@crossauth/backend 1.1.0 → 1.1.1

package/dist/index.js

@@ -18,7 +18,7 @@ import te from "jsonwebtoken";
 import ie from "node:fs";
 import { createPublicKey as $e } from "crypto";
 import * as qe from "jose";
-var f = /* @__PURE__ */ ((S) => (S[S.String = 0] = "String", S[S.Number = 1] = "Number", S[S.Boolean = 2] = "Boolean", S[S.Json = 3] = "Json", S[S.JsonArray = 4] = "JsonArray", S))(f || {});
+var g = /* @__PURE__ */ ((S) => (S[S.String = 0] = "String", S[S.Number = 1] = "Number", S[S.Boolean = 2] = "Boolean", S[S.Json = 3] = "Json", S[S.JsonArray = 4] = "JsonArray", S))(g || {});
 function We(S, a) {
   let e = S.split("."), t = a;
   for (let r in e) {
@@ -78,7 +78,7 @@ class L {
     u(this, "adminEditableFields", []);
     u(this, "normalizeUsername", !0);
     u(this, "normalizeEmail", !0);
-    w("userEditableFields", f.JsonArray, this, a, "USER_EDITABLE_FIELDS"), w("adminEditableFields", f.JsonArray, this, a, "ADMIN_EDITABLE_FIELDS"), w("normalizeUsername", f.JsonArray, this, a, "NORMALIZE_USERNAME"), w("normalizeEmail", f.JsonArray, this, a, "NORMALIZE_EMAIL");
+    w("userEditableFields", g.JsonArray, this, a, "USER_EDITABLE_FIELDS"), w("adminEditableFields", g.JsonArray, this, a, "ADMIN_EDITABLE_FIELDS"), w("normalizeUsername", g.JsonArray, this, a, "NORMALIZE_USERNAME"), w("normalizeEmail", g.JsonArray, this, a, "NORMALIZE_EMAIL");
   }
   /**
    * Creates a user with the given details and secrets.
@@ -345,7 +345,7 @@ class Z extends L {
     u(this, "includes", ["secrets"]);
     u(this, "includesObject", {});
     u(this, "forceIdToNumber", !0);
-    if (w("userTable", f.String, this, e, "USER_TABLE"), w("userSecretsTable", f.String, this, e, "USER_SECRETS_TABLE"), w("idColumn", f.String, this, e, "USER_ID_COLUMN"), w("useridForeignKeyColumn", f.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), w("includes", f.String, this, e, "USER_INCLUDES"), w("forceIdToNumber", f.String, this, e, "USER_FORCE_ID_TO_NUMBER"), this.includes.forEach((t) => {
+    if (w("userTable", g.String, this, e, "USER_TABLE"), w("userSecretsTable", g.String, this, e, "USER_SECRETS_TABLE"), w("idColumn", g.String, this, e, "USER_ID_COLUMN"), w("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), w("includes", g.String, this, e, "USER_INCLUDES"), w("forceIdToNumber", g.String, this, e, "USER_FORCE_ID_TO_NUMBER"), this.includes.forEach((t) => {
       this.includesObject[t] = !0;
     }), e && e.prismaClient)
       this.prismaClient = e.prismaClient;
@@ -468,7 +468,7 @@ class Z extends L {
           });
         } catch {
         }
-        let { userid: g, ...y } = d ?? {};
+        let { userid: f, ...y } = d ?? {};
         n = { ...y, ...n }, await c[this.userTable].update({
           where: {
             [this.idColumn]: e.id
@@ -610,7 +610,7 @@ class Ft extends z {
     u(this, "prismaClient");
     u(this, "transactionTimeout", 5e3);
     u(this, "useridForeignKeyColumn", "userid");
-    if (w("transactionTimeout", f.Number, this, e, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", f.Number, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.keyTable && (this.keyTable = e.keyTable), e.prismaClient == null) {
+    if (w("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", g.Number, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.keyTable && (this.keyTable = e.keyTable), e.prismaClient == null) {
       const t = `${process.env.DATABASE_URL}`, r = new de({ url: t });
       this.prismaClient = new ue({ adapter: r });
     } else
@@ -888,7 +888,7 @@ class Nt extends ye {
     u(this, "transactionTimeout", 5e3);
     u(this, "updateMode", "DeleteAndInsert");
     u(this, "useridForeignKeyColumn", "userid");
-    if (w("clientTable", f.String, this, e, "OAUTH_CLIENT_TABLE"), w("redirectUriTable", f.String, this, e, "OAUTH_REDIRECTURI_TABLE"), w("validFlowTable", f.String, this, e, "OAUTH_VALID_FLOW_TABLE"), w("transactionTimeout", f.Number, this, e, "TRANSACTION_TIMEOUT"), w("updateMode", f.String, this, e, "OAUTHCLIENT_UPDATE_MODE"), w("useridForeignKeyColumn", f.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null) {
+    if (w("clientTable", g.String, this, e, "OAUTH_CLIENT_TABLE"), w("redirectUriTable", g.String, this, e, "OAUTH_REDIRECTURI_TABLE"), w("validFlowTable", g.String, this, e, "OAUTH_VALID_FLOW_TABLE"), w("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), w("updateMode", g.String, this, e, "OAUTHCLIENT_UPDATE_MODE"), w("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null) {
       const t = `${process.env.DATABASE_URL}`, r = new de({ url: t });
       this.prismaClient = new ue({ adapter: r });
     } else
@@ -900,42 +900,43 @@ class Nt extends ye {
   async getClientByName(e, t) {
     return await this.getClientWithTransaction("client_name", e, this.prismaClient, !1, t);
   }
-  async getClientWithTransaction(e, t, r, i, s) {
-    const n = s == null && s !== null ? {} : { [this.useridForeignKeyColumn]: s };
+  async getClientWithTransaction(e, t, r, i, s, n = !0) {
+    const c = s == null && s !== null ? {} : { [this.useridForeignKeyColumn]: s };
     try {
       if (i) {
-        const c = await r[this.clientTable].findUniqueOrThrow({
+        const d = await r[this.clientTable].findUniqueOrThrow({
           where: {
             [e]: t,
-            ...n
+            ...c
           },
           include: { redirect_uri: !0, valid_flow: !0 }
-        }), d = c.redirect_uri, g = c.valid_flow;
-        let y = c[this.useridForeignKeyColumn];
-        return y === null && (y = void 0), this.useridForeignKeyColumn != "userid" && delete c[this.useridForeignKeyColumn], [{
-          ...c,
-          userid: y,
-          client_secret: c.client_secret ?? void 0,
-          redirect_uri: d.map((p) => p.uri),
-          valid_flow: g.map((p) => p.flow)
+        }), f = d.redirect_uri, y = d.valid_flow;
+        let C = d[this.useridForeignKeyColumn];
+        return C === null && (C = void 0), this.useridForeignKeyColumn != "userid" && delete d[this.useridForeignKeyColumn], [{
+          ...d,
+          userid: C,
+          client_secret: d.client_secret ?? void 0,
+          redirect_uri: f.map((v) => v.uri),
+          valid_flow: y.map((v) => v.flow)
         }];
       } else {
-        const c = await r[this.clientTable].findMany({
+        const d = await r[this.clientTable].findMany({
           where: {
             [e]: t,
-            ...n
+            ...c
           },
           include: { redirect_uri: !0, valid_flow: !0 }
         });
-        for (let d of c) {
-          const g = d.redirect_uri, y = d.valid_flow;
-          let p = d[this.useridForeignKeyColumn];
-          p == null && (p = void 0), d.userid = p, this.useridForeignKeyColumn != "userid" && delete d[this.useridForeignKeyColumn], d.client_secret = d.client_secret ?? void 0, d.redirect_uri = g.map((v) => v.uri), d.valid_flow = y.map((v) => v.flow);
+        for (let f of d) {
+          const y = f.redirect_uri, C = f.valid_flow;
+          let v = f[this.useridForeignKeyColumn];
+          v == null && (v = void 0), f.userid = v, this.useridForeignKeyColumn != "userid" && delete f[this.useridForeignKeyColumn], f.client_secret = f.client_secret ?? void 0, f.redirect_uri = y.map((p) => p.uri), f.valid_flow = C.map((p) => p.flow);
         }
-        return c;
+        return d;
       }
-    } catch (c) {
-      throw h.logger.debug(m({ err: c })), h.logger.error(m({ msg: "Invalid OAuth client", [e]: t, cerr: c })), new o(l.InvalidClientId);
+    } catch (d) {
+      if (!n) return [];
+      throw h.logger.debug(m({ err: d })), h.logger.error(m({ msg: "Invalid OAuth client", [e]: t, cerr: d })), new o(l.InvalidClientId);
     }
   }
   /**
@@ -948,7 +949,8 @@ class Nt extends ye {
     try {
       return this.prismaClient.$transaction(async (t) => {
         try {
-          throw await this.getClientWithTransaction("client_id", e.client_id, t, !0, e.userid), new o(l.ClientExists);
+          if ((await this.getClientWithTransaction("client_id", e.client_id, t, !0, e.userid, !1)).length > 0)
+            throw new o(l.ClientExists);
         } catch {
         }
         return await this.createClientWithTransaction(e, t);
@@ -1152,7 +1154,7 @@ class Dt extends pe {
     // PrismaClient;
     u(this, "transactionTimeout", 5e3);
     u(this, "useridForeignKeyColumn", "userid");
-    if (w("authorizationTable", f.String, this, e, "OAUTH_AUTHORIZATION_TABLE"), w("transactionTimeout", f.Number, this, e, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", f.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null) {
+    if (w("authorizationTable", g.String, this, e, "OAUTH_AUTHORIZATION_TABLE"), w("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null) {
       const t = `${process.env.DATABASE_URL}`, r = new de({ url: t });
       this.prismaClient = new ue({ adapter: r });
     } else
@@ -1650,7 +1652,7 @@ class le extends L {
     u(this, "ldapUserSearchBase", "");
     u(this, "ldapUsernameAttribute", "cn");
     u(this, "createUserFn", Xe);
-    this.localStorage = e, w("ldapUrls", f.JsonArray, this, t, "LDAP_URL", !0), w("ldapUserSearchBase", f.String, this, t, "LDAP_USER_SEARCH_BASE"), w("ldapUsernameAttribute", f.String, this, t, "LDAP_USENAME_ATTRIBUTE"), t.createUserFn && (this.createUserFn = t.createUserFn);
+    this.localStorage = e, w("ldapUrls", g.JsonArray, this, t, "LDAP_URL", !0), w("ldapUserSearchBase", g.String, this, t, "LDAP_USER_SEARCH_BASE"), w("ldapUsernameAttribute", g.String, this, t, "LDAP_USENAME_ATTRIBUTE"), t.createUserFn && (this.createUserFn = t.createUserFn);
   }
   /**
    * Authenticates the user in LDAP and, if valid, creates a user in local
@@ -1789,17 +1791,17 @@ class le extends L {
         t,
         n,
         function(c, d) {
-          let g;
+          let f;
           if (c) {
             s(c), e.unbind();
             return;
           }
           d.on("searchEntry", function(y) {
-            g = le.searchResultToUser(y.pojo);
+            f = le.searchResultToUser(y.pojo);
           }), d.on("error", function(y) {
             s(y), e.unbind();
           }), d.on("end", function(y) {
-            y.status != 0 ? s(new o(l.Connection, "LDAP  onnection failed")) : g ? i(g) : s(new o(l.UsernameOrPasswordInvalid)), e.unbind();
+            y.status != 0 ? s(new o(l.Connection, "LDAP  onnection failed")) : f ? i(f) : s(new o(l.UsernameOrPasswordInvalid)), e.unbind();
           });
         }
       );
@@ -1842,7 +1844,7 @@ class Y extends L {
     u(this, "useridForeignKeyColumn", "userid");
     u(this, "forceIdToNumber", !0);
     u(this, "dbPool");
-    this.dbPool = e, w("userTable", f.String, this, t, "USER_TABLE"), w("userSecretsTable", f.String, this, t, "USER_SECRETS_TABLE"), w("idColumn", f.String, this, t, "USER_ID_COLUMN"), w("forceIdToNumber", f.String, this, t, "USER_FORCE_ID_TO_NUMBER"), w("useridForeignKeyColumn", f.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN");
+    this.dbPool = e, w("userTable", g.String, this, t, "USER_TABLE"), w("userSecretsTable", g.String, this, t, "USER_SECRETS_TABLE"), w("idColumn", g.String, this, t, "USER_ID_COLUMN"), w("forceIdToNumber", g.String, this, t, "USER_FORCE_ID_TO_NUMBER"), w("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN");
   }
   /**
    * Returns user matching the given id, or throws an exception.  
