@crossauth/backend 0.0.36 → 0.0.38

package/dist/index.js

@@ -1,6 +1,6 @@
 var Ae = Object.defineProperty;
 var Ie = (S, s, e) => s in S ? Ae(S, s, { enumerable: !0, configurable: !0, writable: !0, value: e }) : S[s] = e;
-var d = (S, s, e) => Ie(S, typeof s != "symbol" ? s + "" : s, e);
+var h = (S, s, e) => Ie(S, typeof s != "symbol" ? s + "" : s, e);
 import { CrossauthError as o, ErrorCode as l, UserState as E, CrossauthLogger as u, j as f, OAuthFlows as b, KeyPrefix as U, OAuthTokenConsumerBase as Pe, OAuthClientBase as Ke } from "@crossauth/common";
 import { PrismaClient as ce, Prisma as X } from "@prisma/client";
 import ye from "@mbakereth/ldapjs";
@@ -71,10 +71,10 @@ class L {
    * @param options See {@link UserStorageOptions}
    */
   constructor(s = {}) {
-    d(this, "userEditableFields", []);
-    d(this, "adminEditableFields", []);
-    d(this, "normalizeUsername", !0);
-    d(this, "normalizeEmail", !0);
+    h(this, "userEditableFields", []);
+    h(this, "adminEditableFields", []);
+    h(this, "normalizeUsername", !0);
+    h(this, "normalizeEmail", !0);
     m("userEditableFields", g.JsonArray, this, s, "USER_EDITABLE_FIELDS"), m("adminEditableFields", g.JsonArray, this, s, "ADMIN_EDITABLE_FIELDS"), m("normalizeUsername", g.JsonArray, this, s, "NORMALIZE_USERNAME"), m("normalizeEmail", g.JsonArray, this, s, "NORMALIZE_EMAIL");
   }
   /**
@@ -173,14 +173,14 @@ class G extends L {
    */
   constructor(e = {}) {
     super(e);
-    d(this, "userTable", "user");
-    d(this, "userSecretsTable", "userSecrets");
-    d(this, "idColumn", "id");
-    d(this, "useridForeignKeyColumn", "userid");
-    d(this, "prismaClient");
-    d(this, "includes", ["secrets"]);
-    d(this, "includesObject", {});
-    d(this, "forceIdToNumber", !0);
+    h(this, "userTable", "user");
+    h(this, "userSecretsTable", "userSecrets");
+    h(this, "idColumn", "id");
+    h(this, "useridForeignKeyColumn", "userid");
+    h(this, "prismaClient");
+    h(this, "includes", ["secrets"]);
+    h(this, "includesObject", {});
+    h(this, "forceIdToNumber", !0);
     m("userTable", g.String, this, e, "USER_TABLE"), m("userSecretsTable", g.String, this, e, "USER_SECRETS_TABLE"), m("idColumn", g.String, this, e, "USER_ID_COLUMN"), m("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), m("includes", g.String, this, e, "USER_INCLUDES"), m("forceIdToNumber", g.String, this, e, "USER_FORCE_ID_TO_NUMBER"), this.includes.forEach((t) => {
       this.includesObject[t] = !0;
     }), e && e.prismaClient ? this.prismaClient = e.prismaClient : this.prismaClient = new ce();
@@ -279,16 +279,16 @@ class G extends L {
     try {
       let { id: r, ...i } = e, { userid: a, ...n } = t ?? {};
       "email" in i && i.email && (i = { email_normalized: G.normalize(i.email), ...i }), "username" in i && i.username && (i = { username_normalized: G.normalize(i.username), ...i }), t ? await this.prismaClient.$transaction(async (c) => {
-        let h = {};
+        let d = {};
         try {
-          h = await c[this.userSecretsTable].findUniqueOrThrow({
+          d = await c[this.userSecretsTable].findUniqueOrThrow({
             where: {
               [this.useridForeignKeyColumn]: e.id
             }
           });
         } catch {
         }
-        let { userid: w, ...y } = h ?? {};
+        let { userid: w, ...y } = d ?? {};
         n = { ...y, ...n }, await c[this.userTable].update({
           where: {
             [this.idColumn]: e.id
@@ -421,10 +421,10 @@ class kt extends x {
    */
   constructor(e = {}) {
     super();
-    d(this, "keyTable", "key");
-    d(this, "prismaClient");
-    d(this, "transactionTimeout", 5e3);
-    d(this, "useridForeignKeyColumn", "userid");
+    h(this, "keyTable", "key");
+    h(this, "prismaClient");
+    h(this, "transactionTimeout", 5e3);
+    h(this, "useridForeignKeyColumn", "userid");
     m("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), m("useridForeignKeyColumn", g.Number, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.keyTable && (this.keyTable = e.keyTable), e.prismaClient == null ? this.prismaClient = new ce() : this.prismaClient = e.prismaClient;
   }
   async getKey(e) {
@@ -468,7 +468,7 @@ class kt extends x {
   async saveKey(e, t, r, i, a, n = {}) {
     let c;
     try {
-      let h = {
+      let d = {
         [this.useridForeignKeyColumn]: e,
         value: t,
         created: r,
@@ -477,10 +477,10 @@ class kt extends x {
         ...n
       };
       await this.prismaClient[this.keyTable].create({
-        data: h
+        data: d
       });
-    } catch (h) {
-      h instanceof X.PrismaClientKnownRequestError || h instanceof Object && "code" in h ? h.code == "P2002" ? (u.logger.warn(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), u.logger.debug(f({ err: h })), c = new o(l.KeyExists)) : (u.logger.debug(f({ err: h })), c = new o(l.Connection, "Error saving key")) : (u.logger.debug(f({ err: h })), c = new o(l.Connection, "Error saving key"));
+    } catch (d) {
+      d instanceof X.PrismaClientKnownRequestError || d instanceof Object && "code" in d ? d.code == "P2002" ? (u.logger.warn(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), u.logger.debug(f({ err: d })), c = new o(l.KeyExists)) : (u.logger.debug(f({ err: d })), c = new o(l.Connection, "Error saving key")) : (u.logger.debug(f({ err: d })), c = new o(l.Connection, "Error saving key"));
     }
     if (c)
       throw c;
@@ -691,14 +691,14 @@ class Et extends me {
    */
   constructor(e = {}) {
     super();
-    d(this, "clientTable", "oAuthClient");
-    d(this, "redirectUriTable", "OAuthClientRedirectUri");
-    d(this, "validFlowTable", "OAuthClientValidFlow");
-    d(this, "prismaClient");
+    h(this, "clientTable", "oAuthClient");
+    h(this, "redirectUriTable", "OAuthClientRedirectUri");
+    h(this, "validFlowTable", "OAuthClientValidFlow");
+    h(this, "prismaClient");
     // PrismaClient;
-    d(this, "transactionTimeout", 5e3);
-    d(this, "updateMode", "DeleteAndInsert");
-    d(this, "useridForeignKeyColumn", "userid");
+    h(this, "transactionTimeout", 5e3);
+    h(this, "updateMode", "DeleteAndInsert");
+    h(this, "useridForeignKeyColumn", "userid");
     m("clientTable", g.String, this, e, "OAUTH_CLIENT_TABLE"), m("redirectUriTable", g.String, this, e, "OAUTH_REDIRECTURI_TABLE"), m("validFlowTable", g.String, this, e, "OAUTH_VALID_FLOW_TABLE"), m("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), m("updateMode", g.String, this, e, "OAUTHCLIENT_UPDATE_MODE"), m("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null ? this.prismaClient = new ce() : this.prismaClient = e.prismaClient;
   }
   async getClientById(e) {
@@ -717,14 +717,14 @@ class Et extends me {
             ...n
           },
           include: { redirect_uri: !0, valid_flow: !0 }
-        }), h = c.redirect_uri, w = c.valid_flow;
+        }), d = c.redirect_uri, w = c.valid_flow;
         let y = c[this.useridForeignKeyColumn];
         return y === null && (y = void 0), this.useridForeignKeyColumn != "userid" && delete c[this.useridForeignKeyColumn], [{
           ...c,
           userid: y,
           client_secret: c.client_secret ?? void 0,
-          redirect_uri: h.map((p) => p.uri),
-          valid_flow: w.map((p) => p.flow)
+          redirect_uri: d.map((C) => C.uri),
+          valid_flow: w.map((C) => C.flow)
         }];
       } else {
         const c = await r[this.clientTable].findMany({
@@ -734,10 +734,10 @@ class Et extends me {
           },
           include: { redirect_uri: !0, valid_flow: !0 }
         });
-        for (let h of c) {
-          const w = h.redirect_uri, y = h.valid_flow;
-          let p = h[this.useridForeignKeyColumn];
-          p == null && (p = void 0), h.userid = p, this.useridForeignKeyColumn != "userid" && delete h[this.useridForeignKeyColumn], h.client_secret = h.client_secret ?? void 0, h.redirect_uri = w.map((_) => _.uri), h.valid_flow = y.map((_) => _.flow);
+        for (let d of c) {
+          const w = d.redirect_uri, y = d.valid_flow;
+          let C = d[this.useridForeignKeyColumn];
+          C == null && (C = void 0), d.userid = C, this.useridForeignKeyColumn != "userid" && delete d[this.useridForeignKeyColumn], d.client_secret = d.client_secret ?? void 0, d.redirect_uri = w.map((v) => v.uri), d.valid_flow = y.map((v) => v.flow);
         }
         return c;
       }
@@ -768,50 +768,50 @@ class Et extends me {
     const { redirect_uri: r, valid_flow: i, userid: a, ...n } = e;
     let c;
     if (a && (n[this.useridForeignKeyColumn] = a), this.useridForeignKeyColumn != "userid" && delete e[this.useridForeignKeyColumn], r)
-      for (let h = 0; h < r.length; ++h) {
-        if (r[h].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
+      for (let d = 0; d < r.length; ++d) {
+        if (r[d].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
         try {
-          new URL(r[h]);
+          new URL(r[d]);
         } catch {
-          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[h]} is not valid`);
+          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[d]} is not valid`);
         }
       }
     if (i) {
-      for (let h = 0; h < i.length; ++h)
-        if (!b.isValidFlow(i[h])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[h]);
+      for (let d = 0; d < i.length; ++d)
+        if (!b.isValidFlow(i[d])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[d]);
     }
     try {
       c = await t[this.clientTable].create({
         data: n
       });
-    } catch (h) {
-      throw h instanceof X.PrismaClientKnownRequestError || h instanceof Object && "code" in h ? h.code == "P2002" ? (u.logger.debug(f({ err: h })), new o(l.ClientExists, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (u.logger.debug(f({ err: h })), new o(l.Connection, "Error saving OAuth client")) : (u.logger.debug(f({ err: h })), new o(l.Connection, "Error saving OAuth client"));
+    } catch (d) {
+      throw d instanceof X.PrismaClientKnownRequestError || d instanceof Object && "code" in d ? d.code == "P2002" ? (u.logger.debug(f({ err: d })), new o(l.ClientExists, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (u.logger.debug(f({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (u.logger.debug(f({ err: d })), new o(l.Connection, "Error saving OAuth client"));
     }
     if (!c)
       throw u.logger.error(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), new o(l.KeyExists);
     if (r)
       try {
-        for (let h = 0; h < r.length; ++h)
+        for (let d = 0; d < r.length; ++d)
           await t[this.redirectUriTable].create({
             data: {
               client_id: c.client_id,
-              uri: r[h]
+              uri: r[d]
             }
           });
-      } catch (h) {
-        throw h instanceof X.PrismaClientKnownRequestError || h instanceof Object && "code" in h ? h.code == "P2002" ? (u.logger.debug(f({ err: h })), new o(l.InvalidRedirectUri, "Attempt to create an OAuth client with a redirect uri that already belongs to another client")) : (u.logger.debug(f({ err: h })), new o(l.Connection, "Error saving OAuth client")) : (u.logger.debug(f({ err: h })), new o(l.Connection, "Error saving OAuth client"));
+      } catch (d) {
+        throw d instanceof X.PrismaClientKnownRequestError || d instanceof Object && "code" in d ? d.code == "P2002" ? (u.logger.debug(f({ err: d })), new o(l.InvalidRedirectUri, "Attempt to create an OAuth client with a redirect uri that already belongs to another client")) : (u.logger.debug(f({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (u.logger.debug(f({ err: d })), new o(l.Connection, "Error saving OAuth client"));
       }
     if (i)
       try {
-        for (let h = 0; h < i.length; ++h)
+        for (let d = 0; d < i.length; ++d)
           await t[this.validFlowTable].create({
             data: {
               client_id: c.client_id,
-              flow: i[h]
+              flow: i[d]
             }
           });
-      } catch (h) {
-        throw h instanceof X.PrismaClientKnownRequestError || h instanceof Object && "code" in h ? (u.logger.debug(f({ err: h })), new o(l.Connection, "Error saving OAuth client")) : (u.logger.debug(f({ err: h })), new o(l.Connection, "Error saving OAuth client"));
+      } catch (d) {
+        throw d instanceof X.PrismaClientKnownRequestError || d instanceof Object && "code" in d ? (u.logger.debug(f({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (u.logger.debug(f({ err: d })), new o(l.Connection, "Error saving OAuth client"));
       }
     return { ...c, redirect_uri: r, valid_flow: i };
   }
@@ -954,11 +954,11 @@ class bt extends we {
    */
   constructor(e = {}) {
     super();
-    d(this, "authorizationTable", "oAuthAuthorization");
-    d(this, "prismaClient");
+    h(this, "authorizationTable", "oAuthAuthorization");
+    h(this, "prismaClient");
     // PrismaClient;
-    d(this, "transactionTimeout", 5e3);
-    d(this, "useridForeignKeyColumn", "userid");
+    h(this, "transactionTimeout", 5e3);
+    h(this, "useridForeignKeyColumn", "userid");
     m("authorizationTable", g.String, this, e, "OAUTH_CLIENT_TABLE"), m("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), m("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null ? this.prismaClient = new ce() : this.prismaClient = e.prismaClient;
   }
   async getAuthorizations(e, t) {
@@ -1018,10 +1018,10 @@ class Ut extends L {
   */
   constructor(e = {}) {
     super(e);
-    d(this, "usersByUsername", {});
-    d(this, "usersByEmail", {});
-    d(this, "secretsByUsername", {});
-    d(this, "secretsByEmail", {});
+    h(this, "usersByUsername", {});
+    h(this, "usersByEmail", {});
+    h(this, "secretsByUsername", {});
+    h(this, "secretsByEmail", {});
   }
   /**
    * Create a user
@@ -1163,9 +1163,9 @@ class At extends x {
    */
   constructor() {
     super();
-    d(this, "keys", {});
-    d(this, "keysByUserId", {});
-    d(this, "nonUserKeys", []);
+    h(this, "keys", {});
+    h(this, "keysByUserId", {});
+    h(this, "nonUserKeys", []);
   }
   /**
    * Returns the matching key recortd, with additional, or throws an exception.
@@ -1239,8 +1239,8 @@ class At extends x {
       for (let i = 0; i < r.length; ++i) {
         let a = !0, n = 0;
         const c = r[i];
-        for (let h in e)
-          if (h in c && c[h] != e[h]) {
+        for (let d in e)
+          if (d in c && c[d] != e[d]) {
             a = !1, n = i;
             break;
           }
@@ -1316,8 +1316,8 @@ class It extends me {
    */
   constructor(e = {}) {
     super();
-    d(this, "clients", {});
-    d(this, "clientsByName", {});
+    h(this, "clients", {});
+    h(this, "clientsByName", {});
   }
   /**
    * Returns the matching client record or throws an exception.
@@ -1407,8 +1407,8 @@ class Pt extends we {
    */
   constructor(e = {}) {
     super();
-    d(this, "byClientAndUser", {});
-    d(this, "byClient", {});
+    h(this, "byClientAndUser", {});
+    h(this, "byClient", {});
   }
   async getAuthorizations(e, t) {
     if (t) {
@@ -1447,11 +1447,11 @@ class oe extends L {
    */
   constructor(e, t = {}) {
     super(t);
-    d(this, "localStorage");
-    d(this, "ldapUrls", []);
-    d(this, "ldapUserSearchBase", "");
-    d(this, "ldapUsernameAttribute", "cn");
-    d(this, "createUserFn", $e);
+    h(this, "localStorage");
+    h(this, "ldapUrls", []);
+    h(this, "ldapUserSearchBase", "");
+    h(this, "ldapUsernameAttribute", "cn");
+    h(this, "createUserFn", $e);
     this.localStorage = e, m("ldapUrls", g.JsonArray, this, t, "LDAP_URL", !0), m("ldapUserSearchBase", g.String, this, t, "LDAP_USER_SEARCH_BASE"), m("ldapUsernameAttribute", g.String, this, t, "LDAP_USENAME_ATTRIBUTE"), t.createUserFn && (this.createUserFn = t.createUserFn);
   }
   /**
@@ -1465,7 +1465,7 @@ class oe extends L {
   async createUser(e, t) {
     if (!(t != null && t.password)) throw new o(l.PasswordInvalid);
     const r = await this.getLdapUser(e.username, t.password);
-    return await this.localStorage.createUser(this.createUserFn(e, r), {});
+    return e = this.createUserFn(e, r), await this.localStorage.createUser(e, { password: "pbkdf2:sha256:32:600000:0:DISABLED:DISABLED" });
   }
   /**
    * Gets a user from the local storage.  Does not check LDAP.
