameter() + ", " + s.nextParameter() + ")", n.push(e), n.push(t), n.push(d), await i.execute(c, n);
+        a = this.dbPool.parameters(), n = [], c = `insert into ${this.authorizationTable} (client_id, userid, scope) values (` + a.nextParameter() + ", " + a.nextParameter() + ", " + a.nextParameter() + ")", n.push(e), n.push(t), n.push(d), await i.execute(c, n);
       await i.commit();
-    } catch (s) {
-      throw await i.rollback(), s;
+    } catch (a) {
+      throw await i.rollback(), a;
     } finally {
       i.release();
     }
@@ -2410,8 +2453,8 @@ class Xe extends Ze {
   crossauthErrorFromPostgresError(e) {
     let t, r;
     if (e && typeof e == "object" && "code" in e && typeof e.code == "string" && (t = e.code), e && typeof e == "object" && "detail" in e && typeof e.detail == "string" && (r = e.detail), t != null && t.startsWith("23")) {
-      const s = t + " : " + (r ?? "Constraint violation during database insert/update");
-      return new o(l.ConstraintViolation, s);
+      const a = t + " : " + (r ?? "Constraint violation during database insert/update");
+      return new o(l.ConstraintViolation, a);
     }
     const i = t ? t + " : " + (r ?? "Constraint violation during database insert/update") : "Couldn't execute database query";
     return new o(l.Connection, i);
@@ -2445,44 +2488,44 @@ class Qe extends Ge {
     return "$" + this.nextParam++;
   }
 }
-class At extends Y {
+class Kt extends Y {
   /**
    * Creates a PostgresUserStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client. 
    * @param options see {@link PostgresUserStorageOptions}.
    */
-  constructor(a, e = {}) {
-    super(new de(a), e);
+  constructor(s, e = {}) {
+    super(new de(s), e);
   }
 }
-class It extends qe {
+class Ft extends qe {
   /**
    * Creates a PostgresKeyStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client. 
    * @param options see {@link PostgresKeyStorageOptions}.
    */
-  constructor(a, e = {}) {
-    super(new de(a), e);
+  constructor(s, e = {}) {
+    super(new de(s), e);
   }
 }
-class Pt extends We {
+class Ot extends We {
   /**
    * Creates a PostgresOAuthClientStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client. 
    * @param options see {@link PostgresOAuthClientStorageOptions}.
    */
-  constructor(a, e = {}) {
-    super(new de(a), e);
+  constructor(s, e = {}) {
+    super(new de(s), e);
   }
 }
-class Kt extends Je {
+class Nt extends Je {
   /**
    * Creates a PostgresOAuthClientStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client. 
    * @param options see {@link PostgresOAuthAuthorizationStorageOptions}.
    */
-  constructor(a, e = {}) {
-    super(new de(a), e);
+  constructor(s, e = {}) {
+    super(new de(s), e);
   }
 }
 class re {
@@ -2491,11 +2534,11 @@ class re {
    * Constructor.
    * @param options see {@link AuthenticationOptions}
    */
-  constructor(a) {
+  constructor(s) {
     h(this, "friendlyName");
     h(this, "factorName", "");
-    if (!(a != null && a.friendlyName)) throw new o(l.Configuration, "Authenticator must have a friendly name");
-    this.friendlyName = a == null ? void 0 : a.friendlyName;
+    if (!(s != null && s.friendlyName)) throw new o(l.Configuration, "Authenticator must have a friendly name");
+    this.friendlyName = s == null ? void 0 : s.friendlyName;
   }
   capabilities() {
     return {
@@ -2523,7 +2566,7 @@ class be extends re {
     return "none";
   }
 }
-const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2_ITERATIONS || 6e5), ve = Number(process.env.PBKDF2_KEYLENGTH || 32), et = Number(process.env.PBKDF2_KEYLENGTH || 16), se = "sha256", q = class q {
+const Ce = process.env.PBKDF2_DIGEST || "sha256", Se = Number(process.env.PBKDF2_ITERATIONS || 6e5), ve = Number(process.env.PBKDF2_KEYLENGTH || 32), et = Number(process.env.PBKDF2_KEYLENGTH || 16), ae = "sha256", q = class q {
   /**
    * Returns true if the plaintext password, when hashed, equals the one in the hash, using
    * it's hasher settings
@@ -2532,8 +2575,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param secret if `useHash`in `encodedHash` is true, uses as a pepper for the hasher
    * @returns true if they are equal, false otherwise
    */
-  static async passwordsEqual(a, e, t) {
-    let r = q.decodePasswordHash(e), i = await q.passwordHash(a, {
+  static async passwordsEqual(s, e, t) {
+    let r = q.decodePasswordHash(e), i = await q.passwordHash(s, {
       salt: r.salt,
       encode: !1,
       secret: r.useSecret ? t : void 0,
@@ -2550,16 +2593,16 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param encoded base64-encoded text
    * @returns URF-8 text
    */
-  static base64Decode(a) {
-    return Buffer.from(a, "base64url").toString("utf-8");
+  static base64Decode(s) {
+    return Buffer.from(s, "base64url").toString("utf-8");
   }
   /**
    * Base64-encodes UTF-8 text
    * @param text UTF-8 text
    * @returns Base64 text
    */
-  static base64Encode(a) {
-    return Buffer.from(a, "utf-8").toString("base64url");
+  static base64Encode(s) {
+    return Buffer.from(s, "utf-8").toString("base64url");
   }
   /**
    * Splits a hashed password into its component parts.  Return it as a {@link PasswordHash }.
@@ -2572,8 +2615,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param hash the hassed password to decode.  See above for format
    * @returns {@link PasswordHash} object containing the deecoded hash components
    */
-  static decodePasswordHash(a) {
-    const e = a.split(":");
+  static decodePasswordHash(s) {
+    const e = s.split(":");
     if (e.length != 7)
       throw new o(l.InvalidHash);
     try {
@@ -2603,8 +2646,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param digest The digest algorithm, eg `pbkdf2`
    * @returns a string encode the above parameters.
    */
-  static encodePasswordHash(a, e, t, r, i, s) {
-    return "pbkdf2:" + s + ":" + String(i) + ":" + String(r) + ":" + (t ? 1 : 0) + ":" + e + ":" + a;
+  static encodePasswordHash(s, e, t, r, i, a) {
+    return "pbkdf2:" + a + ":" + String(i) + ":" + String(r) + ":" + (t ? 1 : 0) + ":" + e + ":" + s;
   }
   /**
    * Creates a random salt
@@ -2618,8 +2661,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param length length of the string to create
    * @returns the random value as a string.  Number of bytes will be greater as it is base64 encoded.
    */
-  static randomValue(a) {
-    return ue(a).toString("base64url");
+  static randomValue(s) {
+    return ue(s).toString("base64url");
   }
   // not real base32 - omits 1,i,0,o
   /**
@@ -2627,9 +2670,9 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param length length of the string to create
    * @returns the random value as a string.  Number of bytes will be greater as it is base64 encoded.
    */
-  static randomBase32(a, e) {
+  static randomBase32(s, e) {
     var i;
-    const r = [...ue(a)].map((s) => q.Base32[s % 32]).join("");
+    const r = [...ue(s)].map((a) => q.Base32[a % 32]).join("");
     return e ? ((i = r.match(/(.{1,4})/g)) == null ? void 0 : i.join("-")) ?? r : r;
   }
   /**
@@ -2644,8 +2687,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param plaintext text to hash
    * @returns the string containing the hash 
    */
-  static hash(a) {
-    return this.sha256(a);
+  static hash(s) {
+    return this.sha256(s);
   }
   /**
    * Standard hash using SHA256 (not PBKDF2 or HMAC)
@@ -2653,8 +2696,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param plaintext text to hash
    * @returns the string containing the hash 
    */
-  static sha256(a) {
-    return Oe("sha256").update(a).digest("base64url");
+  static sha256(s) {
+    return Oe("sha256").update(s).digest("base64url");
   }
   /**
    * Hashes a password and returns it as a base64 or base64url encoded string
@@ -2665,25 +2708,25 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    *        - `encode`: if true, returns the full string as it should be stored in the database.
    * @returns the string containing the hash and the values to decode it
    */
-  static async passwordHash(a, e = {}) {
+  static async passwordHash(s, e = {}) {
     let { salt: t, secret: r, encode: i } = { ...e };
     t || (t = q.randomSalt());
-    let s = r != null, n = s ? t + "!" + r : t;
+    let a = r != null, n = a ? t + "!" + r : t;
     i == null && (i = !1);
     let g = (await De(Ne)(
-      a,
+      s,
       n,
-      e.iterations ?? Ce,
+      e.iterations ?? Se,
       e.keyLen ?? ve,
-      e.digest ?? Se
+      e.digest ?? Ce
     )).toString("base64url");
     return i && (g = this.encodePasswordHash(
       g,
       t,
-      s,
-      e.iterations ?? Ce,
+      a,
+      e.iterations ?? Se,
       e.keyLen ?? ve,
-      e.digest ?? Se
+      e.digest ?? Ce
     )), g;
   }
   /**
@@ -2695,8 +2738,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param timestamp time the token will expire
    * @returns a Base64-URL-encoded string that can be hashed.
    */
-  static signableToken(a, e, t) {
-    return e == null && (e = q.randomSalt()), t || (t = (/* @__PURE__ */ new Date()).getTime()), Buffer.from(JSON.stringify({ ...a, t, s: e })).toString("base64url");
+  static signableToken(s, e, t) {
+    return e == null && (e = q.randomSalt()), t || (t = (/* @__PURE__ */ new Date()).getTime()), Buffer.from(JSON.stringify({ ...s, t, s: e })).toString("base64url");
   }
   /**
    * Signs a JSON payload by creating a hash, using a secret and 
@@ -2708,9 +2751,9 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param timestamp optionally, a timestamp to include in the signed date as a Unix date
    * @returns Base64-url encoded hash
    */
-  static sign(a, e, t, r) {
-    const i = q.signableToken(a, t, r), s = ie(se, e);
-    return i + "." + s.update(i).digest("base64url");
+  static sign(s, e, t, r) {
+    const i = q.signableToken(s, t, r), a = ie(ae, e);
+    return i + "." + a.update(i).digest("base64url");
   }
   /**
    * This can be called for a string payload that is a cryptographically
@@ -2721,9 +2764,9 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param secret the secret to sign with
    * @returns Base64-url encoded hash
    */
-  static signSecureToken(a, e) {
-    const t = ie(se, e);
-    return a + "." + t.update(a).digest("base64url");
+  static signSecureToken(s, e) {
+    const t = ie(ae, e);
+    return s + "." + t.update(s).digest("base64url");
   }
   /**
    * Validates a signature and, if valid, return the unstringified payload
@@ -2735,16 +2778,16 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    *         {@link @crossauth/common!ErrorCode} of `InvalidKey` if signature
    *         is invalid or has expired.  
    */
-  static unsign(a, e, t) {
-    const r = a.split(".");
+  static unsign(s, e, t) {
+    const r = s.split(".");
     if (r.length != 2) throw new o(l.InvalidKey);
-    const i = r[0], s = r[1], n = JSON.parse(Buffer.from(i, "base64url").toString());
+    const i = r[0], a = r[1], n = JSON.parse(Buffer.from(i, "base64url").toString());
     if (t && n.t + t * 1e3 > (/* @__PURE__ */ new Date()).getTime())
       throw new o(l.Expired);
-    const d = ie(se, e).update(i).digest("base64url");
-    if (d.length != s.length)
+    const d = ie(ae, e).update(i).digest("base64url");
+    if (d.length != a.length)
       throw new o(l.InvalidKey, "Signature does not match payload");
-    if (!he(Buffer.from(d), Buffer.from(s)))
+    if (!he(Buffer.from(d), Buffer.from(a)))
       throw new o(l.InvalidKey, "Signature does not match payload");
     return n;
   }
@@ -2758,15 +2801,15 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    *         {@link @crossauth/common!ErrorCode} of `InvalidKey` if signature
    *         is invalid or has expired.  
    */
-  static unsignSecureToken(a, e) {
-    const t = a.split(".");
+  static unsignSecureToken(s, e) {
+    const t = s.split(".");
     if (t.length != 2) throw new o(l.InvalidKey);
-    const r = t[0], i = t[1], s = r, c = ie(se, e).update(r).digest("base64url");
+    const r = t[0], i = t[1], a = r, c = ie(ae, e).update(r).digest("base64url");
     if (c.length != i.length)
       throw new o(l.InvalidKey, "Signature does not match payload");
     if (!he(Buffer.from(c), Buffer.from(i)))
       throw new o(l.InvalidKey, "Signature does not match payload");
-    return s;
+    return a;
   }
   /**
    * XOR's two arrays of base64url-encoded strings
@@ -2774,8 +2817,8 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param mask mask to XOR it with
    * @return an XOR'r string
    */
-  static xor(a, e) {
-    const t = Buffer.from(a, "base64url"), r = Buffer.from(e, "base64url"), i = t.map((s, n) => s ^ r[n]);
+  static xor(s, e) {
+    const t = Buffer.from(s, "base64url"), r = Buffer.from(e, "base64url"), i = t.map((a, n) => a ^ r[n]);
     return Buffer.from(i).toString("base64url");
   }
   /**
@@ -2785,12 +2828,12 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param keyString the symmetric key
    * @returns Encrypted text Base64-url encoded.
    */
-  static symmetricEncrypt(a, e, t = void 0) {
+  static symmetricEncrypt(s, e, t = void 0) {
     t || (t = ue(16));
     let r = Buffer.from(e, "base64url");
     var i = Re("aes-256-cbc", r, t);
-    let s = i.update(a);
-    return s = Buffer.concat([s, i.final()]), t.toString("base64url") + "." + s.toString("base64url");
+    let a = i.update(s);
+    return a = Buffer.concat([a, i.final()]), t.toString("base64url") + "." + a.toString("base64url");
   }
   /**
    * Symmetric decryption using a key that must be a string
@@ -2799,26 +2842,26 @@ const Se = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @param keyString the symmetric key
    * @returns Decrypted text
    */
-  static symmetricDecrypt(a, e) {
+  static symmetricDecrypt(s, e) {
     let t = Buffer.from(e, "base64url");
-    const r = a.split(".");
+    const r = s.split(".");
     if (r.length != 2) throw new o(l.InvalidHash, "Not AES-256-CBC ciphertext");
-    let i = Buffer.from(r[0], "base64url"), s = Buffer.from(r[1], "base64url");
+    let i = Buffer.from(r[0], "base64url"), a = Buffer.from(r[1], "base64url");
     var n = xe("aes-256-cbc", t, i);
-    let c = n.update(s);
+    let c = n.update(a);
     return c = Buffer.concat([c, n.final()]), c.toString();
   }
 };
 h(q, "Base32", "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".split(""));
 let T = q;
-function tt(C) {
-  let a = [];
-  if (!C.password) a.push("Password not provided");
+function tt(S) {
+  let s = [];
+  if (!S.password) s.push("Password not provided");
   else {
-    const e = C.password;
-    e.length < 8 && a.push("Password must be at least 8 characters"), e.match(/[a-z]/) == null && a.push("Password must contain at least one lowercase character"), e.match(/[A-Z]/) == null && a.push("Password must contain at least one uppercase character"), e.match(/[0-9]/) == null && a.push("Password must contain at least one digit");
+    const e = S.password;
+    e.length < 8 && s.push("Password must be at least 8 characters"), e.match(/[a-z]/) == null && s.push("Password must contain at least one lowercase character"), e.match(/[A-Z]/) == null && s.push("Password must contain at least one uppercase character"), e.match(/[0-9]/) == null && s.push("Password must contain at least one digit");
   }
-  return a;
+  return s;
 }
 const le = class le extends be {
   /**
@@ -3046,14 +3089,14 @@ class Z extends re {
     );
     const t = Z.zeroPad(ee(999999), 6), r = e.email ? e.email : e.username;
     Z.validateEmail(r);
-    const i = /* @__PURE__ */ new Date(), s = new Date(i.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), n = {
+    const i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), n = {
       username: e.username,
       email: r,
       factor2: this.factorName
     }, c = {
       username: e.username,
       factor2: this.factorName,
-      expiry: s,
+      expiry: a,
       otp: t
     }, d = this.sendToken(r, t);
     return u.logger.info(f({
@@ -3069,7 +3112,7 @@ class Z extends re {
    * @returns 
    */
   async reprepareConfiguration(e, t) {
-    const r = z.decodeData(t.data)["2fa"], i = Z.zeroPad(ee(999999), 6), s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), c = this.sendToken(r.email, i);
+    const r = L.decodeData(t.data)["2fa"], i = Z.zeroPad(ee(999999), 6), a = /* @__PURE__ */ new Date(), n = new Date(a.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), c = this.sendToken(r.email, i);
     return u.logger.info(f({
       msg: "Sent factor otp email",
       emailMessageId: c,
@@ -3114,11 +3157,11 @@ class Z extends re {
    * @returns `otp` and `expiry` as a Unix time (number).
    */
   async createOneTimeSecrets(e) {
-    const t = Z.zeroPad(ee(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), s = e.email || e.username, n = this.sendToken(s, t);
+    const t = Z.zeroPad(ee(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), a = e.email || e.username, n = this.sendToken(a, t);
     return u.logger.info(f({
       msg: "Sent factor otp email",
       emailMessageId: n,
-      email: s
+      email: a
     })), { otp: t, expiry: i };
   }
   /**
@@ -3235,14 +3278,14 @@ class Q extends re {
     );
     const t = Q.zeroPad(ee(999999), 6), r = e.phone;
     Q.validatePhone(r);
-    const i = /* @__PURE__ */ new Date(), s = new Date(i.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), n = {
+    const i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), n = {
       username: e.username,
       phone: r,
       factor2: this.factorName
     }, c = {
       username: e.username,
       factor2: this.factorName,
-      expiry: s,
+      expiry: a,
       otp: t
     };
     let d = { otp: t };
@@ -3260,7 +3303,7 @@ class Q extends re {
    * @returns 
    */
   async reprepareConfiguration(e, t) {
-    const r = z.decodeData(t.data)["2fa"], i = Q.zeroPad(ee(999999), 6), s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), c = this.sendSms(r.phone, i);
+    const r = L.decodeData(t.data)["2fa"], i = Q.zeroPad(ee(999999), 6), a = /* @__PURE__ */ new Date(), n = new Date(a.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), c = this.sendSms(r.phone, i);
     return u.logger.info(f({
       msg: "Sent factor otp sms",
       smsMessageId: c,
@@ -3304,11 +3347,11 @@ class Q extends re {
    * @returns `otp` and `expiry` as a Unix time (number).
    */
   async createOneTimeSecrets(e) {
-    const t = Q.zeroPad(ee(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), s = e.phone, n = this.sendSms(s, t);
+    const t = Q.zeroPad(ee(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), a = e.phone, n = this.sendSms(a, t);
     return u.logger.info(f({
       msg: "Sent factor otp sms",
       smsMessageId: n,
-      phone: s
+      phone: a
     })), { otp: t, expiry: i };
   }
   /**
@@ -3424,7 +3467,7 @@ class Ue extends Q {
     return (await Be(this.accountSid, this.authToken).messages.create(r)).sid;
   }
 }
-class Ft extends re {
+class Rt extends re {
   /**
    * Constructor
    * 
@@ -3464,13 +3507,13 @@ class Ft extends re {
     const t = /* @__PURE__ */ new Date(), r = new Date(t.getTime() + 1e3 * 60).getTime(), i = {
       username: e.username,
       factor2: this.factorName
-    }, s = {
+    }, a = {
       username: e.username,
       factor2: this.factorName,
       expiry: r,
       otp: this.code
     };
-    return { userData: i, sessionData: s };
+    return { userData: i, sessionData: a };
   }
   /**
    * Creates and emails a new one-time code.
@@ -3479,7 +3522,7 @@ class Ft extends re {
    * @returns 
    */
   async reprepareConfiguration(e, t) {
-    const r = z.decodeData(t.data)["2fa"], i = this.code, s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * 60).getTime();
+    const r = L.decodeData(t.data)["2fa"], i = this.code, a = /* @__PURE__ */ new Date(), n = new Date(a.getTime() + 1e3 * 60).getTime();
     return {
       userData: { factor2: r.factor2, otp: i },
       secrets: {},
@@ -3585,7 +3628,7 @@ class Ft extends re {
     return Array(+(r > 0 && r)).join("0") + e;
   }
 }
-class Ot extends be {
+class xt extends be {
   /**
    * Create a new authenticator.