@@ -1894,25 +1896,25 @@ class Y extends L {
     let i = await this.dbPool.connect(), s, n, c = this.dbPool.parameters();
     try {
       await i.startTransaction();
-      let d = `select * from ${this.userTable} where ${e} = ` + c.nextParameter(), g = await i.execute(d, [t]);
-      if (g.length == 0)
+      let d = `select * from ${this.userTable} where ${e} = ` + c.nextParameter(), f = await i.execute(d, [t]);
+      if (f.length == 0)
         throw new o(l.UserNotExist);
-      let y, p, v;
-      if (this.idColumn in g[0]) y = g[0][this.idColumn];
+      let y, C, v;
+      if (this.idColumn in f[0]) y = f[0][this.idColumn];
       else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
-      if ("username" in g[0]) p = g[0].username;
+      if ("username" in f[0]) C = f[0].username;
       else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
-      if ("state" in g[0]) v = g[0].state;
+      if ("state" in f[0]) v = f[0].state;
       else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
       if (s = {
-        ...g[0],
+        ...f[0],
         id: y,
-        username: p,
+        username: C,
         state: v
       }, !s) throw new o(l.UserNotExist);
-      if (c = this.dbPool.parameters(), d = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = ` + c.nextParameter(), g = await i.execute(d, [s.id]), g.length == 0)
+      if (c = this.dbPool.parameters(), d = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = ` + c.nextParameter(), f = await i.execute(d, [s.id]), f.length == 0)
         throw new o(l.UserNotExist);
-      if (g.length > 0 ? n = { userid: s.id, ...g[0] } : n = { userid: s.id }, !n) throw new o(l.UserNotExist);
+      if (f.length > 0 ? n = { userid: s.id, ...f[0] } : n = { userid: s.id }, !n) throw new o(l.UserNotExist);
       if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.awaitingTwoFactorSetup)
         throw h.logger.debug(m({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
       if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.disabled)
@@ -1943,28 +1945,28 @@ class Y extends L {
     let i = [], s = [], n = "", c = "", d = this.dbPool.parameters();
     e && (c = "OFFSET " + d.nextParameter()), t && (s.push(t), n = "LIMIT " + d.nextParameter());
     try {
-      let g = `select * from ${this.userTable} ${n} ${c} order by username_normalized asc`, y = await r.execute(g, s);
+      let f = `select * from ${this.userTable} ${n} ${c} order by username_normalized asc`, y = await r.execute(f, s);
       if (y.length == 0)
         throw new o(l.UserNotExist);
-      for (let p of y) {
-        let v, C, T;
-        if (this.idColumn in p) v = p[this.idColumn];
+      for (let C of y) {
+        let v, p, T;
+        if (this.idColumn in C) v = C[this.idColumn];
         else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
-        if ("username" in p) C = p.username;
+        if ("username" in C) p = C.username;
         else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
-        if ("state" in p) T = p.state;
+        if ("state" in C) T = C.state;
         else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
         let E = {
-          ...p,
+          ...C,
           id: v,
-          username: C,
+          username: p,
           state: T
         };
         i.push(E);
       }
       return i;
-    } catch (g) {
-      throw g;
+    } catch (f) {
+      throw f;
     } finally {
       r.release();
     }
@@ -1989,23 +1991,23 @@ class Y extends L {
         throw new o(l.UserNotExist);
       let c = { ...e }, d = t ? { ...t } : void 0;
       "email" in c && c.email && (c = { email_normalized: this.normalizeEmail ? Y.normalize(c.email) : c.email, ...c }), "username" in c && c.username && (c = { username_normalized: this.normalizeUsername ? Y.normalize(c.username) : c.username, ...c }), i = this.dbPool.parameters();
-      let g = [], y = [];
-      for (let p in c)
-        c[p] != null && p != "id" && (g.push(p + "= " + i.nextParameter()), y.push(c[p]));
-      if (g.length > 0) {
-        let p = g.join(", ");
+      let f = [], y = [];
+      for (let C in c)
+        c[C] != null && C != "id" && (f.push(C + "= " + i.nextParameter()), y.push(c[C]));
+      if (f.length > 0) {
+        let C = f.join(", ");
         y.push(e.id);
-        let v = `update ${this.userTable} set ${p} where ${this.idColumn} = ` + i.nextParameter();
+        let v = `update ${this.userTable} set ${C} where ${this.idColumn} = ` + i.nextParameter();
         await r.execute(v, y);
       }
       if (t) {
-        g = [], y = [], i = this.dbPool.parameters();
-        for (let p in d)
-          d[p] != null && p != "userid" && (g.push(p + "= " + i.nextParameter()), y.push(d[p]));
-        if (g.length > 0) {
-          let p = g.join(", ");
+        f = [], y = [], i = this.dbPool.parameters();
+        for (let C in d)
+          d[C] != null && C != "userid" && (f.push(C + "= " + i.nextParameter()), y.push(d[C]));
+        if (f.length > 0) {
+          let C = f.join(", ");
           y.push(e.id);
-          let v = `update ${this.userSecretsTable} set ${p} where userid = ` + i.nextParameter();
+          let v = `update ${this.userSecretsTable} set ${C} where userid = ` + i.nextParameter();
           await r.execute(v, y);
         }
       }
@@ -2034,27 +2036,27 @@ class Y extends L {
       await r.startTransaction();
       let s = { ...e }, n = t ? { ...t } : void 0;
       "email" in s && s.email && (s = { email_normalized: this.normalizeEmail ? Y.normalize(s.email) : s.email, ...s }), "username" in s && s.username && (s = { username_normalized: this.normalizeUsername ? Y.normalize(s.username) : s.username, ...s });
-      let c = [], d = [], g = [];
+      let c = [], d = [], f = [];
       const y = this.dbPool.parameters();
       for (let v in s)
-        s[v] != null && v != "id" && (c.push(v), d.push(y.nextParameter()), g.push(s[v]));
+        s[v] != null && v != "id" && (c.push(v), d.push(y.nextParameter()), f.push(s[v]));
       if (c.length > 0) {
-        let v = c.join(", "), C = d.join(", ");
-        const T = `insert into ${this.userTable} (${v}) values (${C}) returning ${this.idColumn}`, E = await r.execute(T, g);
+        let v = c.join(", "), p = d.join(", ");
+        const T = `insert into ${this.userTable} (${v}) values (${p}) returning ${this.idColumn}`, E = await r.execute(T, f);
         if (E.length == 0 || !E[0][this.idColumn]) throw new o(l.Connection, "Couldn't create user");
         i = E[0][this.idColumn];
       }
       if (!i) throw new o(l.Connection, "Couldn't create user");
       if (t) {
-        c = [], d = [], g = [];
+        c = [], d = [], f = [];
         const v = this.dbPool.parameters();
-        c.push("userid"), d.push(v.nextParameter()), g.push(i);
-        for (let C in n)
-          n[C] != null && C != "userid" && (c.push(C), d.push(v.nextParameter()), g.push(n[C]));
+        c.push("userid"), d.push(v.nextParameter()), f.push(i);
+        for (let p in n)
+          n[p] != null && p != "userid" && (c.push(p), d.push(v.nextParameter()), f.push(n[p]));
         if (c.length > 0) {
-          let C = c.join(", "), T = d.join(", ");
-          const E = `insert into ${this.userSecretsTable} (${C}) values (${T})`;
-          h.logger.debug(m({ msg: "Executing query", query: E })), await r.execute(E, g);
+          let p = c.join(", "), T = d.join(", ");
+          const E = `insert into ${this.userSecretsTable} (${p}) values (${T})`;
+          h.logger.debug(m({ msg: "Executing query", query: E })), await r.execute(E, f);
         }
       }
       return await r.commit(), (await this.getUserById(i)).user;
@@ -2113,7 +2115,7 @@ class Qe extends z {
     u(this, "keyTable", "keys");
     u(this, "dbPool");
     u(this, "useridForeignKeyColumn", "userid");
-    w("transactionTimeout", f.Number, this, t, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", f.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), t.keyTable && (this.keyTable = t.keyTable), this.dbPool = e;
+    w("transactionTimeout", g.Number, this, t, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), t.keyTable && (this.keyTable = t.keyTable), this.dbPool = e;
   }
   async getKey(e) {
     const t = await this.dbPool.connect();
@@ -2160,17 +2162,17 @@ class Qe extends z {
    * @throws {@link @crossauth/common!CrossauthError } if the key could not be stored.