@@ -1590,17 +1590,17 @@ class oe extends L {
       r && (n.attributes = r), e.search(
         t,
         n,
-        function(c, h) {
+        function(c, d) {
           let w;
           if (c) {
             a(c), e.unbind();
             return;
           }
-          h.on("searchEntry", function(y) {
+          d.on("searchEntry", function(y) {
             w = oe.searchResultToUser(y.pojo);
-          }), h.on("error", function(y) {
+          }), d.on("error", function(y) {
             a(y), e.unbind();
-          }), h.on("end", function(y) {
+          }), d.on("end", function(y) {
             y.status != 0 ? a(new o(l.Connection, "LDAP  onnection failed")) : w ? i(w) : a(new o(l.UsernameOrPasswordInvalid)), e.unbind();
           });
         }
@@ -1638,12 +1638,12 @@ class Y extends L {
    */
   constructor(e, t = {}) {
     super(t);
-    d(this, "userTable", "users");
-    d(this, "userSecretsTable", "usersecrets");
-    d(this, "idColumn", "id");
-    d(this, "useridForeignKeyColumn", "userid");
-    d(this, "forceIdToNumber", !0);
-    d(this, "dbPool");
+    h(this, "userTable", "users");
+    h(this, "userSecretsTable", "usersecrets");
+    h(this, "idColumn", "id");
+    h(this, "useridForeignKeyColumn", "userid");
+    h(this, "forceIdToNumber", !0);
+    h(this, "dbPool");
     this.dbPool = e, m("userTable", g.String, this, t, "USER_TABLE"), m("userSecretsTable", g.String, this, t, "USER_SECRETS_TABLE"), m("idColumn", g.String, this, t, "USER_ID_COLUMN"), m("forceIdToNumber", g.String, this, t, "USER_FORCE_ID_TO_NUMBER"), m("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN");
   }
   /**
@@ -1696,23 +1696,23 @@ class Y extends L {
     let i = await this.dbPool.connect(), a, n, c = this.dbPool.parameters();
     try {
       await i.startTransaction();
-      let h = `select * from ${this.userTable} where ${e} = ` + c.nextParameter(), w = await i.execute(h, [t]);
+      let d = `select * from ${this.userTable} where ${e} = ` + c.nextParameter(), w = await i.execute(d, [t]);
       if (w.length == 0)
         throw new o(l.UserNotExist);
-      let y, p, _;
+      let y, C, v;
       if (this.idColumn in w[0]) y = w[0][this.idColumn];
       else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
-      if ("username" in w[0]) p = w[0].username;
+      if ("username" in w[0]) C = w[0].username;
       else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
-      if ("state" in w[0]) _ = w[0].state;
+      if ("state" in w[0]) v = w[0].state;
       else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
       if (a = {
         ...w[0],
         id: y,
-        username: p,
-        state: _
+        username: C,
+        state: v
       }, !a) throw new o(l.UserNotExist);
-      if (c = this.dbPool.parameters(), h = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = ` + c.nextParameter(), w = await i.execute(h, [a.id]), w.length == 0)
+      if (c = this.dbPool.parameters(), d = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = ` + c.nextParameter(), w = await i.execute(d, [a.id]), w.length == 0)
         throw new o(l.UserNotExist);
       if (w.length > 0 ? n = { userid: a.id, ...w[0] } : n = { userid: a.id }, !n) throw new o(l.UserNotExist);
       if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.awaitingTwoFactorSetup)
@@ -1728,8 +1728,8 @@ class Y extends L {
       if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.factor2ResetNeeded)
         throw u.logger.debug(f({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
       return { user: a, secrets: n };
-    } catch (h) {
-      throw await i.rollback(), h;
+    } catch (d) {
+      throw await i.rollback(), d;
     } finally {
       i.release();
     }
@@ -1742,24 +1742,24 @@ class Y extends L {
    */
   async getUsers(e, t) {
     const r = await this.dbPool.connect();
-    let i = [], a = [], n = "", c = "", h = this.dbPool.parameters();
-    e && (c = "OFFSET " + h.nextParameter()), t && (a.push(t), n = "LIMIT " + h.nextParameter());
+    let i = [], a = [], n = "", c = "", d = this.dbPool.parameters();
+    e && (c = "OFFSET " + d.nextParameter()), t && (a.push(t), n = "LIMIT " + d.nextParameter());
     try {
       let w = `select * from ${this.userTable} ${n} ${c} order by username_normalized asc`, y = await r.execute(w, a);
       if (y.length == 0)
         throw new o(l.UserNotExist);
-      for (let p of y) {
-        let _, C, T;
-        if (this.idColumn in p) _ = p[this.idColumn];
+      for (let C of y) {
+        let v, p, T;
+        if (this.idColumn in C) v = C[this.idColumn];
         else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
-        if ("username" in p) C = p.username;
+        if ("username" in C) p = C.username;
         else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
-        if ("state" in p) T = p.state;
+        if ("state" in C) T = C.state;
         else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
         let k = {
-          ...p,
-          id: _,
-          username: C,
+          ...C,
+          id: v,
+          username: p,
           state: T
         };
         i.push(k);
@@ -1789,26 +1789,26 @@ class Y extends L {
       let i = this.dbPool.parameters(), a = `select * from ${this.userTable} where ${this.idColumn} = ` + i.nextParameter();
       if ((await r.execute(a, [e.id])).length == 0)
         throw new o(l.UserNotExist);
-      let c = { ...e }, h = t ? { ...t } : void 0;
+      let c = { ...e }, d = t ? { ...t } : void 0;
       "email" in c && c.email && (c = { email_normalized: this.normalizeEmail ? Y.normalize(c.email) : c.email, ...c }), "username" in c && c.username && (c = { username_normalized: this.normalizeUsername ? Y.normalize(c.username) : c.username, ...c }), i = this.dbPool.parameters();
       let w = [], y = [];
-      for (let p in c)
-        c[p] != null && p != "id" && (w.push(p + "= " + i.nextParameter()), y.push(c[p]));
+      for (let C in c)
+        c[C] != null && C != "id" && (w.push(C + "= " + i.nextParameter()), y.push(c[C]));
       if (w.length > 0) {
-        let p = w.join(", ");
+        let C = w.join(", ");
         y.push(e.id);
-        let _ = `update ${this.userTable} set ${p} where ${this.idColumn} = ` + i.nextParameter();
-        await r.execute(_, y);
+        let v = `update ${this.userTable} set ${C} where ${this.idColumn} = ` + i.nextParameter();
+        await r.execute(v, y);
       }
       if (t) {
         w = [], y = [], i = this.dbPool.parameters();
-        for (let p in h)
-          h[p] != null && p != "userid" && (w.push(p + "= " + i.nextParameter()), y.push(h[p]));
+        for (let C in d)
+          d[C] != null && C != "userid" && (w.push(C + "= " + i.nextParameter()), y.push(d[C]));
         if (w.length > 0) {
-          let p = w.join(", ");
+          let C = w.join(", ");
           y.push(e.id);
-          let _ = `update ${this.userSecretsTable} set ${p} where userid = ` + i.nextParameter();
-          await r.execute(_, y);
+          let v = `update ${this.userSecretsTable} set ${C} where userid = ` + i.nextParameter();
+          await r.execute(v, y);
         }
       }
       await r.commit();
@@ -1836,26 +1836,26 @@ class Y extends L {
       await r.startTransaction();
       let a = { ...e }, n = t ? { ...t } : void 0;
       "email" in a && a.email && (a = { email_normalized: this.normalizeEmail ? Y.normalize(a.email) : a.email, ...a }), "username" in a && a.username && (a = { username_normalized: this.normalizeUsername ? Y.normalize(a.username) : a.username, ...a });
-      let c = [], h = [], w = [];
+      let c = [], d = [], w = [];
       const y = this.dbPool.parameters();
-      for (let _ in a)
-        a[_] != null && _ != "id" && (c.push(_), h.push(y.nextParameter()), w.push(a[_]));
+      for (let v in a)
+        a[v] != null && v != "id" && (c.push(v), d.push(y.nextParameter()), w.push(a[v]));
       if (c.length > 0) {
-        let _ = c.join(", "), C = h.join(", ");
-        const T = `insert into ${this.userTable} (${_}) values (${C}) returning ${this.idColumn}`, k = await r.execute(T, w);
+        let v = c.join(", "), p = d.join(", ");
+        const T = `insert into ${this.userTable} (${v}) values (${p}) returning ${this.idColumn}`, k = await r.execute(T, w);
         if (k.length == 0 || !k[0][this.idColumn]) throw new o(l.Connection, "Couldn't create user");
         i = k[0][this.idColumn];
       }
       if (!i) throw new o(l.Connection, "Couldn't create user");
       if (t) {
-        c = [], h = [], w = [];
-        const _ = this.dbPool.parameters();
-        c.push("userid"), h.push(_.nextParameter()), w.push(i);
-        for (let C in n)
-          n[C] != null && C != "userid" && (c.push(C), h.push(_.nextParameter()), w.push(n[C]));
+        c = [], d = [], w = [];
+        const v = this.dbPool.parameters();
+        c.push("userid"), d.push(v.nextParameter()), w.push(i);
+        for (let p in n)
+          n[p] != null && p != "userid" && (c.push(p), d.push(v.nextParameter()), w.push(n[p]));
         if (c.length > 0) {
-          let C = c.join(", "), T = h.join(", ");
-          const k = `insert into ${this.userSecretsTable} (${C}) values (${T})`;
+          let p = c.join(", "), T = d.join(", ");
+          const k = `insert into ${this.userSecretsTable} (${p}) values (${T})`;
           u.logger.debug(f({ msg: "Executing query", query: k })), await r.execute(k, w);
         }
       }
@@ -1912,9 +1912,9 @@ class qe extends x {
    */
   constructor(e, t = {}) {
     super();
-    d(this, "keyTable", "keys");
-    d(this, "dbPool");
-    d(this, "useridForeignKeyColumn", "userid");
+    h(this, "keyTable", "keys");
+    h(this, "dbPool");
+    h(this, "useridForeignKeyColumn", "userid");
     m("transactionTimeout", g.Number, this, t, "TRANSACTION_TIMEOUT"), m("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), t.keyTable && (this.keyTable = t.keyTable), this.dbPool = e;
   }
   async getKey(e) {
@@ -1962,17 +1962,17 @@ class qe extends x {
    * @throws {@link @crossauth/common!CrossauthError } if the key could not be stored.
    */
   async saveKey(e, t, r, i, a, n = {}) {
-    let c, h = [this.useridForeignKeyColumn, "value", "created", "expires", "data"], w = this.dbPool.parameters(), y = [];
+    let c, d = [this.useridForeignKeyColumn, "value", "created", "expires", "data"], w = this.dbPool.parameters(), y = [];
     for (let k = 0; k < 5; ++k)
       y.push(w.nextParameter());
-    let p = [e ?? null, t, r, i ?? null, a ?? ""];
+    let C = [e ?? null, t, r, i ?? null, a ?? ""];
     for (let k in n)
-      h.push(k), y.push(w.nextParameter()), p.push(n[k]);
-    let _ = h.join(", "), C = y.join(", ");
+      d.push(k), y.push(w.nextParameter()), C.push(n[k]);
+    let v = d.join(", "), p = y.join(", ");
     const T = await this.dbPool.connect();
     try {
-      const k = `insert into ${this.keyTable} (${_}) values (${C})`;
-      await T.execute(k, p);
+      const k = `insert into ${this.keyTable} (${v}) values (${p})`;
+      await T.execute(k, C);
     } catch (k) {
       o.asCrossauthError(k).code == l.ConstraintViolation ? (u.logger.warn(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), u.logger.debug(f({ err: k })), c = new o(l.KeyExists)) : (u.logger.debug(f({ err: k })), c = new o(l.Connection, "Error saving key"));
     } finally {
@@ -1993,15 +1993,15 @@ class qe extends x {
   async deleteAllForUser(e, t, r) {
     const i = await this.dbPool.connect();
     try {
-      let a, n = [], c = "", h = this.dbPool.parameters();
+      let a, n = [], c = "", d = this.dbPool.parameters();
       if (e) {
-        const w = h.nextParameter(), y = h.nextParameter();
+        const w = d.nextParameter(), y = d.nextParameter();
         a = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${w} and value like ${y} `, n = [e];
       } else {
-        const w = h.nextParameter();
+        const w = d.nextParameter();
         a = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} is null and value like ${w}`;
       }
-      n.push(t + "%"), r && (c = "and value != " + h.nextParameter(), n.push(r)), a += " " + c, u.logger.debug(f({ msg: "Executing query", query: a })), await i.execute(a, n);
+      n.push(t + "%"), r && (c = "and value != " + d.nextParameter(), n.push(r)), a += " " + c, u.logger.debug(f({ msg: "Executing query", query: a })), await i.execute(a, n);
     } catch (a) {
       throw a;
     } finally {
@@ -2013,9 +2013,9 @@ class qe extends x {
     try {
       let r = [], i = [];
       const a = this.dbPool.parameters();
-      for (let h in e) {
-        let w = h == "userid" ? this.useridForeignKeyColumn : h;
-        e[h] == null ? r.push(w + " is null") : (r.push(w + " = " + a.nextParameter()), i.push(e[h]));
+      for (let d in e) {
+        let w = d == "userid" ? this.useridForeignKeyColumn : d;
+        e[d] == null ? r.push(w + " is null") : (r.push(w + " = " + a.nextParameter()), i.push(e[d]));
       }
       let n = r.join(" and "), c = `delete from ${this.keyTable} where ${n}`;
       await t.execute(c, i);
@@ -2031,8 +2031,8 @@ class qe extends x {
       let i, a = [];
       const n = this.dbPool.parameters();
       if (e) {
-        let c = n.nextParameter(), h = n.nextParameter();
-        i = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${c} and value like ${h}`, a.push(e);
+        let c = n.nextParameter(), d = n.nextParameter();
+        i = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${c} and value like ${d}`, a.push(e);
       } else {
         let c = n.nextParameter();
         i = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} is null and value like ${c}`;
@@ -2053,8 +2053,8 @@ class qe extends x {
       let c = await t.execute(i, a);
       if (c.length == 0)
         return [];
-      for (let h of c) {
-        let w = this.makeKey(h);
+      for (let d of c) {
+        let w = this.makeKey(d);
         this.useridForeignKeyColumn != "userid" && (w.userid = w[this.useridForeignKeyColumn], delete w[this.useridForeignKeyColumn]), r.push(w);
       }
       return r;
@@ -2086,12 +2086,12 @@ class qe extends x {
     delete r.value;
     let i = [], a = [], n = this.dbPool.parameters();
     for (let c in r) {
-      let h = c;
-      r[c] != null && c == "userid" && this.useridForeignKeyColumn != "userid" && (h = this.useridForeignKeyColumn), i.push(c + "= " + n.nextParameter()), a.push(r[h]);
+      let d = c;
+      r[c] != null && c == "userid" && this.useridForeignKeyColumn != "userid" && (d = this.useridForeignKeyColumn), i.push(c + "= " + n.nextParameter()), a.push(r[d]);
     }
     if (a.push(t.value), i.length > 0) {
-      let c = i.join(", "), h = `update ${this.keyTable} set ${c} where value = ` + n.nextParameter();
-      u.logger.debug(f({ msg: "Executing query", query: h })), await e.execute(h, a);
+      let c = i.join(", "), d = `update ${this.keyTable} set ${c} where value = ` + n.nextParameter();
+      u.logger.debug(f({ msg: "Executing query", query: d })), await e.execute(d, a);
     }
   }
   /**
@@ -2162,11 +2162,11 @@ class We extends me {
    */
   constructor(e, t = {}) {
     super();
-    d(this, "clientTable", "oauthclient");
-    d(this, "redirectUriTable", "oauthclientredirecturi");
-    d(this, "validFlowTable", "oauthclientvalidflow");
-    d(this, "dbPool");
-    d(this, "useridForeignKeyColumn", "userid");
+    h(this, "clientTable", "oauthclient");
+    h(this, "redirectUriTable", "oauthclientredirecturi");
+    h(this, "validFlowTable", "oauthclientvalidflow");
+    h(this, "dbPool");
+    h(this, "useridForeignKeyColumn", "userid");