    * 
@@ -3678,7 +3721,7 @@ class Ot extends be {
   async reprepareConfiguration(e, t) {
   }
 }
-class Nt extends re {
+class Dt extends re {
   /**
    * Constructor
    * @param appName this forms part of the QR code that users scan into 
@@ -3705,7 +3748,7 @@ class Nt extends re {
   async createSecret(e, t) {
     t || (t = fe.generateSecret());
     let r = "";
-    return await ze.toDataURL(fe.keyuri(e, this.appName, t)).then((i) => {
+    return await Le.toDataURL(fe.keyuri(e, this.appName, t)).then((i) => {
       r = i;
     }).catch((i) => {
       throw u.logger.debug(f({ err: i })), new o(
@@ -3715,7 +3758,7 @@ class Nt extends re {
     }), { qrUrl: r, secret: t };
   }
   async getSecretFromSession(e, t) {
-    const r = z.decodeData(t.data);
+    const r = L.decodeData(t.data);
     if (!("totpsecret" in r))
       throw new o(
         l.Unauthorized,
@@ -3726,8 +3769,8 @@ class Nt extends re {
         l.Unauthorized,
         "TOTP factor name not in session"
       );
-    const i = r.totpsecret, { qrUrl: s, secret: n } = await this.createSecret(e, i);
-    return { qrUrl: s, secret: n, factor2: r.factor2 };
+    const i = r.totpsecret, { qrUrl: a, secret: n } = await this.createSecret(e, i);
+    return { qrUrl: a, secret: n, factor2: r.factor2 };
   }
   /**
    * Creates a shared secret and returns it, along with image data for the QR
@@ -3748,12 +3791,12 @@ class Nt extends re {
       qr: t,
       totpsecret: r,
       factor2: this.factorName
-    }, s = {
+    }, a = {
       username: e.username,
       totpsecret: r,
       factor2: this.factorName
     };
-    return { userData: i, sessionData: s };
+    return { userData: i, sessionData: a };
   }
   /**
    * For cases when the 2FA page was closed without completing.  Returns the 
@@ -3766,9 +3809,9 @@ class Nt extends re {
    *          `newSessionData` containing the same except `qr`.
    */
   async reprepareConfiguration(e, t) {
-    const { qrUrl: r, secret: i, factor2: s } = await this.getSecretFromSession(e, t);
+    const { qrUrl: r, secret: i, factor2: a } = await this.getSecretFromSession(e, t);
     return {
-      userData: { qr: r, totpsecret: i, factor2: s },
+      userData: { qr: r, totpsecret: i, factor2: a },
       secrets: { totpsecret: i },
       newSessionData: void 0
     };
@@ -3787,8 +3830,8 @@ class Nt extends re {
         l.InvalidToken,
         "TOTP secret or code not given"
       );
-    const i = r.otp, s = t.totpsecret;
-    if (!fe.check(i, s))
+    const i = r.otp, a = t.totpsecret;
+    if (!fe.check(i, a))
       throw new o(
         l.InvalidToken,
         "Invalid TOTP code"
@@ -3869,7 +3912,7 @@ class x {
    * @param keyStorage : where to store email verification tokens
    * @param options see {@link TokenEmailerOptions}
    */
-  constructor(a, e, t = {}) {
+  constructor(s, e, t = {}) {
     h(this, "userStorage");
     h(this, "keyStorage");
     h(this, "views", "views");
@@ -3890,38 +3933,38 @@ class x {
     h(this, "verifyEmailExpires", 60 * 60 * 24);
     h(this, "passwordResetExpires", 60 * 60 * 24);
     h(this, "render");
-    this.userStorage = a, this.keyStorage = e, w("siteUrl", m.String, this, t, "SITE_URL", !0), w("prefix", m.String, this, t, "PREFIX"), w("views", m.String, this, t, "VIEWS"), w("emailVerificationTextBody", m.String, this, t, "EMAIL_VERIFICATION_TEXT_BODY"), w("emailVerificationHtmlBody", m.String, this, t, "EMAIL_VERIFICATION_HTML_BODY"), w("emailVerificationSubject", m.String, this, t, "EMAIL_VERIFICATION_SUBJECT"), w("passwordResetTextBody", m.String, this, t, "PASSWORD_RESET_TEXT_BODY"), w("passwordResetHtmlBody", m.String, this, t, "PASSWORD_RESET_HTML_BODY"), w("passwordResetSubject", m.String, this, t, "PASSWORD_RESET_SUBJECT"), w("emailFrom", m.String, this, t, "EMAIL_FROM", !0), w("smtpHost", m.String, this, t, "SMTP_HOST", !0), w("smtpPort", m.Number, this, t, "SMTP_PORT"), w("smtpUsername", m.String, this, t, "SMTP_USERNAME"), w("smtpPassword", m.String, this, t, "SMTP_PASSWORD"), w("smtpUseTls", m.Boolean, this, t, "SMTP_USE_TLS"), w("verifyEmailExpires", m.Boolean, this, t, "VERIFY_EMAIL_EXPIRES"), w("passwordResetExpires", m.String, this, t, "PASSWORD_RESET_EXPIRES"), t.render ? this.render = t.render : W.configure(this.views, { autoescape: !0 });
+    this.userStorage = s, this.keyStorage = e, w("siteUrl", m.String, this, t, "SITE_URL", !0), w("prefix", m.String, this, t, "PREFIX"), w("views", m.String, this, t, "VIEWS"), w("emailVerificationTextBody", m.String, this, t, "EMAIL_VERIFICATION_TEXT_BODY"), w("emailVerificationHtmlBody", m.String, this, t, "EMAIL_VERIFICATION_HTML_BODY"), w("emailVerificationSubject", m.String, this, t, "EMAIL_VERIFICATION_SUBJECT"), w("passwordResetTextBody", m.String, this, t, "PASSWORD_RESET_TEXT_BODY"), w("passwordResetHtmlBody", m.String, this, t, "PASSWORD_RESET_HTML_BODY"), w("passwordResetSubject", m.String, this, t, "PASSWORD_RESET_SUBJECT"), w("emailFrom", m.String, this, t, "EMAIL_FROM", !0), w("smtpHost", m.String, this, t, "SMTP_HOST", !0), w("smtpPort", m.Number, this, t, "SMTP_PORT"), w("smtpUsername", m.String, this, t, "SMTP_USERNAME"), w("smtpPassword", m.String, this, t, "SMTP_PASSWORD"), w("smtpUseTls", m.Boolean, this, t, "SMTP_USE_TLS"), w("verifyEmailExpires", m.Boolean, this, t, "VERIFY_EMAIL_EXPIRES"), w("passwordResetExpires", m.String, this, t, "PASSWORD_RESET_EXPIRES"), t.render ? this.render = t.render : W.configure(this.views, { autoescape: !0 });
   }
   createEmailer() {
-    let a = {};
-    return this.smtpUsername && (a.user = this.smtpUsername), this.smtpPassword && (a.pass = this.smtpPassword), Ee.createTransport({
+    let s = {};
+    return this.smtpUsername && (s.user = this.smtpUsername), this.smtpPassword && (s.pass = this.smtpPassword), Ee.createTransport({
       host: this.smtpHost,
       port: this.smtpPort,
       secure: this.smtpUseTls,
-      auth: a
+      auth: s
     });
   }
   /**
    * Produces a hash of the given email verification token with the
    * correct prefix for inserting into storage.
    */
-  static hashEmailVerificationToken(a) {
-    return U.emailVerificationToken + T.hash(a);
+  static hashEmailVerificationToken(s) {
+    return U.emailVerificationToken + T.hash(s);
   }
   /**
    * Produces a hash of the given password reset token with the
    * correct prefix for inserting into storage.
    */
-  static hashPasswordResetToken(a) {
-    return U.passwordResetToken + T.hash(a);
+  static hashPasswordResetToken(s) {
+    return U.passwordResetToken + T.hash(s);
   }
-  async createAndSaveEmailVerificationToken(a, e = "") {
+  async createAndSaveEmailVerificationToken(s, e = "") {
     let r = 0;
-    const i = /* @__PURE__ */ new Date(), s = new Date(i.getTime() + 1e3 * this.verifyEmailExpires);
+    const i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + 1e3 * this.verifyEmailExpires);
     for (; r < 10; ) {
       let n = T.randomValue(ne), c = x.hashEmailVerificationToken(n);
       try {
-        return await this.keyStorage.saveKey(a, c, i, s, e), n;
+        return await this.keyStorage.saveKey(s, c, i, a, e), n;
       } catch {
         n = T.randomValue(ne), c = x.hashEmailVerificationToken(n), r++;
       }
@@ -3931,13 +3974,13 @@ class x {
   /**
    * Separated out for unit testing/mocking purposes
    */
-  async _sendEmailVerificationToken(a, e, t) {
+  async _sendEmailVerificationToken(s, e, t) {
     this.smtpUsername && this.smtpUsername, this.smtpPassword && this.smtpPassword;
     let r = {
       from: this.emailFrom,
       to: e,
       subject: this.emailVerificationSubject
-    }, i = { token: a, siteUrl: this.siteUrl, prefix: this.prefix };
+    }, i = { token: s, siteUrl: this.siteUrl, prefix: this.prefix };
     return t && (i = { ...i, ...t }), this.emailVerificationTextBody && (r.text = this.render ? this.render(this.emailVerificationTextBody, i) : W.render(this.emailVerificationTextBody, i)), this.emailVerificationHtmlBody && (r.html = this.render ? this.render(this.emailVerificationHtmlBody, i) : W.render(this.emailVerificationHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
   }
   /**
@@ -3957,15 +4000,15 @@ class x {
    * @param extraData : these extra variables will be passed to the Nunjucks 
    *        templates
    */
-  async sendEmailVerificationToken(a, e = "", t = {}) {
+  async sendEmailVerificationToken(s, e = "", t = {}) {
     if (!this.emailVerificationTextBody && !this.emailVerificationHtmlBody)
       throw new o(
         l.Configuration,
         "Either emailVerificationTextBody or emailVerificationHtmlBody must be set to send email verification emails"
       );
-    let { user: r } = await this.userStorage.getUserById(a, { skipEmailVerifiedCheck: !0 }), i = e;
+    let { user: r } = await this.userStorage.getUserById(s, { skipEmailVerifiedCheck: !0 }), i = e;
     i != "" ? x.validateEmail(i) : (i = r.email ?? r.username, i || (i = r.username), x.validateEmail(i)), x.validateEmail(i);
-    const s = await this.createAndSaveEmailVerificationToken(a, e), n = await this._sendEmailVerificationToken(s, i, t);
+    const a = await this.createAndSaveEmailVerificationToken(s, e), n = await this._sendEmailVerificationToken(a, i, t);
     u.logger.info(f({ msg: "Sent email verification email", emailMessageId: n, email: i }));
   }
   /**
@@ -3983,8 +4026,8 @@ class x {
    * @returns the userid of the user the token is for and the email
    *          address the user is validating
    */
-  async verifyEmailVerificationToken(a) {
-    const e = x.hashEmailVerificationToken(a);
+  async verifyEmailVerificationToken(s) {
+    const e = x.hashEmailVerificationToken(s);
     let t = await this.keyStorage.getKey(e);
     try {
       if (!t.userid || !t.expires) throw new o(l.InvalidKey);
@@ -3995,24 +4038,24 @@ class x {
     } finally {
     }
   }
-  async deleteEmailVerificationToken(a) {
+  async deleteEmailVerificationToken(s) {
     try {
-      const e = x.hashEmailVerificationToken(a);
+      const e = x.hashEmailVerificationToken(s);
       await this.keyStorage.deleteKey(e);
     } catch (e) {
       const t = o.asCrossauthError(e);
       u.logger.debug(f({ err: t }));
     }
   }
-  async createAndSavePasswordResetToken(a) {
+  async createAndSavePasswordResetToken(s) {
     let t = 0;
     const r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.passwordResetExpires);
     for (; t < 10; ) {
-      let s = T.randomValue(ne), n = x.hashPasswordResetToken(s);
+      let a = T.randomValue(ne), n = x.hashPasswordResetToken(a);
       try {
-        return await this.keyStorage.saveKey(a, n, r, i), s;
+        return await this.keyStorage.saveKey(s, n, r, i), a;
       } catch {
-        s = T.randomValue(ne), n = x.hashPasswordResetToken(s), t++;
+        a = T.randomValue(ne), n = x.hashPasswordResetToken(a), t++;
       }
     }
     throw new o(l.Connection, "failed creating a unique key");
@@ -4031,9 +4074,9 @@ class x {
    * @param token the token to validate
    * @returns the user that the token is for
    */
-  async verifyPasswordResetToken(a) {
-    const e = x.hashPasswordResetToken(a);
-    u.logger.debug("verifyPasswordResetToken " + a + " " + e);
+  async verifyPasswordResetToken(s) {
+    const e = x.hashPasswordResetToken(s);
+    u.logger.debug("verifyPasswordResetToken " + s + " " + e);
     let t = await this.keyStorage.getKey(e);
     if (!t.userid) throw new o(l.InvalidKey);
     if (!t.userid || !t.expires) throw new o(l.InvalidKey);
@@ -4049,7 +4092,7 @@ class x {
   /**
    * Separated out for unit testing/mocking purposes
    */
-  async _sendPasswordResetToken(a, e, t) {
+  async _sendPasswordResetToken(s, e, t) {
     if (!this.emailVerificationTextBody && !this.emailVerificationHtmlBody)
       throw new o(
         l.Configuration,
@@ -4060,7 +4103,7 @@ class x {
       from: this.emailFrom,
       to: e,
       subject: this.passwordResetSubject
-    }, i = { token: a, siteUrl: this.siteUrl, prefix: this.prefix };
+    }, i = { token: s, siteUrl: this.siteUrl, prefix: this.prefix };
     return t && (i = { ...i, ...t }), this.passwordResetTextBody && (r.text = this.render ? this.render(this.passwordResetTextBody, i) : W.render(this.passwordResetTextBody, i)), this.passwordResetHtmlBody && (r.html = this.render ? this.render(this.passwordResetHtmlBody, i) : W.render(this.passwordResetHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
   }
   /**
@@ -4069,20 +4112,20 @@ class x {
    * @param extraData : these extra variables will be passed to the Nunjucks 
    *        templates
    */
-  async sendPasswordResetToken(a, e = {}, t = !1) {
+  async sendPasswordResetToken(s, e = {}, t = !1) {
     if (!this.passwordResetTextBody && !this.passwordResetHtmlBody)
       throw new o(
         l.Configuration,
         "Either passwordResetTextBody or passwordResetTextBody must be set to send email verification emails"
       );
-    let { user: r } = await this.userStorage.getUserById(a, {
+    let { user: r } = await this.userStorage.getUserById(s, {
       skipActiveCheck: !0
     });
     if (!t && r.state != E.active && r.state != E.passwordResetNeeded && r.state != E.passwordAndFactor2ResetNeeded)
       throw new o(l.UserNotActive);
     let i = (r.email ?? r.username).toLowerCase();
     i || (i = r.username.toLowerCase()), x.validateEmail(i);
-    const s = await this.createAndSavePasswordResetToken(a), n = await this._sendPasswordResetToken(s, i, e);
+    const a = await this.createAndSavePasswordResetToken(s), n = await this._sendPasswordResetToken(a, i, e);
     u.logger.info(f({ msg: "Sent password reset email", emailMessageId: n, email: i }));
   }
   /**
@@ -4090,8 +4133,8 @@ class x {
    * @param email the email to validate
    * @returns true or false
    */
-  static isEmailValid(a) {
-    return String(a).toLowerCase().match(
+  static isEmailValid(s) {
+    return String(s).toLowerCase().match(
       /^(([^<>()[\]\.,;:\s@"]+(\.[^<>()[\]\.,;:\s@"]+)*)|.(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
     ) != null;
   }
@@ -4102,15 +4145,15 @@ class x {
    * 
    * @param email the email to validate
    */
-  static validateEmail(a) {
-    if (a == null || !x.isEmailValid(a)) throw new o(l.InvalidEmail);
+  static validateEmail(s) {
+    if (s == null || !x.isEmailValid(s)) throw new o(l.InvalidEmail);
   }
 }
-const ke = 16, _e = 16;
-function Rt(C) {
+const _e = 16, ke = 16;
+function Bt(S) {
   return {
-    ...C,
-    path: C.path ?? "/"
+    ...S,
+    path: S.path ?? "/"
   };
 }
 class rt {
@@ -4120,7 +4163,7 @@ class rt {
    * @param options configurable options.  See {@link DoubleSubmitCsrfTokenOptions}.  The 
    *                expires and maxAge options are ignored (cookies are session-only).
    */
-  constructor(a = {}) {
+  constructor(s = {}) {
     // header settings
     /** name of the CRSF HTTP header */
     h(this, "headerName", "X-CROSSAUTH-CSRF");
@@ -4134,7 +4177,7 @@ class rt {
     h(this, "sameSite", "lax");
     // hasher settings
     h(this, "secret", "");
-    w("headerName", m.String, this, a, "CSRF_HEADER_NAME"), w("cookieName", m.String, this, a, "CSRF_COOKIE_NAME"), w("domain", m.String, this, a, "CSRF_COOKIE_DOMAIN"), w("httpOnly", m.Boolean, this, a, "CSRF_COOKIE_HTTPONLY"), w("path", m.String, this, a, "CSRF_COOKIE_PATH"), w("secure", m.Boolean, this, a, "CSRF_COOKIE_SECURE"), w("sameSite", m.String, this, a, "CSRF_COOKIE_SAMESITE"), w("secret", m.String, this, a, "SECRET", !0);
+    w("headerName", m.String, this, s, "CSRF_HEADER_NAME"), w("cookieName", m.String, this, s, "CSRF_COOKIE_NAME"), w("domain", m.String, this, s, "CSRF_COOKIE_DOMAIN"), w("httpOnly", m.Boolean, this, s, "CSRF_COOKIE_HTTPONLY"), w("path", m.String, this, s, "CSRF_COOKIE_PATH"), w("secure", m.Boolean, this, s, "CSRF_COOKIE_SECURE"), w("sameSite", m.String, this, s, "CSRF_COOKIE_SAMESITE"), w("secret", m.String, this, s, "SECRET", !0);
   }
   /**
    * Creates a session key and saves in storage
@@ -4144,7 +4187,7 @@ class rt {
    * @returns a random CSRF token.
    */
   createCsrfToken() {
-    return T.randomValue(ke);
+    return T.randomValue(_e);
   }
   /**
    * Returns a {@link Cookie } object with the given session key.
@@ -4152,8 +4195,8 @@ class rt {
    * @param token the value of the csrf token, with signature
    * @returns a {@link Cookie } object,
    */
-  makeCsrfCookie(a) {
-    const e = T.signSecureToken(a, this.secret);
+  makeCsrfCookie(s) {
+    const e = T.signSecureToken(s, this.secret);
     let t = {};
     return this.domain && (t.domain = this.domain), this.path && (t.path = this.path), t.sameSite = this.sameSite, this.httpOnly && (t.httpOnly = this.httpOnly), this.secure && (t.secure = this.secure), {
       name: this.cookieName,
@@ -4161,11 +4204,11 @@ class rt {
       options: t
     };
   }
-  makeCsrfFormOrHeaderToken(a) {
-    return this.maskCsrfToken(a);
+  makeCsrfFormOrHeaderToken(s) {
+    return this.maskCsrfToken(s);
   }
-  unsignCookie(a) {
-    return T.unsignSecureToken(a, this.secret);
+  unsignCookie(s) {
+    return T.unsignSecureToken(s, this.secret);
   }
   /**
    * Takes a session ID and creates a string representation of the cookie (value of the HTTP `Cookie` header).
@@ -4173,16 +4216,16 @@ class rt {
    * @param cookieValue the value to put in the cookie
    * @returns a string representation of the cookie and options.