    */
   async saveKey(e, t, r, i, s, n = {}) {
-    let c, d = [this.useridForeignKeyColumn, "value", "created", "expires", "data"], g = this.dbPool.parameters(), y = [];
+    let c, d = [this.useridForeignKeyColumn, "value", "created", "expires", "data"], f = this.dbPool.parameters(), y = [];
     for (let E = 0; E < 5; ++E)
-      y.push(g.nextParameter());
-    let p = [e ?? null, t, r, i ?? null, s ?? ""];
+      y.push(f.nextParameter());
+    let C = [e ?? null, t, r, i ?? null, s ?? ""];
     for (let E in n)
-      d.push(E), y.push(g.nextParameter()), p.push(n[E]);
-    let v = d.join(", "), C = y.join(", ");
+      d.push(E), y.push(f.nextParameter()), C.push(n[E]);
+    let v = d.join(", "), p = y.join(", ");
     const T = await this.dbPool.connect();
     try {
-      const E = `insert into ${this.keyTable} (${v}) values (${C})`;
-      await T.execute(E, p);
+      const E = `insert into ${this.keyTable} (${v}) values (${p})`;
+      await T.execute(E, C);
     } catch (E) {
       o.asCrossauthError(E).code == l.ConstraintViolation ? (h.logger.warn(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), h.logger.debug(m({ err: E })), c = new o(l.KeyExists)) : (h.logger.debug(m({ err: E })), c = new o(l.Connection, "Error saving key"));
     } finally {
@@ -2193,11 +2195,11 @@ class Qe extends z {
     try {
       let s, n = [], c = "", d = this.dbPool.parameters();
       if (e) {
-        const g = d.nextParameter(), y = d.nextParameter();
-        s = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${g} and value like ${y} `, n = [e];
+        const f = d.nextParameter(), y = d.nextParameter();
+        s = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} = ${f} and value like ${y} `, n = [e];
       } else {
-        const g = d.nextParameter();
-        s = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} is null and value like ${g}`;
+        const f = d.nextParameter();
+        s = `delete from ${this.keyTable} where ${this.useridForeignKeyColumn} is null and value like ${f}`;
       }
       n.push(t + "%"), r && (c = "and value != " + d.nextParameter(), n.push(r)), s += " " + c, h.logger.debug(m({ msg: "Executing query", query: s })), await i.execute(s, n);
     } catch (s) {
@@ -2212,8 +2214,8 @@ class Qe extends z {
       let r = [], i = [];
       const s = this.dbPool.parameters();
       for (let d in e) {
-        let g = d == "userid" ? this.useridForeignKeyColumn : d;
-        e[d] == null ? r.push(g + " is null") : (r.push(g + " = " + s.nextParameter()), i.push(e[d]));
+        let f = d == "userid" ? this.useridForeignKeyColumn : d;
+        e[d] == null ? r.push(f + " is null") : (r.push(f + " = " + s.nextParameter()), i.push(e[d]));
       }
       let n = r.join(" and "), c = `delete from ${this.keyTable} where ${n}`;
       await t.execute(c, i);
@@ -2252,8 +2254,8 @@ class Qe extends z {
       if (c.length == 0)
         return [];
       for (let d of c) {
-        let g = this.makeKey(d);
-        this.useridForeignKeyColumn != "userid" && (g.userid = g[this.useridForeignKeyColumn], delete g[this.useridForeignKeyColumn]), r.push(g);
+        let f = this.makeKey(d);
+        this.useridForeignKeyColumn != "userid" && (f.userid = f[this.useridForeignKeyColumn], delete f[this.useridForeignKeyColumn]), r.push(f);
       }
       return r;
     } catch (r) {
@@ -2365,7 +2367,7 @@ class et extends ye {
     u(this, "validFlowTable", "oauthclientvalidflow");
     u(this, "dbPool");
     u(this, "useridForeignKeyColumn", "userid");
-    w("clientTable", f.String, this, t, "OAUTH_CLIENT_TABLE"), w("redirectUriTable", f.String, this, t, "OAUTH_REDIRECTURI_TABLE"), w("validFlowTable", f.String, this, t, "OAUTH_VALID_FLOW_TABLE"), w("updateMode", f.String, this, t, "OAUTHCLIENT_UPDATE_MODE"), w("useridForeignKeyColumn", f.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), this.dbPool = e;
+    w("clientTable", g.String, this, t, "OAUTH_CLIENT_TABLE"), w("redirectUriTable", g.String, this, t, "OAUTH_REDIRECTURI_TABLE"), w("validFlowTable", g.String, this, t, "OAUTH_VALID_FLOW_TABLE"), w("updateMode", g.String, this, t, "OAUTHCLIENT_UPDATE_MODE"), w("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), this.dbPool = e;
   }
   async getClientById(e) {
     let t = await this.dbPool.connect();
@@ -2408,12 +2410,12 @@ class et extends ye {
     };
   }
   async getClientWithTransaction(e, t, r, i, s, n) {
-    let c = [], d = this.dbPool.parameters(), g = [], y = `select c.*, r.uri as uri, null as flow from ${this.clientTable} as c left join ${this.redirectUriTable} r on c.client_id = r.client_id `, p = "";
-    t && r && (p = `where c.${t} = ` + d.nextParameter(), g.push(r)), i !== null && i == null || (p == "" ? p = "where " : p += " and ", i == null ? p += "userid is null" : (p += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), g.push(i)));
-    let v = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, C = "";
-    t && r && (C = `where c.${t} = ` + d.nextParameter(), g.push(r)), i !== null && i == null || (C == "" ? C = "where " : C += " and ", i == null ? C += "userid is null" : (C += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), g.push(i))), n && (s || (s = 0), s = Number(s), n = Number(n), p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`, C == "" ? C = "where " : C += " and ", C += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`), y += p, v += C;
+    let c = [], d = this.dbPool.parameters(), f = [], y = `select c.*, r.uri as uri, null as flow from ${this.clientTable} as c left join ${this.redirectUriTable} r on c.client_id = r.client_id `, C = "";
+    t && r && (C = `where c.${t} = ` + d.nextParameter(), f.push(r)), i !== null && i == null || (C == "" ? C = "where " : C += " and ", i == null ? C += "userid is null" : (C += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), f.push(i)));
+    let v = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, p = "";
+    t && r && (p = `where c.${t} = ` + d.nextParameter(), f.push(r)), i !== null && i == null || (p == "" ? p = "where " : p += " and ", i == null ? p += "userid is null" : (p += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), f.push(i))), n && (s || (s = 0), s = Number(s), n = Number(n), C == "" ? C = "where " : C += " and ", C += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`, p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`), y += C, v += p;
     let T = y + " union " + v + " order by client_id";
-    const E = await e.execute(T, g);
+    const E = await e.execute(T, f);
     let A;
     for (let j of E)
       (!A || j.client_id != A.client_id) && (A && c.push(A), A = this.makeClient(j), A.valid_flow = [], A.redirect_uri = []), j.uri && A.redirect_uri.push(j.uri), j.flow && A.valid_flow.push(j.flow);
@@ -2441,45 +2443,45 @@ class et extends ye {
   async createClientWithTransaction(e, t) {
     const { redirect_uri: r, valid_flow: i, userid: s, ...n } = t;
     if (s && (n[this.useridForeignKeyColumn] = s), r)
-      for (let C = 0; C < r.length; ++C) {
-        if (r[C].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
+      for (let p = 0; p < r.length; ++p) {
+        if (r[p].includes("#")) throw new o(l.InvalidRedirectUri, "Redirect Uri's may not contain page fragments");
         try {
-          new URL(r[C]);
+          new URL(r[p]);
         } catch {
-          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[C]} is not valid`);
+          throw new o(l.InvalidRedirectUri, `Redriect uri ${r[p]} is not valid`);
         }
       }
     if (i) {
-      for (let C = 0; C < i.length; ++C)
-        if (!U.isValidFlow(i[C])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[C]);
+      for (let p = 0; p < i.length; ++p)
+        if (!U.isValidFlow(i[p])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[p]);
     }
-    let c = [], d = [], g = [], y = this.dbPool.parameters();
+    let c = [], d = [], f = [], y = this.dbPool.parameters();
     try {
-      for (let C in n)
-        c.push(C), d.push(y.nextParameter()), g.push(n[C]);
+      for (let p in n)
+        c.push(p), d.push(y.nextParameter()), f.push(n[p]);
       if (c.length > 0) {
-        let C = c.join(", "), T = d.join(", ");
-        const E = `insert into ${this.clientTable} (${C}) values (${T})`;
-        await e.execute(E, g);
+        let p = c.join(", "), T = d.join(", ");
+        const E = `insert into ${this.clientTable} (${p}) values (${T})`;
+        await e.execute(E, f);
       }
-    } catch (C) {
-      throw typeof C == "object" && C != null && "code" in C && typeof C.code == "string" && (C.code.startsWith("22") || C.code.startsWith("23")) ? (h.logger.debug(m({ err: C })), new o(l.InvalidClientId, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (h.logger.debug(m({ err: C })), new o(l.Connection, "Error saving OAuth client"));
+    } catch (p) {
+      throw typeof p == "object" && p != null && "code" in p && typeof p.code == "string" && (p.code.startsWith("22") || p.code.startsWith("23")) ? (h.logger.debug(m({ err: p })), new o(l.InvalidClientId, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (h.logger.debug(m({ err: p })), new o(l.Connection, "Error saving OAuth client"));
     }
-    let p = await this.getClientWithTransaction(e, "client_id", t.client_id, t.userid);
-    if (p.length == 0)
+    let C = await this.getClientWithTransaction(e, "client_id", t.client_id, t.userid);
+    if (C.length == 0)
       throw h.logger.error(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), new o(l.KeyExists);
-    let v = p[0];
+    let v = C[0];
     if (r)
-      for (let C = 0; C < r.length; ++C) {
-        g = [], y = this.dbPool.parameters();
+      for (let p = 0; p < r.length; ++p) {
+        f = [], y = this.dbPool.parameters();
         let T = `insert into ${this.redirectUriTable} (client_id, uri) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        g.push(v.client_id), g.push(r[C]), await e.execute(T, g);
+        f.push(v.client_id), f.push(r[p]), await e.execute(T, f);
       }
     if (i)
-      for (let C = 0; C < i.length; ++C) {
-        g = [], y = this.dbPool.parameters();
+      for (let p = 0; p < i.length; ++p) {
+        f = [], y = this.dbPool.parameters();
         let T = `insert into ${this.validFlowTable} (client_id, flow) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        g.push(v.client_id), g.push(i[C]), await e.execute(T, g);
+        f.push(v.client_id), f.push(i[p]), await e.execute(T, f);
       }
     return { ...v, redirect_uri: r, valid_flow: i };
   }
@@ -2541,27 +2543,27 @@ class et extends ye {
     if (!t.client_id) throw new o(l.InvalidClientId, "No client ig given");
     let { client_id: s, redirect_uri: n, valid_flow: c, ...d } = t;
     n || (n = []), c || (c = []);
-    let g = this.dbPool.parameters(), y = `delete from ${this.redirectUriTable} where client_id = ` + g.nextParameter();
-    await e.execute(y, [t.client_id]), g = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + g.nextParameter(), await e.execute(y, [t.client_id]);
-    let p = [], v = [], C = [];
-    g = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + g.nextParameter();
+    let f = this.dbPool.parameters(), y = `delete from ${this.redirectUriTable} where client_id = ` + f.nextParameter();
+    await e.execute(y, [t.client_id]), f = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + f.nextParameter(), await e.execute(y, [t.client_id]);
+    let C = [], v = [], p = [];
+    f = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + f.nextParameter();
     for (let T in d)
-      p.push(T), v.push(g.nextParameter()), C.push(d[T]);
-    if (p.length > 0) {
-      let T = p.join(", "), E = v.join(", ");
-      y = `update ${this.clientTable} set (${T}) values (${E})`, await e.execute(y, C);
+      C.push(T), v.push(f.nextParameter()), p.push(d[T]);
+    if (C.length > 0) {
+      let T = C.join(", "), E = v.join(", ");
+      y = `update ${this.clientTable} set (${T}) values (${E})`, await e.execute(y, p);
     }
     if (n)
       for (let T = 0; T < n.length; ++T) {
-        C = [], g = this.dbPool.parameters();
-        let E = `insert into ${this.redirectUriTable} (client_id, uri) values (` + g.nextParameter() + ", " + g.nextParameter() + ")";
-        C.push(t.client_id), C.push(n[T]), await e.execute(E, C);
+        p = [], f = this.dbPool.parameters();
+        let E = `insert into ${this.redirectUriTable} (client_id, uri) values (` + f.nextParameter() + ", " + f.nextParameter() + ")";
+        p.push(t.client_id), p.push(n[T]), await e.execute(E, p);
       }
     if (c)
       for (let T = 0; T < c.length; ++T) {
-        C = [], g = this.dbPool.parameters();
-        let E = `insert into ${this.validFlowTable} (client_id, flow) values (` + g.nextParameter() + ", " + g.nextParameter() + ")";
-        C.push(t.client_id), C.push(c[T]), await e.execute(E, C);
+        p = [], f = this.dbPool.parameters();
+        let E = `insert into ${this.validFlowTable} (client_id, flow) values (` + f.nextParameter() + ", " + f.nextParameter() + ")";
+        p.push(t.client_id), p.push(c[T]), await e.execute(E, p);
       }
   }
   async getClients(e, t, r) {
@@ -2588,14 +2590,14 @@ class tt extends pe {
     u(this, "authorizationTable", "oauthauthorization");
     u(this, "useridForeignKeyColumn", "userid");
     u(this, "dbPool");
-    w("authorizationTable", f.String, this, t, "OAUTH_CLIENT_TABLE"), w("useridForeignKeyColumn", f.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), this.dbPool = e;
+    w("authorizationTable", g.String, this, t, "OAUTH_CLIENT_TABLE"), w("useridForeignKeyColumn", g.String, this, t, "USER_ID_FOREIGN_KEY_COLUMN"), this.dbPool = e;
   }
   async getAuthorizations(e, t) {
     let r = await this.dbPool.connect();
     try {
       const i = this.dbPool.parameters(), s = [];
       let n = `select scope from ${this.authorizationTable} where client_id = ` + i.nextParameter();
-      return s.push(e), t === null ? n += ` and ${this.useridForeignKeyColumn} is null` : t && (n += ` and ${this.useridForeignKeyColumn} = ` + i.nextParameter(), s.push(t)), (await r.execute(n, s)).map((g) => g.scope);
+      return s.push(e), t === null ? n += ` and ${this.useridForeignKeyColumn} is null` : t && (n += ` and ${this.useridForeignKeyColumn} = ` + i.nextParameter(), s.push(t)), (await r.execute(n, s)).map((f) => f.scope);
     } catch (i) {
       throw i;
     } finally {
@@ -2918,21 +2920,21 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
     t || (t = q.randomSalt());
     let s = r != null, n = s ? t + "!" + r : t;
     i == null && (i = !1);
-    let g = (await He(ze)(
+    let f = (await He(ze)(
       a,
       n,
       e.iterations ?? _e,
       e.keyLen ?? ke,
       e.digest ?? ve
     )).toString("base64url");
-    return i && (g = this.encodePasswordHash(
-      g,
+    return i && (f = this.encodePasswordHash(
+      f,
       t,
       s,
       e.iterations ?? _e,
       e.keyLen ?? ke,
       e.digest ?? ve
-    )), g;
+    )), f;
   }
   /**
    * For creating non-JWT tokens (eg password reset tokens.)  The
@@ -3092,7 +3094,7 @@ const ce = class ce extends Ie {
     u(this, "pbkdf2KeyLength", 32);
     /** See {@link LocalPasswordAuthenticatorOptions.validatePasswordFn}  */
     u(this, "validatePasswordFn", lt);
-    w("secret", f.String, this, t, "HASHER_SECRET"), w("enableSecretForPasswordHash", f.Boolean, this, t, "ENABLE_SECRET_FOR_PASSWORDS"), w("pbkdf2Digest", f.String, this, t, "PASSWORD_PBKDF2_DIGEST"), w("pbkdf2Iterations", f.String, this, t, "PASSWORD_PBKDF2_ITERATIONS"), w("pbkdf2SaltLength", f.String, this, t, "PASSWORD_PBKDF2_SALTLENGTH"), w("pbkdf2KeyLength", f.String, this, t, "PASSWORD_PBKDF2_KEYLENGTH"), t.validatePasswordFn && (this.validatePasswordFn = t.validatePasswordFn);
+    w("secret", g.String, this, t, "HASHER_SECRET"), w("enableSecretForPasswordHash", g.Boolean, this, t, "ENABLE_SECRET_FOR_PASSWORDS"), w("pbkdf2Digest", g.String, this, t, "PASSWORD_PBKDF2_DIGEST"), w("pbkdf2Iterations", g.String, this, t, "PASSWORD_PBKDF2_ITERATIONS"), w("pbkdf2SaltLength", g.String, this, t, "PASSWORD_PBKDF2_SALTLENGTH"), w("pbkdf2KeyLength", g.String, this, t, "PASSWORD_PBKDF2_KEYLENGTH"), t.validatePasswordFn && (this.validatePasswordFn = t.validatePasswordFn);
   }
   /**
    * Authenticates the user, returning a the user as a {@link User} object.