     m("clientTable", g.String, this, t, "OAUTH_CLIENT_TABLE"), m("redirectUriTable", g.String, this, t, "OAUTH_REDIRECTURI_TABLE"), m("validFlowTable", g.String, this, t, "OAUTH_VALID_FLOW_TABLE"), m("updateMode", g.String, this, t, "OAUTHCLIENT_UPDATE_MODE"), m("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), this.dbPool = e;
   }
   async getClientById(e) {
@@ -2210,11 +2210,11 @@ class We extends me {
     };
   }
   async getClientWithTransaction(e, t, r, i, a, n) {
-    let c = [], h = this.dbPool.parameters(), w = [], y = `select c.*, r.uri as uri, null as flow from ${this.clientTable} as c left join ${this.redirectUriTable} r on c.client_id = r.client_id `, p = "";
-    t && r && (p = `where c.${t} = ` + h.nextParameter(), w.push(r)), i !== null && i == null || (p == "" ? p = "where " : p += " and ", i == null ? p += "userid is null" : (p += `${this.useridForeignKeyColumn} = ` + h.nextParameter(), w.push(i)));
-    let _ = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, C = "";
-    t && r && (C = `where c.${t} = ` + h.nextParameter(), w.push(r)), i !== null && i == null || (C == "" ? C = "where " : C += " and ", i == null ? C += "userid is null" : (C += `${this.useridForeignKeyColumn} = ` + h.nextParameter(), w.push(i))), n && (a || (a = 0), a = Number(a), n = Number(n), p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${a})`, C == "" ? C = "where " : C += " and ", C += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${a})`), y += p, _ += C;
-    let T = y + " union " + _ + " order by client_id";
+    let c = [], d = this.dbPool.parameters(), w = [], y = `select c.*, r.uri as uri, null as flow from ${this.clientTable} as c left join ${this.redirectUriTable} r on c.client_id = r.client_id `, C = "";
+    t && r && (C = `where c.${t} = ` + d.nextParameter(), w.push(r)), i !== null && i == null || (C == "" ? C = "where " : C += " and ", i == null ? C += "userid is null" : (C += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), w.push(i)));
+    let v = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, p = "";
+    t && r && (p = `where c.${t} = ` + d.nextParameter(), w.push(r)), i !== null && i == null || (p == "" ? p = "where " : p += " and ", i == null ? p += "userid is null" : (p += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), w.push(i))), n && (a || (a = 0), a = Number(a), n = Number(n), C == "" ? C = "where " : C += " and ", C += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${a})`, p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${a})`), y += C, v += p;
+    let T = y + " union " + v + " order by client_id";
     const k = await e.execute(T, w);
     let A;
     for (let z of k)
@@ -2243,47 +2243,47 @@ class We extends me {
   async createClientWithTransaction(e, t) {
     const { redirect_uri: r, valid_flow: i, userid: a, ...n } = t;
     if (a && (n[this.useridForeignKeyColumn] = a), r)
-      for (let C = 0; C < r.length; ++C) {
-        if (r[C].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
+      for (let p = 0; p < r.length; ++p) {
+        if (r[p].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
         try {
-          new URL(r[C]);
+          new URL(r[p]);
         } catch {
-          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[C]} is not valid`);
+          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[p]} is not valid`);
         }
       }
     if (i) {
-      for (let C = 0; C < i.length; ++C)
-        if (!b.isValidFlow(i[C])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[C]);
+      for (let p = 0; p < i.length; ++p)
+        if (!b.isValidFlow(i[p])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[p]);
     }
-    let c = [], h = [], w = [], y = this.dbPool.parameters();
+    let c = [], d = [], w = [], y = this.dbPool.parameters();
     try {
-      for (let C in n)
-        c.push(C), h.push(y.nextParameter()), w.push(n[C]);
+      for (let p in n)
+        c.push(p), d.push(y.nextParameter()), w.push(n[p]);
       if (c.length > 0) {
-        let C = c.join(", "), T = h.join(", ");
-        const k = `insert into ${this.clientTable} (${C}) values (${T})`;
+        let p = c.join(", "), T = d.join(", ");
+        const k = `insert into ${this.clientTable} (${p}) values (${T})`;
         await e.execute(k, w);
       }
-    } catch (C) {
-      throw typeof C == "object" && C != null && "code" in C && typeof C.code == "string" && (C.code.startsWith("22") || C.code.startsWith("23")) ? (u.logger.debug(f({ err: C })), new o(l.InvalidClientId, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (u.logger.debug(f({ err: C })), new o(l.Connection, "Error saving OAuth client"));
+    } catch (p) {
+      throw typeof p == "object" && p != null && "code" in p && typeof p.code == "string" && (p.code.startsWith("22") || p.code.startsWith("23")) ? (u.logger.debug(f({ err: p })), new o(l.InvalidClientId, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (u.logger.debug(f({ err: p })), new o(l.Connection, "Error saving OAuth client"));
     }
-    let p = await this.getClientWithTransaction(e, "client_id", t.client_id, t.userid);
-    if (p.length == 0)
+    let C = await this.getClientWithTransaction(e, "client_id", t.client_id, t.userid);
+    if (C.length == 0)
       throw u.logger.error(f({ msg: "Attempt to create key that already exists. Stack trace follows" })), new o(l.KeyExists);
-    let _ = p[0];
+    let v = C[0];
     if (r)
-      for (let C = 0; C < r.length; ++C) {
+      for (let p = 0; p < r.length; ++p) {
         w = [], y = this.dbPool.parameters();
         let T = `insert into ${this.redirectUriTable} (client_id, uri) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        w.push(_.client_id), w.push(r[C]), await e.execute(T, w);
+        w.push(v.client_id), w.push(r[p]), await e.execute(T, w);
       }
     if (i)
-      for (let C = 0; C < i.length; ++C) {
+      for (let p = 0; p < i.length; ++p) {
         w = [], y = this.dbPool.parameters();
         let T = `insert into ${this.validFlowTable} (client_id, flow) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        w.push(_.client_id), w.push(i[C]), await e.execute(T, w);
+        w.push(v.client_id), w.push(i[p]), await e.execute(T, w);
       }
-    return { ..._, redirect_uri: r, valid_flow: i };
+    return { ...v, redirect_uri: r, valid_flow: i };
   }
   /**
    * 
@@ -2341,29 +2341,29 @@ class We extends me {
         if (!b.isValidFlow(i[T])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
     }
     if (!t.client_id) throw new o(l.InvalidClientId, "No client ig given");
-    let { client_id: a, redirect_uri: n, valid_flow: c, ...h } = t;
+    let { client_id: a, redirect_uri: n, valid_flow: c, ...d } = t;
     n || (n = []), c || (c = []);
     let w = this.dbPool.parameters(), y = `delete from ${this.redirectUriTable} where client_id = ` + w.nextParameter();
     await e.execute(y, [t.client_id]), w = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + w.nextParameter(), await e.execute(y, [t.client_id]);
-    let p = [], _ = [], C = [];
+    let C = [], v = [], p = [];
     w = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + w.nextParameter();
-    for (let T in h)
-      p.push(T), _.push(w.nextParameter()), C.push(h[T]);
-    if (p.length > 0) {
-      let T = p.join(", "), k = _.join(", ");
-      y = `update ${this.clientTable} set (${T}) values (${k})`, await e.execute(y, C);
+    for (let T in d)
+      C.push(T), v.push(w.nextParameter()), p.push(d[T]);
+    if (C.length > 0) {
+      let T = C.join(", "), k = v.join(", ");
+      y = `update ${this.clientTable} set (${T}) values (${k})`, await e.execute(y, p);
     }
     if (n)
       for (let T = 0; T < n.length; ++T) {
-        C = [], w = this.dbPool.parameters();
+        p = [], w = this.dbPool.parameters();
         let k = `insert into ${this.redirectUriTable} (client_id, uri) values (` + w.nextParameter() + ", " + w.nextParameter() + ")";
-        C.push(t.client_id), C.push(n[T]), await e.execute(k, C);
+        p.push(t.client_id), p.push(n[T]), await e.execute(k, p);
       }
     if (c)
       for (let T = 0; T < c.length; ++T) {
-        C = [], w = this.dbPool.parameters();
+        p = [], w = this.dbPool.parameters();
         let k = `insert into ${this.validFlowTable} (client_id, flow) values (` + w.nextParameter() + ", " + w.nextParameter() + ")";
-        C.push(t.client_id), C.push(c[T]), await e.execute(k, C);
+        p.push(t.client_id), p.push(c[T]), await e.execute(k, p);
       }
   }
   async getClients(e, t, r) {
@@ -2387,9 +2387,9 @@ class Je extends we {
    */
   constructor(e, t = {}) {
     super();
-    d(this, "authorizationTable", "oauthauthorization");
-    d(this, "useridForeignKeyColumn", "userid");
-    d(this, "dbPool");
+    h(this, "authorizationTable", "oauthauthorization");
+    h(this, "useridForeignKeyColumn", "userid");
+    h(this, "dbPool");
     m("authorizationTable", g.String, this, t, "OAUTH_CLIENT_TABLE"), m("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), this.dbPool = e;
   }
   async getAuthorizations(e, t) {
@@ -2410,8 +2410,8 @@ class Je extends we {
       await i.startTransaction();
       let a = this.dbPool.parameters(), n = [], c = `delete from ${this.authorizationTable} where client_id = ` + a.nextParameter();
       n.push(e), t ? (c += ` and ${this.useridForeignKeyColumn} = ` + a.nextParameter(), n.push(t)) : c += ` and ${this.useridForeignKeyColumn} is null`, await i.execute(c, n);
-      for (let h of r)
-        a = this.dbPool.parameters(), n = [], c = `insert into ${this.authorizationTable} (client_id, userid, scope) values (` + a.nextParameter() + ", " + a.nextParameter() + ", " + a.nextParameter() + ")", n.push(e), n.push(t), n.push(h), await i.execute(c, n);
+      for (let d of r)
+        a = this.dbPool.parameters(), n = [], c = `insert into ${this.authorizationTable} (client_id, userid, scope) values (` + a.nextParameter() + ", " + a.nextParameter() + ", " + a.nextParameter() + ")", n.push(e), n.push(t), n.push(d), await i.execute(c, n);
       await i.commit();
     } catch (a) {
       throw await i.rollback(), a;
@@ -2433,7 +2433,7 @@ class Ze {
 class de extends Ye {
   constructor(e) {
     super();
-    d(this, "pgPool");
+    h(this, "pgPool");
     this.pgPool = e;
   }
   async connect() {
@@ -2447,7 +2447,7 @@ class de extends Ye {
 class Xe extends Ze {
   constructor(e) {
     super();
-    d(this, "pgClient");
+    h(this, "pgClient");
     this.pgClient = e;
   }
   crossauthErrorFromPostgresError(e) {
@@ -2482,7 +2482,7 @@ class Xe extends Ze {
 class Qe extends Ge {
   constructor() {
     super();
-    d(this, "nextParam", 1);
+    h(this, "nextParam", 1);
   }
   nextParameter() {
     return "$" + this.nextParam++;
@@ -2535,8 +2535,8 @@ class re {
    * @param options see {@link AuthenticationOptions}
    */
   constructor(s) {
-    d(this, "friendlyName");
-    d(this, "factorName", "");
+    h(this, "friendlyName");
+    h(this, "factorName", "");
     if (!(s != null && s.friendlyName)) throw new o(l.Configuration, "Authenticator must have a friendly name");
     this.friendlyName = s == null ? void 0 : s.friendlyName;
   }
@@ -2547,6 +2547,13 @@ class re {
       canUpdateSecrets: this.canUpdateSecrets()
     };
   }
+  /**
+   * If your authenticator doesn't need a user to be in the table (because
+   * it can create one), override this and return false. Default is true
+   */
+  requireUserEntry() {
+    return !0;
+  }
 }
 class be extends re {
   /** @returns `password` */
@@ -2784,10 +2791,10 @@ const Ce = process.env.PBKDF2_DIGEST || "sha256", Se = Number(process.env.PBKDF2
     const i = r[0], a = r[1], n = JSON.parse(Buffer.from(i, "base64url").toString());
     if (t && n.t + t * 1e3 > (/* @__PURE__ */ new Date()).getTime())
       throw new o(l.Expired);
-    const h = ie(ae, e).update(i).digest("base64url");
-    if (h.length != a.length)
+    const d = ie(ae, e).update(i).digest("base64url");
+    if (d.length != a.length)
       throw new o(l.InvalidKey, "Signature does not match payload");
-    if (!he(Buffer.from(h), Buffer.from(a)))
+    if (!he(Buffer.from(d), Buffer.from(a)))
       throw new o(l.InvalidKey, "Signature does not match payload");
     return n;
   }
@@ -2852,8 +2859,8 @@ const Ce = process.env.PBKDF2_DIGEST || "sha256", Se = Number(process.env.PBKDF2
     return c = Buffer.concat([c, n.final()]), c.toString();
   }
 };
-d(q, "Base32", "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".split(""));
-let v = q;
+h(q, "Base32", "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".split(""));
+let _ = q;
 function tt(S) {
   let s = [];
   if (!S.password) s.push("Password not provided");
@@ -2874,19 +2881,19 @@ const le = class le extends be {
    */
   constructor(e, t = {}) {
     super({ friendlyName: "Local password", ...t });
-    d(this, "secret");
+    h(this, "secret");
     /** If true, the secret key will be added to the salt when hashing.  Default false */
-    d(this, "enableSecretForPasswords", !1);
+    h(this, "enableSecretForPasswords", !1);
     /** See {@link LocalPasswordAuthenticatorOptions.pbkdf2Digest}  */
-    d(this, "pbkdf2Digest", "sha256");
+    h(this, "pbkdf2Digest", "sha256");
     /** See {@link LocalPasswordAuthenticatorOptions.pbkdf2Iterations}  */
-    d(this, "pbkdf2Iterations", 6e5);
+    h(this, "pbkdf2Iterations", 6e5);
     /** See {@link LocalPasswordAuthenticatorOptions.pbkdf2SaltLength}  */
-    d(this, "pbkdf2SaltLength", 16);
+    h(this, "pbkdf2SaltLength", 16);
     /** See {@link LocalPasswordAuthenticatorOptions.pbkdf2KeyLength}  */
-    d(this, "pbkdf2KeyLength", 32);
+    h(this, "pbkdf2KeyLength", 32);
     /** See {@link LocalPasswordAuthenticatorOptions.validatePasswordFn}  */
-    d(this, "validatePasswordFn", tt);
+    h(this, "validatePasswordFn", tt);
     m("secret", g.String, this, t, "HASHER_SECRET"), m("enableSecretForPasswordHash", g.Boolean, this, t, "ENABLE_SECRET_FOR_PASSWORDS"), m("pbkdf2Digest", g.String, this, t, "PASSWORD_PBKDF2_DIGEST"), m("pbkdf2Iterations", g.String, this, t, "PASSWORD_PBKDF2_ITERATIONS"), m("pbkdf2SaltLength", g.String, this, t, "PASSWORD_PBKDF2_SALTLENGTH"), m("pbkdf2KeyLength", g.String, this, t, "PASSWORD_PBKDF2_KEYLENGTH"), t.validatePasswordFn && (this.validatePasswordFn = t.validatePasswordFn);
   }
   /**
@@ -2907,7 +2914,7 @@ const le = class le extends be {
   async authenticateUser(e, t, r) {
     if (!r.password) throw new o(l.PasswordInvalid, "Password not provided");
     if (!t.password) throw new o(l.PasswordInvalid);
-    if (!await v.passwordsEqual(r.password, t.password, this.secret))
+    if (!await _.passwordsEqual(r.password, t.password, this.secret))
       throw u.logger.debug(f({ msg: "Invalid password hash", user: e.username })), new o(l.PasswordInvalid);
     if (e.state == "awaitingtwofactorsetup") throw new o(l.TwoFactorIncomplete);
     if (e.state == "awaitingemailverification") throw new o(l.EmailNotVerified);
@@ -2937,7 +2944,7 @@ const le = class le extends be {
    * @returns the encoded hash string.
    */
   async createPasswordHash(e, t) {
-    return await v.passwordHash(e, {
+    return await _.passwordHash(e, {
       salt: t,
       encode: !0,
       secret: this.enableSecretForPasswords ? this.secret : void 0,
@@ -2962,7 +2969,7 @@ const le = class le extends be {
    * @returns true if match, false otherwise
    */
   async passwordMatchesHash(e, t, r) {
-    return t == le.NoPassword ? !1 : await v.passwordsEqual(e, t, r);
+    return t == le.NoPassword ? !1 : await _.passwordsEqual(e, t, r);
   }
   /**
    * This will return p hash of the passed password.