    */
-  makeCsrfCookieString(a) {
-    let e = this.cookieName + "=" + a + "; SameSite=" + this.sameSite;
+  makeCsrfCookieString(s) {
+    let e = this.cookieName + "=" + s + "; SameSite=" + this.sameSite;
     return this.domain && (e += "; " + this.domain), this.path && (e += "; " + this.path), this.httpOnly && (e += "; httpOnly"), this.secure && (e += "; secure"), e;
   }
-  maskCsrfToken(a) {
-    const e = T.randomValue(ke), t = T.xor(a, e);
+  maskCsrfToken(s) {
+    const e = T.randomValue(_e), t = T.xor(s, e);
     return e + "." + t;
   }
-  unmaskCsrfToken(a) {
-    const e = a.split(".");
+  unmaskCsrfToken(s) {
+    const e = s.split(".");
     if (e.length != 2) throw new o(l.InvalidCsrf, "CSRF token in header or form not in correct format");
     const t = e[0], r = e[1];
     return T.xor(r, t);
@@ -4198,16 +4241,16 @@ class rt {
    * @param formOrHeaderValue the value from the csrfToken form header or the X-CROSSAUTH-CSRF header.
    * @throws {@link @crossauth/common!CrossauthError} with {@link @crossauth/common!ErrorCode} of `InvalidKey`
    */
-  validateDoubleSubmitCsrfToken(a, e) {
+  validateDoubleSubmitCsrfToken(s, e) {
     const t = this.unmaskCsrfToken(e);
     let r;
     try {
-      r = T.unsignSecureToken(a, this.secret);
+      r = T.unsignSecureToken(s, this.secret);
     } catch (i) {
       throw u.logger.error(f({ err: i })), new o(l.InvalidCsrf, "Invalid CSRF cookie");
     }
     if (r != t)
-      throw u.logger.warn(f({ msg: "Invalid CSRF token received - form/header value does not match", csrfCookieHash: T.hash(a) })), new o(l.InvalidCsrf);
+      throw u.logger.warn(f({ msg: "Invalid CSRF token received - form/header value does not match", csrfCookieHash: T.hash(s) })), new o(l.InvalidCsrf);
   }
   /**
    * Validates the passed CSRF cookie (doesn't check it matches the token, just that the cookie is valid).  
@@ -4219,9 +4262,9 @@ class rt {
    * @param cookieValue the CSRF cookie value to validate.
    * @throws {@link @crossauth/common!CrossauthError} with {@link @crossauth/common!ErrorCode} of `InvalidKey`
    */
-  validateCsrfCookie(a) {
+  validateCsrfCookie(s) {
     try {
-      return T.unsignSecureToken(a, this.secret);
+      return T.unsignSecureToken(s, this.secret);
     } catch (e) {
       throw u.logger.error(f({ err: e })), new o(l.InvalidCsrf, "Invalid CSRF cookie");
     }
@@ -4235,7 +4278,7 @@ class D {
    * @param options configurable options.  See {@link SessionCookieOptions}.  The 
    *                expires option is ignored (cookies are session-only).
    */
-  constructor(a, e = {}) {
+  constructor(s, e = {}) {
     h(this, "userStorage");
     h(this, "keyStorage");
     /** This is set from input options.  Number of seconds before an
@@ -4247,8 +4290,8 @@ class D {
     // cookie settings
     /** Name of the CSRF Cookie, set from input options */
     h(this, "cookieName", "SESSIONID");
-    h(this, "maxAge", 60 * 60 * 24 * 4);
-    // 4 weeks
+    h(this, "maxAge", 60 * 60 * 24 * 30);
+    // 30 days
     h(this, "domain");
     h(this, "httpOnly", !1);
     h(this, "path", "/");
@@ -4256,11 +4299,11 @@ class D {
     h(this, "sameSite", "lax");
     // hasher settings
     h(this, "secret", "");
-    e.userStorage && (this.userStorage = e.userStorage), this.keyStorage = a, w("idleTimeout", m.Number, this, e, "SESSION_IDLE_TIMEOUT"), w("persist", m.Boolean, this, e, "PERSIST_SESSION_ID"), this.filterFunction = e.filterFunction, w("cookieName", m.String, this, e, "SESSION_COOKIE_NAME"), w("maxAge", m.String, this, e, "SESSION_COOKIE_MAX_AGE"), w("domain", m.String, this, e, "SESSION_COOKIE_DOMAIN"), w("httpOnly", m.Boolean, this, e, "SESSIONCOOKIE_HTTPONLY"), w("path", m.String, this, e, "SESSION_COOKIE_PATH"), w("secure", m.Boolean, this, e, "SESSION_COOKIE_SECURE"), w("sameSite", m.String, this, e, "SESSION_COOKIE_SAMESITE"), w("secret", m.String, this, e, "SECRET", !0);
+    e.userStorage && (this.userStorage = e.userStorage), this.keyStorage = s, w("idleTimeout", m.Number, this, e, "SESSION_IDLE_TIMEOUT"), w("persist", m.Boolean, this, e, "PERSIST_SESSION_ID"), this.filterFunction = e.filterFunction, w("cookieName", m.String, this, e, "SESSION_COOKIE_NAME"), w("maxAge", m.String, this, e, "SESSION_COOKIE_MAX_AGE"), w("domain", m.String, this, e, "SESSION_COOKIE_DOMAIN"), w("httpOnly", m.Boolean, this, e, "SESSIONCOOKIE_HTTPONLY"), w("path", m.String, this, e, "SESSION_COOKIE_PATH"), w("secure", m.Boolean, this, e, "SESSION_COOKIE_SECURE"), w("sameSite", m.String, this, e, "SESSION_COOKIE_SAMESITE"), w("secret", m.String, this, e, "SECRET", !0);
   }
-  expiry(a) {
+  expiry(s) {
     let e;
-    return this.maxAge > 0 && (e = /* @__PURE__ */ new Date(), e.setTime(a.getTime() + this.maxAge * 1e3)), e;
+    return this.maxAge > 0 && (e = /* @__PURE__ */ new Date(), e.setTime(s.getTime() + this.maxAge * 1e3)), e;
   }
   ///// Session IDs
   /**
@@ -4269,8 +4312,8 @@ class D {
    * @param sessionId the session ID to hash
    * @returns a base64-url-encoded string that can go into the storage
    */
-  static hashSessionId(a) {
-    return U.session + T.hash(a);
+  static hashSessionId(s) {
+    return U.session + T.hash(s);
   }
   /**
    * Creates a session key and saves in storage
@@ -4288,27 +4331,27 @@ class D {
    *         {@link @crossauth/common!ErrorCode} `KeyExists` if maximum
    *          attempts exceeded trying to create a unique session id
    */
-  async createSessionKey(a, e = {}) {
-    let r = 0, i = T.randomValue(_e);
-    const s = /* @__PURE__ */ new Date();
-    let n = this.expiry(s), c = !1;
+  async createSessionKey(s, e = {}) {
+    let r = 0, i = T.randomValue(ke);
+    const a = /* @__PURE__ */ new Date();
+    let n = this.expiry(a), c = !1;
     for (; r < 10 && !c; ) {
       const d = D.hashSessionId(i);
       try {
-        this.idleTimeout > 0 && a && (e = { ...e, lastActivity: /* @__PURE__ */ new Date() }), await this.keyStorage.saveKey(a, d, s, n, void 0, e), c = !0;
+        this.idleTimeout > 0 && s && (e = { ...e, lastActivity: /* @__PURE__ */ new Date() }), await this.keyStorage.saveKey(s, d, a, n, void 0, e), c = !0;
       } catch (g) {
         let y = o.asCrossauthError(g);
         if (y.code == l.KeyExists || y.code == l.InvalidKey) {
-          if (r++, i = T.randomValue(_e), r > 10)
+          if (r++, i = T.randomValue(ke), r > 10)
             throw u.logger.error(f({ msg: "Max attempts exceeded trying to create session ID" })), new o(l.KeyExists);
         } else
           throw u.logger.debug(f({ err: g })), g;
       }
     }
     return {
-      userid: a,
+      userid: s,
       value: i,
-      created: s,
+      created: a,
       expires: n
     };
   }
@@ -4321,9 +4364,9 @@ class D {
    * @param persist if passed, overrides the persistSessionId setting
    * @returns a {@link Cookie } object,
    */
-  makeCookie(a, e) {
-    let t = T.signSecureToken(a.value, this.secret), r = {};
-    return e == null && (e = this.persist), this.domain && (r.domain = this.domain), a.expires && e && (r.expires = a.expires), this.path && (r.path = this.path), r.sameSite = this.sameSite, this.httpOnly && (r.httpOnly = this.httpOnly), this.secure && (r.secure = this.secure), {
+  makeCookie(s, e) {
+    let t = T.signSecureToken(s.value, this.secret), r = {};
+    return e == null && (e = this.persist), this.domain && (r.domain = this.domain), s.expires && e && (r.expires = s.expires), this.path && (r.path = this.path), r.sameSite = this.sameSite, this.httpOnly && (r.httpOnly = this.httpOnly), this.secure && (r.secure = this.secure), {
       name: this.cookieName,
       value: t,
       options: r
@@ -4336,9 +4379,9 @@ class D {
    * @param cookie the cookie vlaues to make a string from
    * @returns a string representation of the cookie and options.
    */
-  makeCookieString(a) {
-    let e = a.name + "=" + a.value;
-    return this.sameSite && (e += "; SameSite=" + this.sameSite), a.options.expires && (e += "; expires=" + new Date(a.options.expires).toUTCString()), this.domain && (e += "; domain=" + this.domain), this.path && (e += "; path=" + this.path), this.httpOnly && (e += "; httpOnly"), this.secure && (e += "; secure"), e;
+  makeCookieString(s) {
+    let e = s.name + "=" + s.value;
+    return this.sameSite && (e += "; SameSite=" + this.sameSite), s.options.expires && (e += "; expires=" + new Date(s.options.expires).toUTCString()), this.domain && (e += "; domain=" + this.domain), this.path && (e += "; path=" + this.path), this.httpOnly && (e += "; httpOnly"), this.secure && (e += "; secure"), e;
   }
   /**
    * Updates a session record in storage
@@ -4347,9 +4390,9 @@ class D {
    * @throws {@link @crossauth/common!CrossauthError} if the session does
    *         not exist. 
    */
-  async updateSessionKey(a) {
-    if (!a.value) throw new o(l.InvalidKey, "No session when updating activity");
-    a.value = D.hashSessionId(a.value), await this.keyStorage.updateKey(a);
+  async updateSessionKey(s) {
+    if (!s.value) throw new o(l.InvalidKey, "No session when updating activity");
+    s.value = D.hashSessionId(s.value), await this.keyStorage.updateKey(s);
   }
   /**
    * Unsigns a cookie and returns the original value.
@@ -4358,8 +4401,8 @@ class D {
    * @throws {@link @crossauth/common!CrossauthError} if the signature
    *         is invalid. 
    */
-  unsignCookie(a) {
-    return T.unsignSecureToken(a, this.secret);
+  unsignCookie(s) {
+    return T.unsignSecureToken(s, this.secret);
   }
   /**
    * Returns the user matching the given session key in session storage, or throws an exception.
@@ -4374,8 +4417,8 @@ class D {
    *          sessionId
    * @throws a {@link @crossauth/common!CrossauthError } with {@link @crossauth/common!ErrorCode } set to `InvalidSessionId` or `Expired`.
    */
-  async getUserForSessionId(a, e) {
-    const t = await this.getSessionKey(a);
+  async getUserForSessionId(s, e) {
+    const t = await this.getSessionKey(s);
     if (!this.userStorage) return { key: t, user: void 0 };
     if (t.userid) {
       let { user: r } = await this.userStorage.getUserById(t.userid, e);
@@ -4396,14 +4439,14 @@ class D {
    *         {@link @crossauth/common!ErrorCode } set to `InvalidSessionId`,
    *         `Expired` or `UserNotExist`.
    */
-  async getSessionKey(a) {
-    const e = Date.now(), t = D.hashSessionId(a), r = await this.keyStorage.getKey(t);
-    if (r.value = a, r.expires && e > r.expires.getTime())
-      throw u.logger.warn(f({ msg: "Session id in cookie expired in key storage", hashedSessionCookie: T.hash(a) })), new o(l.Expired);
+  async getSessionKey(s) {
+    const e = Date.now(), t = D.hashSessionId(s), r = await this.keyStorage.getKey(t);
+    if (r.value = s, r.expires && e > r.expires.getTime())
+      throw u.logger.warn(f({ msg: "Session id in cookie expired in key storage", hashedSessionCookie: T.hash(s) })), new o(l.Expired);
     if (r.userid && this.idleTimeout > 0 && r.lastactive && e > r.lastactive.getTime() + this.idleTimeout * 1e3)
-      throw u.logger.warn(f({ msg: "Session cookie with expired idle time received", hashedSessionCookie: T.hash(a) })), new o(l.Expired);
+      throw u.logger.warn(f({ msg: "Session cookie with expired idle time received", hashedSessionCookie: T.hash(s) })), new o(l.Expired);
     if (this.filterFunction && !this.filterFunction(r))
-      throw u.logger.warn(f({ msg: "Filter function on session id in cookie failed", hashedSessionCookie: T.hash(a) })), new o(l.InvalidKey);
+      throw u.logger.warn(f({ msg: "Filter function on session id in cookie failed", hashedSessionCookie: T.hash(s) })), new o(l.InvalidKey);
     return r;
   }
   /**
@@ -4411,18 +4454,18 @@ class D {
    * @param userid the user to delete keys for
    * @param except if defined, don't delete this key
    */
-  async deleteAllForUser(a, e) {
-    e && (e = D.hashSessionId(e)), await this.keyStorage.deleteAllForUser(a, U.session, e);
+  async deleteAllForUser(s, e) {
+    e && (e = D.hashSessionId(e)), await this.keyStorage.deleteAllForUser(s, U.session, e);
   }
 }
-class xt {
+class Lt {
   /**
    * Constructor
    * @param keyStorage  the {@link KeyStorage} instance to use, eg {@link PrismaKeyStorage}.
    * @param authenticators authenticators used to validate users, eg {@link LocalPasswordAuthenticatorOptions }.
    * @param options optional parameters for authentication. See {@link SessionManagerOptions }.
    */
-  constructor(a, e, t = {}) {
+  constructor(s, e, t = {}) {
     h(this, "userStorage");
     h(this, "keyStorage");
     h(this, "emailTokenStorage");
@@ -4434,7 +4477,7 @@ class xt {
     h(this, "enablePasswordReset", !1);
     h(this, "tokenEmailer");
     h(this, "allowedFactor2", []);
-    t.userStorage && (this.userStorage = t.userStorage), this.keyStorage = a, this.authenticators = e;
+    t.userStorage && (this.userStorage = t.userStorage), this.keyStorage = s, this.authenticators = e;
     for (let r in this.authenticators)
       this.authenticators[r].factorName = r;
     if (this.session = new D(this.keyStorage, { ...t == null ? void 0 : t.sessionCookieOptions, ...t ?? {} }), this.csrfTokens = new rt({ ...t == null ? void 0 : t.doubleSubmitCookieOptions, ...t ?? {} }), w("allowedFactor2", m.JsonArray, this, t, "ALLOWED_FACTOR2"), w("enableEmailVerification", m.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), w("enablePasswordReset", m.Boolean, this, t, "ENABLE_PASSWORD_RESET"), this.emailTokenStorage = this.keyStorage, this.userStorage && (this.enableEmailVerification || this.enablePasswordReset)) {
@@ -4493,13 +4536,13 @@ class xt {
    *         {@link @crossauth/common!ErrorCode} of `Connection`, `UserNotValid`, 
    *         `PasswordNotMatch` or `UserNotExist`.
    */
-  async login(a, e, t = {}, r, i, s = !1) {
+  async login(s, e, t = {}, r, i, a = !1) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call login if no user storage provided");
     let n;
     if (i)
       n = (await this.userStorage.getUserByUsername(i.username, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).secrets;
     else {
-      let p = await this.userStorage.getUserByUsername(a, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
+      let p = await this.userStorage.getUserByUsername(s, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
       if (n = p.secrets, i = p.user, !i) throw new o(l.UserNotExist);
       await this.authenticators[i.factor1].authenticateUser(i, n, e);
     }
@@ -4508,7 +4551,7 @@ class xt {
       c = (await this.createAnonymousSession({ data: JSON.stringify({ passwordchange: { username: i.username } }) })).sessionCookie;
     else if (i.state == E.factor2ResetNeeded)
       c = (await this.createAnonymousSession({ data: JSON.stringify({ factor2change: { username: i.username } }) })).sessionCookie;
-    else if (!s && i.factor2 && i.factor2 != "") {
+    else if (!a && i.factor2 && i.factor2 != "") {
       const { sessionCookie: p } = await this.initiateTwoFactorLogin(i);
       c = p;
     } else {
@@ -4522,7 +4565,7 @@ class xt {
         U.passwordResetToken
       );
     } catch (p) {
-      u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: a })), u.logger.debug(f({ err: p }));
+      u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: s })), u.logger.debug(f({ err: p }));
     }
     return {
       sessionCookie: c,
@@ -4539,8 +4582,8 @@ class xt {
    * @returns a cookie with the session ID, a cookie with the CSRF token
    *          and the CSRF value to put in the form or header value.
    */
-  async createAnonymousSession(a = {}) {
-    const e = await this.session.createSessionKey(void 0, a), t = this.session.makeCookie(e, !1);
+  async createAnonymousSession(s = {}) {
+    const e = await this.session.createSessionKey(void 0, s), t = this.session.makeCookie(e, !1);
     let { csrfCookie: r, csrfFormOrHeaderValue: i } = await this.createCsrfToken();
     return {
       sessionCookie: t,
@@ -4557,8 +4600,8 @@ class xt {
    * @throws {@link @crossauth/common!CrossauthError} with 
    *         {@link @crossauth/common!ErrorCode} of `Connection`
    */
-  async logout(a) {
-    const e = await this.session.getSessionKey(a);
+  async logout(s) {
+    const e = await this.session.getSessionKey(s);
     return await this.keyStorage.deleteKey(D.hashSessionId(e.value));
   }
   /**
@@ -4570,8 +4613,8 @@ class xt {
    * @throws {@link @crossauth/common!CrossauthError} with 
    *         {@link @crossauth/common!ErrorCode} of `Connection`
    */
-  async logoutFromAll(a, e) {
-    return this.session.deleteAllForUser(a, e);
+  async logoutFromAll(s, e) {
+    return this.session.deleteAllForUser(s, e);
   }
   /**
    * Returns the user (without secrets) matching the given session key.
@@ -4585,8 +4628,8 @@ class xt {
    *         `InvalidSessionId`
    *         `UserNotExist` or `Expired`.
    */
-  async userForSessionId(a) {
-    return await this.session.getUserForSessionId(a);
+  async userForSessionId(s) {
+    return await this.session.getUserForSessionId(s);
   }
   /**
    * Returns the data object for a session key, or undefined, as a JSON string 
@@ -4600,9 +4643,9 @@ class xt {
    *         {@link @crossauth/common!ErrorCode} of `Connection`,  `InvalidSessionId`
    *         `UserNotExist` or `Expired`.
    */
-  async dataStringForSessionId(a) {
+  async dataStringForSessionId(s) {
     try {
-      let { key: e } = await this.session.getUserForSessionId(a);
+      let { key: e } = await this.session.getUserForSessionId(s);
       return e.data;
     } catch (e) {
       let t = o.asCrossauthError(e);
@@ -4625,8 +4668,8 @@ class xt {
    *         {@link @crossauth/common!ErrorCode} of `Connection`,  `InvalidSessionId`
    *         `UserNotExist` or `Expired`.
    */
-  async dataForSessionId(a) {
-    const e = await this.dataStringForSessionId(a);
+  async dataForSessionId(s) {
+    const e = await this.dataStringForSessionId(s);
     return !e || e.length == 0 ? {} : JSON.parse(e);
   }
   /**
@@ -4635,9 +4678,9 @@ class xt {
    */
   async createCsrfToken() {
     this.csrfTokens.makeCsrfCookie(await this.csrfTokens.createCsrfToken());
-    const a = this.csrfTokens.createCsrfToken(), e = this.csrfTokens.makeCsrfFormOrHeaderToken(a);
+    const s = this.csrfTokens.createCsrfToken(), e = this.csrfTokens.makeCsrfFormOrHeaderToken(s);
     return {
-      csrfCookie: this.csrfTokens.makeCsrfCookie(a),
+      csrfCookie: this.csrfTokens.makeCsrfCookie(s),
       csrfFormOrHeaderValue: e
     };
   }
@@ -4648,8 +4691,8 @@ class xt {
    * @param csrfCookieValue the value from the CSRF cookie
    * @returns the value to put in the form or CSRF header
    */
-  async createCsrfFormOrHeaderValue(a) {
-    const e = this.csrfTokens.unsignCookie(a);
+  async createCsrfFormOrHeaderValue(s) {
+    const e = this.csrfTokens.unsignCookie(s);
     return this.csrfTokens.makeCsrfFormOrHeaderToken(e);
   }
   /**
@@ -4660,8 +4703,8 @@ class xt {
    * @throws {@link @crossauth/common!CrossauthError} with `InvalidKey`
    *         if the signature is invalid.