@@ -3246,7 +3248,7 @@ class X extends ae {
     u(this, "smtpPassword");
     u(this, "emailAuthenticatorTokenExpires", 60 * 5);
     u(this, "render");
-    w("views", f.String, this, e, "VIEWS"), w("emailAuthenticatorTextBody", f.String, this, e, "EMAIL_AUTHENTICATOR_TEXT_BODY"), w("emailAuthenticatorHtmlBody", f.String, this, e, "EMAIL_AUTHENTICATOR_HTML_BODY"), w("emailAuthenticatorSubject", f.String, this, e, "EMAIL_AUTHENTICATOR_SUBJECT"), w("emailFrom", f.String, this, e, "EMAIL_FROM", !0), w("smtpHost", f.String, this, e, "SMTP_HOST", !0), w("smtpPort", f.Number, this, e, "SMTP_PORT"), w("smtpUsername", f.String, this, e, "SMTP_USERNAME"), w("smtpPassword", f.String, this, e, "SMTP_PASSWORD"), w("smtpUseTls", f.Boolean, this, e, "SMTP_USE_TLS"), w("emailAuthenticatorTokenExpires", f.Number, this, e, "EMAIL_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
+    w("views", g.String, this, e, "VIEWS"), w("emailAuthenticatorTextBody", g.String, this, e, "EMAIL_AUTHENTICATOR_TEXT_BODY"), w("emailAuthenticatorHtmlBody", g.String, this, e, "EMAIL_AUTHENTICATOR_HTML_BODY"), w("emailAuthenticatorSubject", g.String, this, e, "EMAIL_AUTHENTICATOR_SUBJECT"), w("emailFrom", g.String, this, e, "EMAIL_FROM", !0), w("smtpHost", g.String, this, e, "SMTP_HOST", !0), w("smtpPort", g.Number, this, e, "SMTP_PORT"), w("smtpUsername", g.String, this, e, "SMTP_USERNAME"), w("smtpPassword", g.String, this, e, "SMTP_PASSWORD"), w("smtpUseTls", g.Boolean, this, e, "SMTP_USE_TLS"), w("emailAuthenticatorTokenExpires", g.Number, this, e, "EMAIL_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
   }
   /**
    * Used by the OAuth password_mfa grant type.
@@ -3455,7 +3457,7 @@ class ee extends ae {
     u(this, "smsAuthenticatorFrom", "");
     u(this, "smsAuthenticatorTokenExpires", 60 * 5);
     u(this, "render");
-    w("views", f.String, this, e, "VIEWS"), w("smsAuthenticatorBody", f.String, this, e, "SMS_AUTHENTICATOR_BODY"), w("smsAuthenticatorFrom", f.String, this, e, "SMS_AUTHENTICATOR_FROM", !0), w("smsAuthenticatorTokenExpires", f.Number, this, e, "SMS_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
+    w("views", g.String, this, e, "VIEWS"), w("smsAuthenticatorBody", g.String, this, e, "SMS_AUTHENTICATOR_BODY"), w("smsAuthenticatorFrom", g.String, this, e, "SMS_AUTHENTICATOR_FROM", !0), w("smsAuthenticatorTokenExpires", g.Number, this, e, "SMS_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
   }
   /**
    * Used by the OAuth password_mfa grant type.
@@ -3496,7 +3498,7 @@ class ee extends ae {
       otp: t
     };
     let d = { otp: t };
-    const g = this.render ? this.render(this.smsAuthenticatorBody, d) : W.render(this.smsAuthenticatorBody, d), y = this.sendSms(r, g);
+    const f = this.render ? this.render(this.smsAuthenticatorBody, d) : W.render(this.smsAuthenticatorBody, d), y = this.sendSms(r, f);
     return h.logger.info(m({
       msg: "Sent factor otp sms",
       smsMessageId: y,
@@ -3847,7 +3849,7 @@ class $t extends Ie {
     u(this, "ldapAutoCreateAccount", !1);
     u(this, "ldapStorage");
     u(this, "ldapAutoCreateFactor1", "ldap");
-    w("ldapAutoCreateAccount", f.Boolean, this, t, "LDAP_AUTO_CREATE_ACCOUNT"), w("ldapAutoCreateFactor1", f.Boolean, this, t, "LDAP_AUTO_CREATE_FACTOR1"), this.ldapStorage = e;
+    w("ldapAutoCreateAccount", g.Boolean, this, t, "LDAP_AUTO_CREATE_ACCOUNT"), w("ldapAutoCreateFactor1", g.Boolean, this, t, "LDAP_AUTO_CREATE_FACTOR1"), this.ldapStorage = e;
   }
   /**
    * Authenticates the user, returning a the user as a {@link User} object.
@@ -4148,7 +4150,7 @@ class D {
     u(this, "verifyEmailExpires", 60 * 60 * 24);
     u(this, "passwordResetExpires", 60 * 60 * 24);
     u(this, "render");
-    this.userStorage = a, this.keyStorage = e, w("siteUrl", f.String, this, t, "SITE_URL", !0), w("prefix", f.String, this, t, "PREFIX"), w("views", f.String, this, t, "VIEWS"), w("emailVerificationTextBody", f.String, this, t, "EMAIL_VERIFICATION_TEXT_BODY"), w("emailVerificationHtmlBody", f.String, this, t, "EMAIL_VERIFICATION_HTML_BODY"), w("emailVerificationSubject", f.String, this, t, "EMAIL_VERIFICATION_SUBJECT"), w("passwordResetTextBody", f.String, this, t, "PASSWORD_RESET_TEXT_BODY"), w("passwordResetHtmlBody", f.String, this, t, "PASSWORD_RESET_HTML_BODY"), w("passwordResetSubject", f.String, this, t, "PASSWORD_RESET_SUBJECT"), w("emailFrom", f.String, this, t, "EMAIL_FROM", !0), w("smtpHost", f.String, this, t, "SMTP_HOST", !0), w("smtpPort", f.Number, this, t, "SMTP_PORT"), w("smtpUsername", f.String, this, t, "SMTP_USERNAME"), w("smtpPassword", f.String, this, t, "SMTP_PASSWORD"), w("smtpUseTls", f.Boolean, this, t, "SMTP_USE_TLS"), w("verifyEmailExpires", f.Boolean, this, t, "VERIFY_EMAIL_EXPIRES"), w("passwordResetExpires", f.String, this, t, "PASSWORD_RESET_EXPIRES"), t.render ? this.render = t.render : W.configure(this.views, { autoescape: !0 });
+    this.userStorage = a, this.keyStorage = e, w("siteUrl", g.String, this, t, "SITE_URL", !0), w("prefix", g.String, this, t, "PREFIX"), w("views", g.String, this, t, "VIEWS"), w("emailVerificationTextBody", g.String, this, t, "EMAIL_VERIFICATION_TEXT_BODY"), w("emailVerificationHtmlBody", g.String, this, t, "EMAIL_VERIFICATION_HTML_BODY"), w("emailVerificationSubject", g.String, this, t, "EMAIL_VERIFICATION_SUBJECT"), w("passwordResetTextBody", g.String, this, t, "PASSWORD_RESET_TEXT_BODY"), w("passwordResetHtmlBody", g.String, this, t, "PASSWORD_RESET_HTML_BODY"), w("passwordResetSubject", g.String, this, t, "PASSWORD_RESET_SUBJECT"), w("emailFrom", g.String, this, t, "EMAIL_FROM", !0), w("smtpHost", g.String, this, t, "SMTP_HOST", !0), w("smtpPort", g.Number, this, t, "SMTP_PORT"), w("smtpUsername", g.String, this, t, "SMTP_USERNAME"), w("smtpPassword", g.String, this, t, "SMTP_PASSWORD"), w("smtpUseTls", g.Boolean, this, t, "SMTP_USE_TLS"), w("verifyEmailExpires", g.Boolean, this, t, "VERIFY_EMAIL_EXPIRES"), w("passwordResetExpires", g.String, this, t, "PASSWORD_RESET_EXPIRES"), t.render ? this.render = t.render : W.configure(this.views, { autoescape: !0 });
   }
   createEmailer() {
     let a = {};
@@ -4392,7 +4394,7 @@ class ct {
     u(this, "sameSite", "lax");
     // hasher settings
     u(this, "secret", "");
-    w("headerName", f.String, this, a, "CSRF_HEADER_NAME"), w("cookieName", f.String, this, a, "CSRF_COOKIE_NAME"), w("domain", f.String, this, a, "CSRF_COOKIE_DOMAIN"), w("httpOnly", f.Boolean, this, a, "CSRF_COOKIE_HTTPONLY"), w("path", f.String, this, a, "CSRF_COOKIE_PATH"), w("secure", f.Boolean, this, a, "CSRF_COOKIE_SECURE"), w("sameSite", f.String, this, a, "CSRF_COOKIE_SAMESITE"), w("secret", f.String, this, a, "SECRET", !0);
+    w("headerName", g.String, this, a, "CSRF_HEADER_NAME"), w("cookieName", g.String, this, a, "CSRF_COOKIE_NAME"), w("domain", g.String, this, a, "CSRF_COOKIE_DOMAIN"), w("httpOnly", g.Boolean, this, a, "CSRF_COOKIE_HTTPONLY"), w("path", g.String, this, a, "CSRF_COOKIE_PATH"), w("secure", g.Boolean, this, a, "CSRF_COOKIE_SECURE"), w("sameSite", g.String, this, a, "CSRF_COOKIE_SAMESITE"), w("secret", g.String, this, a, "SECRET", !0);
   }
   /**
    * Creates a session key and saves in storage
@@ -4514,7 +4516,7 @@ class x {
     u(this, "sameSite", "lax");
     // hasher settings
     u(this, "secret", "");
-    e.userStorage && (this.userStorage = e.userStorage), this.keyStorage = a, w("idleTimeout", f.Number, this, e, "SESSION_IDLE_TIMEOUT"), w("persist", f.Boolean, this, e, "PERSIST_SESSION_ID"), this.filterFunction = e.filterFunction, w("cookieName", f.String, this, e, "SESSION_COOKIE_NAME"), w("maxAge", f.String, this, e, "SESSION_COOKIE_MAX_AGE"), w("domain", f.String, this, e, "SESSION_COOKIE_DOMAIN"), w("httpOnly", f.Boolean, this, e, "SESSIONCOOKIE_HTTPONLY"), w("path", f.String, this, e, "SESSION_COOKIE_PATH"), w("secure", f.Boolean, this, e, "SESSION_COOKIE_SECURE"), w("sameSite", f.String, this, e, "SESSION_COOKIE_SAMESITE"), w("secret", f.String, this, e, "SECRET", !0);
+    e.userStorage && (this.userStorage = e.userStorage), this.keyStorage = a, w("idleTimeout", g.Number, this, e, "SESSION_IDLE_TIMEOUT"), w("persist", g.Boolean, this, e, "PERSIST_SESSION_ID"), this.filterFunction = e.filterFunction, w("cookieName", g.String, this, e, "SESSION_COOKIE_NAME"), w("maxAge", g.String, this, e, "SESSION_COOKIE_MAX_AGE"), w("domain", g.String, this, e, "SESSION_COOKIE_DOMAIN"), w("httpOnly", g.Boolean, this, e, "SESSIONCOOKIE_HTTPONLY"), w("path", g.String, this, e, "SESSION_COOKIE_PATH"), w("secure", g.Boolean, this, e, "SESSION_COOKIE_SECURE"), w("sameSite", g.String, this, e, "SESSION_COOKIE_SAMESITE"), w("secret", g.String, this, e, "SECRET", !0);
   }
   expiry(a) {
     let e;
@@ -4554,13 +4556,13 @@ class x {
       const d = x.hashSessionId(i);
       try {
         this.idleTimeout > 0 && a && (e = { ...e, lastActivity: /* @__PURE__ */ new Date() }), await this.keyStorage.saveKey(a, d, s, n, void 0, e), c = !0;
-      } catch (g) {
-        let y = o.asCrossauthError(g);
+      } catch (f) {
+        let y = o.asCrossauthError(f);
         if (y.code == l.KeyExists || y.code == l.InvalidKey) {
           if (r++, i = _.randomValue(Ue), r > 10)
             throw h.logger.error(m({ msg: "Max attempts exceeded trying to create session ID" })), new o(l.KeyExists);
         } else
-          throw h.logger.debug(m({ err: g })), g;
+          throw h.logger.debug(m({ err: f })), f;
       }
     }
     return {
@@ -4695,7 +4697,7 @@ class Jt {
     t.userStorage && (this.userStorage = t.userStorage), this.keyStorage = a, this.authenticators = e;
     for (let r in this.authenticators)
       this.authenticators[r].factorName = r;
-    if (this.session = new x(this.keyStorage, { ...t == null ? void 0 : t.sessionCookieOptions, ...t ?? {} }), this.csrfTokens = new ct({ ...t == null ? void 0 : t.doubleSubmitCookieOptions, ...t ?? {} }), w("allowedFactor2", f.JsonArray, this, t, "ALLOWED_FACTOR2"), w("enableEmailVerification", f.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), w("enablePasswordReset", f.Boolean, this, t, "ENABLE_PASSWORD_RESET"), this.emailTokenStorage = this.keyStorage, this.userStorage && (this.enableEmailVerification || this.enablePasswordReset)) {