@@ -3019,7 +3026,7 @@ const le = class le extends be {
   async reprepareConfiguration(e, t) {
   }
 };
-d(le, "NoPassword", "********");
+h(le, "NoPassword", "********");
 let ve = le;
 class Z extends re {
   /**
@@ -3029,18 +3036,18 @@ class Z extends re {
    */
   constructor(e = {}) {
     super({ friendlyName: "Email otp", ...e });
-    d(this, "views", "views");
-    d(this, "emailAuthenticatorTextBody", "emailauthenticationtextbody.njk");
-    d(this, "emailAuthenticatorHtmlBody");
-    d(this, "emailAuthenticatorSubject", "Login code");
-    d(this, "emailFrom", "");
-    d(this, "smtpHost", "");
-    d(this, "smtpPort", 587);
-    d(this, "smtpUseTls", !0);
-    d(this, "smtpUsername");
-    d(this, "smtpPassword");
-    d(this, "emailAuthenticatorTokenExpires", 60 * 5);
-    d(this, "render");
+    h(this, "views", "views");
+    h(this, "emailAuthenticatorTextBody", "emailauthenticationtextbody.njk");
+    h(this, "emailAuthenticatorHtmlBody");
+    h(this, "emailAuthenticatorSubject", "Login code");
+    h(this, "emailFrom", "");
+    h(this, "smtpHost", "");
+    h(this, "smtpPort", 587);
+    h(this, "smtpUseTls", !0);
+    h(this, "smtpUsername");
+    h(this, "smtpPassword");
+    h(this, "emailAuthenticatorTokenExpires", 60 * 5);
+    h(this, "render");
     m("views", g.String, this, e, "VIEWS"), m("emailAuthenticatorTextBody", g.String, this, e, "EMAIL_AUTHENTICATOR_TEXT_BODY"), m("emailAuthenticatorHtmlBody", g.String, this, e, "EMAIL_AUTHENTICATOR_HTML_BODY"), m("emailAuthenticatorSubject", g.String, this, e, "EMAIL_AUTHENTICATOR_SUBJECT"), m("emailFrom", g.String, this, e, "EMAIL_FROM", !0), m("smtpHost", g.String, this, e, "SMTP_HOST", !0), m("smtpPort", g.Number, this, e, "SMTP_PORT"), m("smtpUsername", g.String, this, e, "SMTP_USERNAME"), m("smtpPassword", g.String, this, e, "SMTP_PASSWORD"), m("smtpUseTls", g.Boolean, this, e, "SMTP_USE_TLS"), m("emailAuthenticatorTokenExpires", g.Number, this, e, "EMAIL_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
   }
   /**
@@ -3098,10 +3105,10 @@ class Z extends re {
       factor2: this.factorName,
       expiry: a,
       otp: t
-    }, h = this.sendToken(r, t);
+    }, d = this.sendToken(r, t);
     return u.logger.info(f({
       msg: "Sent factor otp email",
-      emailMessageId: h,
+      emailMessageId: d,
       email: r
     })), { userData: n, sessionData: c };
   }
@@ -3244,11 +3251,11 @@ class Q extends re {
    */
   constructor(e = {}) {
     super({ friendlyName: "SMS otp", ...e });
-    d(this, "views", "views");
-    d(this, "smsAuthenticatorBody", "smsauthenticationbody.njk");
-    d(this, "smsAuthenticatorFrom", "");
-    d(this, "smsAuthenticatorTokenExpires", 60 * 5);
-    d(this, "render");
+    h(this, "views", "views");
+    h(this, "smsAuthenticatorBody", "smsauthenticationbody.njk");
+    h(this, "smsAuthenticatorFrom", "");
+    h(this, "smsAuthenticatorTokenExpires", 60 * 5);
+    h(this, "render");
     m("views", g.String, this, e, "VIEWS"), m("smsAuthenticatorBody", g.String, this, e, "SMS_AUTHENTICATOR_BODY"), m("smsAuthenticatorFrom", g.String, this, e, "SMS_AUTHENTICATOR_FROM", !0), m("smsAuthenticatorTokenExpires", g.Number, this, e, "SMS_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
   }
   /**
@@ -3288,8 +3295,8 @@ class Q extends re {
       expiry: a,
       otp: t
     };
-    let h = { otp: t };
-    const w = this.render ? this.render(this.smsAuthenticatorBody, h) : W.render(this.smsAuthenticatorBody, h), y = this.sendSms(r, w);
+    let d = { otp: t };
+    const w = this.render ? this.render(this.smsAuthenticatorBody, d) : W.render(this.smsAuthenticatorBody, d), y = this.sendSms(r, w);
     return u.logger.info(f({
       msg: "Sent factor otp sms",
       smsMessageId: y,
@@ -3442,8 +3449,8 @@ class Ue extends Q {
    */
   constructor(e = {}) {
     super(e);
-    d(this, "accountSid");
-    d(this, "authToken");
+    h(this, "accountSid");
+    h(this, "authToken");
     if (!process.env.TWILIO_ACCOUNT_SID || !process.env.TWILIO_AUTH_TOKEN)
       throw new o(
         l.Configuration,
@@ -3475,7 +3482,7 @@ class Rt extends re {
    */
   constructor(e, t = {}) {
     super({ friendlyName: "Dummy factor2", ...t });
-    d(this, "code");
+    h(this, "code");
     this.code = e;
   }
   /**
@@ -3637,9 +3644,9 @@ class Dt extends be {
    */
   constructor(e, t = {}) {
     super({ friendlyName: "LDAP", ...t });
-    d(this, "ldapAutoCreateAccount", !1);
-    d(this, "ldapStorage");
-    d(this, "ldapAutoCreateFactor1", "ldap");
+    h(this, "ldapAutoCreateAccount", !1);
+    h(this, "ldapStorage");
+    h(this, "ldapAutoCreateFactor1", "ldap");
     m("ldapAutoCreateAccount", g.Boolean, this, t, "LDAP_AUTO_CREATE_ACCOUNT"), m("ldapAutoCreateFactor1", g.Boolean, this, t, "LDAP_AUTO_CREATE_FACTOR1"), this.ldapStorage = e;
   }
   /**
@@ -3655,17 +3662,21 @@ class Dt extends be {
     if (!r.password) throw new o(l.PasswordInvalid, "Password not provided");
     await this.ldapStorage.getLdapUser(e.username, r.password);
     let i;
-    if (this.ldapAutoCreateAccount)
-      try {
-        i = (await this.ldapStorage.getUserByUsername(e.username)).user, i.factor1 = this.ldapAutoCreateFactor1;
-      } catch {
-        i = await this.ldapStorage.createUser({ factor1: this.ldapAutoCreateFactor1, ...e }, r);
-      }
-    else
-      i = (await this.ldapStorage.getUserByUsername(e.username)).user;
-    if (i.state == "awaitingtwofactorsetup") throw new o(l.TwoFactorIncomplete);
-    if (i.state == "awaitingemailverification") throw new o(l.EmailNotVerified);
-    if (i.state == "deactivated") throw new o(l.UserNotActive);
+    try {
+      if (this.ldapAutoCreateAccount)
+        try {
+          i = (await this.ldapStorage.getUserByUsername(e.username)).user, i.factor1 = this.ldapAutoCreateFactor1;
+        } catch {
+          i = await this.ldapStorage.createUser({ factor1: this.ldapAutoCreateFactor1, ...e }, r);
+        }
+      else
+        i = (await this.ldapStorage.getUserByUsername(e.username)).user;
+      if (i.state == "awaitingtwofactorsetup") throw new o(l.TwoFactorIncomplete);
+      if (i.state == "awaitingemailverification") throw new o(l.EmailNotVerified);
+      if (i.state == "deactivated") throw new o(l.UserNotActive);
+    } catch (a) {
+      throw console.log(a), u.logger.debug(f({ err: a })), a;
+    }
   }
   /**
    * Does nothing as LDAP is responsible for password format (this class doesn't create password entries)
@@ -3673,6 +3684,9 @@ class Dt extends be {
   validateSecrets(e) {
     return [];
   }
+  requireUserEntry() {
+    return !1;
+  }
   /**
    * Does nothing in this class.
    */
@@ -3731,7 +3745,7 @@ class xt extends re {
    */
   constructor(e, t) {
     super({ friendlyName: "Google Authenticator", ...t });
-    d(this, "appName");
+    h(this, "appName");
     this.appName = e;
   }
   /**
@@ -3759,8 +3773,8 @@ class xt extends re {
     }), { qrUrl: r, secret: t };
   }
   async getSecretFromSession(e, t) {
-    const r = x.decodeData(t.data);
-    if (!("totpsecret" in r))
+    let r = x.decodeData(t.data);
+    if (r && r["2fa"] && (r = r["2fa"]), !("totpsecret" in r))
       throw new o(
         l.Unauthorized,
         "TOTP data not in session"
@@ -3914,26 +3928,26 @@ class R {
    * @param options see {@link TokenEmailerOptions}
    */
   constructor(s, e, t = {}) {
-    d(this, "userStorage");
-    d(this, "keyStorage");
-    d(this, "views", "views");
-    d(this, "siteUrl");
-    d(this, "prefix", "/");
-    d(this, "emailVerificationTextBody", "emailverificationtextbody.njk");
-    d(this, "emailVerificationHtmlBody");
-    d(this, "emailVerificationSubject", "Please verify your email");
-    d(this, "passwordResetTextBody", "passwordresettextbody.njk");
-    d(this, "passwordResetHtmlBody");
-    d(this, "passwordResetSubject", "Password reset");
-    d(this, "emailFrom", "");
-    d(this, "smtpHost", "");
-    d(this, "smtpPort", 587);
-    d(this, "smtpUseTls", !0);
-    d(this, "smtpUsername");
-    d(this, "smtpPassword");
-    d(this, "verifyEmailExpires", 60 * 60 * 24);
-    d(this, "passwordResetExpires", 60 * 60 * 24);
-    d(this, "render");
+    h(this, "userStorage");
+    h(this, "keyStorage");
+    h(this, "views", "views");
+    h(this, "siteUrl");
+    h(this, "prefix", "/");
+    h(this, "emailVerificationTextBody", "emailverificationtextbody.njk");
+    h(this, "emailVerificationHtmlBody");
+    h(this, "emailVerificationSubject", "Please verify your email");
+    h(this, "passwordResetTextBody", "passwordresettextbody.njk");
+    h(this, "passwordResetHtmlBody");
+    h(this, "passwordResetSubject", "Password reset");
+    h(this, "emailFrom", "");
+    h(this, "smtpHost", "");
+    h(this, "smtpPort", 587);
+    h(this, "smtpUseTls", !0);
+    h(this, "smtpUsername");
+    h(this, "smtpPassword");
+    h(this, "verifyEmailExpires", 60 * 60 * 24);
+    h(this, "passwordResetExpires", 60 * 60 * 24);
+    h(this, "render");
     this.userStorage = s, this.keyStorage = e, m("siteUrl", g.String, this, t, "SITE_URL", !0), m("prefix", g.String, this, t, "PREFIX"), m("views", g.String, this, t, "VIEWS"), m("emailVerificationTextBody", g.String, this, t, "EMAIL_VERIFICATION_TEXT_BODY"), m("emailVerificationHtmlBody", g.String, this, t, "EMAIL_VERIFICATION_HTML_BODY"), m("emailVerificationSubject", g.String, this, t, "EMAIL_VERIFICATION_SUBJECT"), m("passwordResetTextBody", g.String, this, t, "PASSWORD_RESET_TEXT_BODY"), m("passwordResetHtmlBody", g.String, this, t, "PASSWORD_RESET_HTML_BODY"), m("passwordResetSubject", g.String, this, t, "PASSWORD_RESET_SUBJECT"), m("emailFrom", g.String, this, t, "EMAIL_FROM", !0), m("smtpHost", g.String, this, t, "SMTP_HOST", !0), m("smtpPort", g.Number, this, t, "SMTP_PORT"), m("smtpUsername", g.String, this, t, "SMTP_USERNAME"), m("smtpPassword", g.String, this, t, "SMTP_PASSWORD"), m("smtpUseTls", g.Boolean, this, t, "SMTP_USE_TLS"), m("verifyEmailExpires", g.Boolean, this, t, "VERIFY_EMAIL_EXPIRES"), m("passwordResetExpires", g.String, this, t, "PASSWORD_RESET_EXPIRES"), t.render ? this.render = t.render : W.configure(this.views, { autoescape: !0 });
   }
   createEmailer() {
@@ -3950,24 +3964,24 @@ class R {
    * correct prefix for inserting into storage.
    */
   static hashEmailVerificationToken(s) {
-    return U.emailVerificationToken + v.hash(s);
+    return U.emailVerificationToken + _.hash(s);
   }
   /**
    * Produces a hash of the given password reset token with the
    * correct prefix for inserting into storage.
    */
   static hashPasswordResetToken(s) {
-    return U.passwordResetToken + v.hash(s);
+    return U.passwordResetToken + _.hash(s);
   }
   async createAndSaveEmailVerificationToken(s, e = "") {
     let r = 0;
     const i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + 1e3 * this.verifyEmailExpires);
     for (; r < 10; ) {
-      let n = v.randomValue(ne), c = R.hashEmailVerificationToken(n);
+      let n = _.randomValue(ne), c = R.hashEmailVerificationToken(n);
       try {
         return await this.keyStorage.saveKey(s, c, i, a, e), n;
       } catch {
-        n = v.randomValue(ne), c = R.hashEmailVerificationToken(n), r++;
+        n = _.randomValue(ne), c = R.hashEmailVerificationToken(n), r++;
       }
     }
     throw new o(l.Connection, "failed creating a unique key");
@@ -4052,11 +4066,11 @@ class R {
     let t = 0;
     const r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.passwordResetExpires);
     for (; t < 10; ) {
-      let a = v.randomValue(ne), n = R.hashPasswordResetToken(a);
+      let a = _.randomValue(ne), n = R.hashPasswordResetToken(a);
       try {
         return await this.keyStorage.saveKey(s, n, r, i), a;
       } catch {
-        a = v.randomValue(ne), n = R.hashPasswordResetToken(a), t++;
+        a = _.randomValue(ne), n = R.hashPasswordResetToken(a), t++;
       }
     }
     throw new o(l.Connection, "failed creating a unique key");
@@ -4167,17 +4181,17 @@ class rt {
   constructor(s = {}) {
     // header settings
     /** name of the CRSF HTTP header */
-    d(this, "headerName", "X-CROSSAUTH-CSRF");
+    h(this, "headerName", "X-CROSSAUTH-CSRF");
     // cookie settings
     /** Name of the CSRF Cookie */
-    d(this, "cookieName", "CSRFTOKEN");
-    d(this, "domain");
-    d(this, "httpOnly", !1);
-    d(this, "path", "/");
-    d(this, "secure", !0);
-    d(this, "sameSite", "lax");
+    h(this, "cookieName", "CSRFTOKEN");
+    h(this, "domain");
+    h(this, "httpOnly", !1);
+    h(this, "path", "/");
+    h(this, "secure", !0);
+    h(this, "sameSite", "lax");
     // hasher settings
-    d(this, "secret", "");
+    h(this, "secret", "");
     m("headerName", g.String, this, s, "CSRF_HEADER_NAME"), m("cookieName", g.String, this, s, "CSRF_COOKIE_NAME"), m("domain", g.String, this, s, "CSRF_COOKIE_DOMAIN"), m("httpOnly", g.Boolean, this, s, "CSRF_COOKIE_HTTPONLY"), m("path", g.String, this, s, "CSRF_COOKIE_PATH"), m("secure", g.Boolean, this, s, "CSRF_COOKIE_SECURE"), m("sameSite", g.String, this, s, "CSRF_COOKIE_SAMESITE"), m("secret", g.String, this, s, "SECRET", !0);
   }
   /**
@@ -4188,7 +4202,7 @@ class rt {
    * @returns a random CSRF token.
    */
   createCsrfToken() {
-    return v.randomValue(_e);
+    return _.randomValue(_e);
   }
   /**
    * Returns a {@link Cookie } object with the given session key.
@@ -4197,7 +4211,7 @@ class rt {
    * @returns a {@link Cookie } object,
    */
   makeCsrfCookie(s) {
-    const e = v.signSecureToken(s, this.secret);
+    const e = _.signSecureToken(s, this.secret);
     let t = {};
     return this.domain && (t.domain = this.domain), this.path && (t.path = this.path), t.sameSite = this.sameSite, this.httpOnly && (t.httpOnly = this.httpOnly), this.secure && (t.secure = this.secure), {
       name: this.cookieName,
@@ -4209,7 +4223,7 @@ class rt {
     return this.maskCsrfToken(s);
   }
   unsignCookie(s) {
-    return v.unsignSecureToken(s, this.secret);
+    return _.unsignSecureToken(s, this.secret);
   }
   /**
    * Takes a session ID and creates a string representation of the cookie (value of the HTTP `Cookie` header).
@@ -4222,14 +4236,14 @@ class rt {
     return this.domain && (e += "; " + this.domain), this.path && (e += "; " + this.path), this.httpOnly && (e += "; httpOnly"), this.secure && (e += "; secure"), e;
   }
   maskCsrfToken(s) {
-    const e = v.randomValue(_e), t = v.xor(s, e);
+    const e = _.randomValue(_e), t = _.xor(s, e);
     return e + "." + t;
   }
   unmaskCsrfToken(s) {
     const e = s.split(".");
     if (e.length != 2) throw new o(l.InvalidCsrf, "CSRF token in header or form not in correct format");
     const t = e[0], r = e[1];
-    return v.xor(r, t);
+    return _.xor(r, t);
   }
   /**
    * Validates the passed CSRF token.  