    */
-  getSessionId(a) {
-    return this.session.unsignCookie(a);
+  getSessionId(s) {
+    return this.session.unsignCookie(s);
   }
   /**
    * Throws {@link @crossauth/common!CrossauthError} with 
@@ -4672,17 +4715,17 @@ class xt {
    * @param csrfFormOrHeaderValue the value from the form field or
    *        CSRF header
    */
-  validateDoubleSubmitCsrfToken(a, e) {
-    if (!a || !e) throw new o(l.InvalidCsrf, "CSRF missing from either cookie or form/header value");
-    this.csrfTokens.validateDoubleSubmitCsrfToken(a, e);
+  validateDoubleSubmitCsrfToken(s, e) {
+    if (!s || !e) throw new o(l.InvalidCsrf, "CSRF missing from either cookie or form/header value");
+    this.csrfTokens.validateDoubleSubmitCsrfToken(s, e);
   }
   /**
    * Throws {@link @crossauth/common!CrossauthError} with `InvalidKey` if 
    * the passed CSRF cookie value is not valid (ie invalid signature)
    * @param csrfCookieValue the CSRF cookie value 
    */
-  validateCsrfCookie(a) {
-    this.csrfTokens.validateCsrfCookie(a);
+  validateCsrfCookie(s) {
+    this.csrfTokens.validateCsrfCookie(s);
   }
   /**
    * If sessionIdleTimeout is set, update the last activcity time in key 
@@ -4690,8 +4733,8 @@ class xt {
    * 
    * @param sessionId the session Id to update.
    */
-  async updateSessionActivity(a) {
-    const { key: e } = await this.session.getSessionKey(a);
+  async updateSessionActivity(s) {
+    const { key: e } = await this.session.getSessionKey(s);
     this.session.idleTimeout > 0 && this.session.updateSessionKey({
       value: e.value,
       lastactive: /* @__PURE__ */ new Date()
@@ -4706,9 +4749,9 @@ class xt {
    * @param name of the field.
    * @param value new value to store
    */
-  async updateSessionData(a, e, t) {
-    const r = D.hashSessionId(a);
-    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: T.hash(a) })), await this.keyStorage.updateData(r, e, t);
+  async updateSessionData(s, e, t) {
+    const r = D.hashSessionId(s);
+    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: T.hash(s) })), await this.keyStorage.updateData(r, e, t);
   }
   /**
    * Update field sin the session data.
@@ -4718,9 +4761,9 @@ class xt {
    * @param sessionId the session Id to update.
    * @param dataArray names and values.
    */
-  async updateManySessionData(a, e) {
-    const t = D.hashSessionId(a);
-    u.logger.debug(f({ msg: `Updating session data value${name}`, hashedSessionCookie: T.hash(a) })), await this.keyStorage.updateManyData(t, e);
+  async updateManySessionData(s, e) {
+    const t = D.hashSessionId(s);
+    u.logger.debug(f({ msg: "Updating session data", hashedSessionCookie: T.hash(s) })), await this.keyStorage.updateManyData(t, e);
   }
   /**
   * Deletes a field from the session data.
@@ -4730,17 +4773,17 @@ class xt {
   * @param sessionId the session Id to update.
   * @param name of the field.
   */
-  async deleteSessionData(a, e) {
-    const t = D.hashSessionId(a);
-    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: T.hash(a) })), await this.keyStorage.deleteData(t, e);
+  async deleteSessionData(s, e) {
+    const t = D.hashSessionId(s);
+    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: T.hash(s) })), await this.keyStorage.deleteData(t, e);
   }
   /**
    * Deletes the given session ID from the key storage (not the cookie)
    * 
    * @param sessionId the session Id to delete
    */
-  async deleteSession(a) {
-    return await this.keyStorage.deleteKey(D.hashSessionId(a));
+  async deleteSession(s) {
+    return await this.keyStorage.deleteKey(D.hashSessionId(s));
   }
   /**
    * Creates a new user, sending an email verification message if necessary.
@@ -4756,22 +4799,22 @@ class xt {
    *        performed
    * @returns the new user
    */
-  async createUser(a, e, t, r = !1, i = !1) {
+  async createUser(s, e, t, r = !1, i = !1) {
     var c;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call createUser if no user storage provided");
-    if (!this.authenticators[a.factor1]) throw new o(l.Configuration, "Authenticator cannot create users");
-    this.authenticators[a.factor1].skipEmailVerificationOnSignup() == !0 && (r = !0);
-    let s = i ? void 0 : await this.authenticators[a.factor1].createPersistentSecrets(a.username, e, t);
-    const n = i ? await this.userStorage.createUser(a) : await this.userStorage.createUser(a, s);
+    if (!this.authenticators[s.factor1]) throw new o(l.Configuration, "Authenticator cannot create users");
+    this.authenticators[s.factor1].skipEmailVerificationOnSignup() == !0 && (r = !0);
+    let a = i ? void 0 : await this.authenticators[s.factor1].createPersistentSecrets(s.username, e, t);
+    const n = i ? await this.userStorage.createUser(s) : await this.userStorage.createUser(s, a);
     return !r && this.enableEmailVerification && this.tokenEmailer && await ((c = this.tokenEmailer) == null ? void 0 : c.sendEmailVerificationToken(n.id, void 0)), n;
   }
   /**
    * Deletes the user matching the given username
    * @param username user to delete
    */
-  async deleteUserByUsername(a) {
+  async deleteUserByUsername(s) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call deleteUser if no user storage provided");
-    this.userStorage.deleteUserByUsername(a);
+    this.userStorage.deleteUserByUsername(s);
   }
   /** Creates a user with 2FA enabled.
    * 
@@ -4789,16 +4832,16 @@ class xt {
    *          complete 2FA set up (eg the secret key and QR codee for TOTP),
    * 
    */
-  async initiateTwoFactorSignup(a, e, t, r) {
+  async initiateTwoFactorSignup(s, e, t, r) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call initiateTwoFactorSignup if no user storage provided");
-    if (!this.authenticators[a.factor1]) throw new o(l.Configuration, "Authenticator cannot create users");
-    if (!this.authenticators[a.factor2]) throw new o(l.Configuration, "Two factor authentication not enabled for user");
-    const s = await this.authenticators[a.factor2].prepareConfiguration(a), n = s == null ? {} : s.userData, c = s == null ? {} : s.sessionData, d = await this.authenticators[a.factor1].createPersistentSecrets(a.username, e, r);
-    return a.state = "awaitingtwofactorsetup", await this.keyStorage.updateData(
+    if (!this.authenticators[s.factor1]) throw new o(l.Configuration, "Authenticator cannot create users");
+    if (!this.authenticators[s.factor2]) throw new o(l.Configuration, "Two factor authentication not enabled for user");
+    const a = await this.authenticators[s.factor2].prepareConfiguration(s), n = a == null ? {} : a.userData, c = a == null ? {} : a.sessionData, d = await this.authenticators[s.factor1].createPersistentSecrets(s.username, e, r);
+    return s.state = "awaitingtwofactorsetup", await this.keyStorage.updateData(
       D.hashSessionId(t),
       "2fa",
       c
-    ), { userid: (await this.userStorage.createUser(a, d)).id, userData: n };
+    ), { userid: (await this.userStorage.createUser(s, d)).id, userData: n };
   }
   /**
    * Begins the process of setting up 2FA for a user which has already been 
@@ -4809,18 +4852,18 @@ class xt {
    * @returns the 2FA data that can be displayed to the user in the confifugre 2FA
    *          step (such as the secret and QR code for TOTP).
    */
-  async initiateTwoFactorSetup(a, e, t) {
+  async initiateTwoFactorSetup(s, e, t) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call initiateTwOFactorSetup if no user storage provided");
     if (e && e != "none") {
       if (!this.authenticators[e]) throw new o(l.Configuration, "Two factor authentication not enabled for user");
-      const i = await this.authenticators[e].prepareConfiguration(a), s = i == null ? {} : i.userData, n = i == null ? {} : i.sessionData;
+      const i = await this.authenticators[e].prepareConfiguration(s), a = i == null ? {} : i.userData, n = i == null ? {} : i.sessionData;
       return await this.keyStorage.updateData(
         D.hashSessionId(t),
         "2fa",
         n
-      ), s;
+      ), a;
     }
-    return await this.userStorage.updateUser({ id: a.id, factor2: e ?? "" }), await this.keyStorage.updateData(
+    return await this.userStorage.updateUser({ id: s.id, factor2: e ?? "" }), await this.keyStorage.updateData(
       D.hashSessionId(t),
       "2fa",
       void 0
@@ -4839,9 +4882,9 @@ class xt {
    *          secret but only `userData` has the QR code, since it can be
    *          generated from the shared secret.
    */
-  async repeatTwoFactorSignup(a) {
+  async repeatTwoFactorSignup(s) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call repeatTwoFactorSignup if no user storage provided");
-    const e = (await this.dataForSessionId(a))["2fa"], t = e.username, r = e.factor2, i = D.hashSessionId(a), s = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, s), d = c == null ? {} : c.userData, g = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
+    const e = (await this.dataForSessionId(s))["2fa"], t = e.username, r = e.factor2, i = D.hashSessionId(s), a = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, a), d = c == null ? {} : c.userData, g = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
     y && await this.keyStorage.updateData(i, "2fa", y);
     const { user: p } = await this.userStorage.getUserByUsername(t, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
     return { userid: p.id, userData: d, secrets: g };
@@ -4856,8 +4899,8 @@ class xt {
    * @returns the user object
    * @throws {@link @crossauth/common!CrossauthError} if authentication fails.
    */
-  async completeTwoFactorSetup(a, e) {
-    var k;
+  async completeTwoFactorSetup(s, e) {
+    var _;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call completeTwoFactorSetup if no user storage provided");
     let t = !1, { user: r, key: i } = await this.session.getUserForSessionId(e, {
       skipActiveCheck: !0
@@ -4865,23 +4908,23 @@ class xt {
     if (r && r.state != E.active && r.state != E.factor2ResetNeeded)
       throw new o(l.UserNotActive);
     if (!i) throw new o(l.InvalidKey, "Session key not found");
-    let s = z.decodeData(i.data)["2fa"];
-    if (!(s != null && s.factor2) || !(s != null && s.username)) throw new o(l.Unauthorized, "Two factor authentication not initiated");
-    let n = s.username;
-    const c = this.authenticators[s.factor2];
+    let a = L.decodeData(i.data)["2fa"];
+    if (!(a != null && a.factor2) || !(a != null && a.username)) throw new o(l.Unauthorized, "Two factor authentication not initiated");
+    let n = a.username;
+    const c = this.authenticators[a.factor2];
     if (!c) throw new o(l.Configuration, "Unrecognised second factor authentication");
     const d = {}, g = c.secretNames();
-    for (let S in s)
-      g.includes(S) && (d[S] = s[S]);
-    await c.authenticateUser(void 0, s, a), r || (t = !0, r = (await this.userStorage.getUserByUsername(n, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).user);
+    for (let C in a)
+      g.includes(C) && (d[C] = a[C]);
+    await c.authenticateUser(void 0, a, s), r || (t = !0, r = (await this.userStorage.getUserByUsername(n, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).user);
     const y = c.skipEmailVerificationOnSignup() == !0;
     if (!r) throw new o(l.UserNotExist, "Couldn't fetch user");
     const p = {
       id: r.id,
       state: !y && this.enableEmailVerification ? "awaitingemailverification" : "active",
-      factor2: s.factor2
+      factor2: a.factor2
     };
-    return c.secretNames().length > 0 ? await this.userStorage.updateUser(p, d) : await this.userStorage.updateUser(p), !y && t && this.enableEmailVerification && this.tokenEmailer && await ((k = this.tokenEmailer) == null ? void 0 : k.sendEmailVerificationToken(r.id, void 0)), await this.keyStorage.updateData(D.hashSessionId(i.value), "2fa", void 0), { ...r, ...p };
+    return c.secretNames().length > 0 ? await this.userStorage.updateUser(p, d) : await this.userStorage.updateUser(p), !y && t && this.enableEmailVerification && this.tokenEmailer && await ((_ = this.tokenEmailer) == null ? void 0 : _.sendEmailVerificationToken(r.id, void 0)), await this.keyStorage.updateData(D.hashSessionId(i.value), "2fa", void 0), { ...r, ...p };
   }
   /**
    * Initiates the two factor login process.
@@ -4890,11 +4933,11 @@ class xt {
    * @param user the user, which should aleady have been authenticated with factor1
    * @returns a new anonymous session cookie and corresponding CSRF cookie and token.
    */
-  async initiateTwoFactorLogin(a) {
-    const t = await this.authenticators[a.factor2].createOneTimeSecrets(a), { sessionCookie: r } = await this.createAnonymousSession({ data: JSON.stringify({ "2fa": { username: a.username, twoFactorInitiated: !0, factor2: a.factor2, ...t } }) }), i = this.csrfTokens.createCsrfToken(), s = this.csrfTokens.makeCsrfCookie(i), n = this.csrfTokens.makeCsrfFormOrHeaderToken(i);
+  async initiateTwoFactorLogin(s) {
+    const t = await this.authenticators[s.factor2].createOneTimeSecrets(s), { sessionCookie: r } = await this.createAnonymousSession({ data: JSON.stringify({ "2fa": { username: s.username, twoFactorInitiated: !0, factor2: s.factor2, ...t } }) }), i = this.csrfTokens.createCsrfToken(), a = this.csrfTokens.makeCsrfCookie(i), n = this.csrfTokens.makeCsrfFormOrHeaderToken(i);
     return {
       sessionCookie: r,
-      csrfCookie: s,
+      csrfCookie: a,
       csrfFormOrHeaderValue: n
     };
   }
@@ -4909,12 +4952,12 @@ class xt {
    * @returns If a token was passed a new anonymous session cookie and 
    *          corresponding CSRF cookie and token.
    */
-  async initiateTwoFactorPageVisit(a, e, t, r, i) {
-    const n = await this.authenticators[a.factor2].createOneTimeSecrets(a);
+  async initiateTwoFactorPageVisit(s, e, t, r, i) {
+    const n = await this.authenticators[s.factor2].createOneTimeSecrets(s);
     let c, d, g;
     const y = D.hashSessionId(e);
-    u.logger.debug("initiateTwoFactorPageVisit " + a.username + " " + e + " " + y);
-    let p = { username: a.username, factor2: a.factor2, secrets: n, body: t, url: r };
+    u.logger.debug("initiateTwoFactorPageVisit " + s.username + " " + e + " " + y);
+    let p = { username: s.username, factor2: s.factor2, secrets: n, body: t, url: r };
     return i && (p["content-type"] = i), await this.keyStorage.updateData(y, "pre2fa", p), {
       sessionCookie: c,
       csrfCookie: d,
@@ -4930,18 +4973,18 @@ class xt {
    * @param sessionId the session cookie value (ie still signed)
    * @throws {@link @crossauth/common!CrossauthError} if authentication fails.
    */
-  async completeTwoFactorPageVisit(a, e) {
+  async completeTwoFactorPageVisit(s, e) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call completeTwoFactorPageVisit if no user storage provided");
     let { key: t } = await this.session.getUserForSessionId(e);
     if (!t) throw new o(l.InvalidKey, "Session key not found");
-    let r = z.decodeData(t.data);
+    let r = L.decodeData(t.data);
     if (!("pre2fa" in r)) throw new o(l.Unauthorized, "Two factor authentication not initiated");
-    const { secrets: i } = await this.userStorage.getUserByUsername(r.pre2fa.username), s = this.authenticators[r.pre2fa.factor2];
-    if (!s) throw new o(l.Configuration, "Unrecognised second factor authentication");
-    const n = {}, c = s.secretNames();
+    const { secrets: i } = await this.userStorage.getUserByUsername(r.pre2fa.username), a = this.authenticators[r.pre2fa.factor2];
+    if (!a) throw new o(l.Configuration, "Unrecognised second factor authentication");
+    const n = {}, c = a.secretNames();
     for (let d in i)
       c.includes(d) && d in i && (n[d] = i[d]);
-    await s.authenticateUser(void 0, { ...n, ...r.pre2fa.secrets }, a), await this.keyStorage.updateData(D.hashSessionId(t.value), "pre2fa", void 0);
+    await a.authenticateUser(void 0, { ...n, ...r.pre2fa.secrets }, s), await this.keyStorage.updateData(D.hashSessionId(t.value), "pre2fa", void 0);
   }
   /**
    * Cancels the 2FA that was previously initiated but not completed..  
@@ -4952,10 +4995,10 @@ class xt {
    * @throws {@link @crossauth/common!CrossauthError} of `Unauthorized`
    *         if 2FA was not initiated.
    */
-  async cancelTwoFactorPageVisit(a) {
-    let { key: e } = await this.session.getUserForSessionId(a);
+  async cancelTwoFactorPageVisit(s) {
+    let { key: e } = await this.session.getUserForSessionId(s);
     if (!e) throw new o(l.InvalidKey, "Session key not found");
-    let t = z.decodeData(e.data);
+    let t = L.decodeData(e.data);
     if (!("pre2fa" in t)) throw new o(l.Unauthorized, "Two factor authentication not initiated");
     return await this.keyStorage.updateData(D.hashSessionId(e.value), "pre2fa", void 0), t.pre2fa;
   }
@@ -4976,17 +5019,17 @@ class xt {
    *          `csrfToken` the new CSRF token corresponding to the cookie
    *          `user` the newly-logged in user.
    */
-  async completeTwoFactorLogin(a, e, t = {}, r) {
+  async completeTwoFactorLogin(s, e, t = {}, r) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call completeTwoFactorLogin if no user storage provided");
     let { key: i } = await this.session.getUserForSessionId(e);
     if (!i || !i.data || i.data == "") throw new o(l.Unauthorized);
-    let s = z.decodeData(i.data)["2fa"], n = s.username, c = s.factor2;
+    let a = L.decodeData(i.data)["2fa"], n = a.username, c = a.factor2;
     const { user: d, secrets: g } = await this.userStorage.getUserByUsername(n), y = this.authenticators[c];
     if (!y) throw new o(l.Configuration, "Second factor " + c + " not enabled");
-    await y.authenticateUser(d, { ...g, ...s }, a);
+    await y.authenticateUser(d, { ...g, ...a }, s);
     const p = await this.session.createSessionKey(d.id, t);
     await this.keyStorage.deleteKey(D.hashSessionId(i.value));
-    const k = this.session.makeCookie(p, r), S = this.csrfTokens.createCsrfToken(), v = this.csrfTokens.makeCsrfCookie(S), _ = this.csrfTokens.makeCsrfFormOrHeaderToken(S);
+    const _ = this.session.makeCookie(p, r), C = this.csrfTokens.createCsrfToken(), v = this.csrfTokens.makeCsrfCookie(C), k = this.csrfTokens.makeCsrfFormOrHeaderToken(C);
     try {
       this.emailTokenStorage.deleteAllForUser(
         d.id,
@@ -4996,9 +5039,9 @@ class xt {
       u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: n })), u.logger.debug(f({ err: A }));
     }
     return {
-      sessionCookie: k,
+      sessionCookie: _,
       csrfCookie: v,
-      csrfFormOrHeaderValue: _,
+      csrfFormOrHeaderValue: k,
       user: d
     };
   }
@@ -5006,10 +5049,10 @@ class xt {
        * Sends a password reset token
        * @param email the user's email (where the token will be sent)
   .     */
-  async requestPasswordReset(a) {
+  async requestPasswordReset(s) {
     var t;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call requestPasswordReset if no user storage provided");
-    const { user: e } = await this.userStorage.getUserByEmail(a, {
+    const { user: e } = await this.userStorage.getUserByEmail(s, {
       skipActiveCheck: !0
     });
     if (e.state != E.active && e.state != E.passwordResetNeeded && e.state != E.passwordAndFactor2ResetNeeded)
@@ -5025,16 +5068,16 @@ class xt {
    * @param token the token to apply
    * @returns the new user record
    */
-  async applyEmailVerificationToken(a) {
+  async applyEmailVerificationToken(s) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call applyEmailVerificationToken if no user storage provided");
     if (u.logger.debug(f({ msg: "applyEmailVerificationToken" })), !this.tokenEmailer) throw new o(l.Configuration, "Email verification not enabled");
     try {
-      let { userid: e, newEmail: t } = await this.tokenEmailer.verifyEmailVerificationToken(a), { user: r } = await this.userStorage.getUserById(e, { skipEmailVerifiedCheck: !0 }), i;
+      let { userid: e, newEmail: t } = await this.tokenEmailer.verifyEmailVerificationToken(s), { user: r } = await this.userStorage.getUserById(e, { skipEmailVerifiedCheck: !0 }), i;
       "email" in r && r.email != null ? i = r.email : i = r.username;
-      let s = {
+      let a = {
         id: r.id
       };
-      return (r.state = "awaitingemailverification") && (s.state = "active"), t != "" ? s.email = t : i = void 0, await this.userStorage.updateUser(s), await this.tokenEmailer.deleteEmailVerificationToken(a), { ...r, ...s, oldEmail: i };
+      return (r.state = "awaitingemailverification") && (a.state = "active"), t != "" ? a.email = t : i = void 0, await this.userStorage.updateUser(a), await this.tokenEmailer.deleteEmailVerificationToken(s), { ...r, ...a, oldEmail: i };
     } finally {
     }
   }
@@ -5044,29 +5087,29 @@ class xt {
    * @returns the user
    * @throws {@link @crossauth/common!CrossauthError} if the token is not valid.