+    if (this.session = new x(this.keyStorage, { ...t == null ? void 0 : t.sessionCookieOptions, ...t ?? {} }), this.csrfTokens = new ct({ ...t == null ? void 0 : t.doubleSubmitCookieOptions, ...t ?? {} }), w("allowedFactor2", g.JsonArray, this, t, "ALLOWED_FACTOR2"), w("enableEmailVerification", g.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), w("enablePasswordReset", g.Boolean, this, t, "ENABLE_PASSWORD_RESET"), this.emailTokenStorage = this.keyStorage, this.userStorage && (this.enableEmailVerification || this.enablePasswordReset)) {
       let r = this.keyStorage;
       t.emailTokenStorage && (this.emailTokenStorage = t.emailTokenStorage), this.tokenEmailer = new D(this.userStorage, r, t);
     }
@@ -4768,8 +4770,8 @@ class Jt {
       }
       if (v.username == "") throw new o(l.UserNotExist);
       await this.authenticators[(i == null ? void 0 : i.factor1) ?? c].authenticateUser(v, n, e);
-      let C = await this.userStorage.getUserByUsername(a, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
-      n = C.secrets, i = C.user;
+      let p = await this.userStorage.getUserByUsername(a, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
+      n = p.secrets, i = p.user;
     }
     let d;
     if (i.state == k.passwordChangeNeeded)
@@ -4783,7 +4785,7 @@ class Jt {
       const v = await this.session.createSessionKey(i.id, t);
       d = this.session.makeCookie(v, r);
     }
-    const g = this.csrfTokens.createCsrfToken(), y = this.csrfTokens.makeCsrfCookie(g), p = this.csrfTokens.makeCsrfFormOrHeaderToken(g);
+    const f = this.csrfTokens.createCsrfToken(), y = this.csrfTokens.makeCsrfCookie(f), C = this.csrfTokens.makeCsrfFormOrHeaderToken(f);
     try {
       this.emailTokenStorage.deleteAllForUser(
         i.id,
@@ -4795,7 +4797,7 @@ class Jt {
     return {
       sessionCookie: d,
       csrfCookie: y,
-      csrfFormOrHeaderValue: p,
+      csrfFormOrHeaderValue: C,
       user: i,
       secrets: n
     };
@@ -5109,10 +5111,10 @@ class Jt {
    */
   async repeatTwoFactorSignup(a) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call repeatTwoFactorSignup if no user storage provided");
-    const e = (await this.dataForSessionId(a))["2fa"], t = e.username, r = e.factor2, i = x.hashSessionId(a), s = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, s), d = c == null ? {} : c.userData, g = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
+    const e = (await this.dataForSessionId(a))["2fa"], t = e.username, r = e.factor2, i = x.hashSessionId(a), s = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, s), d = c == null ? {} : c.userData, f = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
     y && await this.keyStorage.updateData(i, "2fa", y);
-    const { user: p } = await this.userStorage.getUserByUsername(t, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
-    return { userid: p.id, userData: d, secrets: g };
+    const { user: C } = await this.userStorage.getUserByUsername(t, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
+    return { userid: C.id, userData: d, secrets: f };
   }
   /**
    * Authenticates with the second factor.  
@@ -5125,7 +5127,7 @@ class Jt {
    * @throws {@link @crossauth/common!CrossauthError} if authentication fails.
    */
   async completeTwoFactorSetup(a, e) {
-    var p;
+    var C;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call completeTwoFactorSetup if no user storage provided");
     let { user: t, key: r } = await this.session.getUserForSessionId(e, {
       skipActiveCheck: !0
@@ -5142,14 +5144,14 @@ class Jt {
     for (let v in i)
       d.includes(v) && (c[v] = i[v]);
     if (await n.authenticateUser(void 0, i, a), t || (t = (await this.userStorage.getUserByUsername(s, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).user), !t) throw new o(l.UserNotExist, "Couldn't fetch user");
-    let g = k.active;
-    t.state == k.awaitingTwoFactorSetupAndEmailVerification && (g = k.awaitingEmailVerification);
+    let f = k.active;
+    t.state == k.awaitingTwoFactorSetupAndEmailVerification && (f = k.awaitingEmailVerification);
     const y = {
       id: t.id,
-      state: g,
+      state: f,
       factor2: i.factor2
     };
-    return n.secretNames().length > 0 ? await this.userStorage.updateUser(y, c) : await this.userStorage.updateUser(y), g == k.awaitingEmailVerification && this.tokenEmailer && await ((p = this.tokenEmailer) == null ? void 0 : p.sendEmailVerificationToken(t.id, void 0)), await this.keyStorage.updateData(x.hashSessionId(r.value), "2fa", void 0), { ...t, ...y };
+    return n.secretNames().length > 0 ? await this.userStorage.updateUser(y, c) : await this.userStorage.updateUser(y), f == k.awaitingEmailVerification && this.tokenEmailer && await ((C = this.tokenEmailer) == null ? void 0 : C.sendEmailVerificationToken(t.id, void 0)), await this.keyStorage.updateData(x.hashSessionId(r.value), "2fa", void 0), { ...t, ...y };
   }
   /**
    * Initiates the two factor login process.
@@ -5179,14 +5181,14 @@ class Jt {
    */
   async initiateTwoFactorPageVisit(a, e, t, r, i) {
     const n = await this.authenticators[a.factor2].createOneTimeSecrets(a);
-    let c, d, g;
+    let c, d, f;
     const y = x.hashSessionId(e);
     h.logger.debug("initiateTwoFactorPageVisit " + a.username + " " + e + " " + y);
-    let p = { username: a.username, factor2: a.factor2, secrets: n, body: t, url: r };
-    return i && (p["content-type"] = i), await this.keyStorage.updateData(y, "pre2fa", p), {
+    let C = { username: a.username, factor2: a.factor2, secrets: n, body: t, url: r };
+    return i && (C["content-type"] = i), await this.keyStorage.updateData(y, "pre2fa", C), {
       sessionCookie: c,
       csrfCookie: d,
-      csrfFormOrHeaderValue: g
+      csrfFormOrHeaderValue: f
     };
   }
   /**
@@ -5249,12 +5251,12 @@ class Jt {
     let { key: i } = await this.session.getUserForSessionId(e);
     if (!i || !i.data || i.data == "") throw new o(l.Unauthorized);
     let s = z.decodeData(i.data)["2fa"], n = s.username, c = s.factor2;
-    const { user: d, secrets: g } = await this.userStorage.getUserByUsername(n), y = this.authenticators[c];
+    const { user: d, secrets: f } = await this.userStorage.getUserByUsername(n), y = this.authenticators[c];
     if (!y) throw new o(l.Configuration, "Second factor " + c + " not enabled");
-    await y.authenticateUser(d, { ...g, ...s }, a);
-    const p = await this.session.createSessionKey(d.id, t);
+    await y.authenticateUser(d, { ...f, ...s }, a);
+    const C = await this.session.createSessionKey(d.id, t);
     await this.keyStorage.deleteKey(x.hashSessionId(i.value));
-    const v = this.session.makeCookie(p, r), C = this.csrfTokens.createCsrfToken(), T = this.csrfTokens.makeCsrfCookie(C), E = this.csrfTokens.makeCsrfFormOrHeaderToken(C);
+    const v = this.session.makeCookie(C, r), p = this.csrfTokens.createCsrfToken(), T = this.csrfTokens.makeCsrfCookie(p), E = this.csrfTokens.makeCsrfFormOrHeaderToken(p);
     try {
       this.emailTokenStorage.deleteAllForUser(
         d.id,
@@ -5331,8 +5333,8 @@ class Jt {
         s.id,
         b.passwordResetToken
       );
-    } catch (g) {
-      h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: a })), h.logger.debug(m({ err: g }));
+    } catch (f) {
+      h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: a })), h.logger.debug(m({ err: f }));
     }
     return s;
   }
@@ -5343,7 +5345,7 @@ class Jt {
    * @returns true if email verification is now needed, false otherwise
    */
   async updateUser(a, e, t = !1, r = !1) {
-    var y, p;
+    var y, C;
     let i;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call updateUser if no user storage provided");
     if (!("id" in a) || a.id == null)
@@ -5352,19 +5354,19 @@ class Jt {
       throw new o(l.UserNotExist, "Please specify a userername");
     let { email: s, username: n, password: c, ...d } = e;
     d.userid = a.userid, d.id = a.id;
-    let g = !1;
+    let f = !1;
     if (s)
-      i = s, D.validateEmail(i), g = !0;
+      i = s, D.validateEmail(i), f = !0;
     else if (n) {
       i = n;
       try {
-        D.validateEmail(a.username), g = !0;
+        D.validateEmail(a.username), f = !0;
       } catch {
       }
-      g && D.validateEmail(i);
+      f && D.validateEmail(i);
     }
-    return !t && this.enableEmailVerification && g ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(a.id, i)) : (s && (d.email = s), n && (d.username = n)), (e.state == k.passwordResetNeeded || e.state == k.passwordAndFactor2ResetNeeded) && await ((p = this.tokenEmailer) == null ? void 0 : p.sendPasswordResetToken(a.id, {}, r)), await this.userStorage.updateUser(d), {
-      emailVerificationTokenSent: !t && this.enableEmailVerification && g,
+    return !t && this.enableEmailVerification && f ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(a.id, i)) : (s && (d.email = s), n && (d.username = n)), (e.state == k.passwordResetNeeded || e.state == k.passwordAndFactor2ResetNeeded) && await ((C = this.tokenEmailer) == null ? void 0 : C.sendPasswordResetToken(a.id, {}, r)), await this.userStorage.updateUser(d), {
+      emailVerificationTokenSent: !t && this.enableEmailVerification && f,
       passwordResetTokenSent: e.state == k.passwordResetNeeded || e.state == k.passwordAndFactor2ResetNeeded
     };
   }
@@ -5417,7 +5419,7 @@ class we {
     u(this, "prefix", b.apiKey);
     /** The name of the speak in the Authorization header.  Defaults to "ApiKey" */
     u(this, "authScheme", "ApiKey");
-    this.apiKeyStorage = a, w("secret", f.String, this, e, "SECRET", !0), w("keyLength", f.String, this, e, "APIKEY_LENGTH"), w("prefix", f.String, this, e, "APIKEY_PREFIX"), w("authScheme", f.String, this, e, "APIKEY_AUTHSCHEME");
+    this.apiKeyStorage = a, w("secret", g.String, this, e, "SECRET", !0), w("keyLength", g.String, this, e, "APIKEY_LENGTH"), w("prefix", g.String, this, e, "APIKEY_PREFIX"), w("authScheme", g.String, this, e, "APIKEY_AUTHSCHEME");
   }
   /**
    * Creates a new random key and returns it, unsigned.  It is also persisted in the key storage as a 
@@ -5438,7 +5440,7 @@ class we {
    *          Authorization header (with the signature appended.)