@@ -4246,12 +4260,12 @@ class rt {
     const t = this.unmaskCsrfToken(e);
     let r;
     try {
-      r = v.unsignSecureToken(s, this.secret);
+      r = _.unsignSecureToken(s, this.secret);
     } catch (i) {
       throw u.logger.error(f({ err: i })), new o(l.InvalidCsrf, "Invalid CSRF cookie");
     }
     if (r != t)
-      throw u.logger.warn(f({ msg: "Invalid CSRF token received - form/header value does not match", csrfCookieHash: v.hash(s) })), new o(l.InvalidCsrf);
+      throw u.logger.warn(f({ msg: "Invalid CSRF token received - form/header value does not match", csrfCookieHash: _.hash(s) })), new o(l.InvalidCsrf);
   }
   /**
    * Validates the passed CSRF cookie (doesn't check it matches the token, just that the cookie is valid).  
@@ -4265,7 +4279,7 @@ class rt {
    */
   validateCsrfCookie(s) {
     try {
-      return v.unsignSecureToken(s, this.secret);
+      return _.unsignSecureToken(s, this.secret);
     } catch (e) {
       throw u.logger.error(f({ err: e })), new o(l.InvalidCsrf, "Invalid CSRF cookie");
     }
@@ -4280,26 +4294,26 @@ class D {
    *                expires option is ignored (cookies are session-only).
    */
   constructor(s, e = {}) {
-    d(this, "userStorage");
-    d(this, "keyStorage");
+    h(this, "userStorage");
+    h(this, "keyStorage");
     /** This is set from input options.  Number of seconds before an
      * idle session will time out
      */
-    d(this, "idleTimeout", 0);
-    d(this, "persist", !0);
-    d(this, "filterFunction");
+    h(this, "idleTimeout", 0);
+    h(this, "persist", !0);
+    h(this, "filterFunction");
     // cookie settings
     /** Name of the CSRF Cookie, set from input options */
-    d(this, "cookieName", "SESSIONID");
-    d(this, "maxAge", 60 * 60 * 24 * 30);
+    h(this, "cookieName", "SESSIONID");
+    h(this, "maxAge", 60 * 60 * 24 * 30);
     // 30 days
-    d(this, "domain");
-    d(this, "httpOnly", !1);
-    d(this, "path", "/");
-    d(this, "secure", !0);
-    d(this, "sameSite", "lax");
+    h(this, "domain");
+    h(this, "httpOnly", !1);
+    h(this, "path", "/");
+    h(this, "secure", !0);
+    h(this, "sameSite", "lax");
     // hasher settings
-    d(this, "secret", "");
+    h(this, "secret", "");
     e.userStorage && (this.userStorage = e.userStorage), this.keyStorage = s, m("idleTimeout", g.Number, this, e, "SESSION_IDLE_TIMEOUT"), m("persist", g.Boolean, this, e, "PERSIST_SESSION_ID"), this.filterFunction = e.filterFunction, m("cookieName", g.String, this, e, "SESSION_COOKIE_NAME"), m("maxAge", g.String, this, e, "SESSION_COOKIE_MAX_AGE"), m("domain", g.String, this, e, "SESSION_COOKIE_DOMAIN"), m("httpOnly", g.Boolean, this, e, "SESSIONCOOKIE_HTTPONLY"), m("path", g.String, this, e, "SESSION_COOKIE_PATH"), m("secure", g.Boolean, this, e, "SESSION_COOKIE_SECURE"), m("sameSite", g.String, this, e, "SESSION_COOKIE_SAMESITE"), m("secret", g.String, this, e, "SECRET", !0);
   }
   expiry(s) {
@@ -4314,7 +4328,7 @@ class D {
    * @returns a base64-url-encoded string that can go into the storage
    */
   static hashSessionId(s) {
-    return U.session + v.hash(s);
+    return U.session + _.hash(s);
   }
   /**
    * Creates a session key and saves in storage
@@ -4333,17 +4347,17 @@ class D {
    *          attempts exceeded trying to create a unique session id
    */
   async createSessionKey(s, e = {}) {
-    let r = 0, i = v.randomValue(ke);
+    let r = 0, i = _.randomValue(ke);
     const a = /* @__PURE__ */ new Date();
     let n = this.expiry(a), c = !1;
     for (; r < 10 && !c; ) {
-      const h = D.hashSessionId(i);
+      const d = D.hashSessionId(i);
       try {
-        this.idleTimeout > 0 && s && (e = { ...e, lastActivity: /* @__PURE__ */ new Date() }), await this.keyStorage.saveKey(s, h, a, n, void 0, e), c = !0;
+        this.idleTimeout > 0 && s && (e = { ...e, lastActivity: /* @__PURE__ */ new Date() }), await this.keyStorage.saveKey(s, d, a, n, void 0, e), c = !0;
       } catch (w) {
         let y = o.asCrossauthError(w);
         if (y.code == l.KeyExists || y.code == l.InvalidKey) {
-          if (r++, i = v.randomValue(ke), r > 10)
+          if (r++, i = _.randomValue(ke), r > 10)
             throw u.logger.error(f({ msg: "Max attempts exceeded trying to create session ID" })), new o(l.KeyExists);
         } else
           throw u.logger.debug(f({ err: w })), w;
@@ -4366,7 +4380,7 @@ class D {
    * @returns a {@link Cookie } object,
    */
   makeCookie(s, e) {
-    let t = v.signSecureToken(s.value, this.secret), r = {};
+    let t = _.signSecureToken(s.value, this.secret), r = {};
     return e == null && (e = this.persist), this.domain && (r.domain = this.domain), s.expires && e && (r.expires = s.expires), this.path && (r.path = this.path), r.sameSite = this.sameSite, this.httpOnly && (r.httpOnly = this.httpOnly), this.secure && (r.secure = this.secure), {
       name: this.cookieName,
       value: t,
@@ -4403,7 +4417,7 @@ class D {
    *         is invalid. 
    */
   unsignCookie(s) {
-    return v.unsignSecureToken(s, this.secret);
+    return _.unsignSecureToken(s, this.secret);
   }
   /**
    * Returns the user matching the given session key in session storage, or throws an exception.
@@ -4443,11 +4457,11 @@ class D {
   async getSessionKey(s) {
     const e = Date.now(), t = D.hashSessionId(s), r = await this.keyStorage.getKey(t);
     if (r.value = s, r.expires && e > r.expires.getTime())
-      throw u.logger.warn(f({ msg: "Session id in cookie expired in key storage", hashedSessionCookie: v.hash(s) })), new o(l.Expired);
+      throw u.logger.warn(f({ msg: "Session id in cookie expired in key storage", hashedSessionCookie: _.hash(s) })), new o(l.Expired);
     if (r.userid && this.idleTimeout > 0 && r.lastactive && e > r.lastactive.getTime() + this.idleTimeout * 1e3)
-      throw u.logger.warn(f({ msg: "Session cookie with expired idle time received", hashedSessionCookie: v.hash(s) })), new o(l.Expired);
+      throw u.logger.warn(f({ msg: "Session cookie with expired idle time received", hashedSessionCookie: _.hash(s) })), new o(l.Expired);
     if (this.filterFunction && !this.filterFunction(r))
-      throw u.logger.warn(f({ msg: "Filter function on session id in cookie failed", hashedSessionCookie: v.hash(s) })), new o(l.InvalidKey);
+      throw u.logger.warn(f({ msg: "Filter function on session id in cookie failed", hashedSessionCookie: _.hash(s) })), new o(l.InvalidKey);
     return r;
   }
   /**
@@ -4467,17 +4481,17 @@ class Lt {
    * @param options optional parameters for authentication. See {@link SessionManagerOptions }.
    */
   constructor(s, e, t = {}) {
-    d(this, "userStorage");
-    d(this, "keyStorage");
-    d(this, "emailTokenStorage");
-    d(this, "csrfTokens");
-    d(this, "session");
-    d(this, "authenticators");
+    h(this, "userStorage");
+    h(this, "keyStorage");
+    h(this, "emailTokenStorage");
+    h(this, "csrfTokens");
+    h(this, "session");
+    h(this, "authenticators");
     //readonly authenticator : UsernamePasswordAuthenticator;
-    d(this, "enableEmailVerification", !1);
-    d(this, "enablePasswordReset", !1);
-    d(this, "tokenEmailer");
-    d(this, "allowedFactor2", []);
+    h(this, "enableEmailVerification", !1);
+    h(this, "enablePasswordReset", !1);
+    h(this, "tokenEmailer");
+    h(this, "allowedFactor2", []);
     t.userStorage && (this.userStorage = t.userStorage), this.keyStorage = s, this.authenticators = e;
     for (let r in this.authenticators)
       this.authenticators[r].factorName = r;
@@ -4539,39 +4553,48 @@ class Lt {
    */
   async login(s, e, t = {}, r, i, a = !1) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call login if no user storage provided");
-    let n;
+    let n = { userid: "" }, c = "";
     if (i)
       n = (await this.userStorage.getUserByUsername(i.username, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).secrets;
     else {
+      let v = { username: "", state: "active" };
+      try {
+        let T = await this.userStorage.getUserByUsername(s, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
+        n = T.secrets, i = T.user, v = T.user;
+      } catch {
+        for (let k in this.authenticators)
+          this.authenticators[k].requireUserEntry() || (v = { username: e.username, state: "active" }, c = k);
+      }
+      if (v.username == "") throw new o(l.UserNotExist);
+      await this.authenticators[(i == null ? void 0 : i.factor1) ?? c].authenticateUser(v, n, e);
       let p = await this.userStorage.getUserByUsername(s, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
-      if (n = p.secrets, i = p.user, !i) throw new o(l.UserNotExist);
-      await this.authenticators[i.factor1].authenticateUser(i, n, e);
+      n = p.secrets, i = p.user;
     }
-    let c;
+    let d;
     if (i.state == E.passwordChangeNeeded)
-      c = (await this.createAnonymousSession({ data: JSON.stringify({ passwordchange: { username: i.username } }) })).sessionCookie;
+      d = (await this.createAnonymousSession({ data: JSON.stringify({ passwordchange: { username: i.username } }) })).sessionCookie;
     else if (i.state == E.factor2ResetNeeded)
-      c = (await this.createAnonymousSession({ data: JSON.stringify({ factor2change: { username: i.username } }) })).sessionCookie;
+      d = (await this.createAnonymousSession({ data: JSON.stringify({ factor2change: { username: i.username } }) })).sessionCookie;
     else if (!a && i.factor2 && i.factor2 != "") {
-      const { sessionCookie: p } = await this.initiateTwoFactorLogin(i);
-      c = p;
+      const { sessionCookie: v } = await this.initiateTwoFactorLogin(i);
+      d = v;
     } else {
-      const p = await this.session.createSessionKey(i.id, t);
-      c = this.session.makeCookie(p, r);
+      const v = await this.session.createSessionKey(i.id, t);
+      d = this.session.makeCookie(v, r);
     }
-    const h = this.csrfTokens.createCsrfToken(), w = this.csrfTokens.makeCsrfCookie(h), y = this.csrfTokens.makeCsrfFormOrHeaderToken(h);
+    const w = this.csrfTokens.createCsrfToken(), y = this.csrfTokens.makeCsrfCookie(w), C = this.csrfTokens.makeCsrfFormOrHeaderToken(w);
     try {
       this.emailTokenStorage.deleteAllForUser(
         i.id,
         U.passwordResetToken
       );
-    } catch (p) {
-      u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: s })), u.logger.debug(f({ err: p }));
+    } catch (v) {
+      u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: s })), u.logger.debug(f({ err: v }));
     }
     return {
-      sessionCookie: c,
-      csrfCookie: w,
-      csrfFormOrHeaderValue: y,
+      sessionCookie: d,
+      csrfCookie: y,
+      csrfFormOrHeaderValue: C,
       user: i,
       secrets: n
     };
@@ -4752,7 +4775,7 @@ class Lt {
    */
   async updateSessionData(s, e, t) {
     const r = D.hashSessionId(s);
-    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: v.hash(s) })), await this.keyStorage.updateData(r, e, t);
+    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: _.hash(s) })), await this.keyStorage.updateData(r, e, t);
   }
   /**
    * Update field sin the session data.
@@ -4764,7 +4787,7 @@ class Lt {
    */
   async updateManySessionData(s, e) {
     const t = D.hashSessionId(s);
-    u.logger.debug(f({ msg: "Updating session data", hashedSessionCookie: v.hash(s) })), await this.keyStorage.updateManyData(t, e);
+    u.logger.debug(f({ msg: "Updating session data", hashedSessionCookie: _.hash(s) })), await this.keyStorage.updateManyData(t, e);
   }
   /**
   * Deletes a field from the session data.
@@ -4776,7 +4799,7 @@ class Lt {
   */
   async deleteSessionData(s, e) {
     const t = D.hashSessionId(s);
-    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: v.hash(s) })), await this.keyStorage.deleteData(t, e);
+    u.logger.debug(f({ msg: `Updating session data value${e}`, hashedSessionCookie: _.hash(s) })), await this.keyStorage.deleteData(t, e);
   }
   /**
    * Deletes the given session ID from the key storage (not the cookie)
@@ -4837,12 +4860,12 @@ class Lt {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call initiateTwoFactorSignup if no user storage provided");
     if (!this.authenticators[s.factor1]) throw new o(l.Configuration, "Authenticator cannot create users");
     if (!this.authenticators[s.factor2]) throw new o(l.Configuration, "Two factor authentication not enabled for user");
-    const a = await this.authenticators[s.factor2].prepareConfiguration(s), n = a == null ? {} : a.userData, c = a == null ? {} : a.sessionData, h = await this.authenticators[s.factor1].createPersistentSecrets(s.username, e, r);
+    const a = await this.authenticators[s.factor2].prepareConfiguration(s), n = a == null ? {} : a.userData, c = a == null ? {} : a.sessionData, d = await this.authenticators[s.factor1].createPersistentSecrets(s.username, e, r);
     return s.state = "awaitingtwofactorsetup", await this.keyStorage.updateData(
       D.hashSessionId(t),
       "2fa",
       c
-    ), { userid: (await this.userStorage.createUser(s, h)).id, userData: n };
+    ), { userid: (await this.userStorage.createUser(s, d)).id, userData: n };
   }
   /**
    * Begins the process of setting up 2FA for a user which has already been 
@@ -4858,7 +4881,7 @@ class Lt {
     if (e && e != "none") {
       if (!this.authenticators[e]) throw new o(l.Configuration, "Two factor authentication not enabled for user");
       const i = await this.authenticators[e].prepareConfiguration(s), a = i == null ? {} : i.userData, n = i == null ? {} : i.sessionData;
-      return await this.keyStorage.updateData(
+      return n && (n.userData = a), await this.keyStorage.updateData(
         D.hashSessionId(t),
         "2fa",
         n
@@ -4885,10 +4908,10 @@ class Lt {
    */
   async repeatTwoFactorSignup(s) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call repeatTwoFactorSignup if no user storage provided");
-    const e = (await this.dataForSessionId(s))["2fa"], t = e.username, r = e.factor2, i = D.hashSessionId(s), a = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, a), h = c == null ? {} : c.userData, w = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
+    const e = (await this.dataForSessionId(s))["2fa"], t = e.username, r = e.factor2, i = D.hashSessionId(s), a = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, a), d = c == null ? {} : c.userData, w = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
     y && await this.keyStorage.updateData(i, "2fa", y);
-    const { user: p } = await this.userStorage.getUserByUsername(t, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
-    return { userid: p.id, userData: h, secrets: w };
+    const { user: C } = await this.userStorage.getUserByUsername(t, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
+    return { userid: C.id, userData: d, secrets: w };
   }
   /**
    * Authenticates with the second factor.  
@@ -4901,7 +4924,7 @@ class Lt {
    * @throws {@link @crossauth/common!CrossauthError} if authentication fails.
    */
   async completeTwoFactorSetup(s, e) {
-    var _;
+    var v;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call completeTwoFactorSetup if no user storage provided");
     let t = !1, { user: r, key: i } = await this.session.getUserForSessionId(e, {
       skipActiveCheck: !0
@@ -4914,18 +4937,18 @@ class Lt {
     let n = a.username;
     const c = this.authenticators[a.factor2];
     if (!c) throw new o(l.Configuration, "Unrecognised second factor authentication");
-    const h = {}, w = c.secretNames();
-    for (let C in a)
-      w.includes(C) && (h[C] = a[C]);
+    const d = {}, w = c.secretNames();
+    for (let p in a)
+      w.includes(p) && (d[p] = a[p]);
     await c.authenticateUser(void 0, a, s), r || (t = !0, r = (await this.userStorage.getUserByUsername(n, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).user);
     const y = c.skipEmailVerificationOnSignup() == !0;
     if (!r) throw new o(l.UserNotExist, "Couldn't fetch user");
-    const p = {
+    const C = {
       id: r.id,
       state: !y && this.enableEmailVerification ? "awaitingemailverification" : "active",
       factor2: a.factor2
     };
-    return c.secretNames().length > 0 ? await this.userStorage.updateUser(p, h) : await this.userStorage.updateUser(p), !y && t && this.enableEmailVerification && this.tokenEmailer && await ((_ = this.tokenEmailer) == null ? void 0 : _.sendEmailVerificationToken(r.id, void 0)), await this.keyStorage.updateData(D.hashSessionId(i.value), "2fa", void 0), { ...r, ...p };
+    return c.secretNames().length > 0 ? await this.userStorage.updateUser(C, d) : await this.userStorage.updateUser(C), !y && t && this.enableEmailVerification && this.tokenEmailer && await ((v = this.tokenEmailer) == null ? void 0 : v.sendEmailVerificationToken(r.id, void 0)), await this.keyStorage.updateData(D.hashSessionId(i.value), "2fa", void 0), { ...r, ...C };
   }
   /**
    * Initiates the two factor login process.