    */
-  async userForPasswordResetToken(a) {
+  async userForPasswordResetToken(s) {
     if (u.logger.debug(f({ msg: "userForPasswordResetToken" })), !this.tokenEmailer) throw new o(l.Configuration, "Password reset not enabled");
-    return await this.tokenEmailer.verifyPasswordResetToken(a);
+    return await this.tokenEmailer.verifyPasswordResetToken(s);
   }
-  async changeSecrets(a, e, t, r, i) {
+  async changeSecrets(s, e, t, r, i) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call changeSecrets if no user storage provided");
-    let { user: s, secrets: n } = await this.userStorage.getUserByUsername(a);
-    const c = e == 1 ? s.factor1 : s.factor2;
-    i != null && await this.authenticators[c].authenticateUser(s, n, i);
-    const d = await this.authenticators[s.factor1].createPersistentSecrets(s.username, t, r);
+    let { user: a, secrets: n } = await this.userStorage.getUserByUsername(s);
+    const c = e == 1 ? a.factor1 : a.factor2;
+    i != null && await this.authenticators[c].authenticateUser(a, n, i);
+    const d = await this.authenticators[a.factor1].createPersistentSecrets(a.username, t, r);
     await this.userStorage.updateUser(
-      { id: s.id },
+      { id: a.id },
       d
     );
     try {
       this.emailTokenStorage.deleteAllForUser(
-        s.id,
+        a.id,
         U.passwordResetToken
       );
     } catch (g) {
-      u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: a })), u.logger.debug(f({ err: g }));
+      u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: s })), u.logger.debug(f({ err: g }));
     }
-    return s;
+    return a;
   }
   /**
    * Updates a user entry in storage
@@ -5074,28 +5117,28 @@ class xt {
    * @param newUser the new user details
    * @returns true if email verification is now needed, false otherwise
    */
-  async updateUser(a, e, t = !1, r = !1) {
+  async updateUser(s, e, t = !1, r = !1) {
     var y, p;
     let i;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call updateUser if no user storage provided");
-    if (!("id" in a) || a.id == null)
+    if (!("id" in s) || s.id == null)
       throw new o(l.UserNotExist, "Please specify a user id");
-    if (!("username" in a) || a.username == null)
+    if (!("username" in s) || s.username == null)
       throw new o(l.UserNotExist, "Please specify a userername");
-    let { email: s, username: n, password: c, ...d } = e;
-    d.userid = a.userid;
+    let { email: a, username: n, password: c, ...d } = e;
+    d.userid = s.userid;
     let g = !1;
-    if (s)
-      i = s, x.validateEmail(i), g = !0;
+    if (a)
+      i = a, x.validateEmail(i), g = !0;
     else if (n) {
       i = n;
       try {
-        x.validateEmail(a.username), g = !0;
+        x.validateEmail(s.username), g = !0;
       } catch {
       }
       g && x.validateEmail(i);
     }
-    return !t && this.enableEmailVerification && g ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(a.id, i)) : (s && (d.email = s), n && (d.username = n)), (e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded) && await ((p = this.tokenEmailer) == null ? void 0 : p.sendPasswordResetToken(a.id, {}, r)), await this.userStorage.updateUser(d), {
+    return !t && this.enableEmailVerification && g ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(s.id, i)) : (a && (d.email = a), n && (d.username = n)), (e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded) && await ((p = this.tokenEmailer) == null ? void 0 : p.sendPasswordResetToken(s.id, {}, r)), await this.userStorage.updateUser(d), {
       emailVerificationTokenSent: !t && this.enableEmailVerification && g,
       passwordResetTokenSent: e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded
     };
@@ -5111,15 +5154,15 @@ class xt {
    * @throws {@link @crossauth/common!CrossauthError} if the repeatParams don't match params,
    * the token is invalid or the user storage cannot be updated.
    */
-  async resetSecret(a, e, t, r) {
+  async resetSecret(s, e, t, r) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call resetSecret if no user storage provided");
     if (u.logger.debug(f({ msg: "resetSecret" })), !this.tokenEmailer) throw new o(l.Configuration, "Password reset not enabled");
-    const i = await this.userForPasswordResetToken(a), s = e == 1 ? i.factor1 : i.factor2;
+    const i = await this.userForPasswordResetToken(s), a = e == 1 ? i.factor1 : i.factor2;
     if (!this.tokenEmailer) throw new o(l.Configuration);
     let n = i.state == E.passwordAndFactor2ResetNeeded ? E.factor2ResetNeeded : E.active;
     await this.userStorage.updateUser(
       { id: i.id, state: n },
-      await this.authenticators[s].createPersistentSecrets(i.username, t, r)
+      await this.authenticators[a].createPersistentSecrets(i.username, t, r)
     );
     try {
       await this.emailTokenStorage.deleteAllForUser(
@@ -5139,7 +5182,7 @@ class ge {
    * @param apiKeyStorage storage for API keys.  In addition to the fields {@link KeyStorage} needs, the storage also needs a string field called `name`.
    * @param options options.  See {@link ApiKeyManagerOptions}
    */
-  constructor(a, e = {}) {
+  constructor(s, e = {}) {
     h(this, "apiKeyStorage");
     h(this, "keyLength", 16);
     h(this, "secret", "");
@@ -5149,7 +5192,7 @@ class ge {
     h(this, "prefix", U.apiKey);
     /** The name of the speak in the Authorization header.  Defaults to "ApiKey" */
     h(this, "authScheme", "ApiKey");
-    this.apiKeyStorage = a, w("secret", m.String, this, e, "SECRET", !0), w("keyLength", m.String, this, e, "APIKEY_LENGTH"), w("prefix", m.String, this, e, "APIKEY_PREFIX"), w("authScheme", m.String, this, e, "APIKEY_AUTHSCHEME");
+    this.apiKeyStorage = s, w("secret", m.String, this, e, "SECRET", !0), w("keyLength", m.String, this, e, "APIKEY_LENGTH"), w("prefix", m.String, this, e, "APIKEY_PREFIX"), w("authScheme", m.String, this, e, "APIKEY_AUTHSCHEME");
   }
   /**
    * Creates a new random key and returns it, unsigned.  It is also persisted in the key storage as a 
@@ -5169,12 +5212,12 @@ class ge {
    * @returns the new key as a {@link ApiKey} object, plus the token for the 
    *          Authorization header (with the signature appended.)
    */
-  async createKey(a, e, t, r, i) {
-    const s = T.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, d = ge.hashApiKeyValue(s), g = {
-      name: a,
-      value: s,
+  async createKey(s, e, t, r, i) {
+    const a = T.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, d = ge.hashApiKeyValue(a), g = {
+      name: s,
+      value: a,
       userid: e,
-      data: z.encodeData(t),
+      data: L.encodeData(t),
       expires: c,
       created: n,
       ...i
@@ -5185,13 +5228,13 @@ class ge {
       n,
       c,
       g.data,
-      { name: a, ...i }
+      { name: s, ...i }
     );
-    const y = this.signApiKeyValue(s);
+    const y = this.signApiKeyValue(a);
     return { key: g, token: y };
   }
-  static hashApiKeyValue(a) {
-    return T.hash(a);
+  static hashApiKeyValue(s) {
+    return T.hash(s);
   }
   /**
    * Returns the hash of the bearer value from the Authorization header.
@@ -5201,21 +5244,21 @@ class ge {
    * @param unsignedValue the part of the Authorization header after "Berear ".
    * @returns a hash of the value (without the prefix).
    */
-  static hashSignedApiKeyValue(a) {
-    return T.hash(a.split(".")[0]);
+  static hashSignedApiKeyValue(s) {
+    return T.hash(s.split(".")[0]);
   }
-  unsignApiKeyValue(a) {
-    return T.unsign(a, this.secret).v;
+  unsignApiKeyValue(s) {
+    return T.unsign(s, this.secret).v;
   }
-  signApiKeyValue(a) {
-    return T.sign({ v: a }, this.secret);
+  signApiKeyValue(s) {
+    return T.sign({ v: s }, this.secret);
   }
-  async getKey(a) {
-    if (this.authScheme != "" && a.startsWith(this.authScheme + " ")) {
+  async getKey(s) {
+    if (this.authScheme != "" && s.startsWith(this.authScheme + " ")) {
       const i = new RegExp(`^${this.authScheme} `);
-      a = a.replace(i, "");
+      s = s.replace(i, "");
     }
-    const e = this.unsignApiKeyValue(a), t = ge.hashApiKeyValue(e), r = await this.apiKeyStorage.getKey(this.prefix + t);
+    const e = this.unsignApiKeyValue(s), t = ge.hashApiKeyValue(e), r = await this.apiKeyStorage.getKey(this.prefix + t);
     if (!("name" in r)) throw new o(l.InvalidKey, "Not a valid API key");
     return { ...r, name: r.name };
   }
@@ -5225,29 +5268,29 @@ class ge {
    * @returns The {@link ApiKey} object
    * @throws {@link @crossauth/common!CrossauthError} with code `InvalidKey`
    */
-  async validateToken(a) {
-    const e = a.split(" ");
+  async validateToken(s) {
+    const e = s.split(" ");
     if (e.length != 2 || e[0] != this.authScheme)
       throw new o(l.InvalidKey, `Not a ${this.authScheme} token`);
     return await this.getKey(e[1]);
   }
 }
-const it = 16, at = 32;
+const it = 16, st = 32;
 class J {
   /**
    * Constructor
    * @param options See  {@link OAuthClientManagerOptions}
    */
-  constructor(a = {}) {
+  constructor(s = {}) {
     h(this, "oauthPbkdf2Digest", "sha256");
     h(this, "oauthPbkdf2Iterations", 4e4);
     h(this, "oauthPbkdf2KeyLength", 32);
     h(this, "clientStorage");
-    if (!a.clientStorage) throw new o(
+    if (!s.clientStorage) throw new o(
       l.Configuration,
       "Must specify clientStorage when adding a client manager"
     );
-    this.clientStorage = a.clientStorage, w("oauthPbkdf2Digest", m.String, this, a, "OAUTH_PBKDF2_DIGEST"), w("oauthPbkdf2KeyLength", m.String, this, a, "OAUTH_PBKDF2_KEYLENGTH"), w("requireRedirectUriRegistration", m.Boolean, this, a, "OAUTH_REQUIRE_REDIRECT_URI_REGISTRATION");
+    this.clientStorage = s.clientStorage, w("oauthPbkdf2Digest", m.String, this, s, "OAUTH_PBKDF2_DIGEST"), w("oauthPbkdf2KeyLength", m.String, this, s, "OAUTH_PBKDF2_KEYLENGTH"), w("requireRedirectUriRegistration", m.Boolean, this, s, "OAUTH_REQUIRE_REDIRECT_URI_REGISTRATION");
   }
   /**
    * Creates a client and puts it in the storage
@@ -5261,8 +5304,8 @@ class J {
    * @returns the new client.  `client_id` and `client_secret` (plaintext)
    *          will be populated.
    */
-  async createClient(a, e, t, r = !0, i) {
-    const s = J.randomClientId();
+  async createClient(s, e, t, r = !0, i) {
+    const a = J.randomClientId();
     let n, c;
     r && (c = J.randomClientSecret(), n = await T.passwordHash(c, {
       encode: !0,
@@ -5273,9 +5316,9 @@ class J {
       J.validateUri(y);
     }), t || (t = b.allFlows());
     const d = {
-      client_id: s,
+      client_id: a,
       client_secret: n,
-      client_name: a,
+      client_name: s,
       redirect_uri: e,
       confidential: r,
       valid_flow: t,
@@ -5304,19 +5347,19 @@ class J {
    * @returns the updated client.  If it has a secret. it will be in
    *          `client_secret` as plaintext.
    */
-  async updateClient(a, e, t = !1) {
-    const r = await this.clientStorage.getClientById(a);
-    let i = !1, s;
-    e.confidential === !0 && !r.confidential || e.confidential === !0 && t ? (s = J.randomClientSecret(), e.client_secret = await T.passwordHash(s, {
+  async updateClient(s, e, t = !1) {
+    const r = await this.clientStorage.getClientById(s);
+    let i = !1, a;
+    e.confidential === !0 && !r.confidential || e.confidential === !0 && t ? (a = J.randomClientSecret(), e.client_secret = await T.passwordHash(a, {
       encode: !0,
       iterations: this.oauthPbkdf2Iterations,
       keyLen: this.oauthPbkdf2KeyLength,
       digest: this.oauthPbkdf2Digest
     }), i = !0) : e.confidential === !1 && (e.client_secret = null), e.redirect_uri && e.redirect_uri.forEach((c) => {
       J.validateUri(c);
-    }), e.client_id = a, await this.clientStorage.updateClient(e);
-    const n = await this.clientStorage.getClientById(a);
-    return s && (n.client_secret = s), { client: n, newSecret: i };
+    }), e.client_id = s, await this.clientStorage.updateClient(e);
+    const n = await this.clientStorage.getClientById(s);
+    return a && (n.client_secret = a), { client: n, newSecret: i };
   }
   /**
    * Create a random OAuth client id
@@ -5328,7 +5371,7 @@ class J {
   * Create a random OAuth client secret
   */
   static randomClientSecret() {
-    return T.randomValue(at);
+    return T.randomValue(st);
   }
   /** If the passed redirect URI is not in the set of valid ones,
    * throw {@link @crossauth/common!CrossauthError} with
@@ -5337,13 +5380,13 @@ class J {
    * @throws {@link @crossauth/common!CrossauthError} with
    *  {@link @crossauth/common!CrossauthError} `BadRequest`.
    */
-  static validateUri(a) {
+  static validateUri(s) {
     let e = !1;
     try {
-      e = new URL(a).hash.length == 0;
+      e = new URL(s).hash.length == 0;
     } catch (t) {
       try {
-        e = new URL(a).hash.length == 0;
+        e = new URL(s).hash.length == 0;
       } catch {
         u.logger.debug(f({ err: t }));
       }
@@ -5351,12 +5394,12 @@ class J {
     if (!e)
       throw o.fromOAuthError(
         "invalid_request",
-        `Invalid redirect Uri ${a}`
+        `Invalid redirect Uri ${s}`
       );
   }
 }
-function st(C) {
-  switch (C) {
+function at(S) {
+  switch (S) {
     case "HS256":
     case "HS384":
     case "HS512":
@@ -5370,14 +5413,14 @@ function st(C) {
     case "PS384":
     case "PS512":
     case "none":
-      return C;
+      return S;
   }
   throw new o(
     l.Configuration,
-    "Invalid JWT signing algorithm " + C
+    "Invalid JWT signing algorithm " + S
   );
 }
-class Dt {
+class zt {
   /**
    * Constructor
    * 
@@ -5389,7 +5432,7 @@ class Dt {
    *         authenticators for the Password MFA flow)
    * @param options See {@link OAuthAuthorizationServerOptions }
    */
-  constructor(a, e, t, r = {}) {
+  constructor(s, e, t, r = {}) {
     h(this, "clientStorage");
     h(this, "keyStorage");
     h(this, "userStorage");
@@ -5439,7 +5482,7 @@ class Dt {
     h(this, "validFlows", ["all"]);
     /** Set from options.  See {@link OAuthAuthorizationServerOptions.allowedFactor2} */
     h(this, "allowedFactor2", []);
-    this.clientStorage = a, this.keyStorage = e, this.userStorage = r.userStorage, this.authStorage = r.authStorage, t && (this.authenticators = t), this.clientManager = new J({ clientStorage: a, ...r }), w("oauthIssuer", m.String, this, r, "AUTH_SERVER_BASE_URL", !0), w("audience", m.String, this, r, "OAUTH_AUDIENCE"), w("oauthPbkdf2Iterations", m.String, this, r, "OAUTH_PBKDF2_ITERATIONS"), w("requireClientSecretOrChallenge", m.Boolean, this, r, "OAUTH_REQUIRE_CLIENT_SECRET_OR_CHALLENGE"), w("jwtAlgorithm", m.String, this, r, "JWT_ALGORITHM"), w("codeLength", m.Number, this, r, "OAUTH_CODE_LENGTH"), w("jwtKeyType", m.String, this, r, "JWT_KEY_TYPE"), w("jwtSecretKeyFile", m.String, this, r, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", m.String, this, r, "JWT_PUBLIC_KEY_FILE"), w("jwtPrivateKeyFile", m.String, this, r, "JWT_PRIVATE_KEY_FILE"), w("jwtSecretKey", m.String, this, r, "JWT_SECRET_KEY"), w("jwtPublicKey", m.String, this, r, "JWT_PUBLIC_KEY"), w("jwtPrivateKey", m.String, this, r, "JWT_PRIVATE_KEY"), w("jwtKid", m.String, this, r, "JWT_KID"), w("persistAccessToken", m.String, this, r, "OAUTH_PERSIST_ACCESS_TOKEN"), w("issueRefreshToken", m.String, this, r, "OAUTH_ISSUE_REFRESH_TOKEN"), w("opaqueAccessToken", m.String, this, r, "OAUTH_OPAQUE_ACCESS_TOKEN"), w("accessTokenExpiry", m.Number, this, r, "OAUTH_ACCESS_TOKEN_EXPIRY"), w("refreshTokenExpiry", m.Number, this, r, "OAUTH_REFRESH_TOKEN_EXPIRY"), w("rollingRefreshToken", m.Boolean, this, r, "OAUTH_ROLLING_REFRESH_TOKEN"), w("authorizationCodeExpiry", m.Number, this, r, "OAUTH_AUTHORIZATION_CODE_EXPIRY"), w("mfaTokenExpiry", m.Number, this, r, "OAUTH_MFA_TOKEN_EXPIRY"), w("clockTolerance", m.Number, this, r, "OAUTH_CLOCK_TOLERANCE"), w("validateScopes", m.Boolean, this, r, "OAUTH_VALIDATE_SCOPES"), w("emptyScopeIsValid", m.Boolean, this, r, "OAUTH_EMPTY_SCOPE_VALID"), w("validScopes", m.JsonArray, this, r, "OAUTH_VALID_SCOPES"), w("validFlows", m.JsonArray, this, r, "OAUTH_validFlows"), w("idTokenClaims", m.Json, this, r, "OAUTH_ID_TOKEN_CLAIMS"), w("allowedFactor2", m.JsonArray, this, r, "ALLOWED_FACTOR2"), w("userCodeExpiry", m.Number, this, r, "DEVICECODE_USERCODE_EXPIRY"), w("userCodeThrottle", m.Number, this, r, "DEVICECODE_USERCODE_THROTTLE"), w("deviceCodePollInterval", m.Number, this, r, "DEVICECODE_POLL_INTERVAL"), w("deviceCodeLength", m.Number, this, r, "DEVICECODE_LENGTH"), w("userCodeLength", m.Number, this, r, "DEVICECODE_USERCODE_LENGTH");
+    this.clientStorage = s, this.keyStorage = e, this.userStorage = r.userStorage, this.authStorage = r.authStorage, t && (this.authenticators = t), this.clientManager = new J({ clientStorage: s, ...r }), w("oauthIssuer", m.String, this, r, "AUTH_SERVER_BASE_URL", !0), w("audience", m.String, this, r, "OAUTH_AUDIENCE"), w("oauthPbkdf2Iterations", m.String, this, r, "OAUTH_PBKDF2_ITERATIONS"), w("requireClientSecretOrChallenge", m.Boolean, this, r, "OAUTH_REQUIRE_CLIENT_SECRET_OR_CHALLENGE"), w("jwtAlgorithm", m.String, this, r, "JWT_ALGORITHM"), w("codeLength", m.Number, this, r, "OAUTH_CODE_LENGTH"), w("jwtKeyType", m.String, this, r, "JWT_KEY_TYPE"), w("jwtSecretKeyFile", m.String, this, r, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", m.String, this, r, "JWT_PUBLIC_KEY_FILE"), w("jwtPrivateKeyFile", m.String, this, r, "JWT_PRIVATE_KEY_FILE"), w("jwtSecretKey", m.String, this, r, "JWT_SECRET_KEY"), w("jwtPublicKey", m.String, this, r, "JWT_PUBLIC_KEY"), w("jwtPrivateKey", m.String, this, r, "JWT_PRIVATE_KEY"), w("jwtKid", m.String, this, r, "JWT_KID"), w("persistAccessToken", m.String, this, r, "OAUTH_PERSIST_ACCESS_TOKEN"), w("issueRefreshToken", m.String, this, r, "OAUTH_ISSUE_REFRESH_TOKEN"), w("opaqueAccessToken", m.String, this, r, "OAUTH_OPAQUE_ACCESS_TOKEN"), w("accessTokenExpiry", m.Number, this, r, "OAUTH_ACCESS_TOKEN_EXPIRY"), w("refreshTokenExpiry", m.Number, this, r, "OAUTH_REFRESH_TOKEN_EXPIRY"), w("rollingRefreshToken", m.Boolean, this, r, "OAUTH_ROLLING_REFRESH_TOKEN"), w("authorizationCodeExpiry", m.Number, this, r, "OAUTH_AUTHORIZATION_CODE_EXPIRY"), w("mfaTokenExpiry", m.Number, this, r, "OAUTH_MFA_TOKEN_EXPIRY"), w("clockTolerance", m.Number, this, r, "OAUTH_CLOCK_TOLERANCE"), w("validateScopes", m.Boolean, this, r, "OAUTH_VALIDATE_SCOPES"), w("emptyScopeIsValid", m.Boolean, this, r, "OAUTH_EMPTY_SCOPE_VALID"), w("validScopes", m.JsonArray, this, r, "OAUTH_VALID_SCOPES"), w("validFlows", m.JsonArray, this, r, "OAUTH_validFlows"), w("idTokenClaims", m.Json, this, r, "OAUTH_ID_TOKEN_CLAIMS"), w("allowedFactor2", m.JsonArray, this, r, "ALLOWED_FACTOR2"), w("userCodeExpiry", m.Number, this, r, "DEVICECODE_USERCODE_EXPIRY"), w("userCodeThrottle", m.Number, this, r, "DEVICECODE_USERCODE_THROTTLE"), w("deviceCodePollInterval", m.Number, this, r, "DEVICECODE_POLL_INTERVAL"), w("deviceCodeLength", m.Number, this, r, "DEVICECODE_LENGTH"), w("userCodeLength", m.Number, this, r, "DEVICECODE_USERCODE_LENGTH");
     let i = {};
     if (w("userCodeDashEvery", m.String, i, r, "DEVICECODE_USERCODE_DASH_EVERY"), i.userCodeDashEvery)
       if (i.userCodeDashEvery == "" || i.userCodeDashEvery.toLowerCase() == "null") this.userCodeDashEvery = null;
@@ -5452,7 +5495,7 @@ class Dt {
             "userCodeDashEvery must be a number or null"
           );
         }
-    if (w("deviceCodeVerificationUri", m.String, this, r, "DEVICECODE_VERIFICATION_URI"), this.validFlows.length == 1 && this.validFlows[0] == b.All && (this.validFlows = b.allFlows()), this.jwtAlgorithmChecked = st(this.jwtAlgorithm), this.jwtSecretKey || this.jwtSecretKeyFile) {
+    if (w("deviceCodeVerificationUri", m.String, this, r, "DEVICECODE_VERIFICATION_URI"), this.validFlows.length == 1 && this.validFlows[0] == b.All && (this.validFlows = b.allFlows()), this.jwtAlgorithmChecked = at(this.jwtAlgorithm), this.jwtSecretKey || this.jwtSecretKeyFile) {
       if (this.jwtPublicKey || this.jwtPublicKeyFile || this.jwtPrivateKey || this.jwtPrivateKeyFile)
         throw new o(
           l.Configuration,
@@ -5515,19 +5558,19 @@ class Dt {
    *          JSON response. 