    */
   async createKey(a, e, t, r, i) {
-    const s = _.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, d = we.hashApiKeyValue(s), g = {
+    const s = _.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, d = we.hashApiKeyValue(s), f = {
       name: a,
       value: s,
       userid: e,
@@ -5452,11 +5454,11 @@ class we {
       this.prefix + d,
       n,
       c,
-      g.data,
+      f.data,
       { name: a, ...i }
     );
     const y = this.signApiKeyValue(s);
-    return { key: g, token: y };
+    return { key: f, token: y };
   }
   static hashApiKeyValue(a) {
     return _.hash(a);
@@ -5515,7 +5517,7 @@ class J {
       l.Configuration,
       "Must specify clientStorage when adding a client manager"
     );
-    this.clientStorage = a.clientStorage, w("oauthPbkdf2Digest", f.String, this, a, "OAUTH_PBKDF2_DIGEST"), w("oauthPbkdf2KeyLength", f.String, this, a, "OAUTH_PBKDF2_KEYLENGTH"), w("requireRedirectUriRegistration", f.Boolean, this, a, "OAUTH_REQUIRE_REDIRECT_URI_REGISTRATION");
+    this.clientStorage = a.clientStorage, w("oauthPbkdf2Digest", g.String, this, a, "OAUTH_PBKDF2_DIGEST"), w("oauthPbkdf2KeyLength", g.String, this, a, "OAUTH_PBKDF2_KEYLENGTH"), w("requireRedirectUriRegistration", g.Boolean, this, a, "OAUTH_REQUIRE_REDIRECT_URI_REGISTRATION");
   }
   /**
    * Creates a client and puts it in the storage
@@ -5549,19 +5551,19 @@ class J {
       valid_flow: t,
       userid: i
     };
-    let g;
+    let f;
     for (let y = 0; y < 5; ++y)
       try {
-        g = await this.clientStorage.createClient(d);
+        f = await this.clientStorage.createClient(d);
         break;
-      } catch (p) {
+      } catch (C) {
         if (y == 4) {
-          if (o.asCrossauthError(p).code != l.ClientExists) throw p;
+          if (o.asCrossauthError(C).code != l.ClientExists) throw C;
         } else
           d.client_id = J.randomClientId();
       }
-    if (!g) throw new o(l.ClientExists);
-    return g.client_secret && c && (g.client_secret = c), g;
+    if (!f) throw new o(l.ClientExists);
+    return f.client_secret && c && (f.client_secret = c), f;
   }
   /**
    * Updates a client
@@ -5631,7 +5633,7 @@ class ht extends Fe {
    */
   constructor(e, t = {}) {
     const r = {};
-    w("jwtKeyType", f.String, r, t, "JWT_KEY_TYPE");
+    w("jwtKeyType", g.String, r, t, "JWT_KEY_TYPE");
     super(e, { ...t, ...r });
     /**
      * Value passed to the constructor.  The `aud` claim must match it
@@ -5645,7 +5647,7 @@ class ht extends Fe {
     u(this, "keyStorage");
     u(this, "jwtSecretKeyFile", "");
     u(this, "jwtPublicKeyFile", "");
-    if (this.audience = e, w("authServerBaseUrl", f.String, this, t, "AUTH_SERVER_BASE_URL", !0), w("jwtSecretKeyFile", f.String, this, t, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", f.String, this, t, "JWT_PUBLIC_KEY_FILE"), w("jwtSecretKey", f.String, this, t, "JWT_SECRET_KEY"), w("jwtPublicKey", f.String, this, t, "JWT_PUBLIC_KEY"), w("clockTolerance", f.Number, this, t, "OAUTH_CLOCK_TOLERANCE"), w("persistAccessToken", f.Boolean, this, t, "OAUTH_PERSIST_ACCESS_TOKEN"), this.keyStorage = t.keyStorage, this.jwtSecretKey || this.jwtSecretKeyFile) {
+    if (this.audience = e, w("authServerBaseUrl", g.String, this, t, "AUTH_SERVER_BASE_URL", !0), w("jwtSecretKeyFile", g.String, this, t, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", g.String, this, t, "JWT_PUBLIC_KEY_FILE"), w("jwtSecretKey", g.String, this, t, "JWT_SECRET_KEY"), w("jwtPublicKey", g.String, this, t, "JWT_PUBLIC_KEY"), w("clockTolerance", g.Number, this, t, "OAUTH_CLOCK_TOLERANCE"), w("persistAccessToken", g.Boolean, this, t, "OAUTH_PERSIST_ACCESS_TOKEN"), this.keyStorage = t.keyStorage, this.jwtSecretKey || this.jwtSecretKeyFile) {
       if (this.jwtPublicKey || this.jwtPublicKeyFile)
         throw new o(
           l.Configuration,
@@ -5721,7 +5723,7 @@ class mt extends Ne {
     const r = {
       client_id: ""
     };
-    w("client_id", f.String, r, t, "OAUTH_CLIENT_ID", !0);
+    w("client_id", g.String, r, t, "OAUTH_CLIENT_ID", !0);
     super({
       authServerBaseUrl: e,
       tokenConsumer: new ht(
@@ -5742,7 +5744,7 @@ class mt extends Ne {
     u(this, "userStorage");
     this.client_id = r.client_id;
     let i = {};
-    if (w("stateLength", f.String, this, t, "OAUTH_STATE_LENGTH"), w("verifierLength", f.String, this, t, "OAUTH_VERIFIER_LENGTH"), w("client_secret", f.String, i, t, "OAUTH_CLIENT_SECRET"), w("codeChallengeMethod", f.String, this, t, "OAUTH_CODE_CHALLENGE_METHOD"), w("deviceAuthorizationUrl", f.String, this, t, "OAUTH_DEVICE_AUTHORIZATION_URL"), w("oauthLogFetch", f.Boolean, this, t, "OAUTH_LOG_FETCH"), this.deviceAuthorizationUrl.startsWith("/") && (this.deviceAuthorizationUrl = this.deviceAuthorizationUrl.substring(1)), i.client_secret && (this.client_secret = i.client_secret), w("userCreationType", f.String, this, t, "OAUTH_USER_CREATION_TYPE"), w("userMatchField", f.String, this, t, "OAUTH_USER_MATCH_FIELD"), w("idTokenMatchField", f.String, this, t, "OAUTH_IDTOKEN_MaTCH_FIELD"), this.userCreationType == "merge" ? this.userCreationFn = ft : this.userCreationType == "embed" ? this.userCreationFn = gt : t.userCreationFn && this.userCreationType == "custom" ? this.userCreationFn = t.userCreationFn : this.userCreationFn = wt, t.userStorage && (this.userStorage = t.userStorage), w("oauthPostType", f.String, this, t, "OAUTH_POST_TYPE"), w("oauthUseUserInfoEndpoint", f.Boolean, this, t, "OAUTH_USE_USER_INFO_ENDPOINT"), w("oauthAuthorizeRedirect", f.String, this, t, "OAUTH_AUTHORIZE_REDIRECT"), this.oauthPostType != "json" && this.oauthPostType != "form")
+    if (w("stateLength", g.String, this, t, "OAUTH_STATE_LENGTH"), w("verifierLength", g.String, this, t, "OAUTH_VERIFIER_LENGTH"), w("client_secret", g.String, i, t, "OAUTH_CLIENT_SECRET"), w("codeChallengeMethod", g.String, this, t, "OAUTH_CODE_CHALLENGE_METHOD"), w("deviceAuthorizationUrl", g.String, this, t, "OAUTH_DEVICE_AUTHORIZATION_URL"), w("oauthLogFetch", g.Boolean, this, t, "OAUTH_LOG_FETCH"), this.deviceAuthorizationUrl.startsWith("/") && (this.deviceAuthorizationUrl = this.deviceAuthorizationUrl.substring(1)), i.client_secret && (this.client_secret = i.client_secret), w("userCreationType", g.String, this, t, "OAUTH_USER_CREATION_TYPE"), w("userMatchField", g.String, this, t, "OAUTH_USER_MATCH_FIELD"), w("idTokenMatchField", g.String, this, t, "OAUTH_IDTOKEN_MaTCH_FIELD"), this.userCreationType == "merge" ? this.userCreationFn = ft : this.userCreationType == "embed" ? this.userCreationFn = gt : t.userCreationFn && this.userCreationType == "custom" ? this.userCreationFn = t.userCreationFn : this.userCreationFn = wt, t.userStorage && (this.userStorage = t.userStorage), w("oauthPostType", g.String, this, t, "OAUTH_POST_TYPE"), w("oauthUseUserInfoEndpoint", g.Boolean, this, t, "OAUTH_USE_USER_INFO_ENDPOINT"), w("oauthAuthorizeRedirect", g.String, this, t, "OAUTH_AUTHORIZE_REDIRECT"), this.oauthPostType != "json" && this.oauthPostType != "form")
       throw new o(l.Configuration, "oauthPostType must be json or form");
   }
   /**
@@ -5889,9 +5891,9 @@ class Yt {
     u(this, "validFlows", ["all"]);
     /** Set from options.  See {@link OAuthAuthorizationServerOptions.allowedFactor2} */
     u(this, "allowedFactor2", []);
-    this.clientStorage = a, this.keyStorage = e, this.userStorage = r.userStorage, this.authStorage = r.authStorage, t && (this.authenticators = t), this.clientManager = new J({ clientStorage: a, ...r }), w("authServerBaseUrl", f.String, this, r, "AUTH_SERVER_BASE_URL", !0), w("oauthIssuer", f.String, this, r, "OAUTH_ISSUER"), this.oauthIssuer || (this.oauthIssuer = this.authServerBaseUrl), w("audience", f.String, this, r, "OAUTH_AUDIENCE"), w("oauthPbkdf2Iterations", f.String, this, r, "OAUTH_PBKDF2_ITERATIONS"), w("requireClientSecretOrChallenge", f.Boolean, this, r, "OAUTH_REQUIRE_CLIENT_SECRET_OR_CHALLENGE"), w("jwtAlgorithm", f.String, this, r, "JWT_ALGORITHM"), w("codeLength", f.Number, this, r, "OAUTH_CODE_LENGTH"), w("jwtKeyType", f.String, this, r, "JWT_KEY_TYPE"), w("jwtSecretKeyFile", f.String, this, r, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", f.String, this, r, "JWT_PUBLIC_KEY_FILE"), w("jwtPrivateKeyFile", f.String, this, r, "JWT_PRIVATE_KEY_FILE"), w("jwtSecretKey", f.String, this, r, "JWT_SECRET_KEY"), w("jwtPublicKey", f.String, this, r, "JWT_PUBLIC_KEY"), w("jwtPrivateKey", f.String, this, r, "JWT_PRIVATE_KEY"), w("jwtKid", f.String, this, r, "JWT_KID"), w("persistAccessToken", f.String, this, r, "OAUTH_PERSIST_ACCESS_TOKEN"), w("issueRefreshToken", f.String, this, r, "OAUTH_ISSUE_REFRESH_TOKEN"), w("opaqueAccessToken", f.String, this, r, "OAUTH_OPAQUE_ACCESS_TOKEN"), w("accessTokenExpiry", f.Number, this, r, "OAUTH_ACCESS_TOKEN_EXPIRY"), w("refreshTokenExpiry", f.Number, this, r, "OAUTH_REFRESH_TOKEN_EXPIRY"), w("rollingRefreshToken", f.Boolean, this, r, "OAUTH_ROLLING_REFRESH_TOKEN"), w("authorizationCodeExpiry", f.Number, this, r, "OAUTH_AUTHORIZATION_CODE_EXPIRY"), w("mfaTokenExpiry", f.Number, this, r, "OAUTH_MFA_TOKEN_EXPIRY"), w("clockTolerance", f.Number, this, r, "OAUTH_CLOCK_TOLERANCE"), w("validateScopes", f.Boolean, this, r, "OAUTH_VALIDATE_SCOPES"), w("emptyScopeIsValid", f.Boolean, this, r, "OAUTH_EMPTY_SCOPE_VALID"), w("validScopes", f.JsonArray, this, r, "OAUTH_VALID_SCOPES"), w("validFlows", f.JsonArray, this, r, "OAUTH_validFlows"), w("idTokenClaims", f.Json, this, r, "OAUTH_ID_TOKEN_CLAIMS"), w("accessTokenClaims", f.Json, this, r, "OAUTH_ACCESS_TOKEN_CLAIMS"), w("allowedFactor2", f.JsonArray, this, r, "ALLOWED_FACTOR2"), w("userCodeExpiry", f.Number, this, r, "DEVICECODE_USERCODE_EXPIRY"), w("userCodeThrottle", f.Number, this, r, "DEVICECODE_USERCODE_THROTTLE"), w("deviceCodePollInterval", f.Number, this, r, "DEVICECODE_POLL_INTERVAL"), w("deviceCodeLength", f.Number, this, r, "DEVICECODE_LENGTH"), w("userCodeLength", f.Number, this, r, "DEVICECODE_USERCODE_LENGTH");