@@ -4955,13 +4978,13 @@ class Lt {
    */
   async initiateTwoFactorPageVisit(s, e, t, r, i) {
     const n = await this.authenticators[s.factor2].createOneTimeSecrets(s);
-    let c, h, w;
+    let c, d, w;
     const y = D.hashSessionId(e);
     u.logger.debug("initiateTwoFactorPageVisit " + s.username + " " + e + " " + y);
-    let p = { username: s.username, factor2: s.factor2, secrets: n, body: t, url: r };
-    return i && (p["content-type"] = i), await this.keyStorage.updateData(y, "pre2fa", p), {
+    let C = { username: s.username, factor2: s.factor2, secrets: n, body: t, url: r };
+    return i && (C["content-type"] = i), await this.keyStorage.updateData(y, "pre2fa", C), {
       sessionCookie: c,
-      csrfCookie: h,
+      csrfCookie: d,
       csrfFormOrHeaderValue: w
     };
   }
@@ -4983,8 +5006,8 @@ class Lt {
     const { secrets: i } = await this.userStorage.getUserByUsername(r.pre2fa.username), a = this.authenticators[r.pre2fa.factor2];
     if (!a) throw new o(l.Configuration, "Unrecognised second factor authentication");
     const n = {}, c = a.secretNames();
-    for (let h in i)
-      c.includes(h) && h in i && (n[h] = i[h]);
+    for (let d in i)
+      c.includes(d) && d in i && (n[d] = i[d]);
     await a.authenticateUser(void 0, { ...n, ...r.pre2fa.secrets }, s), await this.keyStorage.updateData(D.hashSessionId(t.value), "pre2fa", void 0);
   }
   /**
@@ -5025,25 +5048,25 @@ class Lt {
     let { key: i } = await this.session.getUserForSessionId(e);
     if (!i || !i.data || i.data == "") throw new o(l.Unauthorized);
     let a = x.decodeData(i.data)["2fa"], n = a.username, c = a.factor2;
-    const { user: h, secrets: w } = await this.userStorage.getUserByUsername(n), y = this.authenticators[c];
+    const { user: d, secrets: w } = await this.userStorage.getUserByUsername(n), y = this.authenticators[c];
     if (!y) throw new o(l.Configuration, "Second factor " + c + " not enabled");
-    await y.authenticateUser(h, { ...w, ...a }, s);
-    const p = await this.session.createSessionKey(h.id, t);
+    await y.authenticateUser(d, { ...w, ...a }, s);
+    const C = await this.session.createSessionKey(d.id, t);
     await this.keyStorage.deleteKey(D.hashSessionId(i.value));
-    const _ = this.session.makeCookie(p, r), C = this.csrfTokens.createCsrfToken(), T = this.csrfTokens.makeCsrfCookie(C), k = this.csrfTokens.makeCsrfFormOrHeaderToken(C);
+    const v = this.session.makeCookie(C, r), p = this.csrfTokens.createCsrfToken(), T = this.csrfTokens.makeCsrfCookie(p), k = this.csrfTokens.makeCsrfFormOrHeaderToken(p);
     try {
       this.emailTokenStorage.deleteAllForUser(
-        h.id,
+        d.id,
         U.passwordResetToken
       );
     } catch (A) {
       u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: n })), u.logger.debug(f({ err: A }));
     }
     return {
-      sessionCookie: _,
+      sessionCookie: v,
       csrfCookie: T,
       csrfFormOrHeaderValue: k,
-      user: h
+      user: d
     };
   }
   /**
@@ -5097,10 +5120,10 @@ class Lt {
     let { user: a, secrets: n } = await this.userStorage.getUserByUsername(s);
     const c = e == 1 ? a.factor1 : a.factor2;
     i != null && await this.authenticators[c].authenticateUser(a, n, i);
-    const h = await this.authenticators[a.factor1].createPersistentSecrets(a.username, t, r);
+    const d = await this.authenticators[a.factor1].createPersistentSecrets(a.username, t, r);
     await this.userStorage.updateUser(
       { id: a.id },
-      h
+      d
     );
     try {
       this.emailTokenStorage.deleteAllForUser(
@@ -5119,15 +5142,15 @@ class Lt {
    * @returns true if email verification is now needed, false otherwise
    */
   async updateUser(s, e, t = !1, r = !1) {
-    var y, p;
+    var y, C;
     let i;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call updateUser if no user storage provided");
     if (!("id" in s) || s.id == null)
       throw new o(l.UserNotExist, "Please specify a user id");
     if (!("username" in s) || s.username == null)
       throw new o(l.UserNotExist, "Please specify a userername");
-    let { email: a, username: n, password: c, ...h } = e;
-    h.userid = s.userid;
+    let { email: a, username: n, password: c, ...d } = e;
+    d.userid = s.userid;
     let w = !1;
     if (a)
       i = a, R.validateEmail(i), w = !0;
@@ -5139,7 +5162,7 @@ class Lt {
       }
       w && R.validateEmail(i);
     }
-    return !t && this.enableEmailVerification && w ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(s.id, i)) : (a && (h.email = a), n && (h.username = n)), (e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded) && await ((p = this.tokenEmailer) == null ? void 0 : p.sendPasswordResetToken(s.id, {}, r)), await this.userStorage.updateUser(h), {
+    return !t && this.enableEmailVerification && w ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(s.id, i)) : (a && (d.email = a), n && (d.username = n)), (e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded) && await ((C = this.tokenEmailer) == null ? void 0 : C.sendPasswordResetToken(s.id, {}, r)), await this.userStorage.updateUser(d), {
       emailVerificationTokenSent: !t && this.enableEmailVerification && w,
       passwordResetTokenSent: e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded
     };
@@ -5184,15 +5207,15 @@ class ge {
    * @param options options.  See {@link ApiKeyManagerOptions}
    */
   constructor(s, e = {}) {
-    d(this, "apiKeyStorage");
-    d(this, "keyLength", 16);
-    d(this, "secret", "");
+    h(this, "apiKeyStorage");
+    h(this, "keyLength", 16);
+    h(this, "secret", "");
     /** The prefix to add to the hashed key in storage.  Defaults to 
      * {@link @crossauth/common!KeyPrefix}.apiKey
      */
-    d(this, "prefix", U.apiKey);
+    h(this, "prefix", U.apiKey);
     /** The name of the speak in the Authorization header.  Defaults to "ApiKey" */
-    d(this, "authScheme", "ApiKey");
+    h(this, "authScheme", "ApiKey");
     this.apiKeyStorage = s, m("secret", g.String, this, e, "SECRET", !0), m("keyLength", g.String, this, e, "APIKEY_LENGTH"), m("prefix", g.String, this, e, "APIKEY_PREFIX"), m("authScheme", g.String, this, e, "APIKEY_AUTHSCHEME");
   }
   /**
@@ -5214,7 +5237,7 @@ class ge {
    *          Authorization header (with the signature appended.)
    */
   async createKey(s, e, t, r, i) {
-    const a = v.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, h = ge.hashApiKeyValue(a), w = {
+    const a = _.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, d = ge.hashApiKeyValue(a), w = {
       name: s,
       value: a,
       userid: e,
@@ -5225,7 +5248,7 @@ class ge {
     };
     await this.apiKeyStorage.saveKey(
       e,
-      this.prefix + h,
+      this.prefix + d,
       n,
       c,
       w.data,
@@ -5235,7 +5258,7 @@ class ge {
     return { key: w, token: y };
   }
   static hashApiKeyValue(s) {
-    return v.hash(s);
+    return _.hash(s);
   }
   /**
    * Returns the hash of the bearer value from the Authorization header.
@@ -5246,13 +5269,13 @@ class ge {
    * @returns a hash of the value (without the prefix).
    */
   static hashSignedApiKeyValue(s) {
-    return v.hash(s.split(".")[0]);
+    return _.hash(s.split(".")[0]);
   }
   unsignApiKeyValue(s) {
-    return v.unsign(s, this.secret).v;
+    return _.unsign(s, this.secret).v;
   }
   signApiKeyValue(s) {
-    return v.sign({ v: s }, this.secret);
+    return _.sign({ v: s }, this.secret);
   }
   async getKey(s) {
     if (this.authScheme != "" && s.startsWith(this.authScheme + " ")) {
@@ -5283,10 +5306,10 @@ class J {
    * @param options See  {@link OAuthClientManagerOptions}
    */
   constructor(s = {}) {
-    d(this, "oauthPbkdf2Digest", "sha256");
-    d(this, "oauthPbkdf2Iterations", 4e4);
-    d(this, "oauthPbkdf2KeyLength", 32);
-    d(this, "clientStorage");
+    h(this, "oauthPbkdf2Digest", "sha256");
+    h(this, "oauthPbkdf2Iterations", 4e4);
+    h(this, "oauthPbkdf2KeyLength", 32);
+    h(this, "clientStorage");
     if (!s.clientStorage) throw new o(
       l.Configuration,
       "Must specify clientStorage when adding a client manager"
@@ -5308,7 +5331,7 @@ class J {
   async createClient(s, e, t, r = !0, i) {
     const a = J.randomClientId();
     let n, c;
-    r && (c = J.randomClientSecret(), n = await v.passwordHash(c, {
+    r && (c = J.randomClientSecret(), n = await _.passwordHash(c, {
       encode: !0,
       iterations: this.oauthPbkdf2Iterations,
       keyLen: this.oauthPbkdf2KeyLength,
@@ -5316,7 +5339,7 @@ class J {
     })), e.forEach((y) => {
       J.validateUri(y);
     }), t || (t = b.allFlows());
-    const h = {
+    const d = {
       client_id: a,
       client_secret: n,
       client_name: s,
@@ -5328,13 +5351,13 @@ class J {
     let w;
     for (let y = 0; y < 5; ++y)
       try {
-        w = await this.clientStorage.createClient(h);
+        w = await this.clientStorage.createClient(d);
         break;
-      } catch (p) {
+      } catch (C) {
         if (y == 4) {
-          if (o.asCrossauthError(p).code != l.ClientExists) throw p;
+          if (o.asCrossauthError(C).code != l.ClientExists) throw C;
         } else
-          h.client_id = J.randomClientId();
+          d.client_id = J.randomClientId();
       }
     if (!w) throw new o(l.ClientExists);
     return w.client_secret && c && (w.client_secret = c), w;
@@ -5351,7 +5374,7 @@ class J {
   async updateClient(s, e, t = !1) {
     const r = await this.clientStorage.getClientById(s);
     let i = !1, a;
-    e.confidential === !0 && !r.confidential || e.confidential === !0 && t ? (a = J.randomClientSecret(), e.client_secret = await v.passwordHash(a, {
+    e.confidential === !0 && !r.confidential || e.confidential === !0 && t ? (a = J.randomClientSecret(), e.client_secret = await _.passwordHash(a, {
       encode: !0,
       iterations: this.oauthPbkdf2Iterations,
       keyLen: this.oauthPbkdf2KeyLength,
@@ -5366,13 +5389,13 @@ class J {
    * Create a random OAuth client id
    */
   static randomClientId() {
-    return v.randomValue(it);
+    return _.randomValue(it);
   }
   /**
   * Create a random OAuth client secret
   */
   static randomClientSecret() {
-    return v.randomValue(st);
+    return _.randomValue(st);
   }
   /** If the passed redirect URI is not in the set of valid ones,
    * throw {@link @crossauth/common!CrossauthError} with
@@ -5434,57 +5457,57 @@ class zt {
    * @param options See {@link OAuthAuthorizationServerOptions }
    */
   constructor(s, e, t, r = {}) {
-    d(this, "clientStorage");
-    d(this, "keyStorage");
-    d(this, "userStorage");
-    d(this, "authenticators", {});
-    d(this, "authStorage");
+    h(this, "clientStorage");
+    h(this, "keyStorage");
+    h(this, "userStorage");
+    h(this, "authenticators", {});
+    h(this, "authStorage");
     /** For validating redirect URIs. */
-    d(this, "clientManager");
-    d(this, "oauthIssuer", "");
-    d(this, "audience", null);
-    d(this, "requireRedirectUriRegistration", !0);
-    d(this, "requireClientSecretOrChallenge", !0);
-    d(this, "jwtAlgorithm", "RS256");
-    d(this, "jwtAlgorithmChecked", "RS256");
-    d(this, "codeLength", 32);
-    d(this, "jwtKeyType", "");
-    d(this, "jwtSecretKey", "");
-    d(this, "jwtPublicKey", "");
-    d(this, "jwtPrivateKey", "");
-    d(this, "jwtSecretKeyFile", "");
-    d(this, "jwtPublicKeyFile", "");
-    d(this, "jwtPrivateKeyFile", "");
-    d(this, "jwtKid", "1");
-    d(this, "secretOrPrivateKey", "");
-    d(this, "secretOrPublicKey", "");
-    d(this, "persistAccessToken", !1);
-    d(this, "issueRefreshToken", !1);
-    d(this, "opaqueAccessToken", !1);
-    d(this, "accessTokenExpiry", 60 * 60);
-    d(this, "refreshTokenExpiry", 60 * 60);
-    d(this, "rollingRefreshToken", !0);
-    d(this, "authorizationCodeExpiry", 60 * 5);
-    d(this, "mfaTokenExpiry", 60 * 5);
-    d(this, "clockTolerance", 10);
-    d(this, "emptyScopeIsValid", !0);
-    d(this, "validateScopes", !1);
-    d(this, "validScopes", []);
-    d(this, "idTokenClaims", {});
-    d(this, "accessTokenClaims", {});
+    h(this, "clientManager");
+    h(this, "oauthIssuer", "");
+    h(this, "audience", null);
+    h(this, "requireRedirectUriRegistration", !0);
+    h(this, "requireClientSecretOrChallenge", !0);
+    h(this, "jwtAlgorithm", "RS256");
+    h(this, "jwtAlgorithmChecked", "RS256");
+    h(this, "codeLength", 32);
+    h(this, "jwtKeyType", "");
+    h(this, "jwtSecretKey", "");
+    h(this, "jwtPublicKey", "");
+    h(this, "jwtPrivateKey", "");
+    h(this, "jwtSecretKeyFile", "");
+    h(this, "jwtPublicKeyFile", "");
+    h(this, "jwtPrivateKeyFile", "");
+    h(this, "jwtKid", "1");
+    h(this, "secretOrPrivateKey", "");
+    h(this, "secretOrPublicKey", "");
+    h(this, "persistAccessToken", !1);
+    h(this, "issueRefreshToken", !1);
+    h(this, "opaqueAccessToken", !1);
+    h(this, "accessTokenExpiry", 60 * 60);
+    h(this, "refreshTokenExpiry", 60 * 60);
+    h(this, "rollingRefreshToken", !0);
+    h(this, "authorizationCodeExpiry", 60 * 5);
+    h(this, "mfaTokenExpiry", 60 * 5);
+    h(this, "clockTolerance", 10);
+    h(this, "emptyScopeIsValid", !0);
+    h(this, "validateScopes", !1);
+    h(this, "validScopes", []);
+    h(this, "idTokenClaims", {});
+    h(this, "accessTokenClaims", {});
     // device code
-    d(this, "userCodeExpiry", 60 * 5);
-    d(this, "userCodeThrottle", 1500);
-    d(this, "deviceCodePollInterval", 5);
-    d(this, "userCodeLength", 8);
-    d(this, "deviceCodeLength", 16);
-    d(this, "userCodeDashEvery", 4);
-    d(this, "deviceCodeVerificationUri", "");
-    d(this, "authServerBaseUrl", "");
+    h(this, "userCodeExpiry", 60 * 5);
+    h(this, "userCodeThrottle", 1500);
+    h(this, "deviceCodePollInterval", 5);
+    h(this, "userCodeLength", 8);
+    h(this, "deviceCodeLength", 16);
+    h(this, "userCodeDashEvery", 4);
+    h(this, "deviceCodeVerificationUri", "");
+    h(this, "authServerBaseUrl", "");
     /** Set from options.  See {@link OAuthAuthorizationServerOptions.validFlows} */
-    d(this, "validFlows", ["all"]);
+    h(this, "validFlows", ["all"]);
     /** Set from options.  See {@link OAuthAuthorizationServerOptions.allowedFactor2} */
-    d(this, "allowedFactor2", []);
+    h(this, "allowedFactor2", []);