    */
   async authorizeGetEndpoint({
-    responseType: a,
+    responseType: s,
     client_id: e,
     redirect_uri: t,
     scope: r,
     state: i,
-    codeChallenge: s,
+    codeChallenge: a,
     codeChallengeMethod: n,
     user: c
   }) {
-    if (!this.responseTypesSupported().includes(a))
+    if (!this.responseTypesSupported().includes(s))
       return {
         error: "unsupported_response_type",
-        error_description: "Unsupported response type " + a
+        error_description: "Unsupported response type " + s
       };
     let g;
     try {
@@ -5541,22 +5584,22 @@ class Dt {
     const {
       scopes: y,
       error: p,
-      error_description: k
+      error_description: _
     } = await this.validateAndPersistScope(e, r, c);
     if (p) return {
       error: p,
-      error_description: k
+      error_description: _
     };
-    const S = this.inferFlowFromGet(a, y || [], s);
-    if (!S || !this.validFlows.includes(S))
+    const C = this.inferFlowFromGet(s, y || [], a);
+    if (!C || !this.validFlows.includes(C))
       return {
         error: "access_denied",
-        error_description: "Unsupported flow type " + S
+        error_description: "Unsupported flow type " + C
       };
-    if (!g.valid_flow.includes(S))
+    if (!g.valid_flow.includes(C))
       return {
         error: "unauthorized_client",
-        error_description: "Client does not support " + S
+        error_description: "Client does not support " + C
       };
     try {
       this.validateState(i);
@@ -5566,17 +5609,17 @@ class Dt {
         error_description: "Invalid state"
       };
     }
-    return a == "code" ? await this.getAuthorizationCode(
+    return s == "code" ? await this.getAuthorizationCode(
       g,
       t,
       y,
       i,
-      s,
+      a,
       n,
       c
     ) : {
       error: "unsupported_response_type",
-      error_description: `Invalid response_type ${a}`
+      error_description: `Invalid response_type ${s}`
     };
   }
   /**
@@ -5588,12 +5631,12 @@ class Dt {
    * @param requestedScopes the scopes that have been requested
    * @returns true or false.
    */
-  async hasAllScopes(a, e, t) {
+  async hasAllScopes(s, e, t) {
     if (!this.authStorage) return !1;
-    const r = await this.authStorage.getAuthorizations(a, e == null ? void 0 : e.id);
-    return t.filter((s) => r.includes(s)).length == t.length;
+    const r = await this.authStorage.getAuthorizations(s, e == null ? void 0 : e.id);
+    return t.filter((a) => r.includes(a)).length == t.length;
   }
-  async validateAndPersistScope(a, e, t) {
+  async validateAndPersistScope(s, e, t) {
     let r, i;
     if (!e && !this.emptyScopeIsValid)
       return {
@@ -5602,32 +5645,32 @@ class Dt {
       };
     if (e) {
       const {
-        error: s,
+        error: a,
         errorDescription: n,
         scopes: c
       } = this.validateScope(e);
-      if (r = c, i = c, s)
+      if (r = c, i = c, a)
         return {
-          error: s,
+          error: a,
           error_description: n ?? "Unknown error"
         };
     } else
       i = [null];
     if (this.authStorage)
       try {
-        const s = i ?? [], n = await this.authStorage.getAuthorizations(
-          a,
+        const a = i ?? [], n = await this.authStorage.getAuthorizations(
+          s,
           t == null ? void 0 : t.id
-        ), c = [.../* @__PURE__ */ new Set([...n, ...s])];
+        ), c = [.../* @__PURE__ */ new Set([...n, ...a])];
         u.logger.debug(f({
-          msg: "Updating authorizations for " + a + " to " + c
+          msg: "Updating authorizations for " + s + " to " + c
         })), await this.authStorage.updateAuthorizations(
-          a,
+          s,
           (t == null ? void 0 : t.id) ?? null,
           c
         );
-      } catch (s) {
-        return u.logger.debug(f({ err: s })), {
+      } catch (a) {
+        return u.logger.debug(f({ err: a })), {
           error: "server_error",
           error_description: "Couldn't save scope"
         };
@@ -5639,9 +5682,9 @@ class Dt {
       };
     return { scopes: r };
   }
-  async authenticateClient(a, e, t) {
+  async authenticateClient(s, e, t) {
     let r = !1;
-    switch (a) {
+    switch (s) {
       case b.AuthorizationCode:
       case b.AuthorizationCodeWithPKCE:
         r = e.confidential == !0 || e.client_secret != null || t != null;
@@ -5679,10 +5722,10 @@ class Dt {
    * @param client_id 
    * @returns the client_id, or an error or `access_denied`.
    */
-  async getClientById(a) {
+  async getClientById(s) {
     let e;
     try {
-      return e = await this.clientStorage.getClientById(a), { client: e };
+      return e = await this.clientStorage.getClientById(s), { client: e };
     } catch {
       return {
         error: "access_denied",
@@ -5701,30 +5744,30 @@ class Dt {
    *         endpoint JSON output.
    */
   async tokenEndpoint({
-    grantType: a,
+    grantType: s,
     client_id: e,
     scope: t,
     code: r,
     client_secret: i,
-    codeVerifier: s,
+    codeVerifier: a,
     refreshToken: n,
     username: c,
     password: d,
     mfaToken: g,
     oobCode: y,
     bindingCode: p,
-    otp: k,
-    deviceCode: S
+    otp: _,
+    deviceCode: C
   }) {
     var K, O, B;
-    const v = this.inferFlowFromPost(a, s);
+    const v = this.inferFlowFromPost(s, a);
     if (!v) return {
       error: "server_error",
       error_description: "Unable to determine OAuth flow type"
     };
-    const _ = await this.getClientById(e);
-    if (!_.client) return _;
-    const A = _.client, M = await this.authenticateClient(v, A, i);
+    const k = await this.getClientById(e);
+    if (!k.client) return k;
+    const A = k.client, M = await this.authenticateClient(v, A, i);
     if (M.error) return M;
     if (v == b.Password && !this.validFlows.includes(v) && !this.validFlows.includes(b.PasswordMfa))
       return {
@@ -5744,8 +5787,8 @@ class Dt {
     let j = !1;
     this.issueRefreshToken && v != b.RefreshToken && (j = !0), this.issueRefreshToken && v == b.RefreshToken && this.rollingRefreshToken && (j = !0);
     let N;
-    if (a == "authorization_code")
-      return this.requireClientSecretOrChallenge && A && A.client_secret && !i && !s ? {
+    if (s == "authorization_code")
+      return this.requireClientSecretOrChallenge && A && A.client_secret && !i && !a ? {
         error: "access_denied",
         error_description: "Must provide either a client secret or use PKCE"
       } : A && A.client_secret && !i ? {
@@ -5755,13 +5798,13 @@ class Dt {
         client: A,
         code: r,
         client_secret: i,
-        codeVerifier: s,
+        codeVerifier: a,
         issueRefreshToken: j
       }) : {
         error: "access_denied",
         error_description: "No authorization code provided for authorization code flow"
       };
-    if (a == "refresh_token") {
+    if (s == "refresh_token") {
       const R = await this.getRefreshTokenData(n);
       if (!n || !R || !this.userStorage)
         return {
@@ -5793,12 +5836,12 @@ class Dt {
       return await this.makeAccessToken({
         client: A,
         client_secret: i,
-        codeVerifier: s,
+        codeVerifier: a,
         issueRefreshToken: j,
         scopes: R.scope,
         user: P
       });
-    } else if (a == "client_credentials") {
+    } else if (s == "client_credentials") {
       const {
         scopes: R,
         error: P,
@@ -5810,11 +5853,11 @@ class Dt {
       } : await this.makeAccessToken({
         client: A,
         client_secret: i,
-        codeVerifier: s,
+        codeVerifier: a,
         scopes: R,
         issueRefreshToken: j
       });
-    } else if (a == "password") {
+    } else if (s == "password") {
       if (!c || !d)
         return {
           error: "access_denied",
@@ -5826,13 +5869,13 @@ class Dt {
             error: "server_error",
             error_description: "Password authentication not configured"
           };
-        const { user: I, secrets: $ } = await this.userStorage.getUserByUsername(c), L = this.authenticators[I.factor1];
-        if (!L || !L.secretNames().includes("password"))
+        const { user: I, secrets: $ } = await this.userStorage.getUserByUsername(c), z = this.authenticators[I.factor1];
+        if (!z || !z.secretNames().includes("password"))
           return {
             error: "access_denied",
             error_description: "Password flow used but factor 1 authenticator does not accept passwords"
           };
-        await L.authenticateUser(
+        await z.authenticateUser(
           I,
           $,
           { password: d }
@@ -5857,12 +5900,12 @@ class Dt {
       } : await this.createMfaRequest(N) : await this.makeAccessToken({
         client: A,
         client_secret: i,
-        codeVerifier: s,
+        codeVerifier: a,
         scopes: R,
         issueRefreshToken: j,
         user: N
       });
-    } else if (a == "http://auth0.com/oauth/grant-type/mfa-otp") {
+    } else if (s == "http://auth0.com/oauth/grant-type/mfa-otp") {
       const {
         scopes: R,
         error: P,
@@ -5873,7 +5916,7 @@ class Dt {
           error: P,
           error_description: F
         };
-      if (!k)
+      if (!_)
         return {
           error: "access_denied",
           error_description: "OTP not provided"
@@ -5889,18 +5932,18 @@ class Dt {
           error: "access_denied",
           error_description: "Invalid MFA token"
         };
-      const L = this.authenticators[I.user.factor2];
-      if (!L || !this.userStorage)
+      const z = this.authenticators[I.user.factor2];
+      if (!z || !this.userStorage)
         return {
           error: "access_denied",
           error_description: "MFA type is not supported for OAuth"
         };
       try {
         const { secrets: V } = await this.userStorage.getUserById(I.user.id);
-        await L.authenticateUser(
+        await z.authenticateUser(
           I.user,
           V,
-          { otp: k }
+          { otp: _ }
         );
       } catch (V) {
         return u.logger.debug(f({ err: V })), {
@@ -5920,12 +5963,12 @@ class Dt {
       return await this.makeAccessToken({
         client: A,
         client_secret: i,
-        codeVerifier: s,
+        codeVerifier: a,
         scopes: R,
         issueRefreshToken: j,
         user: I.user
       });
-    } else if (a == "http://auth0.com/oauth/grant-type/mfa-oob") {
+    } else if (s == "http://auth0.com/oauth/grant-type/mfa-oob") {
       const {
         scopes: R,
         error: P,
@@ -5959,7 +6002,7 @@ class Dt {
           error_description: "MFA type is not supported for OAuth"
         };
       try {
-        const { secrets: L } = await this.userStorage.getUserById(I.user.id), V = z.decodeData(I.key.data).omfa;
+        const { secrets: z } = await this.userStorage.getUserById(I.user.id), V = L.decodeData(I.key.data).omfa;
         if (!V || !V.otp || !V.oobCode)
           return {
             error: "server_error",
@@ -5972,20 +6015,20 @@ class Dt {
           };
         await $.authenticateUser(
           I.user,
-          { ...L, otp: V.otp, expiry: (O = I.key.expires) == null ? void 0 : O.getTime() },
+          { ...z, otp: V.otp, expiry: (O = I.key.expires) == null ? void 0 : O.getTime() },
           { otp: p }
         );
-      } catch (L) {
-        return u.logger.debug(f({ err: L })), {
+      } catch (z) {
+        return u.logger.debug(f({ err: z })), {
           error: "access_denied",
           error_description: "Invalid OTP"
         };
       }
       try {
         await this.keyStorage.deleteKey(I.key.value);
-      } catch (L) {
-        u.logger.debug(f({ err: L })), u.logger.warn(f({
-          cerr: L,
+      } catch (z) {
+        u.logger.debug(f({ err: z })), u.logger.warn(f({
+          cerr: z,
           msg: "Couldn't delete mfa token",
           hashedMfaToken: I.key.value
         }));
@@ -5993,20 +6036,20 @@ class Dt {
       return await this.makeAccessToken({
         client: A,
         client_secret: i,
-        codeVerifier: s,
+        codeVerifier: a,
         scopes: R,
         issueRefreshToken: j,
         user: I.user
       });
-    } else if (a == "urn:ietf:params:oauth:grant-type:device_code") {
-      if (!S)
+    } else if (s == "urn:ietf:params:oauth:grant-type:device_code") {
+      if (!C)
         return {
           error: "invalid_request",
           error_description: "No device code given"
         };
       let R;
       try {
-        R = await this.keyStorage.getKey(U.deviceCode + S);
+        R = await this.keyStorage.getKey(U.deviceCode + C);
       } catch (P) {
         const F = o.asCrossauthError(P);
         return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), {
@@ -6017,7 +6060,7 @@ class Dt {
       try {
         const P = JSON.parse(R.data ?? "{}"), F = (/* @__PURE__ */ new Date()).getTime();
         if (R.expires && F > R.expires.getTime())
-          return await this.deleteDeviceCode(S), {
+          return await this.deleteDeviceCode(C), {
             error: "expired_token",
             error_description: "Code has expired"
           };
@@ -6028,10 +6071,10 @@ class Dt {
           };
         {
           let I = P.scope ? P.scope.split(" ") : void 0, $ = P.userid ? await ((B = this.userStorage) == null ? void 0 : B.getUserById(P.userid)) : void 0;
-          return await this.deleteDeviceCode(S), await this.makeAccessToken({
+          return await this.deleteDeviceCode(C), await this.makeAccessToken({
             client: A,
             client_secret: i,
-            codeVerifier: s,
+            codeVerifier: a,
             scopes: I,
             issueRefreshToken: j,
             user: $ == null ? void 0 : $.user
@@ -6039,7 +6082,7 @@ class Dt {
         }
       } catch (P) {
         const F = o.asCrossauthError(P);
-        return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), await this.deleteDeviceCode(S), {
+        return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), await this.deleteDeviceCode(C), {
           error: "accerss_denied",
           error_description: "Invalid device code"
         };
@@ -6047,20 +6090,20 @@ class Dt {
     } else
       return {
         error: "invalid_request",
-        error_description: `Invalid grant_type ${a}`
+        error_description: `Invalid grant_type ${s}`
       };
   }
-  async deleteDeviceCode(a) {
+  async deleteDeviceCode(s) {
     try {
-      await this.keyStorage.deleteKey(U.deviceCode + a);
+      await this.keyStorage.deleteKey(U.deviceCode + s);
     } catch (e) {
       const t = o.asCrossauthError(e);
       u.logger.debug(f({ err: t })), u.logger.error(f({ msg: "Couldn't delete device code", cerr: t }));
     }
   }
-  async deleteUserCode(a) {
+  async deleteUserCode(s) {
     try {
-      await this.keyStorage.deleteKey(U.userCode + a);
+      await this.keyStorage.deleteKey(U.userCode + s);
     } catch (e) {
       const t = o.asCrossauthError(e);
       u.logger.debug(f({ err: t })), u.logger.error(f({ msg: "Couldn't delete user code", cerr: t }));
@@ -6078,11 +6121,11 @@ class Dt {
    *         endpoint JSON output.