+    this.clientStorage = a, this.keyStorage = e, this.userStorage = r.userStorage, this.authStorage = r.authStorage, t && (this.authenticators = t), this.clientManager = new J({ clientStorage: a, ...r }), w("authServerBaseUrl", g.String, this, r, "AUTH_SERVER_BASE_URL", !0), w("oauthIssuer", g.String, this, r, "OAUTH_ISSUER"), this.oauthIssuer || (this.oauthIssuer = this.authServerBaseUrl), w("audience", g.String, this, r, "OAUTH_AUDIENCE"), w("oauthPbkdf2Iterations", g.String, this, r, "OAUTH_PBKDF2_ITERATIONS"), w("requireClientSecretOrChallenge", g.Boolean, this, r, "OAUTH_REQUIRE_CLIENT_SECRET_OR_CHALLENGE"), w("jwtAlgorithm", g.String, this, r, "JWT_ALGORITHM"), w("codeLength", g.Number, this, r, "OAUTH_CODE_LENGTH"), w("jwtKeyType", g.String, this, r, "JWT_KEY_TYPE"), w("jwtSecretKeyFile", g.String, this, r, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", g.String, this, r, "JWT_PUBLIC_KEY_FILE"), w("jwtPrivateKeyFile", g.String, this, r, "JWT_PRIVATE_KEY_FILE"), w("jwtSecretKey", g.String, this, r, "JWT_SECRET_KEY"), w("jwtPublicKey", g.String, this, r, "JWT_PUBLIC_KEY"), w("jwtPrivateKey", g.String, this, r, "JWT_PRIVATE_KEY"), w("jwtKid", g.String, this, r, "JWT_KID"), w("persistAccessToken", g.String, this, r, "OAUTH_PERSIST_ACCESS_TOKEN"), w("issueRefreshToken", g.String, this, r, "OAUTH_ISSUE_REFRESH_TOKEN"), w("opaqueAccessToken", g.String, this, r, "OAUTH_OPAQUE_ACCESS_TOKEN"), w("accessTokenExpiry", g.Number, this, r, "OAUTH_ACCESS_TOKEN_EXPIRY"), w("refreshTokenExpiry", g.Number, this, r, "OAUTH_REFRESH_TOKEN_EXPIRY"), w("rollingRefreshToken", g.Boolean, this, r, "OAUTH_ROLLING_REFRESH_TOKEN"), w("authorizationCodeExpiry", g.Number, this, r, "OAUTH_AUTHORIZATION_CODE_EXPIRY"), w("mfaTokenExpiry", g.Number, this, r, "OAUTH_MFA_TOKEN_EXPIRY"), w("clockTolerance", g.Number, this, r, "OAUTH_CLOCK_TOLERANCE"), w("validateScopes", g.Boolean, this, r, "OAUTH_VALIDATE_SCOPES"), w("emptyScopeIsValid", g.Boolean, this, r, "OAUTH_EMPTY_SCOPE_VALID"), w("validScopes", g.JsonArray, this, r, "OAUTH_VALID_SCOPES"), w("validFlows", g.JsonArray, this, r, "OAUTH_validFlows"), w("idTokenClaims", g.Json, this, r, "OAUTH_ID_TOKEN_CLAIMS"), w("accessTokenClaims", g.Json, this, r, "OAUTH_ACCESS_TOKEN_CLAIMS"), w("allowedFactor2", g.JsonArray, this, r, "ALLOWED_FACTOR2"), w("userCodeExpiry", g.Number, this, r, "DEVICECODE_USERCODE_EXPIRY"), w("userCodeThrottle", g.Number, this, r, "DEVICECODE_USERCODE_THROTTLE"), w("deviceCodePollInterval", g.Number, this, r, "DEVICECODE_POLL_INTERVAL"), w("deviceCodeLength", g.Number, this, r, "DEVICECODE_LENGTH"), w("userCodeLength", g.Number, this, r, "DEVICECODE_USERCODE_LENGTH");
     let i = {};
-    if (w("userCodeDashEvery", f.String, i, r, "DEVICECODE_USERCODE_DASH_EVERY"), i.userCodeDashEvery)
+    if (w("userCodeDashEvery", g.String, i, r, "DEVICECODE_USERCODE_DASH_EVERY"), i.userCodeDashEvery)
       if (i.userCodeDashEvery == "" || i.userCodeDashEvery.toLowerCase() == "null") this.userCodeDashEvery = null;
       else
         try {
@@ -5902,7 +5904,7 @@ class Yt {
             "userCodeDashEvery must be a number or null"
           );
         }
-    if (w("deviceCodeVerificationUri", f.String, this, r, "DEVICECODE_VERIFICATION_URI"), r.upstreamClient && (this.upstreamClientOptions = r.upstreamClient, this.upstreamClient = new mt(r.upstreamClient.authServerBaseUrl, r.upstreamClient.options), !r.upstreamClient.options.redirect_uri))
+    if (w("deviceCodeVerificationUri", g.String, this, r, "DEVICECODE_VERIFICATION_URI"), r.upstreamClient && (this.upstreamClientOptions = r.upstreamClient, this.upstreamClient = new mt(r.upstreamClient.authServerBaseUrl, r.upstreamClient.options), !r.upstreamClient.options.redirect_uri))
       throw new o(l.Configuration, "Must define redirect_uri in upstreamClient options");
     if (this.validFlows.length == 1 && this.validFlows[0] == U.All && (this.validFlows = U.allFlows()), this.jwtAlgorithmChecked = yt(this.jwtAlgorithm), this.jwtSecretKey || this.jwtSecretKeyFile) {
       if (this.jwtPublicKey || this.jwtPublicKeyFile || this.jwtPrivateKey || this.jwtPrivateKeyFile)
@@ -5981,9 +5983,9 @@ class Yt {
         error: "unsupported_response_type",
         error_description: "Unsupported response type " + a
       };
-    let g;
+    let f;
     try {
-      g = await this.clientStorage.getClientById(e);
+      f = await this.clientStorage.getClientById(e);
     } catch (T) {
       return h.logger.debug(m({ err: T })), {
         error: "unauthorized_client",
@@ -5992,23 +5994,23 @@ class Yt {
     }
     const {
       scopes: y,
-      error: p,
+      error: C,
       error_description: v
     } = await this.validateAndPersistScope(e, r, c);
-    if (p) return {
-      error: p,
+    if (C) return {
+      error: C,
       error_description: v
     };
-    const C = this.inferFlowFromGet(a, y || [], s);
-    if (!C || !this.validFlows.includes(C))
+    const p = this.inferFlowFromGet(a, y || [], s);
+    if (!p || !this.validFlows.includes(p))
       return {
         error: "access_denied",
-        error_description: "Unsupported flow type " + C
+        error_description: "Unsupported flow type " + p
       };
-    if (!g.valid_flow.includes(C))
+    if (!f.valid_flow.includes(p))
       return {
         error: "unauthorized_client",
-        error_description: "Client does not support " + C
+        error_description: "Client does not support " + p
       };
     try {
       this.validateState(i);
@@ -6019,7 +6021,7 @@ class Yt {
       };
     }
     return a == "code" ? await this.getAuthorizationCode(
-      g,
+      f,
       t,
       y,
       i,
@@ -6162,11 +6164,11 @@ class Yt {
     refreshToken: n,
     username: c,
     password: d,
-    mfaToken: g,
+    mfaToken: f,
     oobCode: y,
-    bindingCode: p,
+    bindingCode: C,
     otp: v,
-    deviceCode: C
+    deviceCode: p
   }) {
     var F, $, V;
     const T = this.inferFlowFromPost(a, s);
@@ -6362,12 +6364,12 @@ class Yt {
           error: "access_denied",
           error_description: "OTP not provided"
         };
-      if (!g)
+      if (!f)
         return {
           error: "access_denied",
           error_description: "MFA token not provided"
         };
-      const P = await this.validateMfaToken(g), R = b.mfaToken + _.hash(g);
+      const P = await this.validateMfaToken(f), R = b.mfaToken + _.hash(f);
       if (!P.user || !P.key)
         return {
           error: "access_denied",
@@ -6420,17 +6422,17 @@ class Yt {
           error: O,
           error_description: I
         };
-      if (!y || !p)
+      if (!y || !C)
         return {
           error: "access_denied",
           error_description: "OOB code or binding code not provided"
         };
-      if (!g)
+      if (!f)
         return {
           error: "access_denied",
           error_description: "MFA token not provided"
         };
-      const P = await this.validateMfaToken(g);
+      const P = await this.validateMfaToken(f);
       if (!P.user || !P.key)
         return {
           error: "access_denied",
@@ -6457,7 +6459,7 @@ class Yt {
         await R.authenticateUser(
           P.user,
           { ...B, otp: M.otp, expiry: ($ = P.key.expires) == null ? void 0 : $.getTime() },
-          { otp: p }
+          { otp: C }
         );
       } catch (B) {
         return h.logger.debug(m({ err: B })), {
@@ -6483,14 +6485,14 @@ class Yt {
         user: P.user
       });
     } else if (a == "urn:ietf:params:oauth:grant-type:device_code") {
-      if (!C)
+      if (!p)
         return {
           error: "invalid_request",
           error_description: "No device code given"
         };
       let N;
       try {
-        N = await this.keyStorage.getKey(b.deviceCode + C);
+        N = await this.keyStorage.getKey(b.deviceCode + p);
       } catch (O) {
         const I = o.asCrossauthError(O);
         return h.logger.debug(m({ err: I })), h.logger.error(m({ msg: "Couldn't get device code", cerr: I })), {
@@ -6501,7 +6503,7 @@ class Yt {
       try {
         const O = JSON.parse(N.data ?? "{}"), I = (/* @__PURE__ */ new Date()).getTime();
         if (N.expires && I > N.expires.getTime())
-          return await this.deleteDeviceCode(C), {
+          return await this.deleteDeviceCode(p), {
             error: "expired_token",
             error_description: "Code has expired"
           };
@@ -6512,7 +6514,7 @@ class Yt {
           };
         {
           let P = O.scope ? O.scope.split(" ") : void 0, R = O.userid ? await ((V = this.userStorage) == null ? void 0 : V.getUserById(O.userid)) : void 0;
-          return await this.deleteDeviceCode(C), await this.makeAccessToken({
+          return await this.deleteDeviceCode(p), await this.makeAccessToken({
             client: A,
             client_secret: i,
             codeVerifier: s,
@@ -6523,7 +6525,7 @@ class Yt {
         }
       } catch (O) {
         const I = o.asCrossauthError(O);
-        return h.logger.debug(m({ err: I })), h.logger.error(m({ msg: "Couldn't get device code", cerr: I })), await this.deleteDeviceCode(C), {
+        return h.logger.debug(m({ err: I })), h.logger.error(m({ msg: "Couldn't get device code", cerr: I })), await this.deleteDeviceCode(p), {
           error: "accerss_denied",
           error_description: "Invalid device code"
         };
@@ -6566,7 +6568,7 @@ class Yt {
     scope: e,
     client_secret: t
   }) {
-    var C;
+    var p;
     if (this.deviceCodeVerificationUri == "")
       return {
         error: "invalid_request",
@@ -6597,14 +6599,14 @@ class Yt {
       };
     }
     let c, d = !1;
-    const g = /* @__PURE__ */ new Date(), y = this.userCodeExpiry, p = new Date(g.getTime() + this.userCodeExpiry * 1e3 + this.clockTolerance * 1e3);
+    const f = /* @__PURE__ */ new Date(), y = this.userCodeExpiry, C = new Date(f.getTime() + this.userCodeExpiry * 1e3 + this.clockTolerance * 1e3);
     for (let T = 0; T < 10 && !d; ++T)
       try {
         c = _.randomValue(this.deviceCodeLength), await this.keyStorage.saveKey(
           void 0,
           b.deviceCode + c,
-          g,
-          p,
+          f,
+          C,
           JSON.stringify({ scope: e, client_id: a })
         ), d = !0;
       } catch {
@@ -6622,8 +6624,8 @@ class Yt {
         v = _.randomBase32(this.userCodeLength), await this.keyStorage.saveKey(
           void 0,
           b.userCode + v,
-          g,
-          p,
+          f,
+          C,
           JSON.stringify({ deviceCode: c })
         ), d = !0;
       } catch {
@@ -6636,7 +6638,7 @@ class Yt {