     this.clientStorage = s, this.keyStorage = e, this.userStorage = r.userStorage, this.authStorage = r.authStorage, t && (this.authenticators = t), this.clientManager = new J({ clientStorage: s, ...r }), m("authServerBaseUrl", g.String, this, r, "AUTH_SERVER_BASE_URL", !0), m("oauthIssuer", g.String, this, r, "OAUTH_ISSUER"), this.oauthIssuer || (this.oauthIssuer = this.authServerBaseUrl), m("audience", g.String, this, r, "OAUTH_AUDIENCE"), m("oauthPbkdf2Iterations", g.String, this, r, "OAUTH_PBKDF2_ITERATIONS"), m("requireClientSecretOrChallenge", g.Boolean, this, r, "OAUTH_REQUIRE_CLIENT_SECRET_OR_CHALLENGE"), m("jwtAlgorithm", g.String, this, r, "JWT_ALGORITHM"), m("codeLength", g.Number, this, r, "OAUTH_CODE_LENGTH"), m("jwtKeyType", g.String, this, r, "JWT_KEY_TYPE"), m("jwtSecretKeyFile", g.String, this, r, "JWT_SECRET_KEY_FILE"), m("jwtPublicKeyFile", g.String, this, r, "JWT_PUBLIC_KEY_FILE"), m("jwtPrivateKeyFile", g.String, this, r, "JWT_PRIVATE_KEY_FILE"), m("jwtSecretKey", g.String, this, r, "JWT_SECRET_KEY"), m("jwtPublicKey", g.String, this, r, "JWT_PUBLIC_KEY"), m("jwtPrivateKey", g.String, this, r, "JWT_PRIVATE_KEY"), m("jwtKid", g.String, this, r, "JWT_KID"), m("persistAccessToken", g.String, this, r, "OAUTH_PERSIST_ACCESS_TOKEN"), m("issueRefreshToken", g.String, this, r, "OAUTH_ISSUE_REFRESH_TOKEN"), m("opaqueAccessToken", g.String, this, r, "OAUTH_OPAQUE_ACCESS_TOKEN"), m("accessTokenExpiry", g.Number, this, r, "OAUTH_ACCESS_TOKEN_EXPIRY"), m("refreshTokenExpiry", g.Number, this, r, "OAUTH_REFRESH_TOKEN_EXPIRY"), m("rollingRefreshToken", g.Boolean, this, r, "OAUTH_ROLLING_REFRESH_TOKEN"), m("authorizationCodeExpiry", g.Number, this, r, "OAUTH_AUTHORIZATION_CODE_EXPIRY"), m("mfaTokenExpiry", g.Number, this, r, "OAUTH_MFA_TOKEN_EXPIRY"), m("clockTolerance", g.Number, this, r, "OAUTH_CLOCK_TOLERANCE"), m("validateScopes", g.Boolean, this, r, "OAUTH_VALIDATE_SCOPES"), m("emptyScopeIsValid", g.Boolean, this, r, "OAUTH_EMPTY_SCOPE_VALID"), m("validScopes", g.JsonArray, this, r, "OAUTH_VALID_SCOPES"), m("validFlows", g.JsonArray, this, r, "OAUTH_validFlows"), m("idTokenClaims", g.Json, this, r, "OAUTH_ID_TOKEN_CLAIMS"), m("accessTokenClaims", g.Json, this, r, "OAUTH_ACCESS_TOKEN_CLAIMS"), m("allowedFactor2", g.JsonArray, this, r, "ALLOWED_FACTOR2"), m("userCodeExpiry", g.Number, this, r, "DEVICECODE_USERCODE_EXPIRY"), m("userCodeThrottle", g.Number, this, r, "DEVICECODE_USERCODE_THROTTLE"), m("deviceCodePollInterval", g.Number, this, r, "DEVICECODE_POLL_INTERVAL"), m("deviceCodeLength", g.Number, this, r, "DEVICECODE_LENGTH"), m("userCodeLength", g.Number, this, r, "DEVICECODE_USERCODE_LENGTH");
     let i = {};
     if (m("userCodeDashEvery", g.String, i, r, "DEVICECODE_USERCODE_DASH_EVERY"), i.userCodeDashEvery)
@@ -5586,23 +5609,23 @@ class zt {
     }
     const {
       scopes: y,
-      error: p,
-      error_description: _
+      error: C,
+      error_description: v
     } = await this.validateAndPersistScope(e, r, c);
-    if (p) return {
-      error: p,
-      error_description: _
+    if (C) return {
+      error: C,
+      error_description: v
     };
-    const C = this.inferFlowFromGet(s, y || [], a);
-    if (!C || !this.validFlows.includes(C))
+    const p = this.inferFlowFromGet(s, y || [], a);
+    if (!p || !this.validFlows.includes(p))
       return {
         error: "access_denied",
-        error_description: "Unsupported flow type " + C
+        error_description: "Unsupported flow type " + p
       };
-    if (!w.valid_flow.includes(C))
+    if (!w.valid_flow.includes(p))
       return {
         error: "unauthorized_client",
-        error_description: "Client does not support " + C
+        error_description: "Client does not support " + p
       };
     try {
       this.validateState(i);
@@ -5712,7 +5735,7 @@ class zt {
     } : r && (!t || !e.client_secret) ? {
       error: "access_denied",
       error_description: "Client is confidential but either secret not passed or is missing in database"
-    } : r && !await v.passwordsEqual(
+    } : r && !await _.passwordsEqual(
       t ?? "",
       e.client_secret ?? ""
     ) ? {
@@ -5755,12 +5778,12 @@ class zt {
     codeVerifier: a,
     refreshToken: n,
     username: c,
-    password: h,
+    password: d,
     mfaToken: w,
     oobCode: y,
-    bindingCode: p,
-    otp: _,
-    deviceCode: C
+    bindingCode: C,
+    otp: v,
+    deviceCode: p
   }) {
     var O, V, j;
     const T = this.inferFlowFromPost(s, a);
@@ -5830,7 +5853,7 @@ class zt {
           };
         }
       try {
-        const F = U.refreshToken + v.hash(n);
+        const F = U.refreshToken + _.hash(n);
         await this.keyStorage.deleteKey(F);
       } catch (F) {
         const I = o.asCrossauthError(F);
@@ -5861,7 +5884,7 @@ class zt {
         issueRefreshToken: H
       });
     } else if (s == "password") {
-      if (!c || !h)
+      if (!c || !d)
         return {
           error: "access_denied",
           error_description: "Username and/or password not provided for password flow"
@@ -5881,7 +5904,7 @@ class zt {
         await B.authenticateUser(
           I,
           $,
-          { password: h }
+          { password: d }
         ), K = I;
       } catch (I) {
         return u.logger.debug(f({ err: I })), {
@@ -5919,7 +5942,7 @@ class zt {
           error: P,
           error_description: F
         };
-      if (!_)
+      if (!v)
         return {
           error: "access_denied",
           error_description: "OTP not provided"
@@ -5929,7 +5952,7 @@ class zt {
           error: "access_denied",
           error_description: "MFA token not provided"
         };
-      const I = await this.validateMfaToken(w), $ = U.mfaToken + v.hash(w);
+      const I = await this.validateMfaToken(w), $ = U.mfaToken + _.hash(w);
       if (!I.user || !I.key)
         return {
           error: "access_denied",
@@ -5946,7 +5969,7 @@ class zt {
         await B.authenticateUser(
           I.user,
           M,
-          { otp: _ }
+          { otp: v }
         );
       } catch (M) {
         return u.logger.debug(f({ err: M })), {
@@ -5982,7 +6005,7 @@ class zt {
           error: P,
           error_description: F
         };
-      if (!y || !p)
+      if (!y || !C)
         return {
           error: "access_denied",
           error_description: "OOB code or binding code not provided"
@@ -6019,7 +6042,7 @@ class zt {
         await $.authenticateUser(
           I.user,
           { ...B, otp: M.otp, expiry: (V = I.key.expires) == null ? void 0 : V.getTime() },
-          { otp: p }
+          { otp: C }
         );
       } catch (B) {
         return u.logger.debug(f({ err: B })), {
@@ -6045,14 +6068,14 @@ class zt {
         user: I.user
       });
     } else if (s == "urn:ietf:params:oauth:grant-type:device_code") {
-      if (!C)
+      if (!p)
         return {
           error: "invalid_request",
           error_description: "No device code given"
         };
       let N;
       try {
-        N = await this.keyStorage.getKey(U.deviceCode + C);
+        N = await this.keyStorage.getKey(U.deviceCode + p);
       } catch (P) {
         const F = o.asCrossauthError(P);
         return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), {
@@ -6063,7 +6086,7 @@ class zt {
       try {
         const P = JSON.parse(N.data ?? "{}"), F = (/* @__PURE__ */ new Date()).getTime();
         if (N.expires && F > N.expires.getTime())
-          return await this.deleteDeviceCode(C), {
+          return await this.deleteDeviceCode(p), {
             error: "expired_token",
             error_description: "Code has expired"
           };
@@ -6074,7 +6097,7 @@ class zt {
           };
         {
           let I = P.scope ? P.scope.split(" ") : void 0, $ = P.userid ? await ((j = this.userStorage) == null ? void 0 : j.getUserById(P.userid)) : void 0;
-          return await this.deleteDeviceCode(C), await this.makeAccessToken({
+          return await this.deleteDeviceCode(p), await this.makeAccessToken({
             client: A,
             client_secret: i,
             codeVerifier: a,
@@ -6085,7 +6108,7 @@ class zt {
         }
       } catch (P) {
         const F = o.asCrossauthError(P);
-        return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), await this.deleteDeviceCode(C), {
+        return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), await this.deleteDeviceCode(p), {
           error: "accerss_denied",
           error_description: "Invalid device code"
         };
@@ -6128,7 +6151,7 @@ class zt {
     scope: e,
     client_secret: t
   }) {
-    var C;
+    var p;
     if (this.deviceCodeVerificationUri == "")
       return {
         error: "invalid_request",
@@ -6158,53 +6181,53 @@ class zt {
         error_description: k
       };
     }
-    let c, h = !1;
-    const w = /* @__PURE__ */ new Date(), y = this.userCodeExpiry, p = new Date(w.getTime() + this.userCodeExpiry * 1e3 + this.clockTolerance * 1e3);
-    for (let T = 0; T < 10 && !h; ++T)
+    let c, d = !1;
+    const w = /* @__PURE__ */ new Date(), y = this.userCodeExpiry, C = new Date(w.getTime() + this.userCodeExpiry * 1e3 + this.clockTolerance * 1e3);
+    for (let T = 0; T < 10 && !d; ++T)
       try {
-        c = v.randomValue(this.deviceCodeLength), await this.keyStorage.saveKey(
+        c = _.randomValue(this.deviceCodeLength), await this.keyStorage.saveKey(
           void 0,
           U.deviceCode + c,
           w,
-          p,
+          C,
           JSON.stringify({ scope: e, client_id: s })
-        ), h = !0;
+        ), d = !0;
       } catch {
         u.logger.debug(f({ msg: `Attempt number${T} at creating a unique authozation code failed` }));
       }
-    if (!h || !c)
+    if (!d || !c)
       return {
         error: "server_error",
         error_description: "Couldn't create device code"
       };
-    let _;
-    h = !1;
-    for (let T = 0; T < 10 && !h; ++T)
+    let v;
+    d = !1;
+    for (let T = 0; T < 10 && !d; ++T)
       try {
-        _ = v.randomBase32(this.userCodeLength), await this.keyStorage.saveKey(
+        v = _.randomBase32(this.userCodeLength), await this.keyStorage.saveKey(
           void 0,
-          U.userCode + _,
+          U.userCode + v,
           w,
-          p,
+          C,
           JSON.stringify({ deviceCode: c })
-        ), h = !0;
+        ), d = !0;
       } catch {
         u.logger.debug(f({ msg: `Attempt number${T} at creating a unique authozation code failed` }));
       }
-    if (!h || !_)
+    if (!d || !v)
       return await this.deleteDeviceCode(c), {
         error: "server_error",
         error_description: "Couldn't create device code"
       };
-    if (_ && this.userCodeDashEvery) {
+    if (v && this.userCodeDashEvery) {
       const T = new RegExp(String.raw`(.{1,${this.userCodeDashEvery}})`, "g");
-      _ = (C = _.match(T)) == null ? void 0 : C.join("-");
+      v = (p = v.match(T)) == null ? void 0 : p.join("-");
     }
     return {
       device_code: c,
-      user_code: _,
+      user_code: v,
       verification_uri: this.deviceCodeVerificationUri,
-      verification_uri_complete: this.deviceCodeVerificationUri + "?user_code=" + _,
+      verification_uri_complete: this.deviceCodeVerificationUri + "?user_code=" + v,
       expires_in: y,
       interval: this.deviceCodePollInterval
     };
@@ -6237,7 +6260,7 @@ class zt {
       };
     }
     if (!r.deviceCode)
-      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: v.hash(s) })), await this.deleteUserCode(s), {
+      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: _.hash(s) })), await this.deleteUserCode(s), {
         ok: !1,
         error: "server_error",
         error_description: "No device code for user code"
@@ -6246,12 +6269,12 @@ class zt {
     try {
       i = await this.keyStorage.getKey(U.deviceCode + r.deviceCode);
     } catch (y) {
-      const p = o.asCrossauthError(y);
-      return u.logger.debug(f({ err: p })), u.logger.error(f({
+      const C = o.asCrossauthError(y);
+      return u.logger.debug(f({ err: C })), u.logger.error(f({
         msg: "Invalid device code for user code",
-        userCodeHash: v.hash(s),
-        deviceCodeHash: v.hash(r.deviceCode),
-        cerr: p
+        userCodeHash: _.hash(s),
+        deviceCodeHash: _.hash(r.deviceCode),
+        cerr: C
       })), await this.deleteUserCode(s), {
         ok: !1,
         error: "server_error",
@@ -6284,24 +6307,24 @@ class zt {
         error_description: "User code has already been used",
         client_id: n
       };
-    let h = !1;
+    let d = !1;
     if (u.logger.debug(f({
       msg: "Checking scopes have been authorized",
       scope: a
-    })), a ? h = await this.hasAllScopes(
+    })), a ? d = await this.hasAllScopes(
       n,
       e,
       a.split(" ")
-    ) : h = await this.hasAllScopes(
+    ) : d = await this.hasAllScopes(
       n,
       e,
       [null]
-    ), !h) {
+    ), !d) {
       try {
         e != null && e.id && await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "userid", e.id);
       } catch (y) {
-        const p = o.asCrossauthError(y);
-        return u.logger.debug(f({ err: p })), u.logger.warn(f({ msg: "Couldn't update user id on user code entry - deleting", cerr: p })), await this.deleteUserCode(s), await this.deleteDeviceCode(r.deviceCode), {
+        const C = o.asCrossauthError(y);
+        return u.logger.debug(f({ err: C })), u.logger.warn(f({ msg: "Couldn't update user id on user code entry - deleting", cerr: C })), await this.deleteUserCode(s), await this.deleteDeviceCode(r.deviceCode), {
           ok: !1,
           error: "access_denied",
           error_description: "Invalid user code",
@@ -6318,8 +6341,8 @@ class zt {
     try {
       e != null && e.id && await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "userid", e.id), await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "ok", !0);
     } catch (y) {
-      const p = o.asCrossauthError(y);
-      return u.logger.debug(f({ err: p })), u.logger.warn(f({ msg: "Couldn't update status on user code entry - deleting", cerr: p })), await this.deleteUserCode(s), await this.deleteDeviceCode(r.deviceCode), {
+      const C = o.asCrossauthError(y);
+      return u.logger.debug(f({ err: C })), u.logger.warn(f({ msg: "Couldn't update status on user code entry - deleting", cerr: C })), await this.deleteUserCode(s), await this.deleteDeviceCode(r.deviceCode), {
         ok: !1,
         error: "access_denied",
         error_description: "Invalid user code",
@@ -6345,7 +6368,7 @@ class zt {
       };
     }
     if (!t.deviceCode)
-      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: v.hash(s) })), await this.deleteUserCode(s), {
+      return u.logger.error(f({ msg: "No device code for user code", userCodeHash: _.hash(s) })), await this.deleteUserCode(s), {
         ok: !1,
         error: "server_error",
         error_description: "No device code for user code"
@@ -6357,8 +6380,8 @@ class zt {
       const c = o.asCrossauthError(n);
       return u.logger.debug(f({ err: c })), u.logger.error(f({
         msg: "Invalid device code for user code",
-        userCodeHash: v.hash(s),
-        deviceCodeHash: v.hash(t.deviceCode),
+        userCodeHash: _.hash(s),
+        deviceCodeHash: _.hash(t.deviceCode),
         cerr: c
       })), await this.deleteUserCode(s), {
         ok: !1,
@@ -6396,7 +6419,7 @@ class zt {
     };
   }
   async createMfaRequest(s) {
-    const e = v.randomValue(this.codeLength), t = U.mfaToken + v.hash(e), r = /* @__PURE__ */ new Date();
+    const e = _.randomValue(this.codeLength), t = U.mfaToken + _.hash(e), r = /* @__PURE__ */ new Date();
     try {
       await this.keyStorage.saveKey(
         s.id,
@@ -6422,7 +6445,7 @@ class zt {
     var r;
     let e, t;
     try {
-      const i = U.mfaToken + v.hash(s);
+      const i = U.mfaToken + _.hash(s);
       if (t = await this.keyStorage.getKey(i), !t.userid)
         return {
           error: "access_denied",
@@ -6509,8 +6532,8 @@ class zt {
   async mfaChallengeEndpoint(s, e, t, r, i) {
     const a = b.PasswordMfa, n = await this.getClientById(e);
     if (!n.client) return n;