    */
   async deviceAuthorizationEndpoint({
-    client_id: a,
+    client_id: s,
     scope: e,
     client_secret: t
   }) {
-    var S;
+    var C;
     if (this.deviceCodeVerificationUri == "")
       return {
         error: "invalid_request",
@@ -6096,9 +6139,9 @@ class Dt {
         error_description: "Invalid deviceCodeVerificationUri"
       };
     }
-    const r = b.DeviceCode, i = await this.getClientById(a);
+    const r = b.DeviceCode, i = await this.getClientById(s);
     if (!i.client) return i;
-    const s = i.client, n = await this.authenticateClient(r, s, t);
+    const a = i.client, n = await this.authenticateClient(r, a, t);
     if (n.error) return n;
     if (!this.validFlows.includes(r))
       return {
@@ -6106,10 +6149,10 @@ class Dt {
         error_description: "Unsupported flow type " + r
       };
     if (e) {
-      const { error: v, errorDescription: _ } = this.validateScope(e);
+      const { error: v, errorDescription: k } = this.validateScope(e);
       if (v) return {
         error: v,
-        error_description: _
+        error_description: k
       };
     }
     let c, d = !1;
@@ -6121,7 +6164,7 @@ class Dt {
           U.deviceCode + c,
           g,
           p,
-          JSON.stringify({ scope: e, client_id: a })
+          JSON.stringify({ scope: e, client_id: s })
         ), d = !0;
       } catch {
         u.logger.debug(f({ msg: `Attempt number${v} at creating a unique authozation code failed` }));
@@ -6131,13 +6174,13 @@ class Dt {
         error: "server_error",
         error_description: "Couldn't create device code"
       };
-    let k;
+    let _;
     d = !1;
     for (let v = 0; v < 10 && !d; ++v)
       try {
-        k = T.randomBase32(this.userCodeLength), await this.keyStorage.saveKey(
+        _ = T.randomBase32(this.userCodeLength), await this.keyStorage.saveKey(
           void 0,
-          U.userCode + k,
+          U.userCode + _,
           g,
           p,
           JSON.stringify({ deviceCode: c })
@@ -6145,20 +6188,20 @@ class Dt {
       } catch {
         u.logger.debug(f({ msg: `Attempt number${v} at creating a unique authozation code failed` }));
       }
-    if (!d || !k)
+    if (!d || !_)
       return await this.deleteDeviceCode(c), {
         error: "server_error",
         error_description: "Couldn't create device code"
       };
-    if (k && this.userCodeDashEvery) {
+    if (_ && this.userCodeDashEvery) {
       const v = new RegExp(String.raw`(.{1,${this.userCodeDashEvery}})`, "g");
-      k = (S = k.match(v)) == null ? void 0 : S.join("-");
+      _ = (C = _.match(v)) == null ? void 0 : C.join("-");
     }
     return {
       device_code: c,
-      user_code: k,
+      user_code: _,
       verification_uri: this.deviceCodeVerificationUri,
-      verification_uri_complete: this.deviceCodeVerificationUri + "?user_code=" + k,
+      verification_uri_complete: this.deviceCodeVerificationUri + "?user_code=" + _,
       expires_in: y,
       interval: this.deviceCodePollInterval
     };
@@ -6175,14 +6218,14 @@ class Dt {
    *         endpoint JSON output.
    */
   async deviceEndpoint({
-    userCode: a,
+    userCode: s,
     user: e
   }) {
     var g;
-    a = a.replace(/[ -]*/g, "");
+    s = s.replace(/[ -]*/g, "");
     let t, r = {};
     try {
-      t = await this.keyStorage.getKey(U.userCode + a), r = JSON.parse((t == null ? void 0 : t.data) ?? "{}");
+      t = await this.keyStorage.getKey(U.userCode + s), r = JSON.parse((t == null ? void 0 : t.data) ?? "{}");
     } catch {
       return {
         ok: !1,
@@ -6191,7 +6234,7 @@ class Dt {
       };
     }
     if (!r.deviceCode)
-      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: T.hash(a) })), await this.deleteUserCode(a), {
+      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: T.hash(s) })), await this.deleteUserCode(s), {
         ok: !1,
         error: "server_error",
         error_description: "No device code for user code"
@@ -6203,29 +6246,29 @@ class Dt {
       const p = o.asCrossauthError(y);
       return u.logger.debug(f({ err: p })), u.logger.error(f({
         msg: "Invalid device code for user code",
-        userCodeHash: T.hash(a),
+        userCodeHash: T.hash(s),
         deviceCodeHash: T.hash(r.deviceCode),
         cerr: p
-      })), await this.deleteUserCode(a), {
+      })), await this.deleteUserCode(s), {
         ok: !1,
         error: "server_error",
         error_description: "Invalid device code user code"
       };
     }
-    let s, n;
+    let a, n;
     try {
       if (!i.data) throw new o(l.UnknownError);
       const y = JSON.parse(i.data);
-      if (s = y.scope, n = y.client_id, !n) throw new o(l.UnknownError);
+      if (a = y.scope, n = y.client_id, !n) throw new o(l.UnknownError);
     } catch {
-      return await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
+      return await this.deleteUserCode(s), await this.deleteDeviceCode(r.deviceCode), {
         ok: !1,
         error: "server_error",
         error_description: "Unexpected or incomplete data in device code key"
       };
     }
     if ((/* @__PURE__ */ new Date()).getTime() > ((g = r.expires) == null ? void 0 : g.getTime()))
-      return await this.deleteUserCode(a), {
+      return await this.deleteUserCode(s), {
         ok: !1,
         error: "expired_token",
         error_description: "User code has expired",
@@ -6241,11 +6284,11 @@ class Dt {
     let d = !1;
     if (u.logger.debug(f({
       msg: "Checking scopes have been authorized",
-      scope: s
-    })), s ? d = await this.hasAllScopes(
+      scope: a
+    })), a ? d = await this.hasAllScopes(
       n,
       e,
-      s.split(" ")
+      a.split(" ")
     ) : d = await this.hasAllScopes(
       n,
       e,
@@ -6255,7 +6298,7 @@ class Dt {
         e != null && e.id && await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "userid", e.id);
       } catch (y) {
         const p = o.asCrossauthError(y);
-        return u.logger.debug(f({ err: p })), u.logger.warn(f({ msg: "Couldn't update user id on user code entry - deleting", cerr: p })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
+        return u.logger.debug(f({ err: p })), u.logger.warn(f({ msg: "Couldn't update user id on user code entry - deleting", cerr: p })), await this.deleteUserCode(s), await this.deleteDeviceCode(r.deviceCode), {
           ok: !1,
           error: "access_denied",
           error_description: "Invalid user code",
@@ -6264,7 +6307,7 @@ class Dt {
       }
       return {
         ok: !0,
-        scope: s,
+        scope: a,
         client_id: n,
         scopeAuthorizationNeeded: !0
       };
@@ -6273,24 +6316,24 @@ class Dt {
       e != null && e.id && await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "userid", e.id), await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "ok", !0);
     } catch (y) {
       const p = o.asCrossauthError(y);
-      return u.logger.debug(f({ err: p })), u.logger.warn(f({ msg: "Couldn't update status on user code entry - deleting", cerr: p })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
+      return u.logger.debug(f({ err: p })), u.logger.warn(f({ msg: "Couldn't update status on user code entry - deleting", cerr: p })), await this.deleteUserCode(s), await this.deleteDeviceCode(r.deviceCode), {
         ok: !1,
         error: "access_denied",
         error_description: "Invalid user code",
         client_id: n
       };
     }
-    return await this.deleteUserCode(a), {
+    return await this.deleteUserCode(s), {
       ok: !0,
-      scope: s,
+      scope: a,
       client_id: n
     };
   }
-  async authorizeDeviceFlowScopes(a) {
-    a = a.replace(/[ -]*/g, "");
+  async authorizeDeviceFlowScopes(s) {
+    s = s.replace(/[ -]*/g, "");
     let e, t = {};
     try {
-      e = await this.keyStorage.getKey(U.userCode + a), t = JSON.parse((e == null ? void 0 : e.data) ?? "{}");
+      e = await this.keyStorage.getKey(U.userCode + s), t = JSON.parse((e == null ? void 0 : e.data) ?? "{}");
     } catch {
       return {
         ok: !1,
@@ -6299,7 +6342,7 @@ class Dt {
       };
     }
     if (!t.deviceCode)
-      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: T.hash(a) })), await this.deleteUserCode(a), {
+      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: T.hash(s) })), await this.deleteUserCode(s), {
         ok: !1,
         error: "server_error",
         error_description: "No device code for user code"
@@ -6311,22 +6354,22 @@ class Dt {
       const c = o.asCrossauthError(n);
       return u.logger.debug(f({ err: c })), u.logger.error(f({
         msg: "Invalid device code for user code",
-        userCodeHash: T.hash(a),
+        userCodeHash: T.hash(s),
         deviceCodeHash: T.hash(t.deviceCode),
         cerr: c
-      })), await this.deleteUserCode(a), {
+      })), await this.deleteUserCode(s), {
         ok: !1,
         error: "server_error",
         error_description: "Invalid device code user code"
       };
     }
-    let i, s;
+    let i, a;
     try {
       if (!r.data) throw new o(l.UnknownError);
       const n = JSON.parse(r.data);
-      if (i = n.scope, s = n.client_id, !s) throw new o(l.UnknownError);
+      if (i = n.scope, a = n.client_id, !a) throw new o(l.UnknownError);
     } catch {
-      return await this.deleteUserCode(a), await this.deleteDeviceCode(t.deviceCode), {
+      return await this.deleteUserCode(s), await this.deleteDeviceCode(t.deviceCode), {
         ok: !1,
         error: "server_error",
         error_description: "Unexpected or incomplete data in device code key"
@@ -6336,33 +6379,33 @@ class Dt {
       await this.keyStorage.updateData(U.deviceCode + t.deviceCode, "ok", !0);
     } catch (n) {
       const c = o.asCrossauthError(n);
-      return u.logger.debug(f({ err: c })), u.logger.warn(f({ msg: "Couldn't update status on user code entry - deleting", cerr: c })), await this.deleteUserCode(a), await this.deleteDeviceCode(t.deviceCode), {
+      return u.logger.debug(f({ err: c })), u.logger.warn(f({ msg: "Couldn't update status on user code entry - deleting", cerr: c })), await this.deleteUserCode(s), await this.deleteDeviceCode(t.deviceCode), {
         ok: !1,
         error: "access_denied",
         error_description: "Invalid user code",
-        client_id: s
+        client_id: a
       };
     }
-    return await this.deleteUserCode(a), {
+    return await this.deleteUserCode(s), {
       ok: !0,
       scope: i,
-      client_id: s
+      client_id: a
     };
   }
-  async createMfaRequest(a) {
+  async createMfaRequest(s) {
     const e = T.randomValue(this.codeLength), t = U.mfaToken + T.hash(e), r = /* @__PURE__ */ new Date();
     try {
       await this.keyStorage.saveKey(
-        a.id,
+        s.id,
         t,
         r,
         this.mfaTokenExpiry ? new Date(r.getTime() + (this.mfaTokenExpiry + this.clockTolerance) * 1e3) : void 0,
-        JSON.stringify({ omfaaid: a.factor2 })
+        JSON.stringify({ omfaaid: s.factor2 })
       );
     } catch (i) {
-      const s = o.asCrossauthError(i);
-      u.logger.debug(f({ err: s })), u.logger.error(f({
-        cerr: s,
+      const a = o.asCrossauthError(i);
+      u.logger.debug(f({ err: a })), u.logger.error(f({
+        cerr: a,
         msg: "Couldn't save MFA token"
       }));
     }
@@ -6372,11 +6415,11 @@ class Dt {
       error_description: "Multifactor authentication required"
     };
   }
-  async validateMfaToken(a) {
+  async validateMfaToken(s) {
     var r;
     let e, t;
     try {
-      const i = U.mfaToken + T.hash(a);
+      const i = U.mfaToken + T.hash(s);
       if (t = await this.keyStorage.getKey(i), !t.userid)
         return {
           error: "access_denied",
@@ -6387,8 +6430,8 @@ class Dt {
           error: "server_error",
           error_description: "No user storage defined"
         };
-      const { user: s } = await ((r = this.userStorage) == null ? void 0 : r.getUserById(t.userid));
-      e = s;
+      const { user: a } = await ((r = this.userStorage) == null ? void 0 : r.getUserById(t.userid));
+      e = a;
     } catch (i) {
       return u.logger.debug(f({ err: i })), u.logger.error(f({
         cerr: i,
@@ -6404,7 +6447,7 @@ class Dt {
         error_description: "Invalid MFA token"
       };
     try {
-      if (z.decodeData(t.data).omfaaid != e.factor2)
+      if (L.decodeData(t.data).omfaaid != e.factor2)
         return {
           error: "access_denied",
           error_description: "authenticatorId not valid for user"
@@ -6417,8 +6460,8 @@ class Dt {
     }
     return { user: e, key: t };
   }
-  async mfaAuthenticatorsEndpoint(a) {
-    const e = await this.validateMfaToken(a);
+  async mfaAuthenticatorsEndpoint(s) {
+    const e = await this.validateMfaToken(s);
     if (!e.user) return e;
     const t = e.user;
     if (!t.factor2)
@@ -6460,12 +6503,12 @@ class Dt {
    * @param authenticatorId as defined by the Password MFA spec
    * @returns respond as defined by the Password MFA spec
    */
-  async mfaChallengeEndpoint(a, e, t, r, i) {
-    const s = b.PasswordMfa, n = await this.getClientById(e);
+  async mfaChallengeEndpoint(s, e, t, r, i) {
+    const a = b.PasswordMfa, n = await this.getClientById(e);
     if (!n.client) return n;
-    const c = n.client, d = await this.authenticateClient(s, c, t);
+    const c = n.client, d = await this.authenticateClient(a, c, t);
     if (d.error) return d;
-    const g = await this.validateMfaToken(a);
+    const g = await this.validateMfaToken(s);
     if (!g.user || !g.key) return g;
     if (g.user.factor2 != i)
       return {
@@ -6488,11 +6531,11 @@ class Dt {
           l.Configuration,
           "User's authenticator has not been loaded"
         );
-      const k = await p.createOneTimeSecrets(g.user);
+      const _ = await p.createOneTimeSecrets(g.user);
       await this.keyStorage.updateData(
         g.key.value,
         "omfa",
-        { ...y, ...k }
+        { ...y, ..._ }
       );
     } catch (p) {
       return u.logger.debug(f({ err: p })), {
@@ -6516,10 +6559,10 @@ class Dt {
    * @param codeChallenge the OAuth code challenge (checks if it is defined)
    * @returns returns the flow key from {@link @crossauth/common!OAuthFlows}
    */
-  inferFlowFromGet(a, e, t) {
-    if (a == "code" && !e.includes("openid"))
+  inferFlowFromGet(s, e, t) {
+    if (s == "code" && !e.includes("openid"))
       return t ? b.AuthorizationCodeWithPKCE : b.AuthorizationCode;
-    if (e.includes("openid") && a == "code")
+    if (e.includes("openid") && s == "code")
       return t ? b.AuthorizationCodeWithPKCE : b.AuthorizationCode;
   }
   /**
@@ -6529,75 +6572,75 @@ class Dt {
    * @param codeVerifier the OAuth code verifier (checks if it is defined)
    * @returns returns the flow key from {@link @crossauth/common!OAuthFlows}
    */
-  inferFlowFromPost(a, e) {
-    if (a == "authorization_code")
+  inferFlowFromPost(s, e) {
+    if (s == "authorization_code")
       return e ? b.AuthorizationCodeWithPKCE : b.AuthorizationCode;
-    if (a == "client_credentials")
+    if (s == "client_credentials")
       return b.ClientCredentials;
-    if (a == "refresh_token")
+    if (s == "refresh_token")
       return b.RefreshToken;
-    if (a == "urn:ietf:params:oauth:grant-type:device_code")
+    if (s == "urn:ietf:params:oauth:grant-type:device_code")
       return b.DeviceCode;
-    if (a == "password")
+    if (s == "password")
       return b.Password;
-    if (a == "http://auth0.com/oauth/grant-type/mfa-otp")
+    if (s == "http://auth0.com/oauth/grant-type/mfa-otp")
       return b.PasswordMfa;
-    if (a == "http://auth0.com/oauth/grant-type/mfa-oob")
+    if (s == "http://auth0.com/oauth/grant-type/mfa-oob")
       return b.PasswordMfa;
   }
-  async getAuthorizationCode(a, e, t, r, i, s, n) {
-    if (i && (s || (s = "S256"), s != "S256" && s != "plain"))
+  async getAuthorizationCode(s, e, t, r, i, a, n) {
+    if (i && (a || (a = "S256"), a != "S256" && a != "plain"))
       return {
         error: "invalid_request",
         error_description: "Code challenge method must be S256 or plain"
       };
     const c = e;
-    if (J.validateUri(c), this.requireRedirectUriRegistration && !a.redirect_uri.includes(c))
+    if (J.validateUri(c), this.requireRedirectUriRegistration && !s.redirect_uri.includes(c))
       return {
         error: "invalid_request",
         error_description: `The redirect uri ${e} is invalid`
       };
     const d = /* @__PURE__ */ new Date(), g = this.authorizationCodeExpiry ? new Date(d.getTime() + this.authorizationCodeExpiry * 1e3 + this.clockTolerance * 1e3) : void 0, y = {};
-    t && (y.scope = t), i && (y.challengeMethod = s, y.challenge = T.hash(i)), n && (y.username = n.username, y.id = n.id);
+    t && (y.scope = t), i && (y.challengeMethod = a, y.challenge = T.hash(i)), n && (y.username = n.username, y.id = n.id);
     const p = JSON.stringify(y);
-    let k = !1, S = "";
-    for (let v = 0; v < 10 && !k; ++v)
+    let _ = !1, C = "";
+    for (let v = 0; v < 10 && !_; ++v)
       try {
-        S = T.randomValue(this.codeLength), await this.keyStorage.saveKey(
+        C = T.randomValue(this.codeLength), await this.keyStorage.saveKey(
           void 0,
-          U.authorizationCode + T.hash(S),
+          U.authorizationCode + T.hash(C),
           d,
           g,
           p
-        ), k = !0;
+        ), _ = !0;
       } catch {
         u.logger.debug(f({ msg: `Attempt number${v} at creating a unique authozation code failed` }));
       }
-    if (!k)
+    if (!_)
       throw new o(
         l.KeyExists,
         "Couldn't create a authorization code"
       );
-    return { code: S, state: r };
+    return { code: C, state: r };
   }
   /**
    * Create an access token
    */
   async makeAccessToken({
-    client: a,
+    client: s,
     code: e,
     client_secret: t,
     codeVerifier: r,
     scopes: i,
-    issueRefreshToken: s = !1,
+    issueRefreshToken: a = !1,
     user: n
   }) {
     var M, j;
     let c = !0;
     try {
-      a.client_secret != null && (c = await T.passwordsEqual(
+      s.client_secret != null && (c = await T.passwordsEqual(
         t ?? "",
-        a.client_secret ?? ""
+        s.client_secret ?? ""
       ));
     } catch (N) {
       return u.logger.error(f({ err: N })), { error: "server_error", error_description: "Couldn't validate client" };
@@ -6610,7 +6653,7 @@ class Dt {
     if (e) {
       let N;
       try {
-        N = await this.keyStorage.getKey(U.authorizationCode + T.hash(e)), d = z.decodeData(N.data);
+        N = await this.keyStorage.getKey(U.authorizationCode + T.hash(e)), d = L.decodeData(N.data);
       } catch (K) {
         return u.logger.debug(f({ err: K })), {
           error: "access_denied",
@@ -6623,7 +6666,7 @@ class Dt {
         u.logger.warn(f({
           err: K,
           msg: "Couldn't delete authorization code from storatge",
-          client_id: a == null ? void 0 : a.client_id
+          client_id: s == null ? void 0 : s.client_id
         }));
       }
       i = d.scope;
@@ -6643,17 +6686,17 @@ class Dt {
     }
     const g = /* @__PURE__ */ new Date(), y = Math.ceil(g.getTime() / 1e3);
     let p;
-    const k = T.uuid(), S = {
-      jti: k,
+    const _ = T.uuid(), C = {
+      jti: _,
       iat: y,
       iss: this.oauthIssuer,
       sub: d.username,
       type: "access"
     };
-    i && (S.scope = i), this.accessTokenExpiry != null && (S.exp = y + this.accessTokenExpiry, p = new Date(g.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (S.aud = this.audience);
+    i && (C.scope = i), this.accessTokenExpiry != null && (C.exp = y + this.accessTokenExpiry, p = new Date(g.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (C.aud = this.audience);
     const v = await new Promise((N, K) => {
-      ae.sign(
-        S,
+      se.sign(
+        C,
         this.secretOrPrivateKey,
         { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
         (O, B) => {
@@ -6667,11 +6710,11 @@ class Dt {
     this.persistAccessToken && this.keyStorage && await ((M = this.keyStorage) == null ? void 0 : M.saveKey(
       void 0,
       // to avoid user storage dependency, we don't set this
-      U.accessToken + T.hash(k),
+      U.accessToken + T.hash(_),
       g,
       p
     ));
-    let _;
+    let k;
     if (i && i.includes("openid")) {
       if (this.userStorage && d.username)
         try {
@@ -6685,7 +6728,7 @@ class Dt {
         }
       const N = T.uuid();
       let K = {
-        aud: a.client_id,
+        aud: s.client_id,
         jti: N,
         iat: y,
         iss: this.oauthIssuer,
@@ -6735,8 +6778,8 @@ class Dt {
               K[B] = n[O[B]];
         }
       }
-      K.scope = i, this.accessTokenExpiry != null && (K.exp = y + this.accessTokenExpiry), _ = await new Promise((O, B) => {
-        ae.sign(
+      K.scope = i, this.accessTokenExpiry != null && (K.exp = y + this.accessTokenExpiry), k = await new Promise((O, B) => {
+        se.sign(
           K,
           this.secretOrPrivateKey,
           {
@@ -6753,10 +6796,10 @@ class Dt {
       });
     }
     let A;
-    if (s) {
+    if (a) {
       const N = {
         username: d.username,
-        client_id: a.client_id
+        client_id: s.client_id
       };
       i && (N.scope = i);
       let K;
@@ -6767,8 +6810,8 @@ class Dt {
         sub: d.username,
         type: "access"
       };
-      this.refreshTokenExpiry != null && (B.exp = y + this.refreshTokenExpiry, K = this.refreshTokenExpiry ? new Date(y + this.refreshTokenExpiry * 1e3 + this.clockTolerance * 1e3) : void 0), this.audience && (S.aud = this.oauthIssuer), A = await new Promise((R, P) => {
-        ae.sign(
+      this.refreshTokenExpiry != null && (B.exp = y + this.refreshTokenExpiry, K = this.refreshTokenExpiry ? new Date(y + this.refreshTokenExpiry * 1e3 + this.clockTolerance * 1e3) : void 0), this.audience && (C.aud = this.oauthIssuer), A = await new Promise((R, P) => {
+        se.sign(
           B,
           this.secretOrPrivateKey,
           { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
@@ -6790,7 +6833,7 @@ class Dt {
     }
     return {
       access_token: v,
-      id_token: _,
+      id_token: k,
       refresh_token: A,
       expires_in: this.accessTokenExpiry == null ? void 0 : this.accessTokenExpiry,
       token_type: "Bearer",
@@ -6803,9 +6846,9 @@ class Dt {
    * @param code the authorization code to look up
    * @returns true or false
    */
-  async validAuthorizationCode(a) {
+  async validAuthorizationCode(s) {
     try {
-      const e = U.authorizationCode + T.hash(a);
+      const e = U.authorizationCode + T.hash(s);
       return await this.keyStorage.getKey(e), !0;
     } catch (e) {
       return u.logger.debug(f({ err: e })), !1;
@@ -6817,9 +6860,9 @@ class Dt {
    * @param token the refresh token to look up
    * @returns true or false
    */
-  async validRefreshToken(a) {
+  async validRefreshToken(s) {
     try {
-      const e = U.refreshToken + T.hash(a);
+      const e = U.refreshToken + T.hash(s);
       return await this.keyStorage.getKey(e), !0;
     } catch (e) {
       return u.logger.debug(f({ err: e })), !1;
@@ -6831,10 +6874,10 @@ class Dt {
    * @returns the object parsed from the stored JSON data for the token,
    *          or undefined if there was an error
    */
-  async getRefreshTokenData(a) {
-    if (a)
+  async getRefreshTokenData(s) {
+    if (s)
       try {
-        const e = U.refreshToken + T.hash(a), t = await this.keyStorage.getKey(e);
+        const e = U.refreshToken + T.hash(s), t = await this.keyStorage.getKey(e);
         return JSON.parse(t.data || "{}");
       } catch (e) {
         u.logger.debug(f({ err: e }));
@@ -6848,9 +6891,9 @@ class Dt {
    * @param token the token to validate
    * @returns the payload or undefinedf if there was an error
    */
-  async validIdToken(a) {
+  async validIdToken(s) {
     try {
-      return await this.validateJwt(a, "id");
+      return await this.validateJwt(s, "id");
     } catch (e) {
       u.logger.debug(f({ err: e }));
       return;
@@ -6864,9 +6907,9 @@ class Dt {
    * @returns the payload or undefinedf if there was an error ir the 
    * `type` field in the payload is not `access`.