       };
     if (v && this.userCodeDashEvery) {
       const T = new RegExp(String.raw`(.{1,${this.userCodeDashEvery}})`, "g");
-      v = (C = v.match(T)) == null ? void 0 : C.join("-");
+      v = (p = v.match(T)) == null ? void 0 : p.join("-");
     }
     return {
       device_code: c,
@@ -6662,7 +6664,7 @@ class Yt {
     userCode: a,
     user: e
   }) {
-    var g;
+    var f;
     a = a.replace(/[ -]*/g, "");
     let t, r = {};
     try {
@@ -6684,12 +6686,12 @@ class Yt {
     try {
       i = await this.keyStorage.getKey(b.deviceCode + r.deviceCode);
     } catch (y) {
-      const p = o.asCrossauthError(y);
-      return h.logger.debug(m({ err: p })), h.logger.error(m({
+      const C = o.asCrossauthError(y);
+      return h.logger.debug(m({ err: C })), h.logger.error(m({
         msg: "Invalid device code for user code",
         userCodeHash: _.hash(a),
         deviceCodeHash: _.hash(r.deviceCode),
-        cerr: p
+        cerr: C
       })), await this.deleteUserCode(a), {
         ok: !1,
         error: "server_error",
@@ -6708,7 +6710,7 @@ class Yt {
         error_description: "Unexpected or incomplete data in device code key"
       };
     }
-    if ((/* @__PURE__ */ new Date()).getTime() > ((g = r.expires) == null ? void 0 : g.getTime()))
+    if ((/* @__PURE__ */ new Date()).getTime() > ((f = r.expires) == null ? void 0 : f.getTime()))
       return await this.deleteUserCode(a), {
         ok: !1,
         error: "expired_token",
@@ -6738,8 +6740,8 @@ class Yt {
       try {
         e != null && e.id && await this.keyStorage.updateData(b.deviceCode + r.deviceCode, "userid", e.id);
       } catch (y) {
-        const p = o.asCrossauthError(y);
-        return h.logger.debug(m({ err: p })), h.logger.warn(m({ msg: "Couldn't update user id on user code entry - deleting", cerr: p })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
+        const C = o.asCrossauthError(y);
+        return h.logger.debug(m({ err: C })), h.logger.warn(m({ msg: "Couldn't update user id on user code entry - deleting", cerr: C })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
           ok: !1,
           error: "access_denied",
           error_description: "Invalid user code",
@@ -6756,8 +6758,8 @@ class Yt {
     try {
       e != null && e.id && await this.keyStorage.updateData(b.deviceCode + r.deviceCode, "userid", e.id), await this.keyStorage.updateData(b.deviceCode + r.deviceCode, "ok", !0);
     } catch (y) {
-      const p = o.asCrossauthError(y);
-      return h.logger.debug(m({ err: p })), h.logger.warn(m({ msg: "Couldn't update status on user code entry - deleting", cerr: p })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
+      const C = o.asCrossauthError(y);
+      return h.logger.debug(m({ err: C })), h.logger.warn(m({ msg: "Couldn't update status on user code entry - deleting", cerr: C })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
         ok: !1,
         error: "access_denied",
         error_description: "Invalid user code",
@@ -6949,9 +6951,9 @@ class Yt {
     if (!n.client) return n;
     const c = n.client, d = await this.authenticateClient(s, c, t);
     if (d.error) return d;
-    const g = await this.validateMfaToken(a);
-    if (!g.user || !g.key) return g;
-    if (g.user.factor2 != i)
+    const f = await this.validateMfaToken(a);
+    if (!f.user || !f.key) return f;
+    if (f.user.factor2 != i)
       return {
         error: "access_denied",
         error_description: "Invalid MFA authenticator"
@@ -6966,20 +6968,20 @@ class Yt {
       oobCode: _.randomValue(this.codeLength)
     });
     try {
-      const p = this.authenticators[g.user.factor2];
-      if (!p)
+      const C = this.authenticators[f.user.factor2];
+      if (!C)
         throw new o(
           l.Configuration,
           "User's authenticator has not been loaded"
         );
-      const v = await p.createOneTimeSecrets(g.user);
+      const v = await C.createOneTimeSecrets(f.user);
       await this.keyStorage.updateData(
-        g.key.value,
+        f.key.value,
         "omfa",
         { ...y, ...v }
       );
-    } catch (p) {
-      return h.logger.debug(m({ err: p })), {
+    } catch (C) {
+      return h.logger.debug(m({ err: C })), {
         error: "server_error",
         error_description: "Unable to initiate OOB authentication"
       };
@@ -7041,21 +7043,21 @@ class Yt {
         error: "invalid_request",
         error_description: `The redirect uri ${e} is invalid`
       };
-    const d = /* @__PURE__ */ new Date(), g = this.authorizationCodeExpiry ? new Date(d.getTime() + this.authorizationCodeExpiry * 1e3 + this.clockTolerance * 1e3) : void 0, y = {
+    const d = /* @__PURE__ */ new Date(), f = this.authorizationCodeExpiry ? new Date(d.getTime() + this.authorizationCodeExpiry * 1e3 + this.clockTolerance * 1e3) : void 0, y = {
       client_id: a.client_id,
       redirect_uri: e
     };
     t && (y.scope = t), i && (y.challengeMethod = s, y.challenge = _.hash(i)), n && (y.username = n.username, y.id = n.id);
-    const p = JSON.stringify(y);
-    let v = !1, C = "";
+    const C = JSON.stringify(y);
+    let v = !1, p = "";
     for (let T = 0; T < 10 && !v; ++T)
       try {
-        C = _.randomValue(this.codeLength), await this.keyStorage.saveKey(
+        p = _.randomValue(this.codeLength), await this.keyStorage.saveKey(
           void 0,
-          b.authorizationCode + _.hash(C),
+          b.authorizationCode + _.hash(p),
           d,
-          g,
-          p
+          f,
+          C
         ), v = !0;
       } catch {
         h.logger.debug(m({ msg: `Attempt number${T} at creating a unique authozation code failed` }));
@@ -7065,7 +7067,7 @@ class Yt {
         l.KeyExists,
         "Couldn't create a authorization code"
       );
-    return { code: C, state: r };
+    return { code: p, state: r };
   }
   async getAuthorizationCodeData(a) {
     let e, t = {};
@@ -7152,8 +7154,8 @@ class Yt {
           error_description: "Code verifier is incorrect"
         };
     }
-    const g = /* @__PURE__ */ new Date(), y = Math.ceil(g.getTime() / 1e3);
-    let p;
+    const f = /* @__PURE__ */ new Date(), y = Math.ceil(f.getTime() / 1e3);
+    let C;
     if ((i && i.includes("openid") || Object.keys(this.accessTokenClaims).length > 0) && this.userStorage && d.username)
       try {
         const { user: K } = await this.userStorage.getUserByUsername(d.username);
@@ -7165,17 +7167,17 @@ class Yt {
         };
       }
     const v = _.uuid();
-    let C = {
+    let p = {
       jti: v,
       iat: y,
       iss: this.oauthIssuer,
       sub: d.username,
       type: "access"
     };
-    C = this.addClaims(C, this.accessTokenClaims, i, n), i && (C.scope = i), this.accessTokenExpiry != null && (C.exp = y + this.accessTokenExpiry, p = new Date(g.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (C.aud = this.audience);
+    p = this.addClaims(p, this.accessTokenClaims, i, n), i && (p.scope = i), this.accessTokenExpiry != null && (p.exp = y + this.accessTokenExpiry, C = new Date(f.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (p.aud = this.audience);
     const T = await new Promise((K, F) => {
       te.sign(
-        C,
+        p,
         this.secretOrPrivateKey,
         { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
         ($, V) => {
@@ -7190,8 +7192,8 @@ class Yt {
       void 0,
       // to avoid user storage dependency, we don't set this
       b.accessToken + _.hash(v),
-      g,
-      p
+      f,
+      C
     ));
     let E;
     if (i && i.includes("openid")) {
@@ -7270,7 +7272,7 @@ class Yt {
         void 0,
         // to avoid user storage dependency
         b.refreshToken + _.hash(A),
-        g,
+        f,
         F,
         JSON.stringify(K)
       ));
@@ -7288,31 +7290,31 @@ class Yt {
    * Create an access token
    */
   async createTokensFromPayload(a, e, t) {
-    var g;
+    var f;
     const r = /* @__PURE__ */ new Date(), i = Math.ceil(r.getTime() / 1e3);
     let s, n, c, d;
     if (e) {
       const y = _.uuid();
-      let p = {
+      let C = {
         ...e,
         jti: y,
         iat: i,
         iss: this.oauthIssuer,
         type: "access"
       };
-      this.accessTokenExpiry != null && (p.exp = i + this.accessTokenExpiry, s = new Date(r.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (p.aud = this.audience), n = await new Promise((v, C) => {
+      this.accessTokenExpiry != null && (C.exp = i + this.accessTokenExpiry, s = new Date(r.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (C.aud = this.audience), n = await new Promise((v, p) => {
         te.sign(
-          p,
+          C,
           this.secretOrPrivateKey,
           { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
           (T, E) => {
-            E ? v(E) : C(T || new o(
+            E ? v(E) : p(T || new o(
               l.Unauthorized,
               "Couldn't create jwt"
             ));
           }
         );
-      }), d = p, this.persistAccessToken && this.keyStorage && await ((g = this.keyStorage) == null ? void 0 : g.saveKey(
+      }), d = C, this.persistAccessToken && this.keyStorage && await ((f = this.keyStorage) == null ? void 0 : f.saveKey(
         void 0,
         // to avoid user storage dependency, we don't set this
         b.accessToken + _.hash(y),
@@ -7330,17 +7332,17 @@ class Yt {
         iss: this.oauthIssuer,
         type: "id"
       }, t) {
-        const p = t;
-        c = await new Promise((v, C) => {
+        const C = t;
+        c = await new Promise((v, p) => {
           te.sign(
-            p,
+            C,
             this.secretOrPrivateKey,
             {
               algorithm: this.jwtAlgorithmChecked,
               keyid: this.jwtKid
             },
             (T, E) => {
-              E ? v(E) : C(T || new o(
+              E ? v(E) : p(T || new o(
                 l.Unauthorized,
                 "Couldn't create jwt"
               ));
@@ -7717,7 +7719,7 @@ export {
   ye as OAuthClientStorage,
   Gt as OAuthResourceServer,
   ht as OAuthTokenConsumer,
-  f as ParamType,
+  g as ParamType,
   Ie as PasswordAuthenticator,
   jt as PostgresKeyStorage,
   Vt as PostgresOAuthAuthorizationStorage,