-    const c = n.client, h = await this.authenticateClient(a, c, t);
-    if (h.error) return h;
+    const c = n.client, d = await this.authenticateClient(a, c, t);
+    if (d.error) return d;
     const w = await this.validateMfaToken(s);
     if (!w.user || !w.key) return w;
     if (w.user.factor2 != i)
@@ -6525,23 +6548,23 @@ class zt {
       };
     let y = {};
     r == "oob" && (y = {
-      oobCode: v.randomValue(this.codeLength)
+      oobCode: _.randomValue(this.codeLength)
     });
     try {
-      const p = this.authenticators[w.user.factor2];
-      if (!p)
+      const C = this.authenticators[w.user.factor2];
+      if (!C)
         throw new o(
           l.Configuration,
           "User's authenticator has not been loaded"
         );
-      const _ = await p.createOneTimeSecrets(w.user);
+      const v = await C.createOneTimeSecrets(w.user);
       await this.keyStorage.updateData(
         w.key.value,
         "omfa",
-        { ...y, ..._ }
+        { ...y, ...v }
       );
-    } catch (p) {
-      return u.logger.debug(f({ err: p })), {
+    } catch (C) {
+      return u.logger.debug(f({ err: C })), {
         error: "server_error",
         error_description: "Unable to initiate OOB authentication"
       };
@@ -6603,28 +6626,28 @@ class zt {
         error: "invalid_request",
         error_description: `The redirect uri ${e} is invalid`
       };
-    const h = /* @__PURE__ */ new Date(), w = this.authorizationCodeExpiry ? new Date(h.getTime() + this.authorizationCodeExpiry * 1e3 + this.clockTolerance * 1e3) : void 0, y = {};
-    t && (y.scope = t), i && (y.challengeMethod = a, y.challenge = v.hash(i)), n && (y.username = n.username, y.id = n.id);
-    const p = JSON.stringify(y);
-    let _ = !1, C = "";
-    for (let T = 0; T < 10 && !_; ++T)
+    const d = /* @__PURE__ */ new Date(), w = this.authorizationCodeExpiry ? new Date(d.getTime() + this.authorizationCodeExpiry * 1e3 + this.clockTolerance * 1e3) : void 0, y = {};
+    t && (y.scope = t), i && (y.challengeMethod = a, y.challenge = _.hash(i)), n && (y.username = n.username, y.id = n.id);
+    const C = JSON.stringify(y);
+    let v = !1, p = "";
+    for (let T = 0; T < 10 && !v; ++T)
       try {
-        C = v.randomValue(this.codeLength), await this.keyStorage.saveKey(
+        p = _.randomValue(this.codeLength), await this.keyStorage.saveKey(
           void 0,
-          U.authorizationCode + v.hash(C),
-          h,
+          U.authorizationCode + _.hash(p),
+          d,
           w,
-          p
-        ), _ = !0;
+          C
+        ), v = !0;
       } catch {
         u.logger.debug(f({ msg: `Attempt number${T} at creating a unique authozation code failed` }));
       }
-    if (!_)
+    if (!v)
       throw new o(
         l.KeyExists,
         "Couldn't create a authorization code"
       );
-    return { code: C, state: r };
+    return { code: p, state: r };
   }
   /**
    * Create an access token
@@ -6641,7 +6664,7 @@ class zt {
     var z, H;
     let c = !0;
     try {
-      s.client_secret != null && (c = await v.passwordsEqual(
+      s.client_secret != null && (c = await _.passwordsEqual(
         t ?? "",
         s.client_secret ?? ""
       ));
@@ -6652,11 +6675,11 @@ class zt {
       error: "access_denied",
       error_description: "Invalid client secret"
     };
-    let h = {};
+    let d = {};
     if (e) {
       let K;
       try {
-        K = await this.keyStorage.getKey(U.authorizationCode + v.hash(e)), h = x.decodeData(K.data);
+        K = await this.keyStorage.getKey(U.authorizationCode + _.hash(e)), d = x.decodeData(K.data);
       } catch (O) {
         return u.logger.debug(f({ err: O })), {
           error: "access_denied",
@@ -6672,26 +6695,26 @@ class zt {
           client_id: s == null ? void 0 : s.client_id
         }));
       }
-      i = h.scope;
+      i = d.scope;
     }
-    if (n && (h.username = n.username), h.challengeMethod && !h.challenge && h.challengeMethod != "plain" && h.challengeMethod != "S256")
+    if (n && (d.username = n.username), d.challengeMethod && !d.challenge && d.challengeMethod != "plain" && d.challengeMethod != "S256")
       return {
         error: "access_denied",
         error_description: "Invalid code challenge/code challenge method method for authorization code"
       };
-    if (h.challenge) {
-      const K = h.challengeMethod == "plain" ? r ?? "" : v.sha256(r ?? "");
-      if (v.hash(K) != h.challenge)
+    if (d.challenge) {
+      const K = d.challengeMethod == "plain" ? r ?? "" : _.sha256(r ?? "");
+      if (_.hash(K) != d.challenge)
         return {
           error: "access_denied",
           error_description: "Code verifier is incorrect"
         };
     }
     const w = /* @__PURE__ */ new Date(), y = Math.ceil(w.getTime() / 1e3);
-    let p;
-    if ((i && i.includes("openid") || Object.keys(this.accessTokenClaims).length > 0) && this.userStorage && h.username)
+    let C;
+    if ((i && i.includes("openid") || Object.keys(this.accessTokenClaims).length > 0) && this.userStorage && d.username)
       try {
-        const { user: K } = await this.userStorage.getUserByUsername(h.username);
+        const { user: K } = await this.userStorage.getUserByUsername(d.username);
         n = K;
       } catch (K) {
         return u.logger.error(f({ err: K })), {
@@ -6699,18 +6722,18 @@ class zt {
           error_description: "Couldn't load user data"
         };
       }
-    const _ = v.uuid();
-    let C = {
-      jti: _,
+    const v = _.uuid();
+    let p = {
+      jti: v,
       iat: y,
       iss: this.oauthIssuer,
-      sub: h.username,
+      sub: d.username,
       type: "access"
     };
-    C = this.addClaims(C, this.accessTokenClaims, i, n), i && (C.scope = i), this.accessTokenExpiry != null && (C.exp = y + this.accessTokenExpiry, p = new Date(w.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (C.aud = this.audience);
+    p = this.addClaims(p, this.accessTokenClaims, i, n), i && (p.scope = i), this.accessTokenExpiry != null && (p.exp = y + this.accessTokenExpiry, C = new Date(w.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (p.aud = this.audience);
     const T = await new Promise((K, O) => {
       se.sign(
-        C,
+        p,
         this.secretOrPrivateKey,
         { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
         (V, j) => {
@@ -6724,19 +6747,19 @@ class zt {
     this.persistAccessToken && this.keyStorage && await ((z = this.keyStorage) == null ? void 0 : z.saveKey(
       void 0,
       // to avoid user storage dependency, we don't set this
-      U.accessToken + v.hash(_),
+      U.accessToken + _.hash(v),
       w,
-      p
+      C
     ));
     let k;
     if (i && i.includes("openid")) {
-      const K = v.uuid();
+      const K = _.uuid();
       let O = {
         aud: s.client_id,
         jti: K,
         iat: y,
         iss: this.oauthIssuer,
-        sub: h.username,
+        sub: d.username,
         type: "id"
       };
       if (i.includes("email") && (n != null && n.email) && (O.email = n.email), i.includes("address") && n && "address" in n && (O.address = n.address), i.includes("phone") && n && "phone" in n && (O.phone = n.phone), i.includes("profile") && n)
@@ -6777,16 +6800,16 @@ class zt {
     let A;
     if (a) {
       const K = {
-        username: h.username,
+        username: d.username,
         client_id: s.client_id
       };
       i && (K.scope = i);
       let O;
       const j = {
-        jti: v.uuid(),
+        jti: _.uuid(),
         iat: y,
         iss: this.oauthIssuer,
-        sub: h.username,
+        sub: d.username,
         type: "refresh"
       };
       this.refreshTokenExpiry != null && (j.exp = y + this.refreshTokenExpiry, O = this.refreshTokenExpiry ? new Date(y + this.refreshTokenExpiry * 1e3 + this.clockTolerance * 1e3) : void 0), this.oauthIssuer && (j.aud = this.oauthIssuer), A = await new Promise((N, P) => {
@@ -6804,7 +6827,7 @@ class zt {
       }), A && await ((H = this.keyStorage) == null ? void 0 : H.saveKey(
         void 0,
         // to avoid user storage dependency
-        U.refreshToken + v.hash(A),
+        U.refreshToken + _.hash(A),
         w,
         O,
         JSON.stringify(K)
@@ -6843,11 +6866,9 @@ class zt {
             ...s,
             ...r
           };
-        else {
-          console.log(i);
+        else
           for (let a in i)
             s[a] = r[i[a]];
-        }
       }
     }
     return s;
@@ -6860,7 +6881,7 @@ class zt {
    */
   async validAuthorizationCode(s) {
     try {
-      const e = U.authorizationCode + v.hash(s);
+      const e = U.authorizationCode + _.hash(s);
       return await this.keyStorage.getKey(e), !0;
     } catch (e) {
       return u.logger.debug(f({ err: e })), !1;
@@ -6874,7 +6895,7 @@ class zt {
    */
   async validRefreshToken(s) {
     try {
-      const e = U.refreshToken + v.hash(s);
+      const e = U.refreshToken + _.hash(s);
       return await this.keyStorage.getKey(e), !0;
     } catch (e) {
       return u.logger.debug(f({ err: e })), !1;
@@ -6889,7 +6910,7 @@ class zt {
   async getRefreshTokenData(s) {
     if (s)
       try {
-        const e = U.refreshToken + v.hash(s), t = await this.keyStorage.getKey(e);
+        const e = U.refreshToken + _.hash(s), t = await this.keyStorage.getKey(e);
         return JSON.parse(t.data || "{}");
       } catch (e) {
         u.logger.debug(f({ err: e }));
@@ -6923,7 +6944,7 @@ class zt {
     try {
       const e = await this.validateJwt(s, "access");
       if (this.persistAccessToken) {
-        const t = U.accessToken + v.hash(e.payload.jti);
+        const t = U.accessToken + _.hash(e.payload.jti);
         await this.keyStorage.getKey(t);
       }
       return e;
@@ -7129,15 +7150,15 @@ class nt extends Pe {
     /**
      * Value passed to the constructor.  The `aud` claim must match it
      */
-    d(this, "audience");
+    h(this, "audience");
     /**
      * Value passed to the constructor. If true, access tokens are saved
      * in storage,
      */
-    d(this, "persistAccessToken", !1);
-    d(this, "keyStorage");
-    d(this, "jwtSecretKeyFile", "");
-    d(this, "jwtPublicKeyFile", "");
+    h(this, "persistAccessToken", !1);
+    h(this, "keyStorage");
+    h(this, "jwtSecretKeyFile", "");
+    h(this, "jwtPublicKeyFile", "");
     if (this.audience = e, m("authServerBaseUrl", g.String, this, t, "AUTH_SERVER_BASE_URL", !0), m("jwtSecretKeyFile", g.String, this, t, "JWT_SECRET_KEY_FILE"), m("jwtPublicKeyFile", g.String, this, t, "JWT_PUBLIC_KEY_FILE"), m("jwtSecretKey", g.String, this, t, "JWT_SECRET_KEY"), m("jwtPublicKey", g.String, this, t, "JWT_PUBLIC_KEY"), m("clockTolerance", g.Number, this, t, "OAUTH_CLOCK_TOLERANCE"), m("persistAccessToken", g.Boolean, this, t, "OAUTH_PERSIST_ACCESS_TOKEN"), this.keyStorage = t.keyStorage, this.jwtSecretKey || this.jwtSecretKeyFile) {
       if (this.jwtPublicKey || this.jwtPublicKeyFile)
         throw new o(
@@ -7166,7 +7187,7 @@ class nt extends Pe {
    * @returns Base64-url-encoded hash
    */
   async hash(e) {
-    return v.hash(e);
+    return _.hash(e);
   }
   /**
    * If the given token is valid, the paylaod is returned.  Otherwise
@@ -7187,7 +7208,7 @@ class nt extends Pe {
     const r = await super.tokenAuthorized(e, t);
     if (r && t == "access" && this.persistAccessToken && this.keyStorage)
       try {
-        const a = U.accessToken + v.hash(r.jti ? r.jti : r.sid ? r.sid : ""), n = await this.keyStorage.getKey(a), c = /* @__PURE__ */ new Date();
+        const a = U.accessToken + _.hash(r.jti ? r.jti : r.sid ? r.sid : ""), n = await this.keyStorage.getKey(a), c = /* @__PURE__ */ new Date();
         if (n.expires && ((i = n.expires) == null ? void 0 : i.getTime()) < c.getTime()) {
           u.logger.error(f({ msg: "Access token expired in storage but not in JWT" }));
           return;
@@ -7195,7 +7216,7 @@ class nt extends Pe {
       } catch (a) {
         u.logger.warn(f({
           msg: "Couldn't get token from database - is it valid?",
-          hashedAccessToken: v.hash(r.jti ? r.jti : r.sid ? r.sid : "")
+          hashedAccessToken: _.hash(r.jti ? r.jti : r.sid ? r.sid : "")
         })), u.logger.debug(f({ err: a }));
         return;
       }
@@ -7227,12 +7248,12 @@ class Ht extends Ke {
       ),
       ...t
     });
-    d(this, "deviceAuthorizationUrl", "device_authorization");
-    d(this, "userCreationType", "idToken");
-    d(this, "userMatchField", "username");
-    d(this, "idTokenMatchField", "sub");
-    d(this, "userCreationFn");
-    d(this, "userStorage");
+    h(this, "deviceAuthorizationUrl", "device_authorization");
+    h(this, "userCreationType", "idToken");
+    h(this, "userMatchField", "username");
+    h(this, "idTokenMatchField", "sub");
+    h(this, "userCreationFn");
+    h(this, "userStorage");
     this.client_id = r.client_id;
     let i = {};
     if (m("stateLength", g.String, this, t, "OAUTH_STATE_LENGTH"), m("verifierLength", g.String, this, t, "OAUTH_VERIFIER_LENGTH"), m("client_secret", g.String, i, t, "OAUTH_CLIENT_SECRET"), m("codeChallengeMethod", g.String, this, t, "OAUTH_CODE_CHALLENGE_METHOD"), m("deviceAuthorizationUrl", g.String, this, t, "OAUTH_DEVICE_AUTHORIZATION_URL"), m("oauthLogFetch", g.Boolean, this, t, "OAUTH_LOG_FETCH"), this.deviceAuthorizationUrl.startsWith("/") && (this.deviceAuthorizationUrl = this.deviceAuthorizationUrl.substring(1)), i.client_secret && (this.client_secret = i.client_secret), m("userCreationType", g.String, this, t, "OAUTH_USER_CREATION_TYPE"), m("userMatchField", g.String, this, t, "OAUTH_USER_MATCH_FIELD"), m("idTokenMatchField", g.String, this, t, "OAUTH_IDTOKEN_MaTCH_FIELD"), this.userCreationType == "merge" ? this.userCreationFn = ot : this.userCreationType == "embed" ? this.userCreationFn = lt : t.userCreationFn && this.userCreationType == "custom" ? this.userCreationFn = t.userCreationFn : this.userCreationFn = ct, t.userStorage && (this.userStorage = t.userStorage), m("oauthPostType", g.String, this, t, "OAUTH_POST_TYPE"), m("oauthUseUserInfoEndpoint", g.Boolean, this, t, "OAUTH_USE_USER_INFO_ENDPOINT"), m("oauthAuthorizeRedirect", g.String, this, t, "OAUTH_AUTHORIZE_REDIRECT"), this.oauthPostType != "json" && this.oauthPostType != "form")
@@ -7245,7 +7266,7 @@ class Ht extends Ke {
    * @returns the Base64-URL-encoded random string
    */
   randomValue(e) {
-    return v.randomValue(e);
+    return _.randomValue(e);
   }
   /**
    * Uses {@link @crossauth/backend!Crypto.sha256} to create hash a string using SHA256
@@ -7253,7 +7274,7 @@ class Ht extends Ke {
    * @returns the Base64-URL-encoded hash
    */
   async sha256(e) {
-    return v.sha256(e);
+    return _.sha256(e);
   }
 }
 async function ot(S, s, e, t) {
@@ -7300,7 +7321,7 @@ class jt {
      * Keyed on auth server base URL then audience.  The latter may be ""
      * for none
      */
-    d(this, "tokenConsumers");
+    h(this, "tokenConsumers");
     this.tokenConsumers = [...s];
   }
   /**
@@ -7332,7 +7353,7 @@ class jt {
 export {
   ge as ApiKeyManager,
   re as Authenticator,
-  v as Crypto,
+  _ as Crypto,
   rt as DoubleSubmitCsrfToken,
   Rt as DummyFactor2Authenticator,
   Z as EmailAuthenticator,