    */
-  async validAccessToken(a) {
+  async validAccessToken(s) {
     try {
-      const e = await this.validateJwt(a, "access");
+      const e = await this.validateJwt(s, "access");
       if (this.persistAccessToken) {
         const t = U.accessToken + T.hash(e.payload.jti);
         await this.keyStorage.getKey(t);
@@ -6877,14 +6920,14 @@ class Dt {
       return;
     }
   }
-  async validateJwt(a, e) {
+  async validateJwt(s, e) {
     return new Promise((t, r) => {
-      ae.verify(
-        a,
+      se.verify(
+        s,
         this.secretOrPublicKey,
         { clockTolerance: this.clockTolerance, complete: !0 },
-        (i, s) => {
-          s ? !e || s.payload.type == e ? t(s) : r(new o(
+        (i, a) => {
+          a ? !e || a.payload.type == e ? t(a) : r(new o(
             l.Unauthorized,
             "Invalid JWT type"
           )) : i ? (u.logger.debug(f({ err: i })), r(new o(
@@ -6898,12 +6941,12 @@ class Dt {
       );
     });
   }
-  validateScope(a) {
+  validateScope(s) {
     let e = [];
     try {
-      e = a.split(" ");
+      e = s.split(" ");
     } catch {
-      const r = "invalid_scope", i = `Invalid scope ${a}`;
+      const r = "invalid_scope", i = `Invalid scope ${s}`;
       return u.logger.debug(f({ err: o.fromOAuthError(r, i) })), {
         error: r,
         errorDescription: i
@@ -6913,10 +6956,10 @@ class Dt {
       let t;
       if (e.forEach((r) => {
         if (!this.validScopes.includes(r)) {
-          const i = "invalid_scope", s = `Illegal scope ${r}`;
-          u.logger.debug(f({ err: o.fromOAuthError(i, s) })), t = {
+          const i = "invalid_scope", a = `Illegal scope ${r}`;
+          u.logger.debug(f({ err: o.fromOAuthError(i, a) })), t = {
             error: i,
-            errorDescription: s
+            errorDescription: a
           };
         }
       }), t) return t;
@@ -6933,16 +6976,16 @@ class Dt {
    * @param state the state to append
    * @returns the new URL as a string.
    */
-  redirect_uri(a, e, t) {
-    const r = a.includes("?") ? "&" : "?";
-    return `${a}${r}code=${e}&state=${t}`;
+  redirect_uri(s, e, t) {
+    const r = s.includes("?") ? "&" : "?";
+    return `${s}${r}code=${e}&state=${t}`;
   }
   /**
    * @returns all the response types that are supported.
    */
   responseTypesSupported() {
-    let a = [];
-    return (this.validFlows.includes(b.AuthorizationCode) || this.validFlows.includes(b.AuthorizationCodeWithPKCE) || this.validFlows.includes(b.OidcAuthorizationCode)) && a.push("code"), a;
+    let s = [];
+    return (this.validFlows.includes(b.AuthorizationCode) || this.validFlows.includes(b.AuthorizationCodeWithPKCE) || this.validFlows.includes(b.OidcAuthorizationCode)) && s.push("code"), s;
   }
   /**
    * Returns an OIDC configuration object based on this authorization
@@ -6957,7 +7000,7 @@ class Dt {
    * @returns the OIDC configuration
    */
   oidcConfiguration({
-    authorizeEndpoint: a,
+    authorizeEndpoint: s,
     tokenEndpoint: e,
     jwksUri: t,
     additionalClaims: r
@@ -6967,7 +7010,7 @@ class Dt {
       const c = b.grantType(n);
       c && (i = [...i, ...c]);
     });
-    const s = [
+    const a = [
       "HS256",
       "HS384",
       "HS512",
@@ -6984,7 +7027,7 @@ class Dt {
     return r || (r = []), {
       issuer: this.oauthIssuer,
       authorization_endpoint: new URL(
-        a ?? "authorize",
+        s ?? "authorize",
         this.oauthIssuer
       ).toString(),
       token_endpoint: new URL(
@@ -6996,9 +7039,9 @@ class Dt {
       response_types_supported: this.responseTypesSupported(),
       response_modes_supported: ["query"],
       grant_types_supported: i,
-      token_endpoint_auth_signing_alg_values_supported: s,
+      token_endpoint_auth_signing_alg_values_supported: a,
       subject_types_supported: ["public"],
-      id_token_signing_alg_values_supported: s,
+      id_token_signing_alg_values_supported: a,
       claims_supported: [
         "iss",
         "sub",
@@ -7019,15 +7062,15 @@ class Dt {
    * @returns an array of keys with exactly one or zero entries.
    */
   jwks() {
-    let a = [];
+    let s = [];
     if (this.jwtPublicKey) {
-      const e = Le(this.jwtPublicKey).export({ format: "jwk" });
-      e.kid = "1", e.alg = this.jwtKeyType, a.push(e);
+      const e = ze(this.jwtPublicKey).export({ format: "jwk" });
+      e.kid = "1", e.alg = this.jwtKeyType, s.push(e);
     }
-    return { keys: a };
+    return { keys: s };
   }
-  validateState(a) {
-    if (!/^[A-Za-z0-9_-]+$/.test(a))
+  validateState(s) {
+    if (!/^[A-Za-z0-9_-]+$/.test(s))
       throw o.fromOAuthError("invalid_request");
   }
   /**
@@ -7040,16 +7083,16 @@ class Dt {
    * @returns an empty object or an error if the parameters were not valid
    */
   validateAuthorizeParameters({
-    response_type: a,
+    response_type: s,
     client_id: e,
     redirect_uri: t,
     scope: r,
     state: i,
-    code_challenge: s,
+    code_challenge: a,
     code_challenge_method: n
   }) {
     let c;
-    /^[A-Za-z0-9_-]+$/.test(a) ? /^[A-Za-z0-9_-]+$/.test(e) ? r && !/^[A-Za-z0-9_+ -]+$/.test(r) ? c = "scope is invalid" : /^[A-Za-z0-9_-]+$/.test(i) ? s && !/^[A-Za-z0-9_-]+$/.test(s) ? c = "code_challenge is invalid" : n && !/^[A-Za-z0-9_-]+$/.test(n) && (c = "code_challenge_method is invalid") : c = "state is invalid" : c = "client_id is invalid" : c = "response_type is invalid";
+    /^[A-Za-z0-9_-]+$/.test(s) ? /^[A-Za-z0-9_-]+$/.test(e) ? r && !/^[A-Za-z0-9_+ -]+$/.test(r) ? c = "scope is invalid" : /^[A-Za-z0-9_-]+$/.test(i) ? a && !/^[A-Za-z0-9_-]+$/.test(a) ? c = "code_challenge is invalid" : n && !/^[A-Za-z0-9_-]+$/.test(n) && (c = "code_challenge_method is invalid") : c = "state is invalid" : c = "client_id is invalid" : c = "response_type is invalid";
     try {
       new URL(t);
     } catch {
@@ -7132,22 +7175,22 @@ class nt extends Pe {
     const r = await super.tokenAuthorized(e, t);
     if (r && t == "access" && this.persistAccessToken && this.keyStorage)
       try {
-        const s = U.accessToken + T.hash(r.jti), n = await this.keyStorage.getKey(s), c = /* @__PURE__ */ new Date();
+        const a = U.accessToken + T.hash(r.jti), n = await this.keyStorage.getKey(a), c = /* @__PURE__ */ new Date();
         if (n.expires && ((i = n.expires) == null ? void 0 : i.getTime()) < c.getTime()) {
           u.logger.error(f({ msg: "Access token expired in storage but not in JWT" }));
           return;
         }
-      } catch (s) {
+      } catch (a) {
         u.logger.warn(f({
           msg: "Couldn't get token from database - is it valid?",
           hashedAccessToken: T.hash(r.jti)
-        })), u.logger.debug(f({ err: s }));
+        })), u.logger.debug(f({ err: a }));
         return;
       }
     return r;
   }
 }
-class Bt extends Ke {
+class Ht extends Ke {
   /**
    * Constructor
    * @param authServerBaseUrl bsae URI for the authorization server
@@ -7173,9 +7216,14 @@ class Bt extends Ke {
       ...t
     });
     h(this, "deviceAuthorizationUrl", "device_authorization");
+    h(this, "userCreationType", "idToken");
+    h(this, "userMatchField", "username");
+    h(this, "idTokenMatchField", "sub");
+    h(this, "userCreationFn");
+    h(this, "userStorage");
     this.client_id = r.client_id;
     let i = {};
-    w("stateLength", m.String, this, t, "OAUTH_STATE_LENGTH"), w("verifierLength", m.String, this, t, "OAUTH_VERIFIER_LENGTH"), w("client_secret", m.String, i, t, "OAUTH_CLIENT_SECRET"), w("codeChallengeMethod", m.String, this, t, "OAUTH_CODE_CHALLENGE_METHOD"), w("deviceAuthorizationUrl", m.String, this, t, "OAUTH_DEVICE_AUTHORIZATION_URL"), this.deviceAuthorizationUrl.startsWith("/") && (this.deviceAuthorizationUrl = this.deviceAuthorizationUrl.substring(1)), i.client_secret && (this.client_secret = i.client_secret);
+    w("stateLength", m.String, this, t, "OAUTH_STATE_LENGTH"), w("verifierLength", m.String, this, t, "OAUTH_VERIFIER_LENGTH"), w("client_secret", m.String, i, t, "OAUTH_CLIENT_SECRET"), w("codeChallengeMethod", m.String, this, t, "OAUTH_CODE_CHALLENGE_METHOD"), w("deviceAuthorizationUrl", m.String, this, t, "OAUTH_DEVICE_AUTHORIZATION_URL"), this.deviceAuthorizationUrl.startsWith("/") && (this.deviceAuthorizationUrl = this.deviceAuthorizationUrl.substring(1)), i.client_secret && (this.client_secret = i.client_secret), w("userCreationType", m.String, this, t, "OAUTH_USER_CREATION_TYPE"), w("userMatchField", m.String, this, t, "OAUTH_USER_MATCH_FIELD"), w("idTokenMatchField", m.String, this, t, "OAUTH_IDTOKEN_MaTCH_FIELD"), this.userCreationType == "merge" ? this.userCreationFn = ot : this.userCreationType == "embed" ? this.userCreationFn = lt : t.userCreationFn && this.userCreationType == "custom" ? this.userCreationFn = t.userCreationFn : this.userCreationFn = ct, t.userStorage && (this.userStorage = t.userStorage);
   }
   /**
    * Uses {@link @crossauth/backend!Crypto.randomValue} to create a random string
@@ -7195,7 +7243,38 @@ class Bt extends Ke {
     return T.sha256(e);
   }
 }
-class zt {
+async function ot(S, s, e, t) {
+  if (!s) throw new o(l.Configuration, "userCreationType set to merge but no user storage set");
+  try {
+    let r;
+    return e == "username" ? r = await s.getUserByUsername(S[t]) : e == "username" ? r = await s.getUserByEmail(S[t]) : r = await s.getUserBy(e, S[t]), { ...S, ...r.user };
+  } catch (r) {
+    const i = o.asCrossauthError(r);
+    if (i.code == l.UserNotExist || i.code == l.UserNotActive)
+      return;
+    throw u.logger.error(f({ err: r })), r;
+  }
+}
+async function lt(S, s, e, t) {
+  if (!s) throw new o(l.Configuration, "userCreationType set to embed but no user storage set");
+  try {
+    let r;
+    return e == "username" ? r = await s.getUserByUsername(S[t]) : e == "username" ? r = await s.getUserByEmail(S[t]) : r = await s.getUserBy(e, S[t]), { ...r.user, idToken: S };
+  } catch (r) {
+    const i = o.asCrossauthError(r);
+    if (i.code == l.UserNotExist || i.code == l.UserNotActive)
+      return;
+    throw u.logger.error({ err: r }), r;
+  }
+}
+async function ct(S, s, e, t) {
+  return {
+    id: S.userid ?? S.sub,
+    username: S.sub,
+    state: S.state ?? "active"
+  };
+}
+class Mt {
   /**
    * Constructor
    * @param tokenConsumers one or more consumers that will process
@@ -7203,13 +7282,13 @@ class zt {
    * @param _options See {@link OAuthResourceServerOptions}.  Unused
    *        at present
    */
-  constructor(a, e = {}) {
+  constructor(s, e = {}) {
     /** The token consumer that validates the access tokens.
      * Keyed on auth server base URL then audience.  The latter may be ""
      * for none
      */
     h(this, "tokenConsumers");
-    this.tokenConsumers = [...a];
+    this.tokenConsumers = [...s];
   }
   /**
    * Returns a token payload if the access token has a valid signature
@@ -7224,12 +7303,12 @@ class zt {
    * @returns The JWT payload as an object or undefinedf if the JWT is
    *          invalid
    */
-  async accessTokenAuthorized(a) {
+  async accessTokenAuthorized(s) {
     try {
-      const e = He.decodeJwt(a);
+      const e = He.decodeJwt(s);
       for (let t of this.tokenConsumers)
         if (e.iss == t.authServerBaseUrl && (e.aud == t.audience || e.aud == null && t.audience == ""))
-          return await t.tokenAuthorized(a, "access");
+          return await t.tokenAuthorized(s, "access");
       throw new o(l.Unauthorized, "Invalid issuer in access token");
     } catch (e) {
       u.logger.warn(f({ err: e }));
@@ -7242,40 +7321,40 @@ export {
   re as Authenticator,
   T as Crypto,
   rt as DoubleSubmitCsrfToken,
-  Ft as DummyFactor2Authenticator,
+  Rt as DummyFactor2Authenticator,
   Z as EmailAuthenticator,
-  Et as InMemoryKeyStorage,
-  Ut as InMemoryOAuthAuthorizationStorage,
-  bt as InMemoryOAuthClientStorage,
-  _t as InMemoryUserStorage,
-  z as KeyStorage,
-  Ot as LdapAuthenticator,
+  At as InMemoryKeyStorage,
+  Pt as InMemoryOAuthAuthorizationStorage,
+  It as InMemoryOAuthClientStorage,
+  Ut as InMemoryUserStorage,
+  L as KeyStorage,
+  xt as LdapAuthenticator,
   oe as LdapUserStorage,
   Te as LocalPasswordAuthenticator,
-  Dt as OAuthAuthorizationServer,
+  zt as OAuthAuthorizationServer,
   we as OAuthAuthorizationStorage,
-  Bt as OAuthClientBackend,
+  Ht as OAuthClientBackend,
   J as OAuthClientManager,
   me as OAuthClientStorage,
-  zt as OAuthResourceServer,
+  Mt as OAuthResourceServer,
   nt as OAuthTokenConsumer,
   m as ParamType,
   be as PasswordAuthenticator,
-  It as PostgresKeyStorage,
-  Kt as PostgresOAuthAuthorizationStorage,
-  Pt as PostgresOAuthClientStorage,
-  At as PostgresUserStorage,
-  vt as PrismaKeyStorage,
-  kt as PrismaOAuthAuthorizationStorage,
-  Tt as PrismaOAuthClientStorage,
+  Ft as PostgresKeyStorage,
+  Nt as PostgresOAuthAuthorizationStorage,
+  Ot as PostgresOAuthClientStorage,
+  Kt as PostgresUserStorage,
+  kt as PrismaKeyStorage,
+  bt as PrismaOAuthAuthorizationStorage,
+  Et as PrismaOAuthClientStorage,
   G as PrismaUserStorage,
   D as SessionCookie,
-  xt as SessionManager,
+  Lt as SessionManager,
   Q as SmsAuthenticator,
   x as TokenEmailer,
-  Nt as TotpAuthenticator,
+  Dt as TotpAuthenticator,
   Ue as TwilioAuthenticator,
   H as UserStorage,
   w as setParameter,
-  Rt as toCookieSerializeOptions
+  Bt as toCookieSerializeOptions
 };